Heap-based buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a crafted RTSP URL.
[APPLE-SA-2009-01-21]
[http://support.apple.com/kb/HT3403]
[33385]
[TA09-022A]
[ADV-2009-0212]
[quicktime-rtspurl-bo(48154)]
[oval:org.mitre.oval:def:6135]
Heap-based buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a QTVR movie file with crafted THKD atoms.
[20090121 ZDI-09-005: Apple QuickTime VR Track Header Atom Heap Corruption Vulnerability]
[APPLE-SA-2009-01-21]
[http://support.apple.com/kb/HT3403]
[33384]
[TA09-022A]
[ADV-2009-0212]
[http://www.zerodayinitiative.com/advisories/ZDI-09-005/]
[oval:org.mitre.oval:def:5646]
Heap-based buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and execute arbitrary code via an AVI movie file with an invalid nBlockAlign value in the _WAVEFORMATEX structure.
[APPLE-SA-2009-01-21]
[http://support.apple.com/kb/HT3403]
[33387]
[TA09-022A]
[ADV-2009-0212]
[http://www.zerodayinitiative.com/advisories/ZDI-09-006/]
[oval:org.mitre.oval:def:6218]
Buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a crafted MP3 audio file.
[APPLE-SA-2009-01-21]
[http://support.apple.com/kb/HT3403]
[TA09-022A]
[ADV-2009-0212]
[quicktime-mpeg2-bo(48157)]
[oval:org.mitre.oval:def:6211]
Unspecified vulnerability in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a crafted H.263 encoded movie file that triggers memory corruption.
[APPLE-SA-2009-01-21]
[http://support.apple.com/kb/HT3403]
[33386]
[TA09-022A]
[ADV-2009-0212]
[quicktime-h263-movie-code-execution(48158)]
[oval:org.mitre.oval:def:6187]
Integer signedness error in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a Cinepak encoded movie file with a crafted MDAT atom that triggers a heap-based buffer overflow.
[20090121 ZDI-09-007: Apple QuickTime Cinepak Codec MDAT Heap Corruption Vulnerability]
[APPLE-SA-2009-01-21]
[http://support.apple.com/kb/HT3403]
[20090124 Re: ZDI-09-007: Apple QuickTime Cinepak Codec MDAT Heap Corruption Vulnerability]
[33388]
[TA09-022A]
[ADV-2009-0212]
[http://www.zerodayinitiative.com/advisories/ZDI-09-007/]
[oval:org.mitre.oval:def:6153]
Heap-based buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a QuickTime movie file containing invalid image width data in JPEG atoms within STSD atoms.
[APPLE-SA-2009-01-21]
[http://support.apple.com/kb/HT3403]
[33390]
[TA09-022A]
[ADV-2009-0212]
[http://www.zerodayinitiative.com/advisories/ZDI-09-008/]
[oval:org.mitre.oval:def:6132]
Unspecified vulnerability in Apple QuickTime MPEG-2 Playback Component before 7.60.92.0 on Windows allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted MPEG-2 movie.
per http://lists.apple.com/archives/security-announce//2009/Jan/msg00001.html
"This issue does not
affect systems running Mac OS X."
[APPLE-SA-2009-01-21]
[http://support.apple.com/kb/HT3404]
[33393]
[1021621]
[ADV-2009-0211]
[quicktime-mpeg2playback-code-execution(48162)]
[oval:org.mitre.oval:def:5974]
Unspecified vulnerability in the Pixlet codec in Apple Mac OS X 10.4.11 and 10.5.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a crafted movie file that triggers memory corruption.
[APPLE-SA-2009-02-12]
[1021718]
[http://support.apple.com/kb/HT3438]
[33759]
[ADV-2009-0422]
[macosx-pixlet-codec-code-execution(48713)]
Integer underflow in QuickDraw Manager in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7, and Apple QuickTime before 7.6.2, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PICT image with a crafted 0x77 Poly tag and a crafted length field, which triggers a heap-based buffer overflow.
[APPLE-SA-2009-06-01-1]
[APPLE-SA-2009-05-12]
[http://support.apple.com/kb/HT3549]
[http://support.apple.com/kb/HT3591]
[20090527 ZDI-09-021: Apple QuickTime PICT Unspecified Tag Heap Overflow Vulnerability]
[34926]
[34938]
[1022209]
[TA09-133A]
[ADV-2009-1297]
[ADV-2009-1407]
[http://www.vupen.com/exploits/Apple_QuickTime_PICT_Poly_Tag_Parsing_Heap_Overflow_PoC_Exploit_1407144.php]
[http://www.zerodayinitiative.com/advisories/ZDI-09-021]
[http://www.zerodayinitiative.com/advisories/ZDI-09-021/]
Certificate Assistant in Apple Mac OS X 10.5.6 allows local users to overwrite arbitrary files via unknown vectors related to an "insecure file operation" on a temporary file.
[APPLE-SA-2009-02-12]
[1021720]
[http://support.apple.com/kb/HT3438]
[33759]
[ADV-2009-0422]
[macosx-certificate-asst-file-overwrite(48715)]
Heap-based buffer overflow in CoreText in Apple Mac OS X 10.5.6 allows remote attackers to execute arbitrary code via a crafted Unicode string.
[APPLE-SA-2009-02-12]
[http://support.apple.com/kb/HT3438]
[33759]
[33809]
[ADV-2009-0422]
dscl in DS Tools in Apple Mac OS X 10.4.11 and 10.5.6 requires that passwords must be provided as command line arguments, which allows local users to gain privileges by listing process information.
[APPLE-SA-2009-02-12]
[1021722]
[http://support.apple.com/kb/HT3438]
[33759]
[33815]
[ADV-2009-0422]
[macosx-dstools-information-disclosure(48717)]
Folder Manager in Apple Mac OS X 10.5.6 uses insecure default permissions when recreating a Downloads folder after it has been deleted, which allows local users to bypass intended access restrictions and read the Downloads folder.
[APPLE-SA-2009-02-12]
[http://support.apple.com/kb/HT3438]
[33759]
[33820]
[ADV-2009-0422]
Unspecified vulnerability in fseventsd in the FSEvents framework in Apple Mac OS X 10.5.6 allows local users to obtain sensitive information (filesystem activities and directory names) via unknown vectors related to "credential management."
[APPLE-SA-2009-02-12]
[http://support.apple.com/kb/HT3438]
[33759]
[33821]
[ADV-2009-0422]
Apple iTunes before 8.1 on Windows allows remote attackers to cause a denial of service (infinite loop) via a Digital Audio Access Protocol (DAAP) message with a crafted Content-Length header.
[20090312 Apple iTunes DAAP Messages Handling Denial of Service Vulnerability]
[APPLE-SA-2009-03-11]
[1021842]
[http://support.apple.com/kb/HT3487]
[http://www.fortiguardcenter.com/advisory/FGA-2009-11.html]
[20090313 Apple iTunes DAAP Messages Handling Denial of Service Vulnerability]
[34094]
[ADV-2009-0702]
[itunes-daap-dos(49200)]
[oval:org.mitre.oval:def:6001]
csregprinter in the Printing component in Apple Mac OS X 10.4.11 and 10.5.6 does not properly handle error conditions, which allows local users to execute arbitrary code via unknown vectors that trigger a heap-based buffer overflow.
[APPLE-SA-2009-02-12]
[http://support.apple.com/kb/HT3438]
[33759]
[33811]
[ADV-2009-0422]
The Remote Apple Events server in Apple Mac OS X 10.4.11 and 10.5.6 does not properly initialize a buffer, which allows remote attackers to read portions of memory.
[APPLE-SA-2009-02-12]
[http://support.apple.com/kb/HT3438]
[33759]
[33816]
[ADV-2009-0422]
Remote Apple Events in Apple Mac OS X 10.4.11 and 10.5.6 allows remote attackers to cause a denial of service (application termination) or obtain sensitive information via unspecified vectors that trigger an out-of-bounds memory access.
[APPLE-SA-2009-02-12]
[http://support.apple.com/kb/HT3438]
[33759]
[33814]
[ADV-2009-0422]
Unspecified vulnerability in CarbonCore in Apple Mac OS X 10.4.11 and 10.5.6 allows remote attackers to cause a denial of service (application termination) and execute arbitrary code via a crafted resource fork that triggers memory corruption.
[APPLE-SA-2009-02-12]
[http://support.apple.com/kb/HT3438]
[33759]
[ADV-2009-0422]
NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.
Note that versions 4.2.5 before 4.2.5p150 are development versions and not production versions. Development versions are not included in the CPE configuration for CVEs.
[APPLE-SA-2009-05-12]
[SUSE-SR:2009:005]
[SUSE-SR:2009:008]
[SSA:2009-014-03]
[http://support.apple.com/kb/HT3549]
[http://www.ocert.org/advisories/ocert-2008-016.html]
[RHSA-2009:0046]
[20090107 [oCERT-2008-016] Multiple OpenSSL signature verification API misuses]
[1021533]
[TA09-133A]
[ADV-2009-0042]
[ADV-2009-1297]
[[announce] 20090108 NTP 4.2.4p6 Released]
[oval:org.mitre.oval:def:10035]
Samba 3.2.0 through 3.2.6, when registry shares are enabled, allows remote authenticated users to access the root filesystem via a crafted connection request that specifies a blank share name.
Patch Information - http://www.samba.org/samba/history/security.html
[http://master.samba.org/samba/ftp/patches/security/samba-3.2.6-CVE-2009-0022.patch]
[MDVSA-2009:042]
[http://www.samba.org/samba/security/CVE-2009-0022.html]
[33118]
[1021513]
[ADV-2009-0017]
[samba-file-system-security-bypass(47733)]
[USN-702-1]
[FEDORA-2009-0268]
The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow.
[APPLE-SA-2009-11-09-1]
[HPSBUX02612]
[GLSA-200907-03]
[SSA:2009-167-02]
[http://support.apple.com/kb/HT3937]
[http://svn.apache.org/viewvc?view=rev&revision=779880]
[http://wiki.rpath.com/Advisories:rPSA-2009-0144]
[http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3]
[DSA-1812]
[MDVSA-2009:131]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
[RHSA-2009:1107]
[RHSA-2009:1108]
[20091112 rPSA-2009-0144-1 apr-util]
[35221]
[USN-786-1]
[USN-787-1]
[ADV-2009-1907]
[ADV-2009-3184]
[PK88341]
[PK91241]
[PK99478]
[http://www-01.ibm.com/support/docview.wss?uid=swg27014463]
[https://bugzilla.redhat.com/show_bug.cgi?id=503928]
[apache-aprstrmatchprecompile-dos(50964)]
[[httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[[httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[oval:org.mitre.oval:def:10968]
[oval:org.mitre.oval:def:12321]
[FEDORA-2009-6014]
[FEDORA-2009-6261]
[FEDORA-2009-5969]
The sys_remap_file_pages function in mm/fremap.c in the Linux kernel before 2.6.24.1 allows local users to cause a denial of service or gain privileges via unspecified vectors, related to the vm_file structure member, and the mmap_region and do_munmap functions.
[http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.24.y.git;a=commit;h=8a459e44ad837018ea5c34a9efe8eb4ad27ded26]
[[oss-security] 20090112 CVE-2009-0024 kernel: local privilege escalation in sys_remap_file_pages]
[http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.24.1]
[33211]
BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3, and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.
[http://groups.google.com/group/comp.protocols.dns.bind/browse_thread/thread/49ef622c8329fd33]
[APPLE-SA-2009-05-12]
[HPSBOV03226]
[FreeBSD-SA-09:04]
[SSA:2009-014-02]
[250846]
[http://support.apple.com/kb/HT3549]
[http://support.avaya.com/elmodocs2/security/ASA-2009-045.htm]
[http://wiki.rpath.com/Advisories:rPSA-2009-0009]
[http://www.ocert.org/advisories/ocert-2008-016.html]
[http://www.openbsd.org/errata44.html#008_bind]
[20090107 [oCERT-2008-016] Multiple OpenSSL signature verification API misuses]
[20090120 rPSA-2009-0009-1 bind bind-utils]
[20090401 VMSA-2009-0004 ESX Service Console updates for openssl, bind, and vim]
[33151]
[TA09-133A]
[http://www.vmware.com/security/advisories/VMSA-2009-0004.html]
[ADV-2009-0043]
[ADV-2009-0366]
[ADV-2009-0904]
[ADV-2009-1297]
[https://issues.rpath.com/browse/RPL-2938]
[oval:org.mitre.oval:def:10879]
[oval:org.mitre.oval:def:5569]
[https://www.isc.org/software/bind/advisories/cve-2009-0025]
[FEDORA-2009-0350]
Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to (1) search.jsp or (2) swr.jsp.
[4942]
[http://www.apache.org/dist/jackrabbit/RELEASE-NOTES-1.5.2.txt]
[20090120 [ANNOUNCE] Apache Jackrabbit 1.5.2 released]
[33360]
[ADV-2009-0177]
[jackrabbit-search-swr-xss(48110)]
[https://issues.apache.org/jira/browse/JCR-1925]
The request handler in JBossWS in JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP06 and 4.3 before 4.3.0.CP04 does not properly validate the resource path during a request for a WSDL file with a custom web-service endpoint, which allows remote attackers to read arbitrary XML files via a crafted request.
[RHSA-2009:0346]
[RHSA-2009:0347]
[RHSA-2009:0348]
[RHSA-2009:0349]
[34023]
[1021817]
[https://bugzilla.redhat.com/show_bug.cgi?id=479668]
[https://jira.jboss.org/jira/browse/JBPAPP-1548]
The clone system call in the Linux kernel 2.6.28 and earlier allows local users to send arbitrary signals to a parent process from an unprivileged child process by launching an additional child process with the CLONE_PARENT flag, and then letting this new process exit.
[SUSE-SA:2009:010]
[SUSE-SA:2009:030]
[SUSE-SA:2009:031]
[RHSA-2009:0459]
[http://scary.beasts.org/security/CESA-2009-002.html]
[http://scarybeastsecurity.blogspot.com/2009/02/linux-kernel-minor-signal-vulnerability.html]
[http://wiki.rpath.com/Advisories:rPSA-2009-0084]
[DSA-1787]
[DSA-1794]
[DSA-1800]
[MDVSA-2009:118]
[RHSA-2009:0326]
[RHSA-2009:0451]
[20090516 rPSA-2009-0084-1 kernel]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[33906]
[USN-751-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-3316]
[https://bugzilla.redhat.com/show_bug.cgi?id=479932]
[oval:org.mitre.oval:def:11187]
[oval:org.mitre.oval:def:7947]
The ABI in the Linux kernel 2.6.28 and earlier on s390, powerpc, sparc64, and mips 64-bit platforms requires that a 32-bit argument in a 64-bit register was properly sign extended when sent from a user-mode application, but cannot verify this, which allows local users to cause a denial of service (crash) or possibly gain privileges via a crafted system call.
