3831 matches found
PostgreSQL: Multiple vulnerabilities
Background PostgreSQL is an open source object-relational database management system. Description Multiple vulnerabilities have been discovered in PostgreSQL. Please review the CVE identifiers referenced below for details. Impact A remote authenticated attacker may be able to create a Denial of...
Wireshark: Multiple vulnerabilities
Background Wireshark is a network protocol analyzer formerly known as ethereal. Description Multiple vulnerabilities have been discovered in Wireshark. Please review the CVE identifiers referenced below for details. Impact A remote attacker can cause arbitrary code execution or a Denial of Servic...
Perl Digest-Base module: Arbitrary code execution
Background Digest-Base is a set of Perl modules that calculate message digests Description The vulnerability is caused due to the “Digest-new” function not properly sanitising input before using it in an “eval” call. Impact The vulnerability might allow an attacker to execute arbitrary code...
WebP: User-assisted execution of arbitrary code
Background WebP is a lossy image compression format. Description An integer overflow flaw has been found in WebP. Impact A remote attacker could entice a user to open a specially crafted image in an application linked against WebP, possibly resulting in execution of arbitrary code with the...
Squid: Multiple vulnerabilities
Background Squid is a full-featured web proxy cache. Description Multiple vulnerabilities have been discovered in Squid. Please review the CVE identifiers referenced below for details. Impact A remote attacker may be able to bypass ACL restrictions or cause a Denial of Service condition. Workarou...
Wireshark: Multiple vulnerabilities
Background Wireshark is a versatile network protocol analyzer. Description Multiple vulnerabilities have been discovered in Wireshark. Please review the CVE identifiers referenced below for details. Impact A remote attacker could possibly execute arbitrary code with the privileges of the process ...
LibreOffice: Multiple vulnerabilities
Background LibreOffice is a full office productivity suite. Description Multiple vulnerabilities have been found in LibreOffice: The Microsoft Word Document parser contains an out-of-bounds read error CVE-2011-2713. The Raptor RDF parser contains an XML External Entity expansion error...
Expat: Multiple vulnerabilities
Background Expat is a set of XML parsing libraries. Description Multiple vulnerabilities have been discovered in Expat. Please review the CVE identifiers referenced below for details. Impact A remote attacker could entice a user to open a specially crafted XML file in an application linked agains...
Adobe Reader: Multiple vulnerabilities
Background Adobe Reader is a closed-source PDF reader. Description Multiple vulnerabilities have been found in Adobe Reader, including an integer overflow in TrueType Font handling CVE-2012-0774 and multiple unspecified errors which could cause memory corruption. Impact A remote attacker could...
ejabberd: Multiple Denial of Service vulnerabilities
Background ejabberd is the Erlang jabber daemon. Description Multiple vulnerabilities have been discovered in ejabberd. Please review the CVE identifiers referenced below for details. Impact ejabberd allows remote attackers to cause a Denial of Service condition with the result of either crashing...
libxml2: User-assisted execution of arbitrary code
Background libxml2 is the XML C parser and toolkit developed for the Gnome project. Description The "xmlStringLenDecodeEntities" function in parser.c contains a boundary error which could possibly cause a heap-based buffer overflow. Impact A remote attacker could entice a user to open a specially...
Pure-FTPd: Multiple vulnerabilities
Background Pure-FTPd is a fast, production-quality and standards-compliant FTP server. Description Multiple vulnerabilities have been discovered in Pure-FTPd. Please review the CVE identifiers referenced below for details. Impact Remote unauthenticated attackers may be able to inject FTP commands...
Clam AntiVirus: Multiple vulnerabilities
Background Clam AntiVirus short: ClamAV is an anti-virus toolkit for UNIX, designed especially for e-mail scanning on mail gateways. Description Multiple vulnerabilities have been discovered in Clam AntiVirus. Please review the CVE identifiers referenced below for details. Impact An unauthenticat...
Bugzilla: Multiple vulnerabilities
Background Bugzilla is a bug tracking system from the Mozilla project. Description Multiple vulnerabilities have been reported in Bugzilla. Please review the CVE identifiers referenced below for details. Impact A remote attacker might be able to disclose local files, bug information, passwords, a...
GNU Emacs, XEmacs: Multiple vulnerabilities
Background GNU Emacs and XEmacs are highly extensible and customizable text editors. edit-utils are miscellaneous extensions to XEmacs. Description Morten Welinder reports about GNU Emacs and edit-utils in XEmacs: By shipping a .flc accompanying a source file .c for example and setting...
VLC: Multiple vulnerabilities
Background VLC is a cross-platform media player and streaming server. Description Tobias Klein reported the following vulnerabilities: A stack-based buffer overflow when processing CUE image files in modules/access/vcd/cdrom.c CVE-2008-5032. A stack-based buffer overflow when processing RealText...
xine-lib: User-assisted execution of arbitrary code
Background xine-lib is the core library package for the xine media player. Description Damian Frizza and Alfredo Ortega Core Security Technologies discovered a stack-based buffer overflow within the openflacfile function in the file demuxflac.c when parsing tags within a FLAC file CVE-2008-0486. ...
