Gaim contains a buffer overflow vulnerability in the http_canread() function

Overview There is a buffer overflow vulnerability in the Gaim httpcanread function, which could allow an unauthenticated, remote attacker to execute arbitrary code. Description Gaim is a multi-protocol instant messenger available for a number of operating systems. It provides a feature that allow...

Gaim fails to properly parse cookies in Yahoo web connections

Overview There is a buffer overflow vulnerability in the way Gaim parses cookies for Yahoo web connections. Description Gaim is a multi-protocol instant messenger available for a number of operating systems. It supports a variety of instant messaging protocols, including the Yahoo Messenger YMSG...

Apple QuickTime contains an integer overflow in the "QuickTime.qts" extension

Overview Apple QuickTime contains an integer overflow vulnerability in the "QuickTime.qts" extension, which could result in arbitrary code execution. Description Apple's QuickTime Player is a player that allow users to view local and remote audio/video content. Other applications, such as web...

libgcc contains multiple flaws that allow integer type range vulnerabilities to occur at runtime

Overview The libgcc runtime for the gcc and g++ compilers contain multiple flaws that can result in integer type range vulnerabilities in programs that are compiled using the -ftrapv option. Description Both gcc and g++ provide an -ftrapv compiler option that, according to the gcc man page,...

Gaim contains an off-by-one buffer overflow vulnerability in the gaim_quotedp_decode() function

Overview There is an off-by-one buffer overflow vulnerability in the Gaim MIME decoder. Description Gaim is a multi-protocol instant messenger available for a number of operating systems. It includes a feature that requires Gaim to decode MIME-encoded data. There is an off-by-one buffer overflow...

Gaim contains an off-by-one buffer overflow vulnerability in the yahoo_decode() function

Overview There is an off-by-one buffer overflow vulnerability in the Gaim yahoodecode function. Description Gaim is a multi-protocol instant messenger available for a number of operating systems. It supports a variety of instant messaging protocols, including the Yahoo Messenger YMSG protocol...

Gaim contains a buffer overflow vulnerability in the yahoo_decode() function

Overview There is a buffer overflow vulnerability in the Gaim yahoodecode function, which could cause a pointer to reference memory beyond the terminating null byte. Description Gaim is a multi-protocol instant messenger available for a number of operating systems. It supports a variety of instan...

Gaim contains a buffer overflow vulnerability in the gaim_quotedp_decode() function

Overview There is a buffer overflow vulnerability in the Gaim gaimquotedpdecode function, which could cause a pointer to reference memory beyond the terminating null byte. Description Gaim is a multi-protocol instant messenger available for a number of operating systems. It includes a feature tha...

BEA WebLogic Server contains a vulnerability in the URL pattern matching

Overview There is a vulnerability in the URL pattern matching functionality of BEA WebLogic Server that could allow URL restrictions to be bypassed. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating, securing, and...

BEA WebLogic Server configuration wizard stores administrative credentials in clear text log files

Overview There is a vulnerability in BEA WebLogic Server in which a user with access to log files generated by the configuration wizard could obtain the administrative username and password. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure fo...

BEA WebLogic Server allows unauthorized removal of EJB objects

Overview There is a vulnerability in the BEA WebLogic Server that could allow the unauthorized removal of an Enterprise JavaBean EJB. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating, securing, and managing...

BEA WebLogic Server internal methods may disclose sensitive information

Overview There is a vulnerability in BEA WebLogic Server that could allow users to obtain the credentials of the user who booted the server. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating, securing, and managing...

BEA WebLogic Server fails to properly validate certificate chains

Overview There is a vulnerability in BEA WebLogic Server in which certificate chains rejected by the custom trust manager could still be accepted by the server. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating,...

The Border Gateway Protocol relies on persistent TCP sessions without specifying authentication requirements

Overview A vulnerability exists in the reliance of the Border Gateway Protocol BGP on the Transmission Control Protocol TCP to maintain persistent sessions. Sustained exploitation of this vulnerability could lead to a denial-of-service condition affecting a large segment of the Internet community...

Cisco IOS fails to properly process solicited SNMP operations

Overview Cisco IOS contains a vulnerability in the processing of solicited Simple Network Management Protocol SNMP operations that may result in memory corruption of the device causing it to reload. Sustained exploitation of this vulnerability could lead to a denial of service condition affect a...

BEA WebLogic Server stores database password in clear text in "config.xml"

Overview WebLogic Server contains a vulnerability that may expose the database username and password in clear text in the config.xml file. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating, securing, and managing...

BEA WebLogic Server fails to properly associate re-created groups

Overview WebLogic Server contains a vulnerability that could result in the creation of new groups inheriting the privileges of a previously deleted group if members of the deleted group still exist. Description BEA Systems describes WebLogic Server as "an industrial-strength application...

ptrace contains vulnerability allowing for local root compromise

Overview A vulnerability in the Linux 2.2 and 2.4 distributions of ptrace may permit a local attacker to gain elevated privileges. Description The Linux 2.2 and 2.4 kernels contained a flaw in ptrace. This vulnerability may permit a local user to have the kernel spawn a child process. From the ma...