[SUSE-SA:2009:010]
[[linux-kernel] 20090110 Re: [PATCH -v7][RFC]: mutex: implement adaptive spinning]
[DSA-1749]
[DSA-1787]
[DSA-1794]
[MDVSA-2009:135]
[33275]
[https://bugzilla.redhat.com/show_bug.cgi?id=479969]
[FEDORA-2009-0816]
A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated users to access other users' folder lists and configuration data in opportunistic circumstances by using the standard webmail.php interface. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-3663.
[SUSE-SR:2009:004]
[1021611]
[33354]
[https://bugzilla.redhat.com/show_bug.cgi?id=480224]
[https://bugzilla.redhat.com/show_bug.cgi?id=480488]
[squirrelmail-sessionid-session-hijacking(48115)]
[oval:org.mitre.oval:def:10366]
[RHSA-2009:0057]
Memory leak in the keyctl_join_session_keyring function (security/keys/keyctl.c) in Linux kernel 2.6.29-rc2 and earlier allows local users to cause a denial of service (kernel memory consumption) via unknown vectors related to a "missing kfree."
[http://git2.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0d54ee1c7850a954026deec4cd4885f331da35cc]
[SUSE-SA:2009:010]
[RHSA-2009:0264]
[http://support.avaya.com/elmodocs2/security/ASA-2009-114.htm]
[DSA-1749]
[DSA-1787]
[DSA-1794]
[[oss-security] 20090119 CVE-2009-0031 kernel: local denial of service in keyctl_join_session_keyring]
[RHSA-2009:0331]
[RHSA-2009:0360]
[USN-751-1]
[oval:org.mitre.oval:def:11386]
CUPS on Mandriva Linux 2008.0, 2008.1, 2009.0, Corporate Server (CS) 3.0 and 4.0, and Multi Network Firewall (MNF) 2.0 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/pdf.log temporary file.
[1021637]
[MDVSA-2009:027]
[MDVSA-2009:028]
[MDVSA-2009:029]
[33418]
[cups-pdflog-symlink(48210)]
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.
[JVN#87272440]
[APPLE-SA-2010-03-29-1]
[SUSE-SR:2009:012]
[HPSBMA02535]
[HPSBUX02579]
[HPSBOV02762]
[HPSBUX02860]
[1022331]
[263529]
[http://support.apple.com/kb/HT4077]
[http://svn.apache.org/viewvc?rev=742915&view=rev]
[http://svn.apache.org/viewvc?rev=781362&view=rev]
[http://tomcat.apache.org/security-4.html]
[http://tomcat.apache.org/security-5.html]
[http://tomcat.apache.org/security-6.html]
[DSA-2207]
[MDVSA-2009:136]
[MDVSA-2009:138]
[MDVSA-2010:176]
[20090603 [SECURITY] CVE-2009-0033 Apache Tomcat DoS when using Java AJP connector]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[35193]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-1496]
[ADV-2009-1856]
[ADV-2009-3316]
[ADV-2010-3056]
[tomcat-ajp-dos(50928)]
[[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/]
[[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/]
[oval:org.mitre.oval:def:10231]
[oval:org.mitre.oval:def:19110]
[oval:org.mitre.oval:def:5739]
[FEDORA-2009-11374]
[FEDORA-2009-11352]
[FEDORA-2009-11356]
parse.c in sudo 1.6.9p17 through 1.6.9p19 does not properly interpret a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command.
[[Security-announce] 20090710 VMSA-2009-0009 ESX Service Console updates for udev, sudo, and curl]
[http://wiki.rpath.com/Advisories:rPSA-2009-0021]
[http://www.gratisoft.us/bugzilla/show_bug.cgi?id=327]
[MDVSA-2009:033]
[RHSA-2009:0267]
[20090129 rPSA-2009-0021-1 sudo]
[20090711 VMSA-2009-0009 ESX Service Console updates for udev, sudo, and curl]
[33517]
[1021688]
[http://www.sudo.ws/cgi-bin/cvsweb/sudo/parse.c.diff?r1=1.160.2.21&r2=1.160.2.22&f=h]
[http://www.vmware.com/security/advisories/VMSA-2009-0009.html]
[ADV-2009-1865]
[https://bugzilla.novell.com/show_bug.cgi?id=468923]
[https://issues.rpath.com/browse/RPL-2954]
[oval:org.mitre.oval:def:10856]
[oval:org.mitre.oval:def:6462]
Buffer overflow in the proxyReadClientSocket function in proxy/libvirt_proxy.c in libvirt_proxy 0.5.1 might allow local users to gain privileges by sending a portion of the header of a virProxyPacket packet, and then sending the remainder of the packet with crafted values in the header, related to use of uninitialized memory in a validation check.
[http://git.et.redhat.com/?p=libvirt.git;a=commitdiff;h=2bb0657e28]
[[oss-security] 20090210 libvirt_proxy heads up]
[RHSA-2009:0382]
[33724]
[https://bugzilla.redhat.com/show_bug.cgi?id=484947]
[oval:org.mitre.oval:def:10127]
[[libvir-list] 20090127 [libvirt] [PATCH] proxy: Fix use of uninitalized memory]
[[libvir-list] 20090128 Re: [libvirt] [PATCH] proxy: Fix use of uninitalized memory]
[[libvir-list] 20090128 Re: [libvirt] [PATCH] proxy: Fix use of uninitalized memory]
The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3) execute arbitrary commands via a redirect to an scp: URL.
[http://curl.haxx.se/docs/adv_20090303.html]
[http://curl.haxx.se/lxr/source/CHANGES]
[APPLE-SA-2010-03-29-1]
[SUSE-SR:2009:006]
[[Security-announce] 20090710 VMSA-2009-0009 ESX Service Console updates for udev, sudo, and curl]
[GLSA-200903-21]
[SSA:2009-069-01]
[http://support.apple.com/kb/HT4077]
[http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0042]
[DSA-1738]
[RHSA-2009:0341]
[20090312 rPSA-2009-0042-1 curl]
[20090711 VMSA-2009-0009 ESX Service Console updates for udev, sudo, and curl]
[33962]
[1021783]
[USN-726-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0009.html]
[ADV-2009-0581]
[ADV-2009-1865]
[http://www.withdk.com/2009/03/03/curllibcurl-redirect-arbitrary-file-access/]
[http://www.withdk.com/archives/Libcurl_arbitrary_file_access.pdf]
[curl-location-security-bypass(49030)]
[oval:org.mitre.oval:def:11054]
[oval:org.mitre.oval:def:6074]
Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring; or (5) the PATH_INFO to the default URI under console/portal/.
[http://dsecrg.com/pages/vul/show.php?id=119]
[http://geronimo.apache.org/21x-security-report.html#2.1.xSecurityReport-214]
[http://issues.apache.org/jira/browse/GERONIMO-4597]
[20090416 [DSECRG-09-019] Apache Geronimo - XSS vulnerabilities.txt]
[34562]
[ADV-2009-1089]
Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that (1) change the web administration password, (2) upload applications, and perform unspecified other administrative actions, as demonstrated by (3) a Shutdown request to console/portal//Server/Shutdown.
[http://dsecrg.com/pages/vul/show.php?id=120]
[http://geronimo.apache.org/21x-security-report.html#2.1.xSecurityReport-214]
[http://issues.apache.org/jira/browse/GERONIMO-4597]
[20090416 [DSECRG-09-020] Apache Geronimo - XSRF vulnerabilities]
[34562]
[ADV-2009-1089]
The PNG reference library (aka libpng) before 1.0.43, and 1.2.x before 1.2.35, as used in pngcrush and other applications, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file that triggers a free of an uninitialized pointer in (1) the png_read_png function, (2) pCAL chunk handling, or (3) setup of 16-bit gamma tables.
[ftp://ftp.simplesystems.org/pub/png/src/libpng-1.2.34-ADVISORY.txt]
[http://downloads.sourceforge.net/libpng/libpng-1.2.34-ADVISORY.txt]
[APPLE-SA-2009-08-05-1]
[APPLE-SA-2009-06-08-1]
[APPLE-SA-2009-06-17-1]
[APPLE-SA-2009-05-12]
[SUSE-SR:2009:005]
[SUSE-SA:2009:012]
[SUSE-SA:2009:023]
[[security-announce] 20090820 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server]
[GLSA-200903-28]
[GLSA-201209-25]
[SSA:2009-083-02]
[SSA:2009-083-03]
[[png-mng-implement] 20090219 libpng-1.2.35 and libpng-1.0.43 fix security vulnerability]
[http://sourceforge.net/project/shownotes.php?group_id=1689&release_id=662441]
[259989]
[1020521]
[http://support.apple.com/kb/HT3549]
[http://support.apple.com/kb/HT3613]
[http://support.apple.com/kb/HT3639]
[http://support.apple.com/kb/HT3757]
[http://support.avaya.com/elmodocs2/security/ASA-2009-069.htm]
[http://support.avaya.com/elmodocs2/security/ASA-2009-208.htm]
[http://support.avaya.com/japple/css/japple?temp.documentID=366362&temp.productID=154235&temp.releaseID=361845&temp.bucketID=126655&PAGE=Document]
[http://wiki.rpath.com/Advisories:rPSA-2009-0046]
[DSA-1750]
[DSA-1830]
[VU#649212]
[MDVSA-2009:051]
[MDVSA-2009:075]
[MDVSA-2009:083]
[RHSA-2009:0315]
[RHSA-2009:0325]
[RHSA-2009:0333]
[RHSA-2009:0340]
[20090312 rPSA-2009-0046-1 libpng]
[20090529 VMSA-2009-0007 VMware Hosted products and ESX and ESXi patches resolve security issues]
[20090821 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server]
[33827]
[33990]
[TA09-133A]
[TA09-218A]
[http://www.vmware.com/security/advisories/VMSA-2009-0007.html]
[ADV-2009-0469]
[ADV-2009-0473]
[ADV-2009-0632]
[ADV-2009-1297]
[ADV-2009-1451]
[ADV-2009-1462]
[ADV-2009-1522]
[ADV-2009-1560]
[ADV-2009-1621]
[ADV-2009-2172]
[libpng-pointer-arrays-code-execution(48819)]
[oval:org.mitre.oval:def:10316]
[oval:org.mitre.oval:def:6458]
[FEDORA-2009-2045]
[FEDORA-2009-1976]
[FEDORA-2009-2882]
[FEDORA-2009-2884]
IAX2 in Asterisk Open Source 1.2.x before 1.2.31, 1.4.x before 1.4.23-rc4, and 1.6.x before 1.6.0.3-rc2; Business Edition A.x.x, B.x.x before B.2.5.7, C.1.x.x before C.1.10.4, and C.2.x.x before C.2.1.2.1; and s800i 1.2.x before 1.3.0 responds differently to a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
Vendor Advisory: http://downloads.digium.com/pub/security/AST-2009-001.html
[http://downloads.digium.com/pub/security/AST-2009-001.html]
[GLSA-200905-01]
[4910]
[DSA-1952]
[20090108 AST-2009-001: Information leak in IAX2 authentication]
[33174]
[1021549]
[ADV-2009-0063]
Multiple unspecified vulnerabilities in the Arclib library (arclib.dll) before 7.3.0.15 in the CA Anti-Virus engine for CA Anti-Virus for the Enterprise 7.1, r8, and r8.1; Anti-Virus 2007 v8 and 2008; Internet Security Suite 2007 v3 and 2008; and other CA products allow remote attackers to bypass virus detection via a malformed archive file.
[http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/26/ca20090126-01-ca-anti-virus-engine-detection-evasion-multiple-vulnerabilities.aspx]
[http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197601]
[20090127 CA20090126-01: CA Anti-Virus Engine Detection Evasion Multiple Vulnerabilities]
[33464]
[1021639]
[ADV-2009-0270]
[ca-antivirus-engine-security-bypass(48261)]
The smmsnmpd service in CA Service Metric Analysis r11.0 through r11.1 SP1 and Service Level Management 3.5 does not properly restrict access, which allows remote attackers to execute arbitrary commands via unspecified vectors.
[http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/07.aspx]
[4887]
[20090107 CA20090107-01: CA Service Metric Analysis and CA Service Level Management smmsnmpd Arbitrary Command Execution Vulnerability]
[33161]
[ADV-2009-0053]
[https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=196148]
Sun GridEngine 5.3 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.
[http://www.ocert.org/advisories/ocert-2008-016.html]
[20090107 [oCERT-2008-016] Multiple OpenSSL signature verification API misuses]
[ADV-2009-0045]
Gale 0.99 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.
[http://www.ocert.org/advisories/ocert-2008-016.html]
[20090107 [oCERT-2008-016] Multiple OpenSSL signature verification API misuses]
[ADV-2009-0046]
OpenEvidence 1.0.6 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.
[http://www.ocert.org/advisories/ocert-2008-016.html]
[20090107 [oCERT-2008-016] Multiple OpenSSL signature verification API misuses]
[ADV-2009-0047]
Belgian eID middleware (eidlib) 2.6.0 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.
[SUSE-SR:2009:005]
[http://www.ocert.org/advisories/ocert-2008-016.html]
[20090107 [oCERT-2008-016] Multiple OpenSSL signature verification API misuses]
Lasso 2.2.1 and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.
[http://www.ocert.org/advisories/ocert-2008-016.html]
[20090107 [oCERT-2008-016] Multiple OpenSSL signature verification API misuses]
[openssl-dsa-verify-security-bypass(47837)]
ZXID 0.29 and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.
[http://www.ocert.org/advisories/ocert-2008-016.html]
[20090107 [oCERT-2008-016] Multiple OpenSSL signature verification API misuses]
[openssl-dsa-verify-security-bypass(47837)]
The Atheros wireless driver, as used in Netgear WNDAP330 Wi-Fi access point with firmware 2.1.11 and other versions before 3.0.3 on the Atheros AR9160-BC1A chipset, and other products, allows remote authenticated users to cause a denial of service (device reboot or hang) and possibly execute arbitrary code via a truncated reserved management frame.
[20091110 Atheros Driver Reserved Frame Vulnerability]
[36991]
[ADV-2009-3212]
[netgear-wndap330-frame-dos(54216)]
PXE Encryption in Cisco IronPort Encryption Appliance 6.2.4 before 6.2.4.1.1, 6.2.5, 6.2.6, 6.2.7 before 6.2.7.7, 6.3 before 6.3.0.4, and 6.5 before 6.5.0.2; and Cisco IronPort PostX 6.2.1 before 6.2.1.1 and 6.2.2 before 6.2.2.3; allows remote attackers to obtain the decryption key via unspecified vectors, related to a "logic error."
[1021593]
[20090114 IronPort Encryption Appliance / PostX and PXE Encryption Vulnerabilities]
[33268]
[ADV-2009-0140]
PXE Encryption in Cisco IronPort Encryption Appliance 6.2.4 before 6.2.4.1.1, 6.2.5, 6.2.6, 6.2.7 before 6.2.7.7, 6.3 before 6.3.0.4, and 6.5 before 6.5.0.2; and Cisco IronPort PostX 6.2.1 before 6.2.1.1 and 6.2.2 before 6.2.2.3; allows remote attackers to capture credentials by tricking a user into reading a modified or crafted e-mail message.
