Firebird: Buffer overflow

Background Firebird is an open source relational database that runs on Linux, Windows, and various UNIX systems. Description Cody Pierce from TippingPoint DVLabs has discovered a buffer overflow when processing "connect" requests with an overly large "pcnctcount" value. Impact An unauthenticated...

Blackdown Java: Applet privilege escalation

Background Blackdown provides implementations of the Java Development Kit JDK and the Java Runtime Environment JRE. Description Chris Evans has discovered multiple buffer overflows in the Sun JDK and the Sun JRE possibly related to various AWT and font layout functions. Tom Hawtin has discovered ...

Tomcat: Information disclosure

Background Tomcat is the Apache Jakarta Project's official implementation of Java Servlets and Java Server Pages. Description Tomcat allows special characters like slash, backslash or URL-encoded backslash as a separator, while Apache does not. Impact A remote attacker could send a specially...

xine-lib: Heap-based buffer overflow

Background xine-lib is the core library package for the xine media player. Description xine-lib does not check boundaries on data being read into buffers from DMO video files in code that is shared with MPlayer DMOVideoDecoder.c. Impact An attacker could entice a user to play a specially crafted...

OpenOffice.org: EMF/WMF file handling vulnerabilities

Background OpenOffice.org is an open source office productivity suite, including word processing, spreadsheet, presentation, drawing, data charting, formula editing, and file conversion facilities. Description John Heasman of NGSSoftware has discovered integer overflows in the EMRPOLYPOLYGON and...

ncompress: Buffer Underflow

Background ncompress is a suite of utilities to create and extract Lempel-Ziff-Welch LZW compressed archives. Description Tavis Ormandy of the Google Security Team discovered a static buffer underflow in ncompress. Impact An attacker could create a specially crafted LZW archive, that when...

FFmpeg: Buffer overflows

Background FFmpeg is a very fast video and audio converter. Description FFmpeg contains buffer overflows in the AVI processing code. Impact An attacker could trigger the buffer overflows by enticing a user to load a specially crafted AVI file in an application using the FFmpeg library. This might...

LibXfont, monolithic X.org: Multiple integer overflows

Background libXfont is the X.Org Xfont library, some parts are based on the FreeType code base. Description Several integer overflows have been found in the CID font parser. Impact A remote attacker could exploit this vulnerability by enticing a user to load a malicious font file resulting in the...

PAM-MySQL: Multiple vulnerabilities

Background PAM-MySQL is a PAM module used to authenticate users against a MySQL backend. Description A flaw in handling the result of pamgetitem as well as further unspecified flaws were discovered in PAM-MySQL. Impact By exploiting the mentioned flaws an attacker can cause a Denial of Service an...

Ruby: Denial of service

Background Ruby is an interpreted scripting language for quick and easy object-oriented programming. It comes bundled with HTTP "WEBrick" and XMLRPC server objects. Description Ruby uses blocking sockets for WEBrick and XMLRPC servers. Impact An attacker could send large amounts of data to an...

Nagios: Buffer overflow

Background Nagios is an open source host, service and network monitoring program. Description Sebastian Krahmer of the SuSE security team discovered a buffer overflow vulnerability in the handling of a negative HTTP Content-Length header. Impact A buffer overflow in Nagios CGI scripts under certa...

MPlayer: Multiple integer overflows

Background MPlayer is a media player capable of handling multiple multimedia file formats. Description MPlayer makes use of the FFmpeg library, which is vulnerable to a heap overflow in the avcodecdefaultgetbuffer function discovered by Simon Kilvington see GLSA 200601-06. Furthermore, AFI Securi...

HylaFAX: Multiple vulnerabilities

Background HylaFAX is an enterprise-class system for sending and receiving facsimile messages and for sending alpha-numeric pages. Description Patrice Fournier discovered that HylaFAX runs the notify script on untrusted user input. Furthermore, users can log in without a password when HylaFAX is...

Ethereal: Multiple vulnerabilities in protocol dissectors

Background Ethereal is a feature-rich network protocol analyzer. Description There are numerous vulnerabilities in versions of Ethereal prior to 0.10.13, including: The SLIM3 and AgentX dissectors could overflow a buffer CVE-2005-3243. iDEFENSE discovered a buffer overflow in the SRVLOC dissector...

Weex: Format string vulnerability

Background Weex is a non-interactive FTP client typically used to update web pages. Description Ulf Harnhammar discovered a format string bug in Weex that can be triggered when it is first run or when its cache files are rebuilt, using the -r option. Impact An attacker could setup a malicious FTP...