FTE fails to properly validate environment variables

Overview FTE contains a vulnerability in the processing of certain environment variables that could allow an attacker to execute arbitrary code. Description FTE is a text editor available for a variety of operating systems. There is a buffer overflow vulnerability in the way FTE performs bounds...

FTE fails to properly validate command line arguments

Overview FTE contains a vulnerability in the processing of command line arguments that could allow an attacker to execute arbitrary code. Description FTE is a text editor available for a variety of operating systems. There is a buffer overflow vulnerability in the way FTE performs bounds checking...

Microsoft Windows H.323 implementation fails to handle malformed requests

Overview A vulnerabilities in Microsoft Windows' implementation of the multimedia telephony protocol H.323 could lead to the ability to remotely execute arbitrary code on the system. Description Microsoft Windows' implementation of the H.323 protocol contains a buffer overflow in the handling of...

Microsoft Windows ASN.1 library contains a memory management vulnerability

Overview Microsoft's ASN.1 library contains a memory management error that could be exploited by a remote attacker to cause a denial-of-service situation, or execute arbitrary code. Description Microsoft's ASN.1 library contains a memory management error, potentially a "double-free" condition. By...

Microsoft Windows Virtual DOS Machine (VDM) contains null pointer dereference

Overview Microsoft Windows NT4.0 and Windows 2000 contain a vulnerability that could permit a local user to gain elevated privileges on the system. Description Microsoft Windows NT4.0 and Windows 2000 provide an Virtual DOS Machine VDM to support 16-bit legacy operations and applications. A...

Microsoft Windows logon process fails contains a buffer overflow during the logon process

Overview The Windows Logon process Winlogon contains a vulnerability that may permit a remote attacker to execute arbitrary code on the system. Description The Windows logon process Winlogon containss a buffer overflow vulnerability during the processeing of the domain value. It fails to perform...

Microsoft Private Communication Technology (PCT) fails to properly validate message inputs

Overview A vulnerability exists in the Private Communications Transport PCT protocol, which is part of the Microsoft Secure Sockets Layer SSL library. Exploitation of this vulnerability may permit a remote attacker to compromise the system. An exploit for this issue currently being used to...

HAHTsite Scenario Server fails to handle overly long URLs

Overview HAHTsite Scenario Server fails to properly handle HTTP requests containing an overly long "project name". Description HAHTsite Scenario Server is an e-Business platform that consists of a web application server and web development environment. There is a buffer overflow vulnerability in...

Microsoft RPCSS Service contains memory leak in handling of specially crafted messages

Overview Microsoft RPCSS Service contains a memory management vulnerability that may permit a remote attacker to cause a denial-of-service situation. Description The Microsoft RPCSS Service is responsible for managing Remote Procedure Call RPC messages and is enabled by default on many versions o...

Microsoft LSA Service contains buffer overflow in DsRolepInitializeLog() function

Overview The Windows Local Security Authority Service Server LSASS contains a vulnerability that may permit an attacker to completely compromise the system. Description A buffer overflow vulnerability exists in a Microsoft Active Directory service logging function that is exposed by the LSASS...

Microsoft Windows SSP interface fails to properly validate value used during authentication protocol selection

Overview A remotely exploitable vulnerability in Microsoft's Negotiate Security Software Provider SSP interface could permit an attacker to execute arbitrary code on the system. Description Microsoft's Negotiate Security Software Provider SSP interface contains a buffer overflow during the...

Microsoft Windows 2000 LSASS fails to properly handle certain LDAP messages

Overview A vulnerability exists in the Lightweight Directory Access Protocol LDAP message processing of the Windows 2000 domain controller. An attacker may be able to cause a denial-of-service condition to the vulnerable Active Directory domain. Description A vulnerability exists in the processin...

Microsoft Windows Utility Manager contains vulnerability in the way it launches applications

Overview Microsoft Windows Utility Manager contains a vulnerability that may permit an authenticated user to launch applications with elevated privileges. Description Microsoft Windows 2000's Utility Manager is a program that permits users to monitor and launch various accessibility applications....

Microsoft Windows fails to properly create entries in the Local Descriptor Table (LDT)

Overview Microsoft Windows NT4.0 and Windows 2000 contain a vulnerability that could permit a local user to gain elevated privileges on the system. Description Microsoft Windows NT4.0 and Windows 2000 provide an API to the kernel to create Local Descriptor Tables LDT for applications. A failure t...

Microsoft Windows Help and Support Center (HCP) fails to validate HCP URLs

Overview A remotely exploitable vulnerability exists in the Help and Support Center HCP. An attacker could compromise the victim's system by tricking them into visiting a malicious web site, or viewing a malicious email message. Description A failure to filter special characters, such as quotes,...