[1021593]
[20090114 IronPort Encryption Appliance / PostX and PXE Encryption Vulnerabilities]
[33268]
[ADV-2009-0140]
Cross-site request forgery (CSRF) vulnerability in the administration interface in Cisco IronPort Encryption Appliance 6.2.4 before 6.2.4.1.1, 6.2.5, 6.2.6, 6.2.7 before 6.2.7.7, 6.3 before 6.3.0.4, and 6.5 before 6.5.0.2; and Cisco IronPort PostX 6.2.1 before 6.2.1.1 and 6.2.2 before 6.2.2.3; allows remote attackers to modify appliance preferences as arbitrary users via unspecified vectors.
[1021594]
[20090114 IronPort Encryption Appliance / PostX and PXE Encryption Vulnerabilities]
[33268]
[ADV-2009-0140]
Cross-site request forgery (CSRF) vulnerability in the administration interface in Cisco IronPort Encryption Appliance 6.2.4 before 6.2.4.1.1, 6.2.5, 6.2.6, 6.2.7 before 6.2.7.7, 6.3 before 6.3.0.4, and 6.5 before 6.5.0.2; and Cisco IronPort PostX 6.2.1 before 6.2.1.1 and 6.2.2 before 6.2.2.3; allows remote attackers to execute commands and modify appliance preferences as arbitrary users via a logout action.
[1021594]
[20090114 IronPort Encryption Appliance / PostX and PXE Encryption Vulnerabilities]
[33268]
[ADV-2009-0140]
The Certificate Authority Proxy Function (CAPF) service in Cisco Unified Communications Manager 5.x before 5.1(3e) and 6.x before 6.1(3) allows remote attackers to cause a denial of service (voice service outage) by sending malformed input over a TCP session in which the "client terminates prematurely."
[20090121 Cisco Unified Communications Manager CAPF Denial of Service Vulnerability]
[33379]
[1021620]
[ADV-2009-0213]
[cucm-capf-dos-var1(48139)]
The Cisco Wireless LAN Controller (WLC), Cisco Catalyst 6500 Wireless Services Module (WiSM), and Cisco Catalyst 3750 Integrated Wireless LAN Controller with software 4.x before 4.2.176.0 and 5.x before 5.2 allow remote attackers to cause a denial of service (web authentication outage or device reload) via unspecified network traffic, as demonstrated by a vulnerability scanner.
[20090204 Multiple Vulnerabilities in Cisco Wireless LAN Controllers]
[33608]
[1021679]
The Cisco Wireless LAN Controller (WLC), Cisco Catalyst 6500 Wireless Services Module (WiSM), and Cisco Catalyst 3750 Integrated Wireless LAN Controller with software 4.x before 4.2.176.0 and 5.2.x before 5.2.157.0 allow remote attackers to cause a denial of service (device reload) via a web authentication (aka WebAuth) session that includes a malformed POST request to login.html.
[20090204 Multiple Vulnerabilities in Cisco Wireless LAN Controllers]
[33608]
[1021679]
Unspecified vulnerability in the Wireless LAN Controller (WLC) TSEC driver in the Cisco 4400 WLC, Cisco Catalyst 6500 and 7600 Wireless Services Module (WiSM), and Cisco Catalyst 3750 Integrated Wireless LAN Controller with software 4.x before 4.2.176.0 and 5.x before 5.1 allows remote attackers to cause a denial of service (device crash or hang) via unknown IP packets.
[20090204 Multiple Vulnerabilities in Cisco Wireless LAN Controllers]
[33608]
[1021679]
Unspecified vulnerability in the Cisco Wireless LAN Controller (WLC), Cisco Catalyst 6500 Wireless Services Module (WiSM), and Cisco Catalyst 3750 Integrated Wireless LAN Controller with software 4.2.173.0 allows remote authenticated users to gain privileges via unknown vectors, as demonstrated by escalation from the (1) Lobby Admin and (2) Local Management User privilege levels.
[20090204 Multiple Vulnerabilities in Cisco Wireless LAN Controllers]
[33608]
[1021678]
Cross-site scripting (XSS) vulnerability in the Control Center in Symantec Brightmail Gateway Appliance before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
[1022116]
[34641]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090423_01]
[ADV-2009-1155]
[brightmail-controlcenter-xss(50074)]
Multiple unspecified vulnerabilities in the Control Center in Symantec Brightmail Gateway Appliance before 8.0.1 allow remote authenticated users to gain privileges, and possibly obtain sensitive information or hijack sessions of arbitrary users, via vectors involving (1) administrative scripts or (2) console functions.
[1022117]
[34639]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090423_01]
[ADV-2009-1155]
[brightmail-consolescripts-priv-escalation(50075)]
Buffer overflow in net/sctp/sm_statefuns.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.28-git8 allows remote attackers to have an unknown impact via an FWD-TSN (aka FORWARD-TSN) chunk with a large stream ID.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9fcb95a105758b81ef0131cd18e2db5149f13e95]
[HPSBNS02449]
[SUSE-SA:2009:010]
[SUSE-SA:2009:030]
[SUSE-SA:2009:031]
[http://patchwork.ozlabs.org/patch/15024/]
[RHSA-2009:0264]
[http://support.avaya.com/elmodocs2/security/ASA-2009-114.htm]
[DSA-1749]
[DSA-1787]
[DSA-1794]
[[oss-security] 20090105 CVE request: kernel: sctp: memory overflow when FWD-TSN chunk is received with bad stream ID]
[RHSA-2009:0053]
[RHSA-2009:0331]
[RHSA-2009:1055]
[33113]
[1022698]
[USN-751-1]
[ADV-2009-0029]
[ADV-2009-2193]
[https://bugzilla.redhat.com/show_bug.cgi?id=478800]
[oval:org.mitre.oval:def:10872]
[FEDORA-2009-0816]
Multiple unspecified vulnerabilities in Intel system software for Trusted Execution Technology (TXT) allow attackers to bypass intended loader integrity protections, as demonstrated by exploitation of tboot. NOTE: as of 20090107, the only disclosure is a vague pre-advisory with no actionable information. However, because it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
[http://blackhat.com/html/bh-dc-09/bh-dc-09-speakers.html#Wojtczuk]
[http://invisiblethingslab.com/press/itl-press-2009-01.pdf]
[http://theinvisiblethings.blogspot.com/2009/01/attacking-intel-trusted-execution.html]
[33119]
Interaction error in xdg-open allows remote attackers to execute arbitrary code by sending a file with a dangerous MIME type but using a safe type that Firefox sends to xdg-open, which causes xdg-open to process the dangerous file type through automatic type detection, as demonstrated by overwriting the .desktop file.
[[oss-security] 20090106 Fwd: Using xdg-open in /etc/mailcap causes hole in Firefox (Demonstration/Exploit included)]
[33137]
[https://bugs.freedesktop.org/show_bug.cgi?id=19377]
Unspecified vulnerability in the nfs4rename_persistent_fh function in the NFS 4 (aka NFSv4) client in the kernel in Sun Solaris 10 and OpenSolaris before snv_102 allows local users to cause a denial of service (recursive mutex_enter and panic) via unspecified vectors.
[[onnv-notify] 20081021 6300710 recursive mutex_enter in nfs4rename_persistent_fh()]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-139466-02-1]
[248566]
[33128]
[1021519]
[ADV-2009-0030]
[solaris-nfs4client-dos(47750)]
Integer signedness error in Apple Safari allows remote attackers to read the contents of arbitrary memory locations, cause a denial of service (application crash), and probably have unspecified other impact via the array index of the arguments array in a JavaScript function, possibly a related issue to CVE-2008-2307.
[safari-array-memory-disclosure(48214)]
[7673]
Mozilla Firefox 3.0.5 and earlier 3.0.x versions, when designMode is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a certain (a) replaceChild or (b) removeChild call, followed by a (1) queryCommandValue, (2) queryCommandState, or (3) queryCommandIndeterm call. NOTE: it was later reported that 3.0.6 and 3.0.7 are also affected.
[20090107 Firefox 3.0.5 remote vulnerability via queryCommandState]
[20090107 Re: Firefox 3.0.5 remote vulnerability via queryCommandState]
[20090107 Re: Firefox 3.0.5 remote vulnerability via queryCommandState]
[33154]
[https://bugzilla.mozilla.org/show_bug.cgi?id=448329]
[https://bugzilla.mozilla.org/show_bug.cgi?id=456727]
[https://bugzilla.mozilla.org/show_bug.cgi?id=472507]
[8091]
[8219]
Microsoft Internet Explorer 6.0 through 8.0 beta2 allows remote attackers to cause a denial of service (application crash) via an onload=screen[""] attribute value in a BODY element.
[http://skypher.com/index.php/2009/01/07/msie-screen-null-ptr-dos-details/]
[33149]
[ie-javascript-screen-dos(47788)]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2009. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2009. Notes: none.
Microsoft Internet Explorer 7 does not properly handle errors during attempted access to deleted objects, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to CFunctionPointer and the appending of document objects, aka "Uninitialized Memory Corruption Vulnerability."
[33627]
[TA09-041A]
[ADV-2009-0389]
[http://www.zerodayinitiative.com/advisories/ZDI-09-011/]
[MS09-002]
[oval:org.mitre.oval:def:6000]
[8077]
[8079]
[8080]
[8082]
Microsoft Internet Explorer 7, when XHTML strict mode is used, allows remote attackers to execute arbitrary code via the zoom style directive in conjunction with unspecified other directives in a malformed Cascading Style Sheets (CSS) stylesheet in a crafted HTML document, aka "CSS Memory Corruption Vulnerability."
[TA09-041A]
[ADV-2009-0389]
[http://www.zerodayinitiative.com/advisories/ZDI-09-012/]
[MS09-002]
[oval:org.mitre.oval:def:6081]
The firewall engine in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2004 SP3, 2006, 2006 Supportability Update, and 2006 SP1; does not properly manage the session state of web listeners, which allows remote attackers to cause a denial of service (many stale sessions) via crafted packets, aka "Web Proxy TCP State Limited Denial of Service Vulnerability."
[1022045]
[TA09-104A]
[ADV-2009-1030]
[MS09-016]
[oval:org.mitre.oval:def:6068]
The Windows Management Instrumentation (WMI) provider in Microsoft Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly implement isolation among a set of distinct processes that (1) all run under the NetworkService account or (2) all run under the LocalService account, which allows local users to gain privileges by accessing the resources of one of the processes, aka "Windows WMI Service Isolation Vulnerability."
[1022044]
[TA09-104A]
[ADV-2009-1026]
[MS09-012]
[oval:org.mitre.oval:def:6193]
The RPCSS service in Microsoft Windows XP SP2 and SP3 and Server 2003 SP1 and SP2 does not properly implement isolation among a set of distinct processes that (1) all run under the NetworkService account or (2) all run under the LocalService account, which allows local users to gain privileges by accessing the resources of one of the processes, aka "Windows RPCSS Service Isolation Vulnerability."
[1022044]
[TA09-104A]
[ADV-2009-1026]
[MS09-012]
[oval:org.mitre.oval:def:6147]
The ThreadPool class in Windows Vista Gold and SP1, and Server 2008, does not properly implement isolation among a set of distinct processes that (1) all run under the NetworkService account or (2) all run under the LocalService account, which allows local users to gain privileges by leveraging incorrect thread ACLs to access the resources of one of the processes, aka "Windows Thread Pool ACL Weakness Vulnerability."
[1022044]
[TA09-104A]
[ADV-2009-1026]
[MS09-012]
[oval:org.mitre.oval:def:6177]
The graphics device interface (GDI) implementation in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly validate input received from user mode, which allows remote attackers to execute arbitrary code via a crafted (1) Windows Metafile (aka WMF) or (2) Enhanced Metafile (aka EMF) image file, aka "Windows Kernel Input Validation Vulnerability."
[http://support.avaya.com/elmodocs2/security/ASA-2009-079.htm]
[http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=842987&poid=]
[34012]
[1021826]
[TA09-069A]
[ADV-2009-0659]
[MS09-006]
[oval:org.mitre.oval:def:6202]
The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly validate handles, which allows local users to gain privileges via a crafted application that triggers unspecified "actions," aka "Windows Kernel Handle Validation Vulnerability."
[http://support.avaya.com/elmodocs2/security/ASA-2009-079.htm]
[http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=842987&poid=]
[34027]
[1021827]
[TA09-069A]
[ADV-2009-0659]
[MS09-006]
[oval:org.mitre.oval:def:6036]
The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 does not properly handle invalid pointers, which allows local users to gain privileges via an application that triggers use of a crafted pointer, aka "Windows Kernel Invalid Pointer Vulnerability."
[http://support.avaya.com/elmodocs2/security/ASA-2009-079.htm]
[http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=842987&poid=]
[34025]
[1021827]
[TA09-069A]
[ADV-2009-0659]
[MS09-006]
[oval:org.mitre.oval:def:5440]
Use-after-free vulnerability in DirectShow in Microsoft DirectX 8.1 and 9.0 allows remote attackers to execute arbitrary code via an MJPEG file or video stream with a malformed Huffman table, which triggers an exception that frees heap memory that is later accessed, aka "MJPEG Decompression Vulnerability."
[http://support.avaya.com/elmodocs2/security/ASA-2009-132.htm]
[http://www.piotrbania.com/all/adv/ms-directx-mjpeg-adv.txt]
[34460]
[1022040]
[TA09-104A]
[ADV-2009-1025]
[MS09-011]
[oval:org.mitre.oval:def:5618]
The Secure Channel (aka SChannel) authentication component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008, when certificate authentication is used, does not properly validate the client's key exchange data in Transport Layer Security (TLS) handshake messages, which allows remote attackers to spoof authentication by crafting a TLS packet based on knowledge of the certificate but not the private key, aka "SChannel Spoofing Vulnerability."
[1021828]
[TA09-069A]
[ADV-2009-0660]
[MS09-007]
[oval:org.mitre.oval:def:6011]
Integer underflow in Windows HTTP Services (aka WinHTTP) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote HTTP servers to execute arbitrary code via crafted parameter values in a response, related to error handling, aka "Windows HTTP Services Integer Underflow Vulnerability."
[34435]
[1022041]
[TA09-104A]
[ADV-2009-1027]
[MS09-013]
[oval:org.mitre.oval:def:6149]
Unspecified vulnerability in the Word 6 text converter in WordPad in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and the Word 6 text converter in Microsoft Office Word 2000 SP3 and 2002 SP3; allows remote attackers to execute arbitrary code via a crafted Word 6 file that contains malformed data, aka "WordPad and Office Text Converter Memory Corruption Vulnerability."
[1022043]
[TA09-104A]
[ADV-2009-1024]
[MS09-010]
[oval:org.mitre.oval:def:5799]
The WordPerfect 6.x Converter (WPFT632.CNV, 1998.1.27.0) in Microsoft Office Word 2000 SP3 and Microsoft Office Converter Pack does not properly validate the length of an unspecified string, which allows remote attackers to execute arbitrary code via a crafted WordPerfect 6.x file, related to an unspecified counter and control structures on the stack, aka "Word 2000 WordPerfect 6.x Converter Stack Corruption Vulnerability."