CUPS: Multiple vulnerabilities
Background CUPS provides a portable printing layer for UNIX-based operating systems. The alternate pdftops filter is a CUPS filter used to convert PDF files to the Postscript format via Poppler; the filter is installed by default in Gentoo Linux. Description Wei Wang McAfee AVERT Research...
KOffice, KWord, KPDF, KDE Graphics Libraries: Stack-based buffer overflow
Background KOffice is an integrated office suite for KDE. KWord is the KOffice word processor. KPDF is a KDE-based PDF viewer included in the kdegraphics package. Description KPDF includes code from xpdf that is vulnerable to an integer overflow in the StreamPredictor::StreamPredictor function...
OpenOffice.org: Two buffer overflows
Background OpenOffice.org is an open source office productivity suite, including word processing, spreadsheet, presentation, drawing, data charting, formula editing, and file conversion facilities. Description John Heasman of NGSSoftware has discovered a heap-based buffer overflow when parsing th...
Mozilla products: Multiple vulnerabilities
Background Mozilla Firefox is an open-source web browser from the Mozilla Project, and Mozilla Thunderbird an email client. The SeaMonkey project is a community effort to deliver production-quality releases of code derived from the application formerly known as the 'Mozilla Application Suite'...
Apache mod_perl: Denial of service
Background Modperl is an Apache module that embeds the Perl interpreter within the server, allowing Perl-based web-applications to be created. Description Alex Solvey discovered that the "pathinfo" variable used in file RegistryCooker.pm modperl 2.x or file PerlRun.pm modperl 1.x, is not properly...
WordPress: Multiple vulnerabilities
Background WordPress is a popular personal publishing platform with a web interface. Description WordPress contains cross-site scripting or cross-site scripting forgery vulnerabilities reported by: g30rg3x in the "year" parameter of the wptitle function Alexander Concha in the "demo" parameter of...
libTIFF: Multiple buffer overflows
Background libTIFF provides support for reading and manipulating TIFF images. Description A buffer overflow has been found in the t2pwritepdfstring function in tiff2pdf, which can been triggered with a TIFF file containing a DocumentName tag with UTF-8 characters. An additional buffer overflow ha...
libTIFF: Multiple vulnerabilities
Background libTIFF provides support for reading and manipulating TIFF images. Description Multiple vulnerabilities, ranging from integer overflows and NULL pointer dereferences to double frees, were reported in libTIFF. Impact An attacker could exploit these vulnerabilities by enticing a user to...
Mozilla Suite: Multiple vulnerabilities
Background The Mozilla Suite is a popular all-in-one web browser that includes a mail and news reader. Description Several vulnerabilities were found in Mozilla Suite. Version 1.7.13 was released to fix them. Impact A remote attacker could craft malicious web pages or emails that would leverage...
Perl: Format string errors can lead to code execution
Background Perl is a stable, cross-platform programming language created by Larry Wall. It contains printf functions that allows construction of strings from format specifiers and parameters, like the C printf functions. A well-known class of vulnerabilities, called format string errors, result o...
OpenSSL: SSL 2.0 protocol rollback
Background OpenSSL is a toolkit implementing the Secure Sockets Layer, Transport Layer Security protocols and a general-purpose cryptography library. Description Applications setting the SSLOPMSIESSLV2RSAPADDING option or the SSLOPALL option, that implies it can be forced by a third-party to...
phpBB: Arbitrary command execution
Background phpBB is an Open Source bulletin board package. Description Ron van Daal discovered that phpBB contains a vulnerability in the highlighting code. Impact Successful exploitation would grant an attacker unrestricted access to the PHP exec or system functions, allowing the execution of...
Net-SNMP: fixproc insecure temporary file creation
Background Net-SNMP is a suite of applications used to implement the Simple Network Management Protocol. Description The fixproc application of Net-SNMP creates temporary files with predictable filenames. Impact A malicious local attacker could exploit a race condition to change the content of th...
phpMyAdmin: Cross-site scripting vulnerability
Background phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL databases from a web-browser. Description Oriol Torrent Santiago has discovered that phpMyAdmin fails to validate input to the "convcharset" variable, rendering it vulnerable to cross-site scripting...
MIT krb5: Multiple vulnerabilities
Background MIT krb5 is the free implementation of the Kerberos network authentication protocol by the Massachusetts Institute of Technology. Description The implementation of the Key Distribution Center KDC and the MIT krb5 library contain double-free vulnerabilities, making client programs as we...