X.Org: Heap overflow in pixmap allocation

Background X.Org is X.Org Foundation's Public Implementation of the X Window System. Description X.Org is missing an integer overflow check during pixmap memory allocation. Impact An X.Org user could exploit this issue to make the X server execute arbitrary code with elevated privileges. Workarou...

phpLDAPadmin: Authentication bypass

Background phpLDAPadmin is a web-based LDAP client allowing to easily manage LDAP servers. Description Alexander Gerasiov discovered a flaw in login.php preventing the application from validating whether anonymous bind has been disabled in the target LDAP server configuration. Impact Anonymous...

phpWebSite: Arbitrary command execution through XML-RPC and SQL injection

Background phpWebSite is a web site content management system. Description phpWebSite uses an XML-RPC library that improperly handles XML-RPC requests and responses with malformed nested tags. Furthermore, "matrixkiller" reported that phpWebSite is vulnerable to an SQL injection attack. Impact A...

Compress::Zlib: Buffer overflow

Background The Compress::Zlib is a Perl module which provides an interface to the zlib compression library. Description Compress::Zlib 1.34 contains a local vulnerable version of zlib, which may lead to a buffer overflow. Impact By creating a specially crafted compressed data stream, attackers ca...

PHP: Script injection through XML-RPC

Background PHP is a general-purpose scripting language widely used to develop web-based applications. It can run inside a web server using the modphp module or the CGI version of PHP, or can run stand-alone in a CLI. Description James Bercegay has discovered that the XML-RPC implementation in PHP...

Gaim: Denial of Service and buffer overflow vulnerabilties

Background Gaim is a full featured instant messaging client which handles a variety of instant messaging protocols. Description Stu Tomlinson discovered that Gaim is vulnerable to a remote stack based buffer overflow when receiving messages in certain protocols, like Jabber and SILC, with a very...

HT Editor: Multiple buffer overflows

Background HT is a hex editor, designed to help analyse and modify executable files. Description Tavis Ormandy of the Gentoo Linux Security Team discovered an integer overflow in the ELF parser, leading to a heap-based buffer overflow. The vendor has reported that an unrelated buffer overflow has...

Convert-UUlib: Buffer overflow

Background Convert-UUlib provides a Perl interface to the uulib library, allowing Perl applications to access data encoded in a variety of formats. Description A vulnerability has been reported in Convert-UUlib where a malformed parameter can be provided by an attacker allowing a read operation t...

telnet-bsd: Multiple buffer overflows

Background telnet-bsd provides a command line telnet client which is used for remote login using the telnet protocol. Description A buffer overflow has been identified in the envoptadd function of telnet-bsd, where a response requiring excessive escaping can cause a heap-based buffer overflow...

Mozilla Thunderbird: Multiple vulnerabilities

Background Mozilla Thunderbird is the next-generation mail client from the Mozilla project. Description The following vulnerabilities were found and fixed in Mozilla Thunderbird: Mark Dowd from ISS X-Force reported an exploitable heap overrun in the GIF processing of obsolete Netscape extension 2...

Python: Arbitrary code execution through SimpleXMLRPCServer

Background Python is an interpreted, interactive, object-oriented, cross-platform programming language. Description Graham Dumpleton discovered that XML-RPC servers making use of the SimpleXMLRPCServer library that use the registerinstance method to register an object without a dispatch method ar...

phpBB: Remote command execution

Background phpBB is an Open Source bulletin board package. Description phpBB contains a vulnerability in the highlighting code and several vulnerabilities in the username handling code. Impact An attacker can exploit the highlighting vulnerability to access the PHP exec function without...

MySQL: Multiple vulnerabilities

Background MySQL is a popular open-source, multi-threaded, multi-user SQL database server. Description The following vulnerabilities were found and fixed in MySQL: Oleksandr Byelkin found that ALTER TABLE ... RENAME checks CREATE/INSERT rights of the old table instead of the new one CAN-2004-0835...

Ghostscript: Insecure temporary file use in multiple scripts

Background Ghostscript is a software package providing an interpreter for the PostScript language and the PDF file format. It also provides output drivers for various file formats and printers. Description The pj-gs.sh, ps2epsi, pv.sh and sysvlp.sh scripts create temporary files in world-writeabl...

CUPS: Leakage of sensitive information

Background The Common UNIX Printing System CUPS is a cross-platform print spooler. Description When printing to a SMB-shared printer requiring authentication, CUPS leaks the user name and password to a logfile. Impact A local user could gain knowledge of sensitive authentication data. Workaround...

CUPS: Denial of service vulnerability

Background The Common UNIX Printing System CUPS is a cross-platform print spooler. Description Alvaro Martinez Echevarria discovered a hole in the CUPS Internet Printing Protocol IPP implementation that allows remote attackers to cause CUPS to stop listening on the IPP port. Impact A remote user...