[20090414 Microsoft Word 2000 WordPerfect 6.x Converter Stack Corruption Vulnerability]
[1022043]
[TA09-104A]
[ADV-2009-1024]
[MS09-010]
[oval:org.mitre.oval:def:5736]
Windows HTTP Services (aka WinHTTP) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, and Vista Gold allows remote web servers to impersonate arbitrary https web sites by using DNS spoofing to "forward a connection" to a different https web site that has a valid certificate matching its own domain name, but not a certificate matching the domain name of the host requested by the user, aka "Windows HTTP Services Certificate Name Mismatch Vulnerability."
[34437]
[1022041]
[TA09-104A]
[ADV-2009-1027]
[MS09-013]
[oval:org.mitre.oval:def:6027]
Microsoft .NET Framework 1.0 SP3, 1.1 SP1, and 2.0 SP1 does not properly validate .NET verifiable code, which allows remote attackers to obtain unintended access to stack memory, and execute arbitrary code, via (1) a crafted XAML browser application (XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka "Microsoft .NET Framework Pointer Verification Vulnerability."
[TA09-286A]
[MS09-061]
[oval:org.mitre.oval:def:5716]
Microsoft .NET Framework 2.0, 2.0 SP1, and 3.5 does not properly enforce a certain type-equality constraint in .NET verifiable code, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka "Microsoft .NET Framework Type Verification Vulnerability."
[TA09-286A]
[MS09-061]
[oval:org.mitre.oval:def:6451]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2009. Notes: none.
Windows DNS Server in Microsoft Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008, when dynamic updates are enabled, does not restrict registration of the "wpad" hostname, which allows remote authenticated users to hijack the Web Proxy Auto-Discovery (WPAD) feature, and conduct man-in-the-middle attacks by spoofing a proxy server, via a Dynamic Update request for this hostname, aka "DNS Server Vulnerability in WPAD Registration Vulnerability," a related issue to CVE-2007-1692.
[http://blog.ncircle.com/blogs/vert/archives/2009/03/successful_exploit_renders_mic.html]
[http://blogs.technet.com/srd/archive/2009/03/13/ms09-008-dns-and-wins-server-security-update-in-more-detail.aspx]
[http://support.avaya.com/elmodocs2/security/ASA-2009-083.htm]
[33989]
[1021830]
[TA09-069A]
[ADV-2009-0661]
[MS09-008]
[oval:org.mitre.oval:def:6138]
The WINS server in Microsoft Windows 2000 SP4 and Server 2003 SP1 and SP2 does not restrict registration of the (1) "wpad" and (2) "isatap" NetBIOS names, which allows remote authenticated users to hijack the Web Proxy Auto-Discovery (WPAD) and Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) features, and conduct man-in-the-middle attacks by spoofing a proxy server or ISATAP route, by registering one of these names in the WINS database, aka "WPAD WINS Server Registration Vulnerability," a related issue to CVE-2007-1692.
Per: http://www.microsoft.com/technet/security/Bulletin/MS09-008.mspx
Mitigating Factors for WPAD WINS Server Registration Vulnerability - CVE-2009-0094
Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation.
If WINS server already has WPAD and ISATAP registered than an attacker will not be able to register these as well.
[http://blogs.technet.com/srd/archive/2009/03/13/ms09-008-dns-and-wins-server-security-update-in-more-detail.aspx]
[http://support.avaya.com/elmodocs2/security/ASA-2009-083.htm]
[34013]
[1021829]
[TA09-069A]
[ADV-2009-0661]
[MS09-008]
[oval:org.mitre.oval:def:6117]
Microsoft Office Visio 2002 SP2, 2003 SP3, and 2007 SP1 does not properly validate object data in Visio files, which allows remote attackers to execute arbitrary code via a crafted file, aka "Memory Validation Vulnerability."
[TA09-041A]
[ADV-2009-0391]
[MS09-005]
[oval:org.mitre.oval:def:6179]
Microsoft Office Visio 2002 SP2, 2003 SP3, and 2007 SP1 does not properly perform memory copy operations for object data, which allows remote attackers to execute arbitrary code via a crafted Visio document, aka "Memory Corruption Vulnerability."
[TA09-041A]
[ADV-2009-0391]
[MS09-005]
[oval:org.mitre.oval:def:6172]
Microsoft Office Visio 2002 SP2 and 2003 SP3 does not properly validate memory allocation for Visio files, which allows remote attackers to execute arbitrary code via a crafted file, aka "Memory Corruption Vulnerability."
[TA09-041A]
[ADV-2009-0391]
[MS09-005]
[oval:org.mitre.oval:def:6188]
Microsoft Exchange 2000 Server SP3, Exchange Server 2003 SP2, and Exchange Server 2007 SP1 do not properly interpret Transport Neutral Encapsulation (TNEF) properties, which allows remote attackers to execute arbitrary code via a crafted TNEF message, aka "Memory Corruption Vulnerability."
[TA09-041A]
[MS09-003]
[oval:org.mitre.oval:def:6114]
The Electronic Messaging System Microsoft Data Base (EMSMDB32) provider in Microsoft Exchange 2000 Server SP3 and Exchange Server 2003 SP2, as used in Exchange System Attendant, allows remote attackers to cause a denial of service (application outage) via a malformed MAPI command, aka "Literal Processing Vulnerability."
[TA09-041A]
[MS09-003]
[oval:org.mitre.oval:def:6159]
Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel in Microsoft Office 2004 and 2008 for Mac; Microsoft Office Excel Viewer and Excel Viewer 2003 SP3; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 do not properly parse the Excel spreadsheet file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet that contains a malformed object with "an offset and a two-byte value" that trigger a memory calculation error, aka "Memory Corruption Vulnerability."
[http://www.fortiguardcenter.com/advisory/FGA-2009-16.html]
[20090415 Microsoft Office Excel Remote Memory Corruption Vulnerability]
[1022039]
[TA09-104A]
[ADV-2009-1023]
[MS09-009]
[oval:org.mitre.oval:def:6043]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2009. Notes: none.
Microsoft Project 2000 SR1 and 2002 SP1, and Office Project 2003 SP3, does not properly handle memory allocation for Project files, which allows remote attackers to execute arbitrary code via a malformed file, aka "Project Memory Validation Vulnerability."
[TA09-342A]
[MS09-074]
[oval:org.mitre.oval:def:6298]
Multiple PHP remote file inclusion vulnerabilities in playSMS 0.9.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) apps_path[plug] parameter to plugin/gateway/gnokii/init.php, the (2) apps_path[themes] parameter to plugin/themes/default/init.php, and the (3) apps_path[libs] parameter to lib/function.php.
[4888]
[33138]
[7687]
SQL injection vulnerability in index.php in EZpack 4.2b2 allows remote attackers to execute arbitrary SQL commands via the qType parameter in a webboard prog action.
[4890]
[33131]
[7680]
Cross-site scripting (XSS) vulnerability in index.php in EZpack 4.2b2 allows remote attackers to inject arbitrary web script or HTML via the mdfd parameter in a prog action.
[4890]
[33131]
[7680]
SQL injection vulnerability in profile.php in PHPAuctions (aka PHPAuctionSystem) allows remote attackers to execute arbitrary SQL commands via the user_id parameter.
[33115]
[phpauctions-profile-sql-injection(43264)]
[7672]
Cross-site scripting (XSS) vulnerability in profile.php in PHPAuctions (aka PHPAuctionSystem) allows remote attackers to inject arbitrary web script or HTML via the user_id parameter.
[33115]
[7672]
PHPAuctions (aka PHPAuctionSystem) allows remote attackers to bypass authentication and gain administrative access via modified (1) PHPAUCTION_RM_ID, (2) PHPAUCTION_RM_NAME, (3) PHPAUCTION_RM_USERNAME, and (4) PHPAUCTION_RM_EMAIL cookies.
[4891]
[33120]
[7674]
SQL injection vulnerability in index.php in RiotPix 0.61 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information.
[4892]
[33132]
[7682]
SQL injection vulnerability in read.php in RiotPix 0.61 and earlier allows remote attackers to execute arbitrary SQL commands via the forumid parameter.
[4893]
[33129]
[7679]
SQL injection vulnerability in frontpage.php in Goople CMS 1.8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.
[4894]
[33135]
[7683]
Cross-site request forgery (CSRF) vulnerability in admin/agent_edit.asp in PollPro 3.0 allows remote attackers to create or modify accounts as administrators via the username, password, and name parameters.
[20090103 PollPro 3.0 XSRF VuLn]
[4895]
[pollpro-unspecified-csrf(47754)]
Directory traversal vulnerability in attachmentlibrary.php in the XStandard component for Joomla! 1.5.8 and earlier allows remote attackers to list arbitrary directories via a .. (dot dot) in the X_CMS_LIBRARY_PATH HTTP header.
[4896]
[33143]
[7691]
Unspecified vulnerability in the Settings Manager in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87, and possibly other versions, allows remote attackers to trick a user into visiting an arbitrary URL via unknown vectors, related to "a potential Clickjacking issue variant."
[http://isc.sans.org/diary.html?storyid=5929]
[APPLE-SA-2009-05-12]
[GLSA-200903-23]
[1021751]
[254909]
[http://support.apple.com/kb/HT3549]
[http://www.adobe.com/support/security/bulletins/apsb09-01.html]
[TA09-133A]
[ADV-2009-0513]
[ADV-2009-0743]
[ADV-2009-1297]
[flash-settings-manager-click-hijacking(48902)]
[oval:org.mitre.oval:def:16419]
[oval:org.mitre.oval:def:6662]
The Device Mapper multipathing driver (aka multipath-tools or device-mapper-multipath) 0.4.8, as used in SUSE openSUSE, SUSE Linux Enterprise Server (SLES), Fedora, and possibly other operating systems, uses world-writable permissions for the socket file (aka /var/run/multipathd.sock), which allows local users to send arbitrary commands to the multipath daemon.
[http://download.opensuse.org/update/10.3-test/repodata/patch-kpartx-6082.xml]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10691]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705]
[http://launchpad.net/bugs/cve/2009-0115]
[SUSE-SR:2009:007]
[SUSE-SR:2009:008]
[[security-announce] 20100303 VMSA-2010-0004 ESX Service Console and vMA third party updates]
[http://support.avaya.com/elmodocs2/security/ASA-2009-128.htm]
[DSA-1767]
[ADV-2010-0528]
[oval:org.mitre.oval:def:9214]
[FEDORA-2009-3449]
[FEDORA-2009-3453]
Buffer overflow in Microsoft Windows XP SP3 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted .chm file.
[4912]
[33204]
[7720]
The IBM WebSphere DataPower XML Security Gateway XS40 with firmware 3.6.1.5 allows remote attackers to cause a denial of service (device reboot) by sending data over an established SSL connection, as demonstrated by the abc\r\n\r\n string data.
[4911]
[20090108 [IBM Datapower XS40] Denial of Service]
[33169]
[1021547]
[ADV-2009-0111]
SQL injection vulnerability in frontpage.php in Goople CMS 1.8.2 allows remote attackers to execute arbitrary SQL commands via the password parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
hplip.postinst in HP Linux Imaging and Printing (HPLIP) 2.7.7 and 2.8.2 on Ubuntu allows local users to change the ownership of arbitrary files via unspecified manipulations in advance of an HPLIP installation or upgrade by an administrator, related to the product's attempt to correct the ownership of its configuration files within home directories.
[33249]
[USN-708-1]
[https://launchpad.net/bugs/191299]
Unspecified vulnerability in Apple Safari on Mac OS X 10.5 and Windows allows remote attackers to read arbitrary files on a client machine via vectors related to the association of Safari with the (1) feed, (2) feeds, and (3) feedsearch URL types for RSS feeds. NOTE: as of 20090114, the only disclosure is a vague pre-advisory. However, because it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
[http://brian.mastenbrook.net/display/27]
[http://isc.sans.org/diary.html?storyid=5689]
[33234]
[1021581]
[safari-rss-feed-info-disclosure(47917)]
The tqsl_verifyDataBlock function in openssl_cert.cpp in American Radio Relay League (ARRL) tqsllib 2.0 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511509]
[[oss-security] 20090112 CVE Request -- tsqllib, slurm-llnl, libnasl, libcrypt-openssl-dsa-perl, erlang, boinc-client, m2crypto]
[https://bugzilla.redhat.com/show_bug.cgi?id=479650]
[FEDORA-2009-0543]
** DISPUTED ** NOTE: this issue has been disputed by the upstream vendor. nasl/nasl_crypto2.c in the Nessus Attack Scripting Language library (aka libnasl) 2.2.11 does not properly check the return value from the OpenSSL DSA_do_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: the upstream vendor has disputed this issue, stating "while we do misuse this function (this is a bug), it has absolutely no security ramification."
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511517]
[http://cvs.fedoraproject.org/viewvc/rpms/libnasl/F-10/libnasl.spec?r1=1.16&r2=1.17]
[SUSE-SR:2009:003]
[[oss-security] 20090112 CVE Request -- tsqllib, slurm-llnl, libnasl, libcrypt-openssl-dsa-perl, erlang, boinc-client, m2crypto]
[20090120 CVE-2009-0125 (fwd)]
[https://bugzilla.redhat.com/show_bug.cgi?id=479655]
The decrypt_public function in lib/crypt.cpp in the client in Berkeley Open Infrastructure for Network Computing (BOINC) 6.2.14 and 6.4.5 does not check the return value from the OpenSSL RSA_public_decrypt function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.
[http://boinc.berkeley.edu/trac/changeset/16883]
[http://boinc.berkeley.edu/trac/ticket/823]
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511521]
[SUSE-SR:2009:003]
[[oss-security] 20090112 CVE Request -- tsqllib, slurm-llnl, libnasl, libcrypt-openssl-dsa-perl, erlang, boinc-client, m2crypto]
[https://bugzilla.redhat.com/show_bug.cgi?id=479664]
[FEDORA-2009-0578]
** DISPUTED ** M2Crypto does not properly check the return value from the OpenSSL EVP_VerifyFinal, DSA_verify, ECDSA_verify, DSA_do_verify, and ECDSA_do_verify functions, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a Linux vendor disputes the relevance of this report to the M2Crypto product because "these functions are not used anywhere in m2crypto."
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511515]
[[oss-security] 20090112 CVE Request -- tsqllib, slurm-llnl, libnasl, libcrypt-openssl-dsa-perl, erlang, boinc-client, m2crypto]
[https://bugzilla.redhat.com/show_bug.cgi?id=479676]
plugins/crypto/openssl/crypto_openssl.c in Simple Linux Utility for Resource Management (aka SLURM or slurm-llnl) does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511511]
[[oss-security] 20090112 CVE Request -- tsqllib, slurm-llnl, libnasl, libcrypt-openssl-dsa-perl, erlang, boinc-client, m2crypto]
libcrypt-openssl-dsa-perl does not properly check the return value from the OpenSSL DSA_verify and DSA_do_verify functions, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511519]
[[oss-security] 20090112 CVE Request -- tsqllib, slurm-llnl, libnasl, libcrypt-openssl-dsa-perl, erlang, boinc-client, m2crypto]
** DISPUTED ** lib/crypto/c_src/crypto_drv.c in erlang does not properly check the return value from the OpenSSL DSA_do_verify function, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a package maintainer disputes this issue, reporting that there is a proper check within the only code that uses the applicable part of crypto_drv.c, and thus "this report is invalid."