MPlayer: GUI filename handling overflow
Background MPlayer is a media player capable of handling multiple multimedia file formats. Description The MPlayer GUI code contains several buffer overflow vulnerabilities, and at least one in the TranslateFilename function is exploitable. Impact By enticing a user to play a file with a carefull...
phpMyAdmin: Multiple vulnerabilities
Background phpMyAdmin is a popular, web-based MySQL administration tool written in PHP. It allows users to administer a MySQL database from a web-browser. Description Two serious vulnerabilities exist in phpMyAdmin. The first allows any user to alter the server configuration variables including...
XFree86, X.org: XDM ignores requestPort setting
Background The X Display Manager XDM is a program which provides a graphical login prompt to users on the console or on remote X terminals. It has largely been superseded by programs such as GDM and KDM. Description XDM will open TCP sockets for its chooser, even if the DisplayManager.requestPort...
Ethereal: Multiple security problems
Background Ethereal is a feature rich network protocol analyzer. Description There are multiple vulnerabilities in versions of Ethereal earlier than 0.10.4, including: A buffer overflow in the MMSE dissector. Under specific conditions a SIP packet could make Ethereal crash. The AIM dissector coul...
WebKitGTK+: Multiple Vulnerabilities
Background WebKitGTK+ is a full-featured port of the WebKit rendering engine, suitable for projects requiring any kind of web integration, from hybrid HTML/CSS applications to full-fledged web browsers. Description Multiple vulnerabilities have been discovered in WebKitGTK+. Please review the CVE...
Ruby: Multiple vulnerabilities
Background Ruby is an interpreted scripting language for quick and easy object-oriented programming. It comes bundled with a HTTP server "WEBrick". Description Multiple vulnerabilities have been discovered in Ruby. Please review the CVE identifiers referenced below for details. Impact Please revi...
Apache Batik: Multiple Vulnerabilities
Background Apache Batik is a Java-based toolkit for applications or applets that want to use images in the Scalable Vector Graphics SVG format for various purposes, such as display, generation or manipulation. Description Multiple vulnerabilities have been discovered in Apache Batik. Please revie...
Arduino: Remote Code Execution
Background Arduino is an open-source AVR electronics prototyping platform. Description A vulnerability has been discovered in Arduino. Please review the CVE identifier referenced below for details. Impact Arduino bundles a vulnerable version of log4j that may lead to remote code execution...
SQLite: Multiple Vulnerabilities
Background SQLite is a C library that implements an SQL database engine. Description Multiple vulnerabilities have been discovered in SQLite. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no kno...
libsdl: Multiple Vulnerabilities
Background Simple DirectMedia Layer is a cross-platform development library designed to provide low level access to audio, keyboard, mouse, joystick, and graphics hardware via OpenGL and Direct3D. Description Multiple vulnerabilities have been discovered in SDL. Please review the CVE identifiers...
Mozilla Network Security Service (NSS): Multiple Vulnerabilities
Background The Mozilla Network Security Service is a library implementing security features like SSL v.2/v.3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME and X.509 certificates. Description Multiple vulnerabilities have been discovered in Mozilla Network Security Service NSS. Please review the...
xterm: Arbitrary Code Execution
Background xterm is a terminal emulator for the X Window system. Description xterm does not correctly handle control characters related to OSC 50 font ops sequence handling. Impact The vulnerability allows text written to the terminal to write text to the terminal's command line. If the terminal'...
Sofia-SIP: Multiple Vulnerabilities
Background Sofia-SIP is an RFC3261 compliant SIP User-Agent library. Description Multiple vulnerabilities have been discovered in Sofia-SIP. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no know...
OpenEXR: Multiple Vulnerabilities
Background OpenEXR is a high dynamic-range HDR image file format developed by Industrial Light & Magic for use in computer imaging applications. Description Multiple vulnerabilities have been discovered in OpenEXR. Please review the CVE identifiers referenced below for details. Impact Please revi...
libxml2: Multiple Vulnerabilities
Background libxml2 is the XML C parser and toolkit developed for the GNOME project. Description Multiple vulnerabilities have been discovered in libxml2. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround The...
Poppler: Arbitrary Code Execution
Background Poppler is a PDF rendering library based on the xpdf-3.0 code base. Description Multiple vulnerabilities have been discovered in Poppler. Please review the CVE identifiers referenced below for details. Impact Processing a specially crafted PDF file or JBIG2 image could lead to a crash ...
Smokeping: Multiple vulnerabilities
Background Smokeping is a powerful latency measurement tool Description Multiple vulnerabilities have been discovered in Smokeping. Please review the CVE identifiers referenced below for details. Impact A local attacker which gains access to the smokeping user could gain root privileges. Workarou...
GRUB: Multiple Vulnerabilities
Background GNU GRUB is a multiboot boot loader used by most Linux systems. Description Multiple vulnerabilities have been discovered in GRUB. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no kno...