ImageMagick, imlib, imlib2: BMP decoding buffer overflows

Background ImageMagick is a suite of image manipulation utilities and libraries used for a wide variety of image formats. imlib is a general image loading and rendering library. Description Due to improper bounds checking, ImageMagick and imlib are vulnerable to a buffer overflow when decoding...

l2tpd: Buffer overflow

Background l2tpd is a GPL implentation of the Layer 2 Tunneling Protocol. Description Thomas Walpuski discovered a buffer overflow that may be exploitable by sending a specially crafted packet. In order to exploit the vulnerable code, an attacker would need to fake the establishment of an L2TP...

Unreal Tournament 2003/2004: Buffer overflow in 'secure' queries

Background Unreal Tournament 2003 and 2004 are popular first-person-shooter games. They are both based on the Unreal engine, and can be used in a game server / client setup. Description The Unreal-based game servers support a specific type of query called 'secure'. Part of the Gamespy protocol,...

Icecast denial of service vulnerability

Background Icecast is a program that streams audio data to listeners over the Internet. Description There is an out-of-bounds read error in the web interface of Icecast when handling Basic Authorization requests. This vulnerability can theorically be exploited by sending a specially crafted...

Multiple vulnerabilities in sysstat

Background sysstat is a package containing a number of performance monitoring utilities for Linux, including sar, mpstat, iostat and sa tools Description There are two vulnerabilities in the way sysstat handles symlinks: 1. The isag utility, which displays sysstat data in a graphical format,...

Tcpdump Vulnerabilities in ISAKMP Parsing

Background Tcpdump is a program for monitoring IP network traffic. Libpcap is a supporting library which is responsibile for capturing packets off a network interface. Description There are two specific vulnerabilities in tcpdump, outlined in reference 1 . In the first scenario, an attacker may...

Multiple security vulnerabilities in Apache 2

Background The Apache HTTP Server Project is an effort to develop and maintain an open-source HTTP server for modern operating systems. The goal of this project is to provide a secure, efficient and extensible server that provides services in tune with the current HTTP standards. Description Thre...

Apache: multiple buffer overflows

Background The Apache HTTP Server is one of the most popular web servers on the Internet. Description Multiple stack-based buffer overflows in modalias and modrewrite allow attackers who can create or edit configuration files including .htaccess files, to cause a denial of service and execute...

GPAC: Multiple Vulnerabilities

Background GPAC is an implementation of the MPEG-4 Systems standard developed from scratch in ANSI C. Description Multiple vulnerabilities have been discovered in GPAC. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

Percona XtraBackup: Multiple Vulnerabilities

Background Percona XtraBackup is a complete and open source online backup solution for all versions of MySQL. Description Multiple vulnerabilities have been discovered in Percona XtraBackup. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE...

Flatpak: Sandbox Escape

Background Flatpak is a Linux application sandboxing and distribution framework. Description A vulnerability has been discovered in Flatpak. Please review the CVE identifier referenced below for details. Impact A malicious or compromised Flatpak app could execute arbitrary code outside its sandbo...

Python, PyPy3: Multiple Vulnerabilities

Background Python is an interpreted, interactive, object-oriented, cross-platform programming language. Description Multiple vulnerabilities have been discovered in Python, PyPy3. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers f...

X.Org X Server, XWayland: Multiple Vulnerabilities

Background The X Window System is a graphical windowing system based on a client/server model. Description Multiple vulnerabilities have been discovered in X.Org X Server and XWayland. Please review the CVE identifiers referenced below for details. Impact The X server can be crashed by a maliciou...

Synapse: Multiple Vulnerabilities

Background Synapse is a Matrix homeserver written in Python/Twisted. Description Multiple vulnerabilities have been discovered in Synapse. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known...

Open vSwitch: Multiple Vulnerabilities

Background Open vSwitch is a production quality multilayer virtual switch. Description Multiple vulnerabilities have been discovered in Open vSwitch. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There i...

multipath-tools: Multiple Vulnerabilities

Background multipath-tools are used to drive the Device Mapper multipathing driver. Description Multiple vulnerabilities have been discovered in multipath-tools. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

Apptainer: Privilege Escalation

Background Apptainer is the container system for secure high-performance computing. Description A vulnerability has been discovered in Apptainer. Please review the CVE identifier referenced below for details. Impact There is an ext4 use-after-free flaw that is exploitable in vulnerable versions...

Rack: Multiple Vulnerabilities

Background Rack is a modular Ruby web server interface. Description Multiple vulnerabilities have been discovered in Rack. Please review the CVE identifiers referenced below for details. Impact A possible denial of service vulnerability was found in the multipart parsing component of Rack. A...

Mozilla Firefox: Multiple Vulnerabilities

Background Mozilla Firefox is a popular open-source web browser from the Mozilla project. Description Multiple vulnerabilities have been discovered in Mozilla Firefox. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...