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511520]
[[oss-security] 20090112 CVE Request -- tsqllib, slurm-llnl, libnasl, libcrypt-openssl-dsa-perl, erlang, boinc-client, m2crypto]
The UFS implementation in the kernel in Sun OpenSolaris snv_29 through snv_90 allows local users to cause a denial of service (panic) via the single posix_fallocate test in the SUSv3 POSIX test suite, related to an F_ALLOCSP fcntl call.
[http://bugs.opensolaris.org/view_bug.do?bug_id=6711995]
[239188]
[33267]
[1021600]
Integer overflow in the aio_suspend function in Sun Solaris 8 through 10 and OpenSolaris, when 32-bit mode is enabled, allows local users to cause a denial of service (panic) via a large integer value in the second argument (aka nent argument).
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-117350-59-1]
[247986]
[33188]
[1021553]
[http://www.trapkit.de/advisories/TKADV2009-001.txt]
[ADV-2009-0099]
Buffer overflow in Microsoft HTML Help Workshop 4.74 and earlier allows context-dependent attackers to execute arbitrary code via a .hhp file with a long "Index file" field, possibly a related issue to CVE-2006-0564.
[4914]
[7727]
Insecure method vulnerability in the EasyGrid.SGCtrl.32 ActiveX control in EasyGrid.ocx 1.0.0.1 in AAA EasyGrid ActiveX 3.51 allows remote attackers to create and overwrite arbitrary files via the (1) DoSaveFile or (2) DoSaveHtmlFile method. NOTE: vector 1 could be leveraged for code execution by creating executable files in Startup folders or by accessing files using hcp:// URLs. NOTE: some of these details are obtained from third party information.
[4913]
[33272]
[easygrid-activex-dosavefile-file-overwrite(47946)]
[7779]
Multiple integer overflows in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to execute arbitrary code via an Audible Audio (.aa) file with a large (1) nlen or (2) vlen Tag value, each of which triggers a heap-based buffer overflow.
[http://amarok.kde.org/en/releases/2.0.1.1]
[http://bugs.gentoo.org/show_bug.cgi?id=254896]
[SUSE-SR:2009:003]
[[oss-security] 20090114 CVE Request -- amarok]
[GLSA-200903-34]
[4915]
[http://trapkit.de/advisories/TKADV2009-002.txt]
[http://websvn.kde.org/?view=rev&revision=908391]
[http://websvn.kde.org/?view=rev&revision=908401]
[http://websvn.kde.org/?view=rev&revision=908415]
[DSA-1706]
[MDVSA-2009:030]
[20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities]
[33210]
[1021558]
[USN-739-1]
[ADV-2009-0100]
[https://bugzilla.redhat.com/show_bug.cgi?id=479560]
[https://bugzilla.redhat.com/show_bug.cgi?id=479946]
[FEDORA-2009-0715]
Multiple array index errors in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via an Audible Audio (.aa) file with a crafted (1) nlen or (2) vlen Tag value, each of which can lead to an invalid pointer dereference, or the writing of a 0x00 byte to an arbitrary memory location, after an allocation failure.
[http://amarok.kde.org/en/releases/2.0.1.1]
[http://bugs.gentoo.org/show_bug.cgi?id=254896]
[SUSE-SR:2009:003]
[[oss-security] 20090114 CVE Request -- amarok]
[GLSA-200903-34]
[4915]
[http://trapkit.de/advisories/TKADV2009-002.txt]
[http://websvn.kde.org/?view=rev&revision=908391]
[http://websvn.kde.org/?view=rev&revision=908401]
[http://websvn.kde.org/?view=rev&revision=908415]
[DSA-1706]
[MDVSA-2009:030]
[20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities]
[33210]
[1021558]
[USN-739-1]
[ADV-2009-0100]
[https://bugzilla.redhat.com/show_bug.cgi?id=479560]
[https://bugzilla.redhat.com/show_bug.cgi?id=479946]
[FEDORA-2009-0715]
Multiple unspecified vulnerabilities in Safari RSS in Apple Mac OS X 10.4.11 and 10.5.6, and Windows XP and Vista, allow remote attackers to execute arbitrary JavaScript in the local security zone via a crafted feed: URL, related to "input validation issues."
[APPLE-SA-2009-02-12]
[APPLE-SA-2009-02-12]
[http://support.apple.com/kb/HT3438]
servermgrd (Server Manager) in Apple Mac OS X 10.5.6 does not properly validate authentication credentials, which allows remote attackers to modify the system configuration.
[APPLE-SA-2009-02-12]
[http://support.apple.com/kb/HT3438]
[33759]
[33813]
[ADV-2009-0422]
Integer overflow in the SMB component in Apple Mac OS X 10.5.6 allows remote SMB servers to cause a denial of service (system shutdown) or execute arbitrary code via a crafted SMB file system that triggers a heap-based buffer overflow.
[APPLE-SA-2009-02-12]
[http://support.apple.com/kb/HT3438]
[ADV-2009-0422]
Unspecified vulnerability in the SMB component in Apple Mac OS X 10.4.11 and 10.5.6 allows remote SMB servers to cause a denial of service (memory exhaustion and system shutdown) via a crafted file system name.
[APPLE-SA-2009-02-12]
[http://support.apple.com/kb/HT3438]
[ADV-2009-0422]
XTerm in Apple Mac OS X 10.4.11 and 10.5.6, when used with luit, creates tty devices with insecure world-writable permissions, which allows local users to write to the Xterm of another user.
[APPLE-SA-2009-02-12]
[1021729]
[http://support.apple.com/kb/HT3438]
[33798]
[ADV-2009-0422]
[macosx-xterm-information-disclosure(48727)]
Race condition in AFP Server in Apple Mac OS X 10.5.6 allows local users to cause a denial of service (infinite loop) via unspecified vectors related to "file enumeration logic."
[APPLE-SA-2009-02-12]
[http://support.apple.com/kb/HT3438]
[33759]
[33812]
[ADV-2009-0422]
Apple iTunes before 8.1 does not properly inform the user about the origin of an authentication request, which makes it easier for remote podcast servers to trick a user into providing a username and password when subscribing to a crafted podcast.
[APPLE-SA-2009-03-11]
[1021843]
[http://support.apple.com/kb/HT3487]
[34094]
[ADV-2009-0702]
[itunes-podcast-information-disclosure(49201)]
[oval:org.mitre.oval:def:5336]
CFNetwork in Apple Mac OS X 10.5 before 10.5.7 does not properly parse noncompliant Set-Cookie headers, which allows remote attackers to obtain sensitive information by sniffing the network for "secure cookies" that are sent over unencrypted HTTP connections.
[APPLE-SA-2009-05-12]
[http://support.apple.com/kb/HT3549]
[34926]
[1022214]
[TA09-133A]
[ADV-2009-1297]
[macos-cfnetwork-info-disclosure(50479)]
CoreGraphics in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF file that triggers memory corruption.
[APPLE-SA-2009-06-08-1]
[APPLE-SA-2009-06-17-1]
[APPLE-SA-2009-05-12]
[http://support.apple.com/kb/HT3549]
[http://support.apple.com/kb/HT3613]
[http://support.apple.com/kb/HT3639]
[34926]
[1022209]
[TA09-133A]
[ADV-2009-1297]
[ADV-2009-1522]
[ADV-2009-1621]
[macos-coregraphics-pdf-code-execution(50481)]
Multiple buffer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related to (1) JBIG2SymbolDict::setBitmap and (2) JBIG2Stream::readSymbolDictSeg.
[http://bugs.gentoo.org/show_bug.cgi?id=263028]
[APPLE-SA-2009-06-17-1]
[APPLE-SA-2009-05-12]
[SUSE-SA:2009:024]
[SUSE-SR:2009:010]
[SUSE-SR:2009:012]
[RHSA-2009:0458]
[GLSA-200904-20]
[SSA:2009-129-01]
[http://support.apple.com/kb/HT3549]
[http://support.apple.com/kb/HT3639]
[http://wiki.rpath.com/Advisories:rPSA-2009-0059]
[http://wiki.rpath.com/Advisories:rPSA-2009-0061]
[DSA-1790]
[DSA-1793]
[MDVSA-2009:101]
[MDVSA-2010:087]
[RHSA-2009:0429]
[RHSA-2009:0430]
[RHSA-2009:0431]
[RHSA-2009:0480]
[20090417 rPSA-2009-0061-1 cups]
[20090417 rPSA-2009-0059-1 poppler]
[34568]
[1022073]
[TA09-133A]
[ADV-2009-1065]
[ADV-2009-1066]
[ADV-2009-1077]
[ADV-2009-1297]
[ADV-2009-1621]
[ADV-2010-1040]
[https://bugzilla.redhat.com/show_bug.cgi?id=490612]
[oval:org.mitre.oval:def:9632]
[FEDORA-2009-6972]
[FEDORA-2009-6973]
[FEDORA-2009-6982]
Multiple integer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related to (1) JBIG2Stream::readSymbolDictSeg, (2) JBIG2Stream::readSymbolDictSeg, and (3) JBIG2Stream::readGenericBitmap.
[http://bugs.gentoo.org/show_bug.cgi?id=263028]
[APPLE-SA-2009-06-17-1]
[APPLE-SA-2009-05-12]
[SUSE-SA:2009:024]
[SUSE-SR:2009:010]
[SUSE-SR:2009:012]
[RHSA-2009:0458]
[GLSA-200904-20]
[SSA:2009-129-01]
[http://support.apple.com/kb/HT3549]
[http://support.apple.com/kb/HT3639]
[http://wiki.rpath.com/Advisories:rPSA-2009-0059]
[http://wiki.rpath.com/Advisories:rPSA-2009-0061]
[DSA-1790]
[DSA-1793]
[MDVSA-2009:101]
[MDVSA-2010:087]
[RHSA-2009:0429]
[RHSA-2009:0430]
[RHSA-2009:0431]
[RHSA-2009:0480]
[20090417 rPSA-2009-0061-1 cups]
[20090417 rPSA-2009-0059-1 poppler]
[34568]
[1022073]
[TA09-133A]
[ADV-2009-1065]
[ADV-2009-1066]
[ADV-2009-1077]
[ADV-2009-1297]
[ADV-2009-1621]
[ADV-2010-1040]
[https://bugzilla.redhat.com/show_bug.cgi?id=490614]
[oval:org.mitre.oval:def:9941]
[FEDORA-2009-6972]
[FEDORA-2009-6973]
[FEDORA-2009-6982]
Multiple buffer overflows in Cscope before 15.7a allow remote attackers to execute arbitrary code via long strings in input such as (1) source-code tokens and (2) pathnames, related to integer overflows in some cases. NOTE: this issue exists because of an incomplete fix for CVE-2004-2541.
[APPLE-SA-2009-05-12]
[GLSA-200905-02]
[http://sourceforge.net/forum/forum.php?forum_id=947983]
[[cscope-cvs] 20090410 CVS: cscope/src snprintf.c, NONE, 1.1 build.c, 1.14, 1.15 command.c, 1.32, 1.33 dir.c, 1.30, 1.31 display.c, 1.29, 1.30 edit.c, 1.6, 1.7 exec.c, 1.11, 1.12 find.c, 1.20, 1.21 global.h, 1.36, 1.37 main.c, 1.45, 1.46 Makefile.am, 1.12, 1.13 Makefile.in, 1.15, 1.16 vpaccess.c, 1.2, 1.3 vpfopen.c, 1.3, 1.4 vpopen.c, 1.4, 1.5]
[http://sourceforge.net/project/shownotes.php?group_id=4664&release_id=679527]
[http://support.apple.com/kb/HT3549]
[DSA-1806]
[[oss-security] 20090506 Re: Old cscope buffer overflow]
[RHSA-2009:1101]
[RHSA-2009:1102]
[34805]
[1022218]
[TA09-133A]
[ADV-2009-1238]
[ADV-2009-1297]
[https://bugzilla.redhat.com/show_bug.cgi?id=490667]
[oval:org.mitre.oval:def:9633]
Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 allows local users to gain privileges or cause a denial of service (application crash) by attempting to mount a crafted sparse disk image that triggers memory corruption.
[APPLE-SA-2009-05-12]
[http://support.apple.com/kb/HT3549]
[34926]
[34942]
[1022217]
[TA09-133A]
[ADV-2009-1297]
[macos-diskimages-code-execution-var1(50484)]
Stack-based buffer overflow in Apple Mac OS X 10.5 before 10.5.7 allows local users to gain privileges or cause a denial of service (application crash) by attempting to mount a crafted sparse disk image.
[APPLE-SA-2009-05-12]
[http://support.apple.com/kb/HT3549]
[34926]
[1022217]
[TA09-133A]
[ADV-2009-1297]
[macos-diskimages-bo(50483)]
The screen saver in Dock in Apple Mac OS X 10.5 before 10.5.8 does not prevent four-finger Multi-Touch gestures, which allows physically proximate attackers to bypass locking and "manage applications or use Expose" via unspecified vectors.
[APPLE-SA-2009-08-05-1]
[http://support.apple.com/kb/HT3757]
[35954]
[TA09-218A]
[ADV-2009-2172]
[macosx-dock-security-bypass(52421)]
iChat in Apple Mac OS X 10.5 before 10.5.7 disables SSL for AOL Instant Messenger (AIM) communication in certain circumstances that are inconsistent with the Require SSL setting, which allows remote attackers to obtain sensitive information by sniffing the network.
[APPLE-SA-2009-05-12]
[http://support.apple.com/kb/HT3549]
[34926]
[1022212]
[TA09-133A]
[ADV-2009-1297]
[macos-ichat-ssl-weak-security(50487)]
International Components for Unicode (ICU) 4.0, 3.6, and other 3.x versions, as used in Apple Mac OS X 10.5 before 10.5.7, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Fedora 9 and 10, and possibly other operating systems, does not properly handle invalid byte sequences during Unicode conversion, which might allow remote attackers to conduct cross-site scripting (XSS) attacks.
[http://bugs.icu-project.org/trac/ticket/5691]
[APPLE-SA-2009-06-08-1]
[APPLE-SA-2009-06-17-1]
[APPLE-SA-2009-05-12]
[http://support.apple.com/kb/HT3549]
[http://support.apple.com/kb/HT3613]
[http://support.apple.com/kb/HT3639]
[RHSA-2009:1122]
[34926]
[34974]
[TA09-133A]
[ADV-2009-1297]
[ADV-2009-1522]
[ADV-2009-1621]
[https://bugzilla.redhat.com/show_bug.cgi?id=503071]
[macos-icu-security-bypass(50488)]
[oval:org.mitre.oval:def:11366]
[FEDORA-2009-6121]
[FEDORA-2009-6273]
Heap-based buffer overflow in Apple Type Services (ATS) in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 allows remote attackers to execute arbitrary code via a crafted Compact Font Format (CFF) font.
