3831 matches found
Apache: Multiple vulnerabilities
Background The Apache HTTP server is one of the most popular web servers on the Internet. Description Adrian Pastor and Amir Azam ProCheckUp reported that the HTTP Method specifier header is not properly sanitized when the HTTP return code is "413 Request Entity too large" CVE-2007-6203. The...
PDFlib: Multiple buffer overflows
Background PDFlib is a library for generating PDF on the fly. Description poplix reported multiple boundary errors in the pdcfsearchfopen function when processing overly long filenames. Impact A remote attacker could send specially crafted content to a vulnerable application using PDFlib, possibl...
Cacti: Multiple vulnerabilities
Background Cacti is a web-based network graphing and reporting tool. Description The following inputs are not properly sanitized before being processed: "viewtype" parameter in the file graph.php, "filter" parameter in the file graphview.php, "action" and "loginusername" parameters in the file...
MPlayer: Multiple buffer overflows
Background MPlayer is a media player incuding support for a wide range of audio and video formats. Description The following errors have been discovered in MPlayer: Felipe Manzano and Anibal Sacco Core Security Technologies reported an array indexing error in the file libmpdemux/demuxmov.c when...
phpMyAdmin: SQL injection vulnerability
Background phpMyAdmin is a free web-based database administration tool. Description Richard Cunningham reported that phpMyAdmin uses the $REQUEST variable of $GET and $POST as a source for its parameters. Impact An attacker could entice a user to visit a malicious web application that sets an...
Ghostscript: Buffer overflow
Background Ghostscript is a suite of software based on an interpreter for PostScript and PDF. Description Chris Evans Google Security discovered a stack-based buffer overflow within the zseticcspace function in the file zicc.c when processing a PostScript file containing a long "Range" array in a...
VLC: Multiple vulnerabilities
Background VLC is a cross-platform media player and streaming server. Description Multiple vulnerabilities were found in VLC: Michal Luczaj and Luigi Auriemma reported that VLC contains boundary errors when handling subtitles in the ParseMicroDvd, ParseSSA, and ParseVplayer functions in the...
Vobcopy: Insecure temporary file creation
Background Vobcopy is a tool for decrypting and copying DVD .vob files to a hard disk. Description Joey Hess reported that vobcopy appends data to the file "/tmp/vobcopy.bla" in an insecure manner. Impact A local attacker could exploit this vulnerability to conduct symlink attacks and append data...
lighttpd: Multiple vulnerabilities
Background lighttpd is a lightweight high-performance web server. Description lighttpd contains a calculation error when allocating the global file descriptor array CVE-2008-0983. Furthermore, it sends the source of a CGI script instead of returning a 500 error Internal Server Error when the fork...
Evolution: Format string vulnerability
Background Evolution is a GNOME groupware application. Description Ulf Harnhammar from Secunia Research discovered a format string error in the emfmultipartencrypted function in the file mail/em-format.c when reading certain data e.g. the "Version:" field from an encrypted e-mail. Impact A remote...
Win32 binary codecs: Multiple vulnerabilities
Background Win32 binary codecs provide support for video and audio playback. Description Multiple buffer overflow, heap overflow, and integer overflow vulnerabilities were discovered in the Quicktime plugin when processing MOV, FLC, SGI, H.264 and FPX files. Impact A remote attacker could entice ...
Opera: Multiple vulnerabilities
Background Opera is a fast web browser that is available free of charge. Description Mozilla discovered that Opera does not handle input to file form fields properly, allowing scripts to manipulate the file path CVE-2008-1080. Max Leonov found out that image comments might be treated as scripts,...
SWORD: Shell command injection
Background SWORD is a library for Bible study software. Description Dan Dennison reported that the diatheke.pl script used in SWORD does not properly sanitize shell meta-characters in the "range" parameter before processing it. Impact A remote attacker could provide specially crafted input to a...
SplitVT: Privilege escalation
Background SplitVT is a program for splitting terminals into two shells. Description Mike Ashton reported that SplitVT does not drop group privileges before executing the xprop utility. Impact A local attacker could exploit this vulnerability to gain the "utmp" group privileges. Workaround There ...
Paramiko: Information disclosure
Background Paramiko is a Secure Shell Server implementation written in Python. Description Dwayne C. Litzenberger reported that the file "common.py" does not properly use RandomPool when using threads or forked processes. Impact A remote attacker could predict the values generated by applications...
Mantis: Cross-Site Scripting
Background Mantis is a web-based bug tracking system. Description seiji reported that the filename for the uploaded file in bugreport.php is not properly sanitised before being stored. Impact A remote attacker could upload a file with a specially crafted to a bug report, resulting in the executio...
Adobe Acrobat Reader: Multiple vulnerabilities
Background Adobe Acrobat Reader is a PDF reader released by Adobe. Description Multiple vulnerabilities have been discovered in Adobe Acrobat Reader, including: A file disclosure when using file:// in PDF documents CVE-2007-1199 Multiple buffer overflows in unspecified Javascript methods...