Microsoft Windows creates COM object identifiers incorrectly

Overview A vulnerability exists in Microsoft's COM object component. Explotiation of this vulnerability may lead to information disclosure and the ability for an attacker to open services on network communication ports. Description Microsoft's COM object component creates object identifiers in a...

Microsoft Windows XP creates tasks with elevated privileges

Overview Microsoft Windows XP contains a vulnerability in the way that tasks are created that may permit an authenticated user to launch applications with elevated privileges. Description Microsoft Windows creates tasks when a user launches an application. A vulnerability in the way that Windows ...

Microsoft Windows Secure Sockets Layer (SSL) library vulnerable to DoS

Overview A vulnerability in the Microsoft Secure Sockets Layer library could allow a remote attacker to cause a denial-of-service condition on an affected system. Description The Secure Sockets Layer SSL protocol is commonly used to provide authentication, encryption, integrity, and non-repudiati...

Microsoft CIS and RPC over HTTP Proxy components fail to properly handle responses

Overview A vulnerability in a Microsoft HTTP Proxy component may lead to a denial of service. Description Microsoft's COM Internet Sevices CIS and Remote Procedure Call RPC over HTTP Proxy contain a vulnerability that could permit an attacker to cause a denial of service. When a forwarded request...

Microsoft Windows contains buffer overflow in processing of WMF and EMF image formats

Overview A vulnerability exists in the APIs that handle Microsoft Windows Metafiles WMF and Enhanced Metafiles EMF image formats. Exploitation may lead to an attacker executing arbitrary code on the system. Description The code that renders Windows Metafiles WMF and Enhanced Metafiles EMF image...

Sun Solaris SSH Daemon fails to properly log client IP addresses

Overview The Sun Solaris Secure Shell Daemon sshd may incorrectly log client IP addresses. Description SSH is a program used to provide secure connection and communications between client and servers. Upon connecting to the service, the client's IP address is logged. There is a vulnerability in t...

Microsoft Jet Database Engine database request handling buffer overflow

Overview The Microsoft Jet Database Engine Jet provides data access functionality to a number of other Microsoft and many third party applications. A buffer overflow vulnerability exists in the Jet Database Engine that could allow a remote attacker to execute code of their choosing on an affected...

BEA WebLogic Server stores administrator password in clear text in config.xml

Overview BEA WebLogic Server stores the administrator password used to boot the server in clear text within the config.xml file. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating, securing, and managing distributed...

MPlayer contains a buffer overflow in the HTTP parser

Overview MPlayer fails to properly allocate a memory buffer for URL strings containing characters that need to be escaped. Description MPlayer is a movie player for Linux and other Unix-based operating systems. MPlayer fails to properly allocate a memory buffer for URL strings containing characte...

KAME Racoon IKE daemon fails to properly verify client RSA signatures

Overview The KAME Racoon IKE daemon fails to properly verify client RSA signatures when using Main or Aggressive Mode during a Phase 1 IKE exchange. Description Racoon is an IKE Key Management daemon that negotiates and configures a set of parameters for IPSec. When authenticating a peer in Phase...

BEA WebLogic Server fails to properly associate the user identity on subsequent client connections

Overview BEA WebLogic Server fails to properly associate a user's identity when a client attempts to connect multiple times using different client certificates. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating,...

Cisco WLSE and HSE devices contain hardcoded username and password

Overview A default account with a common username and password exists in two Cisco products. An attacker with knowledge of this account information can compromise any of these devices on the network. Description A default account with a known, fixed username and password combination exists in som...

Monit fails to properly handle negative Content-Length fields

Overview Monit fails to properly handle HTTP requests containing a negative Content-Length field. Description Monit is a utility to monitor system processes, files, directories, devices, and remote hosts. It provides a web-based interface that can be used to access the Monit server. When processi...

Monit fails to properly handle overly long HTTP requests

Overview Monit is vulnerable to a buffer overflow when processing overly long HTTP requests. Description Monit is a utility to monitor system processes, files, directories, devices, and remote hosts. It provides a web-based interface that can be used to access the Monit server. There is a buffer...

Outlook Express MHTML protocol handler does not properly validate source of alternate content

Overview The Outlook Express MIME Encapsulation of Aggregate HTML Documents MHTML protocol handler does not adequately validate the source of alternate content. An attacker could exploit this vulnerability to access data and execute script in different security domains. By causing script to be ru...

Sun Solaris contains a vulnerability in the tcsetattr() library function

Overview A vulnerability in the Sun Solaris tcsetattr library function could allow a unprivileged local user to cause the system to hang. Description Sun Solaris uses a tcsetattr library function to set the parameters associated with the terminal. There is an unspecified vulnerability in the...

Cisco 6000/6500/7600 series systems fail to properly process layer 2 frames

Overview Cisco 6000/6500/7600 series systems with Multilayer Switch Feature Card 2 MSFC2 fail to properly process layer 2 frames. Description Cisco 6000/6500/7600 series systems with MSFC2 contain a vulnerability in the way layer 2 frames are processed in software. By sending a specially crafted...