[APPLE-SA-2009-05-12]
[http://support.apple.com/kb/HT3549]
[20090519 ZDI-09-023: Apple OS X ATSServer Compact Font Format Parsing Memory Corruption Vulnerability]
[34926]
[1022218]
[TA09-133A]
[ADV-2009-1297]
[http://www.zerodayinitiative.com/advisories/ZDI-09-023]
[macos-ats-cff-bo(50478)]
Integer underflow in CoreGraphics in Apple Mac OS X 10.5 before 10.5.7, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF file that triggers a heap-based buffer overflow.
[APPLE-SA-2009-06-17-1]
[APPLE-SA-2009-05-12]
[http://support.apple.com/kb/HT3549]
[http://support.apple.com/kb/HT3639]
[34926]
[1022209]
[TA09-133A]
[ADV-2009-1297]
[ADV-2009-1621]
[macos-coregraphics-pdf-bo(50482)]
Launch Services in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 allows remote attackers to cause a denial of service (persistent Finder crash) via a crafted Mach-O executable that triggers an out-of-bounds memory read.
[APPLE-SA-2009-05-12]
[http://support.apple.com/kb/HT3549]
[34926]
[34932]
[1022215]
[TA09-133A]
[ADV-2009-1297]
[macos-launchservices-dos(50490)]
Heap-based buffer overflow in CFNetwork in Apple Mac OS X 10.5 before 10.5.7 allows remote web servers to execute arbitrary code or cause a denial of service (application crash) via long HTTP headers.
[APPLE-SA-2009-05-12]
[http://support.apple.com/kb/HT3549]
[34926]
[1022211]
[TA09-133A]
[ADV-2009-1297]
[macos-cfnetwork-bo(50480)]
Stack-based buffer overflow in telnet in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a long hostname for a telnet server.
[APPLE-SA-2009-05-12]
[SSRT101144]
[http://support.apple.com/kb/HT3549]
[34926]
[TA09-133A]
[ADV-2009-1297]
Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.
[NetBSD-SA2009-006]
[http://bugs.pardus.org.tr/show_bug.cgi?id=9532]
[APPLE-SA-2009-05-12]
[SUSE-SR:2009:011]
[SSRT101144]
[http://ntp.bkbits.net:8080/ntp-stable/?PAGE=gnupatch&REV=1.1565]
[RHSA-2009:1039]
[RHSA-2009:1040]
[SSA:2009-154-01]
[http://support.apple.com/kb/HT3549]
[DSA-1801]
[GLSA-200905-08]
[MDVSA-2009:092]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[34481]
[1022033]
[TA09-133A]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-0999]
[ADV-2009-1297]
[ADV-2009-3316]
[https://bugzilla.redhat.com/show_bug.cgi?id=490617]
[ntp-cookedprint-bo(49838)]
[oval:org.mitre.oval:def:19392]
[oval:org.mitre.oval:def:5411]
[oval:org.mitre.oval:def:8386]
[oval:org.mitre.oval:def:8665]
[oval:org.mitre.oval:def:9634]
[RHSA-2009:1651]
[https://support.ntp.org/bugs/show_bug.cgi?id=1144]
[USN-777-1]
[FEDORA-2009-5273]
[FEDORA-2009-5275]
QuickDraw Manager in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PICT image that triggers memory corruption.
[APPLE-SA-2009-05-12]
[http://support.apple.com/kb/HT3549]
[34926]
[34937]
[1022209]
[TA09-133A]
[ADV-2009-1297]
The OpenSSL::OCSP module for Ruby in Apple Mac OS X 10.5 before 10.5.7 misinterprets an unspecified invalid response as a successful OCSP certificate validation, which might allow remote attackers to spoof certificate authentication via a revoked certificate.
[APPLE-SA-2009-05-12]
[http://support.apple.com/kb/HT3549]
[34926]
[TA09-133A]
[ADV-2009-1297]
[macos-opensslocsp-weak-security(50592)]
Cross-site scripting (XSS) vulnerability in Safari before 3.2.3, and 4 Public Beta, on Apple Mac OS X 10.5 before 10.5.7 and Windows allows remote attackers to inject arbitrary web script or HTML via a crafted feed: URL.
[APPLE-SA-2009-05-12]
[APPLE-SA-2009-05-12]
[APPLE-SA-2009-05-12]
[http://support.apple.com/kb/HT3549]
[http://support.apple.com/kb/HT3550]
[34925]
[1022206]
[TA09-133A]
[ADV-2009-1297]
[ADV-2009-1298]
[safari-feedurl-code-execution(50476)]
Integer overflow in the TIFF image decoding routines in CUPS 1.3.9 and earlier allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a crafted TIFF image, which is not properly handled by the (1) _cupsImageReadTIFF function in the imagetops filter and (2) imagetoraster filter, leading to a heap-based buffer overflow.
[SUSE-SA:2009:024]
[GLSA-200904-20]
[http://wiki.rpath.com/Advisories:rPSA-2009-0061]
[http://www.cups.org/articles.php?L582]
[http://www.cups.org/str.php?L3031]
[DSA-1773]
[RHSA-2009:0428]
[RHSA-2009:0429]
[20090417 rPSA-2009-0061-1 cups]
[34571]
[1022070]
[USN-760-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=490596]
[oval:org.mitre.oval:def:11546]
The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which makes it easier for remote attackers to conduct DNS rebinding attacks.
[http://bugs.gentoo.org/show_bug.cgi?id=263070]
[APPLE-SA-2009-05-12]
[GLSA-200904-20]
[http://support.apple.com/kb/HT3549]
[http://wiki.rpath.com/Advisories:rPSA-2009-0061]
[http://www.cups.org/articles.php?L582]
[http://www.cups.org/str.php?L3118]
[20090417 rPSA-2009-0061-1 cups]
[34665]
[TA09-133A]
[ADV-2009-1297]
[https://bugzilla.redhat.com/show_bug.cgi?id=490597]
Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, as used in Poppler and other products, when running on Mac OS X, has unspecified impact, related to "g*allocn."
[http://bugs.gentoo.org/show_bug.cgi?id=263028]
[APPLE-SA-2009-06-17-1]
[APPLE-SA-2009-05-12]
[SUSE-SA:2009:024]
[SUSE-SR:2009:010]
[SUSE-SR:2009:012]
[SSA:2009-129-01]
[http://support.apple.com/kb/HT3549]
[http://support.apple.com/kb/HT3639]
[DSA-1790]
[DSA-1793]
[MDVSA-2009:101]
[34568]
[TA09-133A]
[ADV-2009-1297]
[ADV-2009-1621]
[multiple-jbig2-unspecified(50377)]
The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers a free of uninitialized memory.
[SUSE-SA:2009:024]
[SUSE-SR:2009:010]
[SUSE-SR:2009:012]
[RHSA-2009:0458]
[GLSA-200904-20]
[SSA:2009-129-01]
[http://wiki.rpath.com/Advisories:rPSA-2009-0061]
[DSA-1790]
[DSA-1793]
[MDVSA-2009:101]
[MDVSA-2010:087]
[RHSA-2009:0429]
[RHSA-2009:0430]
[RHSA-2009:0431]
[RHSA-2009:0480]
[20090417 rPSA-2009-0061-1 cups]
[34568]
[1022073]
[ADV-2009-1065]
[ADV-2009-1066]
[ADV-2009-1077]
[ADV-2010-1040]
[https://bugzilla.redhat.com/show_bug.cgi?id=490625]
[oval:org.mitre.oval:def:9778]
[FEDORA-2009-6972]
[FEDORA-2009-6973]
[FEDORA-2009-6982]
Unspecified vulnerability in lpadmin in Sun Solaris 10 and OpenSolaris snv_61 through snv_106 allows local users to cause a denial of service via unspecified vectors, related to enumeration of "wrong printers," aka a "Temporary file vulnerability."
[http://opensolaris.org/os/bug_reports/request_sponsor/]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-139390-01-1]
[249306]
[http://support.avaya.com/elmodocs2/security/ASA-2009-026.htm]
[33269]
[1021601]
[ADV-2009-0155]
[oval:org.mitre.oval:def:6175]
Unspecified vulnerability in ppdmgr in Sun Solaris 10 and OpenSolaris snv_61 through snv_106 allows local users to cause a denial of service via unspecified vectors, related to a failure to "include all cache files," and improper handling of temporary files.
[http://opensolaris.org/os/bug_reports/request_sponsor/]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-139390-01-1]
[249306]
[http://support.avaya.com/elmodocs2/security/ASA-2009-026.htm]
[33269]
[1021601]
[ADV-2009-0155]
[solaris-ppdmgr-dos(48143)]
[oval:org.mitre.oval:def:5503]
Sun Java System Access Manager 7.1 allows remote authenticated sub-realm administrators to gain privileges, as demonstrated by creating the amadmin account in the sub-realm, and then logging in as amadmin in the root realm.
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-126356-02-1]
[249106]
[33266]
[1021604]
[ADV-2009-0157]
[sun-jsam-subrealm-privilege-escalation(47944)]
Sun Java System Access Manager 6.3 2005Q1, 7 2005Q4, and 7.1 allows remote authenticated users with console privileges to discover passwords, and obtain unspecified other "access to resources," by visiting the Configuration Items component in the console.
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-126356-02-1]
[242166]
[33265]
[1021605]
[ADV-2009-0156]
[sun-jsam-password-info-disclosure(47942)]
The Sun SPARC Enterprise M4000 and M5000 Server, within a certain range of serial numbers, allows remote attackers to use the manufacturing root password, perform a root login to the eXtended System Control Facility Unit (aka XSCFU or Service Processor), and have unspecified other impact.
[249126]
[33280]
[1021602]
[ADV-2009-0207]
Unspecified vulnerability in IBM DB2 8 before FP17a, 9.1 before FP6a, and 9.5 before FP3a allows remote attackers to cause a denial of service (infinite loop) via a crafted CONNECT data stream.
[ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT]
[ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v91/APARLIST.TXT]
[ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT]
[1021591]
[33258]
[ADV-2009-0137]
[IZ37696]
[http://www-01.ibm.com/support/docview.wss?uid=swg21363936]
[ibm-db2-connect-stream-dos(47931)]
Unspecified vulnerability in the server in IBM DB2 8 before FP17a, 9.1 before FP6a, and 9.5 before FP3a allows remote authenticated users to cause a denial of service (trap) via a crafted data stream.
[ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT]
[ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v91/APARLIST.TXT]
[ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT]
[1021591]
[33258]
[ADV-2009-0137]
[IZ39652]
[http://www-01.ibm.com/support/docview.wss?uid=swg21363936]
[ibm-db2-datastream-dos(47934)]
Stack-based buffer overflow in VUPlayer 2.49 allows remote attackers to execute arbitrary code via a long .asf URI in the HREF attribute of a REF element in a .asx file.
[4918]
[33185]
[vuplayer-asx-bo(47851)]
[7709]
[7713]
[7714]
[7715]
Heap-based buffer overflow in Heathco Software MP3 TrackMaker 1.5 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long string in an invalid .mp3 file.
[4920]
[33183]
[mp3trackmaker-mp3-bo(47852)]
[7708]
Multiple heap-based buffer overflows in the PDF distiller in the Attachment Service in Research in Motion (RIM) BlackBerry Enterprise Server (BES) 4.1.3 through 4.1.6, BlackBerry Professional Software 4.1.4, and BlackBerry Unite! before 1.0.3 bundle 28 allow user-assisted remote attackers to execute arbitrary code via (1) a crafted stream in a .pdf file, related to "symWidths"; or (2) a crafted data stream in a .pdf file, related to "bitmaps."
[20090113 RIM BlackBerry Enterprise Server Attachment Service PDF Distiller 'symWidths' Heap Overflow Vulnerability]
[20090113 RIM BlackBerry Enterprise Server Attachment Service PDF Distiller 'bitmaps' Heap Overflow Vulnerability]
[http://www.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB17118]
[http://www.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB17119]
[33224]
vmwarebase.dll, as used in the vmware-authd service (aka vmware-authd.exe), in VMware Workstation 6.5.1 build 126130, 6.5.1 and earlier; VMware Player 2.5.1 build 126130, 2.5.1 and earlier; VMware ACE 2.5.1 and earlier; VMware Server 2.0.x before 2.0.1 build 156745; and VMware Fusion before 2.0.2 build 147997 allows remote attackers to cause a denial of service (daemon crash) via a long (1) USER or (2) PASS command.
[[security-announce] 20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues]
[20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues]
[34373]
[1021512]
[http://www.vmware.com/security/advisories/VMSA-2009-0005.html]
[ADV-2009-0024]
[ADV-2009-0944]
[oval:org.mitre.oval:def:6433]
[7647]
Unspecified vulnerability in IBM Hardware Management Console (HMC) 7 release 3.2.0 SP1 has unknown impact and attack vectors.
[33293]
[ADV-2009-0158]
[http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=4521]
[ibm-hmc-unspecified(48010)]
libmikmod 3.1.11 through 3.2.0, as used by MikMod and possibly other products, allows user-assisted attackers to cause a denial of service (application crash) by loading an XM file.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=476339]
[SUSE-SR:2009:006]
[[oss-security] 20090113 CVE Request -- libmikmod]
[33240]
[https://bugzilla.redhat.com/show_bug.cgi?id=479833]
[FEDORA-2009-9095]
[FEDORA-2009-9112]
Certain Fedora build scripts for nfs-utils before 1.1.2-9.fc9 on Fedora 9, and before 1.1.4-6.fc10 on Fedora 10, omit TCP Wrapper support, which might allow remote attackers to bypass intended access restrictions, possibly a related issue to CVE-2008-1376.
[33294]
[https://bugzilla.redhat.com/show_bug.cgi?id=477864]
[nfsutils-tcpwrapper-security-bypass(48058)]
[FEDORA-2009-0266]
[FEDORA-2009-0297]
Buffer overflow in VUPlayer allows user-assisted attackers to have an unknown impact via a long file, as demonstrated by a file composed entirely of 'A' characters.
[4921]
[20090106 VUPLAYER BufferOver flow POC]
[vuplayer-file-bo(48169)]
Buffer overflow in VUPlayer 2.49 and earlier allows user-assisted attackers to execute arbitrary code via a long URL in a File line in a .pls file, as demonstrated by an http URL on a File1 line.
[4923]
[vuplayer-fileline-bo(48170)]
[7695]
Stack-based buffer overflow in Remote Control Server in Free Download Manager (FDM) 2.5 Build 758 and 3.0 Build 844 allows remote attackers to execute arbitrary code via a long Authorization header in an HTTP request.
[20090202 Secunia Research: Free Download Manager Remote Control Server Buffer Overflow]
[33554]
[ADV-2009-0302]
[7986]
Multiple buffer overflows in the torrent parsing implementation in Free Download Manager (FDM) 2.5 Build 758 and 3.0 Build 844 allow remote attackers to execute arbitrary code via (1) a long file name within a torrent file, (2) a long tracker URL in a torrent file, or (3) a long comment in a torrent file.
[20090202 Secunia Research: Free Download Manager Torrent Parsing Buffer Overflows]
[33555]
[ADV-2009-0302]
Heap-based buffer overflow in Apple QuickTime before 7.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted MS ADPCM encoded audio data in an AVI movie file.