Audacity: Insecure temporary file creation
Background Audacity is a free cross-platform audio editor. Description Viktor Griph reported that the "AudacityApp::OnInit" method in file src/AudacityApp.cpp does not handle temporary files properly. Impact A local attacker could exploit this vulnerability to conduct symlink attacks to delete...
Firebird: Multiple vulnerabilities
Background Firebird is a multi-platform, open source relational database. Description Firebird does not properly handle certain types of XDR requests, resulting in an integer overflow CVE-2008-0387. Furthermore, it is vulnerable to a buffer overflow when processing usernames CVE-2008-0467. Impact...
xine-lib: User-assisted execution of arbitrary code
Background xine-lib is the core library package for the xine media player. Description Damian Frizza and Alfredo Ortega Core Security Technologies discovered a stack-based buffer overflow within the openflacfile function in the file demuxflac.c when parsing tags within a FLAC file CVE-2008-0486. ...
Asterisk: Multiple vulnerabilities
Background Asterisk is an open source telephony engine and tool kit. Description Multiple vulnerabilities have been found in Asterisk: Russel Bryant reported a stack buffer overflow in the IAX2 channel driver chaniax2 when bridging calls between chaniax2 and any channel driver that uses RTP for...
Python: PCRE Integer overflow
Background Python is an interpreted, interactive, object-oriented programming language. Description Python 2.3 includes a copy of PCRE which is vulnerable to an integer overflow vulnerability, leading to a buffer overflow. Impact An attacker could exploit the vulnerability by tricking a vulnerabl...
ClamAV: Multiple vulnerabilities
Background Clam AntiVirus is a free anti-virus toolkit for UNIX, designed especially for e-mail scanning on mail gateways. Description An integer overflow has been reported in the "cliscanpe" function in file libclamav/pe.c CVE-2008-0318. Another unspecified vulnerability has been reported in fil...
Boost: Denial of service
Background Boost is a set of C++ libraries, including the Boost.Regex library to process regular expressions. Description Tavis Ormandy and Will Drewry from the Google Security Team reported a failed assertion in file regex/v4/perlmatchernonrecursive.hpp CVE-2008-0171 and a NULL pointer dereferen...
Pulseaudio: Privilege escalation
Background Pulseaudio is a networked sound server with an advanced plugin system. Description Marcus Meissner from SUSE reported that the padroproot function does not properly check the return value of the system calls setuid, seteuid, setresuid and setreuid when dropping its privileges. Impact A...
scponly: Multiple vulnerabilities
Background scponly is a shell for restricting user access to file transfer only using sftp and scp. Description Joachim Breitner reported that Subversion and rsync support invokes subcommands in an insecure manner CVE-2007-6350. It has also been discovered that scponly does not filter the -o and ...
Gnumeric: User-assisted execution of arbitrary code
Background The Gnumeric spreadsheet is a versatile application developed as part of the GNOME Office project. Description Multiple integer overflow and signedness errors have been reported in the excelreadHLINK function in file plugins/excel/ms-excel-read.c when processing XLS HLINK opcodes. Impa...
Gallery: Multiple vulnerabilities
Background Gallery is a web-based application for creating and viewing photo albums. Description The Gallery developement team reported and fixed critical vulnerabilities during an internal audit CVE-2007-6685, CVE-2007-6686, CVE-2007-6687, CVE-2007-6688, CVE-2007-6689, CVE-2007-6690,...
Horde IMP: Security bypass
Background Horde IMP provides a web-based access to IMAP and POP3 mailboxes. Description Ulf Harnhammar, Secunia Research discovered that the "frame" and "frameset" HTML tags are not properly filtered out. He also reported that certain HTTP requests are executed without being checked. Impact A...
SDL_image: Two buffer overflow vulnerabilities
Background SDLimage is an image file library that loads images as SDL surfaces, and supports various formats like BMP, GIF, JPEG, LBM, PCX, PNG, PNM, TGA, TIFF, XCF, XPM, and XV. Description The LWZReadByte function in file IMGgif.c and the IMGLoadLBMRW function in file IMGlbm.c each contain a...
Doomsday: Multiple vulnerabilities
Background The Doomsday Engine deng is a modern gaming engine for popular ID games like Doom, Heretic and Hexen. Description Luigi Auriemma discovered multiple buffer overflows in the DNetPlayerEvent function, the MsgWrite function and the NetSvReadCommands function. He also discovered errors whe...
Kazehakase: Multiple vulnerabilities
Background Kazehakase is a web browser based on the Gecko engine. Description Kazehakase includes a copy of PCRE which is vulnerable to multiple buffer overflows and memory corruptions vulnerabilities GLSA 200711-30. Impact A remote attacker could entice a user to open specially crafted input e.g...