[APPLE-SA-2009-06-01-1]
[http://support.apple.com/kb/HT3591]
[20090602 Secunia Research: Apple QuickTime MS ADPCM Encoding Buffer Overflow]
[35163]
[1022314]
[ADV-2009-1469]
[quicktime-msadpcm-bo(50894)]
[oval:org.mitre.oval:def:15727]
Integer overflow in libsndfile 1.0.18, as used in Winamp and other products, allows context-dependent attackers to execute arbitrary code via crafted description chunks in a CAF audio file, leading to a heap-based buffer overflow.
[SUSE-SR:2009:008]
[GLSA-200904-16]
[DSA-1742]
[http://www.mega-nerd.com/libsndfile/NEWS]
[20090303 Secunia Research: Winamp CAF Processing Integer Overflow Vulnerability]
[20090303 Secunia Research: libsndfile CAF Processing Integer Overflow Vulnerability]
[33963]
[1021784]
[USN-749-1]
[ADV-2009-0584]
[ADV-2009-0585]
[libsndfile-caf-bo(49038)]
Stack-based buffer overflow in Orbit Downloader 2.8.2 and 2.8.3, and possibly other versions before 2.8.5, allows remote attackers to execute arbitrary code via a crafted HTTP URL with a long host name, which is not properly handled when constructing a "Connecting" log message.
[20090225 Secunia Research: Orbit Downloader Long URL Parsing Buffer Overflow]
[33894]
[ADV-2009-0521]
[orbitdownloader-connecting-bo(48932)]
Apple QuickTime before 7.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie composed of a Sorenson 3 video file.
[APPLE-SA-2009-06-01-1]
[http://support.apple.com/kb/HT3591]
[20090602 Secunia Research: QuickTime Sorenson Video 3 Content Parsing Vulnerability]
[35159]
[1022314]
[ADV-2009-1469]
[quicktime-sorensonvideo-code-execution(50886)]
[oval:org.mitre.oval:def:16085]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2009-1012. Reason: This candidate is a reservation duplicate of CVE-2009-1012. Notes: All CVE users should reference CVE-2009-1012 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2009-1016. Reason: This candidate is a reservation duplicate of CVE-2009-1016. Notes: All CVE users should reference CVE-2009-1016 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Foxit Reader 2.3 before Build 3902 and 3.0 before Build 1506, including 3.0.2009.1301, does not properly handle a JBIG2 symbol dictionary segment with zero new symbols, which allows remote attackers to execute arbitrary code via a crafted PDF file that triggers a dereference of an uninitialized memory location.
[http://www.foxitsoftware.com/pdf/reader/security.htm#Processing]
[20090309 Secunia Research: Foxit Reader JBIG2 Symbol Dictionary Processing Vulnerability]
[34035]
[1021822]
[ADV-2009-0634]
[foxitreader-jbig2-code-execution(49135)]
Off-by-one error in the iMonitor component in Novell eDirectory 8.8 SP3, 8.8 SP3 FTF3, and possibly other versions allows remote attackers to execute arbitrary code via an HTTP request with a crafted Accept-Language header, which triggers a stack-based buffer overflow.
[http://www.novell.com/support/viewContent.do?externalId=3426981]
[20090714 Secunia Research: Novell eDirectory iMonitor "Accept-Language" Buffer Overflow]
[35666]
[ADV-2009-1883]
[edirectory-imonitor-acceptlanguage-bo(51703)]
Heap-based buffer overflow in Adobe Acrobat Reader 9 before 9.1, 8 before 8.1.4, and 7 before 7.1.1 allows remote attackers to execute arbitrary code via a PDF file with a malformed JBIG2 symbol dictionary segment, a different vulnerability than CVE-2009-1061 and CVE-2009-1062.
[SUSE-SA:2009:014]
[SUSE-SR:2009:009]
[GLSA-200904-17]
[256788]
[http://www.adobe.com/support/security/bulletins/apsb09-04.html]
[RHSA-2009:0376]
[20090325 Secunia Research: Adobe Reader JBIG2 Symbol Dictionary Buffer Overflow]
[34229]
[1021892]
[ADV-2009-1019]
The domain-locking implementation in the GARMINAXCONTROL.GarminAxControl_t.1 ActiveX control in npGarmin.dll in the Garmin Communicator Plug-In 2.6.4.0 does not properly enforce the restrictions that (1) download and (2) upload requests come from a web site specified by the user, which allows remote attackers to obtain sensitive information or reconfigure Garmin GPS devices via unspecified vectors related to a "synchronisation error."
[1022173]
[20090507 Secunia Research: Garmin Communicator Plug-In Domain Locking Security Bypass]
[34858]
[communicator-domain-security-bypass(50360)]
Heap-based buffer overflow in Xpdf 3.02pl2 and earlier, CUPS 1.3.9, and probably other products, allows remote attackers to execute arbitrary code via a PDF file with crafted JBIG2 symbol dictionary segments.
[RHSA-2009:0458]
[MDVSA-2010:087]
[RHSA-2009:0480]
[20090417 Secunia Research: CUPS pdftops JBIG2 Symbol Dictionary Buffer Overflow]
[20090417 Secunia Research: Xpdf JBIG2 Symbol Dictionary Buffer Overflow Vulnerability]
[34791]
[ADV-2010-1040]
[oval:org.mitre.oval:def:10076]
Heap-based buffer overflow in the big2_decode_symbol_dict function (jbig2_symbol_dict.c) in the JBIG2 decoding library (jbig2dec) in Ghostscript 8.64, and probably earlier versions, allows remote attackers to execute arbitrary code via a PDF file with a JBIG2 symbol dictionary segment with a large run length value.
[SUSE-SR:2009:009]
[SUSE-SR:2009:011]
[GLSA-201412-17]
[262288]
[http://wiki.rpath.com/Advisories:rPSA-2009-0060]
[MDVSA-2009:095]
[RHSA-2009:0421]
[20090409 Secunia Research: Ghostscript jbig2dec JBIG2 Processing Buffer Overflow]
[20090417 rPSA-2009-0060-1 ghostscript]
[34445]
[1022029]
[ADV-2009-0983]
[ADV-2009-1708]
[https://bugzilla.redhat.com/attachment.cgi?id=337747]
[oval:org.mitre.oval:def:10533]
[USN-757-1]
[FEDORA-2009-3709]
[FEDORA-2009-3710]
Integer overflow in the FORMATS Plugin before 4.23 for IrfanView allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a large XPM file that triggers a heap-based buffer overflow.
[http://www.irfanview.com/plugins.htm]
[20090407 Secunia Research: IrfanView Formats Plug-in XPM Parsing Integer Overflow]
[34402]
[ADV-2009-0953]
[irfanview-formatsplugin-xpm-bo(49717)]
Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PDF file that contains JBIG2 text region segments with Huffman encoding.
[SUSE-SA:2009:035]
[SUSE-SR:2009:012]
[GLSA-200907-06]
[1022361]
[http://www.adobe.com/support/security/bulletins/apsb09-07.html]
[RHSA-2009:1109]
[20090610 Secunia Research: Adobe Reader JBIG2 Text Region Segment Buffer Overflow]
[35274]
[35302]
[TA09-161A]
[ADV-2009-1547]
[reader-acrobat-jbig2-code-exec(51015)]
Heap-based buffer overflow in the VMnc media codec in vmnc.dll in VMware Movie Decoder before 6.5.3 build 185404, VMware Workstation 6.5.x before 6.5.3 build 185404, VMware Player 2.5.x before 2.5.3 build 185404, and VMware ACE 2.5.x before 2.5.3 build 185404 on Windows might allow remote attackers to execute arbitrary code via a video file with crafted dimensions (aka framebuffer parameters).
[[security-announce] 20090904 VMSA-2009-0012 VMware Movie Decoder, VMware Workstation, VMware Player, and VMware ACE resolve security issues.]
[20090905 VMSA-2009-0012 VMware Movie Decoder, VMware Workstation, VMware Player, and VMware ACE resolve security issues.]
[36290]
[http://www.vmware.com/security/advisories/VMSA-2009-0012.html]
[ADV-2009-2553]
Integer underflow in OpenOffice.org (OOo) before 3.1.1 and StarOffice/StarSuite 7, 8, and 9 might allow remote attackers to execute arbitrary code via crafted records in the document table of a Word document, leading to a heap-based buffer overflow.
[http://development.openoffice.org/releases/3.1.1.html]
[SUSE-SR:2009:015]
[263508]
[1020715]
[DSA-1880]
[GLSA-201408-19]
[MDVSA-2010:035]
[MDVSA-2010:091]
[MDVSA-2010:105]
[http://www.openoffice.org/security/cves/CVE-2009-0200-0201.html]
[20090901 Secunia Research: OpenOffice.org Word Document Table Parsing Integer Underflow]
[36200]
[ADV-2009-2490]
[oval:org.mitre.oval:def:10881]
Heap-based buffer overflow in OpenOffice.org (OOo) before 3.1.1 and StarOffice/StarSuite 7, 8, and 9 might allow remote attackers to execute arbitrary code via unspecified records in a crafted Word document, related to "table parsing."
[http://development.openoffice.org/releases/3.1.1.html]
[SUSE-SR:2009:015]
[263508]
[1020715]
[DSA-1880]
[GLSA-201408-19]
[MDVSA-2010:035]
[MDVSA-2010:091]
[MDVSA-2010:105]
[http://www.openoffice.org/security/cves/CVE-2009-0200-0201.html]
[20090901 Secunia Research: OpenOffice.org Word Document Table Parsing Buffer Overflow]
[36200]
[1022798]
[ADV-2009-2490]
[oval:org.mitre.oval:def:10726]
Array index error in FL21WIN.DLL in the PowerPoint Freelance Windows 2.1 Translator in Microsoft PowerPoint 2000 and 2002 allows remote attackers to execute arbitrary code via a Freelance file with unspecified "layout information" that triggers a heap-based buffer overflow.
[1022369]
[20090610 Secunia Research: Microsoft PowerPoint Freelance Layout Parsing Vulnerability]
[35275]
[ms-powerpoint-freelance-bo(51034)]
Cross-site scripting (XSS) vulnerability in HP Select Access 6.1 and 6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[SSRT090007]
[1021641]
[33505]
[ADV-2009-0296]
[selectaccess-unspecified-xss(48334)]
Unspecified vulnerability in NFS in HP ONCplus B.11.31.05 and earlier for HP-UX B.11.31 allows local users to cause a denial of service via unknown vectors.
[33653]
[ADV-2009-0350]
[hpux-nfs-dos(48556)]
Unspecified vulnerability in HP-UX B.11.11 running VERITAS Oracle Disk Manager (VRTSodm) 3.5, B.11.23 running VRTSodm 4.1 or VERITAS File System (VRTSvxfs) 4.1, B.11.23 running VRTSodm 5.0 or VRTSvxfs 5.0, and B.11.31 running VRTSodm 5.0 allows local users to gain root privileges via unknown vectors.
[HPSBUX02409]
[34226]
[1021891]
[ADV-2009-0823]
[hpux-veritas-unspecified-priv-escalation(49403)]
[oval:org.mitre.oval:def:6352]
Unspecified vulnerability in HP Virtual Rooms Client before 7.0.1, when running on Windows, allows remote attackers to execute arbitrary code via unknown vectors.
[SSRT080135]
PI Server in OSIsoft PI System before 3.4.380.x does not properly use encryption in the default authentication process, which allows remote attackers to read or modify information in databases via unspecified vectors.
[20090930 C4 SCADA Security Advisory - OSISoft PI Server Authentication Weakness]
Buffer overflow in the MLF application in AREVA e-terrahabitat 5.7 and earlier allows remote attackers to execute arbitrary commands or cause a denial of service (system crash) via unspecified vectors, aka PD28578.
Per http://www.kb.cert.org/vuls/id/337569
"III. Solution
Apply Patch Users of e-terrahabitat version 5.5, 5.6, and 5.7 should apply the e-terrahabitat_560_P20081030_SEC patch immediately."
[VU#337569]
[http://www.scada-security.com/vulnerabilities/areva1.html]
[20090205 C4 SCADA Security Advisory - AREVA e-terrahabitat / e-terraplatform Multiple Vulnerabilities]
[33637]
Unspecified vulnerability in the WebFGServer application in AREVA e-terrahabitat 5.7 and earlier allows remote attackers to cause a denial of service (system crash) via unknown vectors, aka PD32018.
[VU#337569]
[http://www.scada-security.com/vulnerabilities/areva1.html]
[20090205 C4 SCADA Security Advisory - AREVA e-terrahabitat / e-terraplatform Multiple Vulnerabilities]
[33637]
Unspecified vulnerability in the WebFGServer application in AREVA e-terrahabitat 5.7 and earlier allows remote attackers to cause a denial of service (system crash) via unknown vectors, aka PD32020.
Per http://www.kb.cert.org/vuls/id/337569
"III. Solution
Apply Patch Users of e-terrahabitat version 5.5, 5.6, and 5.7 should apply the e-terrahabitat_560_P20081030_SEC patch immediately."
[VU#337569]
[http://www.scada-security.com/vulnerabilities/areva1.html]
[20090205 C4 SCADA Security Advisory - AREVA e-terrahabitat / e-terraplatform Multiple Vulnerabilities]
[33637]
Unspecified vulnerability in the NETIO application in AREVA e-terrahabitat 5.7 and earlier allows remote attackers to cause a denial of service (system crash) via unknown vectors, aka PD32021.
Per http://www.kb.cert.org/vuls/id/337569
"III. Solution
Apply Patch
Users of e-terrahabitat version 5.5, 5.6, and 5.7 should apply the e-terrahabitat_560_P20081030_SEC patch immediately."
[VU#337569]
[http://www.scada-security.com/vulnerabilities/areva1.html]
[20090205 C4 SCADA Security Advisory - AREVA e-terrahabitat / e-terraplatform Multiple Vulnerabilities]
[33637]
Unspecified vulnerability in the WebFGServer application in AREVA e-terrahabitat 5.7 and earlier allows remote authenticated users to gain privileges via unknown vectors, aka PD32022.
Per http://www.kb.cert.org/vuls/id/337569
"III. Solution
Apply Patch Users of e-terrahabitat version 5.5, 5.6, and 5.7 should apply the e-terrahabitat_560_P20081030_SEC patch immediately."
[VU#337569]
[http://www.scada-security.com/vulnerabilities/areva1.html]
[20090205 C4 SCADA Security Advisory - AREVA e-terrahabitat / e-terraplatform Multiple Vulnerabilities]
[33637]
Stack-based buffer overflow in the GetXMLValue method in the IBM Access Support ActiveX control in IbmEgath.dll, as distributed on IBM and Lenovo computers, allows remote attackers to execute arbitrary code via unspecified vectors.
[VU#340420]
[34228]
[ADV-2009-0824]
[ibm-access-activex-bo(49409)]
GE Fanuc iFIX 5.0 and earlier relies on client-side authentication involving a weakly encrypted local password file, which allows remote attackers to bypass intended access restrictions and start privileged server login sessions by recovering a password or by using a modified program module.