Xdg-Utils: Arbitrary command execution
Background Xdg-Utils is a set of tools allowing all applications to easily integrate with the Free Desktop configuration. Description Miroslav Lichvar discovered that the "xdg-open" and "xdg-email" shell scripts do not properly sanitize their input before processing it. Impact A remote attacker...
libxml2: Denial of service
Background libxml2 is the XML eXtended Markup Language C parser and toolkit initially developed for the Gnome project. Description Brad Fitzpatrick reported that the xmlCurrentChar function does not properly handle some UTF-8 multibyte encodings. Impact A remote attacker could entice a user to op...
GOffice: Multiple vulnerabilities
Background GOffice is a library of document-centric objects and utilities based on GTK. Description GOffice includes a copy of PCRE which is vulnerable to multiple buffer overflows and memory corruptions vulnerabilities GLSA 200711-30. Impact An attacker could entice a user to open specially...
PeerCast: Buffer overflow
Background PeerCast is a client and server for P2P-radio network Description Luigi Auriemma reported a heap-based buffer overflow within the "handshakeHTTP" function when processing HTTP requests. Impact A remote attacker could send a specially crafted request to the vulnerable server, possibly...
Netkit FTP Server: Denial of service
Background net-ftp/netkit-ftpd is the Linux Netkit FTP server with optional SSL support. Description Venustech AD-LAB discovered that an FTP client connected to a vulnerable server with passive mode and SSL support can trigger an fclose function call on an uninitialized stream in ftpd.c. Impact A...
MaraDNS: CNAME Denial of service
Background MaraDNS is a package that implements the Domain Name Service DNS with resolver and caching ability. Description Michael Krieger reported that a specially crafted DNS could prevent an authoritative canonical name CNAME record from being resolved because of an "improper rotation of...
PostgreSQL: Multiple vulnerabilities
Background PostgreSQL is an open source object-relational database management system. Description If using the "expression indexes" feature, PostgreSQL executes index functions as the superuser during VACUUM and ANALYZE instead of the table owner, and allows SET ROLE and SET SESSION AUTHORIZATION...
xine-lib: User-assisted execution of arbitrary code
Background xine-lib is the core library package for the xine media player. Description Luigi Auriemma reported that xine-lib does not properly check boundaries when processing SDP attributes of RTSP streams, leading to heap-based buffer overflows. Impact An attacker could entice a user to play...
Blam: User-assisted execution of arbitrary code
Background Blam is an RSS and Atom feed reader for GNOME written in C. Description The "/usr/bin/blam" script sets the "LDLIBRARYPATH" environment variable incorrectly, which might result in the current working directory . being included when searching for dynamically linked libraries of the Mono...
ngIRCd: Denial of service
Background ngIRCd is a free open source daemon for Internet Relay Chat IRC. Description The IRCPART function in the file irc-channel.c does not properly check the number of parameters, referencing an invalid pointer if no channel is supplied. Impact A remote attacker can exploit this vulnerabilit...
CherryPy: Directory traversal vulnerability
Background CherryPy is a Python-based, object-oriented web development framework. Description CherryPy does not sanitize the session id, provided as a cookie value, in the FileSession.getfilepath function before using it as part of the file name. Impact A remote attacker could exploit this...
TikiWiki: Multiple vulnerabilities
Background TikiWiki is an open source content management system written in PHP. Description Jesus Olmos Gonzalez from isecauditors reported insufficient sanitization of the "movies" parameter in file tiki-listmovies.php CVE-2007-6528. Mesut Timur from H-Labs discovered that the input passed to th...
X.Org X server and Xfont library: Multiple vulnerabilities
Background The X Window System is a graphical windowing system based on a client/server model. Description regenrecht reported multiple vulnerabilities in various X server extension via iDefense: The XFree86-Misc extension does not properly sanitize a parameter within a PassMessage request,...
libcdio: User-assisted execution of arbitrary code
Background libcdio is a library for accessing CD-ROM and CD images. Description Devon Miller reported a boundary error in the "printiso9660recurse" function in files cd-info.c and iso-info.c when processing long filenames within Joliet images. Impact A remote attacker could entice a user to open ...
Adobe Flash Player: Multiple vulnerabilities
Background The Adobe Flash Player is a renderer for the popular SWF file format, which is commonly used to provide interactive websites, digital experiences and mobile content. Description Flash contains a copy of PCRE which is vulnerable to a heap-based buffer overflow GLSA 200711-30,...
Squid: Denial of service
Background Squid is a multi-protocol proxy server. Description The Wikimedia Foundation reported a memory leak vulnerability when performing cache updates. Impact A remote attacker could perform numerous specially crafted requests to the vulnerable server, resulting in a Denial of Service...
Xfce: Multiple vulnerabilities
Background Xfce is a GTK+ 2 based desktop environment that allows to run a modern desktop environment on modest hardware. Description Gregory Andersen reported that the Xfce4 panel does not correctly calculate memory boundaries, leading to a stack-based buffer overflow in the...
OpenAFS: Denial of service
Background OpenAFS is a distributed network filesystem. Description Russ Allbery, Jeffrey Altman, Dan Hyde and Thomas Mueller discovered a race condition due to an improper handling of the clients callbacks lists. Impact A remote attacker could construct cases which trigger the race condition,...