[http://support.gefanuc.com/support/index?page=kbchannel&id=S:KB13253&actp=search]
[VU#310355]
[http://www.mcgrewsecurity.com/2009/02/10/ge-fanuc-releases-info-on-ifix-vulnerabilities-vu-310355/]
[33739]
[gefanucifix-multiple-unauth-access(48691)]
The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.
[http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161]
[http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7]
[http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7]
[APPLE-SA-2009-09-03-1]
[SUSE-SA:2009:053]
[SUSE-SA:2010:017]
[HPSBUX02476]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1]
[263429]
[269208]
[1020710]
[http://svn.apache.org/viewvc?revision=794013&view=revision]
[http://www.aleksey.com/xmlsec/]
[DSA-1995]
[GLSA-201408-19]
[VU#466161]
[http://www.kb.cert.org/vuls/id/MAPG-7TSKXQ]
[http://www.kb.cert.org/vuls/id/WDON-7TY529]
[MDVSA-2009:209]
[http://www.mono-project.com/Vulnerabilities]
[http://www.openoffice.org/security/cves/CVE-2009-0217.html]
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html]
[http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html]
[RHSA-2009:1694]
[35671]
[1022561]
[1022567]
[1022661]
[USN-903-1]
[TA09-294A]
[TA10-159B]
[ADV-2009-1900]
[ADV-2009-1908]
[ADV-2009-1909]
[ADV-2009-1911]
[ADV-2009-2543]
[ADV-2009-3122]
[ADV-2010-0366]
[ADV-2010-0635]
[http://www.w3.org/2008/06/xmldsigcore-errata.html#e03]
[http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html]
[PK80596]
[PK80627]
[http://www-01.ibm.com/support/docview.wss?rs=180&uid=swg21384925]
[https://bugzilla.redhat.com/show_bug.cgi?id=511915]
[MS10-041]
[https://issues.apache.org/bugzilla/show_bug.cgi?id=47526]
[https://issues.apache.org/bugzilla/show_bug.cgi?id=47527]
[oval:org.mitre.oval:def:10186]
[oval:org.mitre.oval:def:7158]
[oval:org.mitre.oval:def:8717]
[RHSA-2009:1200]
[RHSA-2009:1201]
[RHSA-2009:1428]
[RHSA-2009:1636]
[RHSA-2009:1637]
[RHSA-2009:1649]
[RHSA-2009:1650]
[USN-826-1]
[FEDORA-2009-8329]
[FEDORA-2009-8337]
[FEDORA-2009-8456]
[FEDORA-2009-8473]
Insecure method vulnerability in Particle Software IntraLaunch Application Launcher ActiveX control in IntraLaunch.ocx, as used in LDRA TBbrowse and possibly other products, allows remote attackers to execute arbitrary code via unknown vectors.
[VU#908801]
[http://www.kb.cert.org/vuls/id/MAPG-7PYRP4]
[http://www.kb.cert.org/vuls/id/WDON-7Q4RZN]
[34395]
[intralaunch-activex-code-execution(49684)]
The PDF distiller in the Attachment Service in Research in Motion (RIM) BlackBerry Enterprise Server (BES) 4.1.3 through 4.1.6, BlackBerry Professional Software 4.1.4, and BlackBerry Unite! before 1.0.3 bundle 28 performs delete operations on uninitialized pointers, which allows user-assisted remote attackers to execute arbitrary code via a crafted data stream in a .pdf file.
[20090113 RIM BlackBerry Enterprise Server Attachment Service PDF Distiller Uninitialized Memory Vulnerability]
[http://www.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB17118]
[http://www.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB17119]
[33250]
[1021559]
Multiple stack-based buffer overflows in the PowerPoint 4.0 importer (PP4X32.DLL) in Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allow remote attackers to execute arbitrary code via crafted formatting data for paragraphs in a file that uses a PowerPoint 4.0 native file format, related to (1) an incorrect calculation from a record header, or (2) an interget that is used to specify the number of bytes to copy, aka "Legacy File Format Vulnerability."
[20090512 Microsoft PowerPoint PPT 4.0 Importer Multiple Stack Buffer Overflow Vulnerabilities]
[34833]
[1022205]
[TA09-132A]
[ADV-2009-1290]
[MS09-017]
[oval:org.mitre.oval:def:5610]
Integer overflow in Microsoft Office PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a PowerPoint file containing a crafted record type for "collaboration information for different slides" that contains a field that specifies a large number of records, which triggers an under-allocated buffer and a heap-based buffer overflow, aka "Integer Overflow Vulnerability."
[20090512 Microsoft PowerPoint Integer Overflow Vulnerability]
[34835]
[1022205]
[TA09-132A]
[ADV-2009-1290]
[MS09-017]
[oval:org.mitre.oval:def:6127]
Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allows remote attackers to execute arbitrary code via crafted sound data in a file that uses a PowerPoint 4.0 native file format, leading to a "pointer overwrite" and memory corruption, aka "Legacy File Format Vulnerability," a different vulnerability than CVE-2009-0223, CVE-2009-0226, CVE-2009-0227, and CVE-2009-1137.
[34831]
[1022205]
[TA09-132A]
[ADV-2009-1290]
[http://www.vupen.com/exploits/Microsoft_PowerPoint_Memory_Corruption_Code_Execution_Exploit_MS09_017_1290124.php]
[http://www.vupen.com/exploits/Microsoft_PowerPoint_Pointer_Overwrite_Code_Execution_Exploit_MS09_017_1290123.php]
[MS09-017]
[oval:org.mitre.oval:def:6143]
Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allows remote attackers to execute arbitrary code via crafted sound data in a file that uses a PowerPoint 4.0 native file format, leading to memory corruption, aka "Legacy File Format Vulnerability," a different vulnerability than CVE-2009-0222, CVE-2009-0226, CVE-2009-0227, and CVE-2009-1137.
[34834]
[1022205]
[TA09-132A]
[ADV-2009-1290]
[MS09-017]
[oval:org.mitre.oval:def:6269]
Microsoft Office PowerPoint 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; PowerPoint Viewer 2003 and 2007 SP1 and SP2; PowerPoint in Microsoft Office 2004 for Mac and 2008 for Mac; Open XML File Format Converter for Mac; Microsoft Works 8.5 and 9.0; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 do not properly validate PowerPoint files, which allows remote attackers to execute arbitrary code via multiple crafted BuildList records that include ChartBuild containers, which triggers memory corruption, aka "Memory Corruption Vulnerability."
[20090512 Microsoft PowerPoint Build List Memory Corruption Vulnerability]
[34879]
[1022205]
[TA09-132A]
[ADV-2009-1290]
[MS09-017]
[oval:org.mitre.oval:def:6023]
Microsoft Office PowerPoint 2002 SP3 allows remote attackers to execute arbitrary code via crafted sound data in a file that uses a PowerPoint 95 native file format, leading to improper "array indexing" and memory corruption, aka "PP7 Memory Corruption Vulnerability."
[34880]
[1022205]
[TA09-132A]
[ADV-2009-1290]
[http://www.vupen.com/exploits/Microsoft_PowerPoint_Array_Indexing_Code_Execution_Exploit_MS09_017_1290125.php]
[MS09-017]
[oval:org.mitre.oval:def:5526]
Stack-based buffer overflow in the PowerPoint 4.2 conversion filter in Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allows remote attackers to execute arbitrary code via a long string in sound data in a file that uses a PowerPoint 4.0 native file format, leading to memory corruption, aka "Legacy File Format Vulnerability," a different vulnerability than CVE-2009-0222, CVE-2009-0223, CVE-2009-0227, and CVE-2009-1137.
[20090512 Microsoft PowerPoint 4.2 Conversion Filter Stack Overflow]
[34881]
[1022205]
[TA09-132A]
[ADV-2009-1290]
[MS09-017]
[oval:org.mitre.oval:def:6106]
Stack-based buffer overflow in the PowerPoint 4.2 conversion filter (PP4X32.DLL) in Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allows remote attackers to execute arbitrary code via a large number of structures in sound data in a file that uses a PowerPoint 4.0 native file format, leading to memory corruption, aka "Legacy File Format Vulnerability," a different vulnerability than CVE-2009-0222, CVE-2009-0223, CVE-2009-0226, and CVE-2009-1137.
[20090512 Microsoft PowerPoint 4.2 Conversion Filter Stack Buffer Overflow Vulnerability]
[34882]
[1022205]
[TA09-132A]
[ADV-2009-1290]
[MS09-017]
[oval:org.mitre.oval:def:6239]
Stack-based buffer overflow in the EnumeratePrintShares function in Windows Print Spooler Service (win32spl.dll) in Microsoft Windows 2000 SP4 allows remote printer servers to execute arbitrary code via a crafted ShareName in a response to an RPC request, related to "printing data structures," aka "Buffer Overflow in Print Spooler Vulnerability."
[20090609 Microsoft Windows 2000 Print Spooler Remote Stack Buffer Overflow Vulnerability]
[http://support.avaya.com/elmodocs2/security/ASA-2009-217.htm]
[35206]
[1022352]
[TA09-160A]
[ADV-2009-1541]
[MS09-022]
[oval:org.mitre.oval:def:6317]
The Windows Printing Service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 allows local users to read arbitrary files via a crafted separator page, aka "Print Spooler Read File Vulnerability."
[http://support.avaya.com/elmodocs2/security/ASA-2009-217.htm]
[35208]
[1022352]
[TA09-160A]
[ADV-2009-1541]
[MS09-022]
[oval:org.mitre.oval:def:5815]
The Windows Print Spooler in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 allows remote authenticated users to gain privileges via a crafted RPC message that triggers loading of a DLL file from an arbitrary directory, aka "Print Spooler Load Library Vulnerability."
[http://support.avaya.com/elmodocs2/security/ASA-2009-217.htm]
[35209]
[1022352]
[TA09-160A]
[ADV-2009-1541]
[MS09-022]
[oval:org.mitre.oval:def:6287]
The Embedded OpenType (EOT) Font Engine (T2EMBED.DLL) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted name table in a data record that triggers an integer truncation and a heap-based buffer overflow, aka "Embedded OpenType Font Heap Overflow Vulnerability."
[20090714 Microsoft Embedded OpenType Font Engine (T2EMBED.DLL) Heap Buffer Overflow Vulnerability]
[1022543]
[TA09-195A]
[ADV-2009-1887]
[MS09-029]
[oval:org.mitre.oval:def:5457]
Integer overflow in the Embedded OpenType (EOT) Font Engine in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted name table, aka "Embedded OpenType Font Integer Overflow Vulnerability."
[1022543]
[TA09-195A]
[ADV-2009-1887]
[MS09-029]
[oval:org.mitre.oval:def:5678]
The DNS Resolver Cache Service (aka DNSCache) in Windows DNS Server in Microsoft Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008, when dynamic updates are enabled, does not reuse cached DNS responses in all applicable situations, which makes it easier for remote attackers to predict transaction IDs and poison caches by simultaneously sending crafted DNS queries and responses, aka "DNS Server Query Validation Vulnerability."
[http://blogs.technet.com/srd/archive/2009/03/13/ms09-008-dns-and-wins-server-security-update-in-more-detail.aspx]
[http://support.avaya.com/elmodocs2/security/ASA-2009-083.htm]
[33982]
[1021831]
[TA09-069A]
[ADV-2009-0661]
[MS09-008]
[oval:org.mitre.oval:def:6228]
The DNS Resolver Cache Service (aka DNSCache) in Windows DNS Server in Microsoft Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008 does not properly cache crafted DNS responses, which makes it easier for remote attackers to predict transaction IDs and poison caches by sending many crafted DNS queries that trigger "unnecessary lookups," aka "DNS Server Response Validation Vulnerability."
[http://blogs.technet.com/srd/archive/2009/03/13/ms09-008-dns-and-wins-server-security-update-in-more-detail.aspx]
[http://support.avaya.com/elmodocs2/security/ASA-2009-083.htm]
[VU#319331]
[33988]
[1021831]
[TA09-069A]
[ADV-2009-0661]
[MS09-008]
[oval:org.mitre.oval:def:5715]
Stack-based buffer overflow in the Word 97 text converter in WordPad in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted Word 97 file that triggers memory corruption, related to use of inconsistent integer data sizes for an unspecified length field, aka "WordPad Word 97 Text Converter Stack Overflow Vulnerability."
[20090414 Microsoft WordPad Word97 Converter Stack Buffer Overflow Vulnerability]
[34470]
[1022043]
[TA09-104A]
[ADV-2009-1024]
[MS09-010]
[oval:org.mitre.oval:def:5893]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2009. Notes: none.
Cross-site scripting (XSS) vulnerability in cookieauth.dll in the HTML forms authentication component in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2006, 2006 Supportability Update, and 2006 SP1; allows remote attackers to inject arbitrary web script or HTML via "authentication input" to this component, aka "Cross-Site Scripting Vulnerability."
[1022046]
[TA09-104A]
[ADV-2009-1030]
[MS09-016]
[oval:org.mitre.oval:def:5771]
Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute arbitrary code via a crafted Excel document that triggers an access attempt on an invalid object, as exploited in the wild in February 2009 by Trojan.Mdropper.AC.
[http://blogs.zdnet.com/security/?p=2658]
[http://isc.sans.org/diary.html?storyid=5923]
[1021744]
[http://www.microsoft.com/technet/security/advisory/968272.mspx]
[33870]
[http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-022310-4202-99]
[TA09-104A]
[ADV-2009-1023]
[MS09-009]
[ms-excel-unspecified-code-execution(48875)]
[oval:org.mitre.oval:def:5968]
Cross-site scripting (XSS) vulnerability in Windows Search 4.0 for Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted file that appears in a preview in a search result, aka "Script Execution in Windows Search Vulnerability."
[1022353]
[TA09-160A]
[ADV-2009-1542]
[MS09-023]
[oval:org.mitre.oval:def:5428]
listing.php in WebSVN 2.0 and possibly 1.7 beta, when using an SVN authz file, allows remote authenticated users to read changelogs or diffs for restricted projects via a modified repname parameter.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512191]
[DSA-1725]
[GLSA-200903-20]
[[oss-security] 20090118 CVE request: WebSVN]
[websvn-listing-information-disclosure(48171)]
Stack-based buffer overflow in the process_path function in gmetad/server.c in Ganglia 3.1.1 allows remote attackers to cause a denial of service (crash) via a request to the gmetad service with a long pathname.
[http://bugzilla.ganglia.info/cgi-bin/bugzilla/show_bug.cgi?id=223]
[SUSE-SR:2009:011]
[GLSA-200903-22]
[[Ganglia-developers] 20090113 patches for: [Sec] Gmetad server BoF and network overload + [Feature] multiple requests per conn on interactive port]
[33299]
** REJECT ** gmetad in Ganglia 3.1.1, when supporting multiple requests per connection on an interactive port, allows remote attackers to cause a denial of service via a request to the gmetad service with a path that does not exist, which causes Ganglia to (1) perform excessive CPU computation and (2) send the entire tree, which consumes network bandwidth. NOTE: the vendor and original researcher have disputed this issue, since legitimate requests can generate the same amount of resource consumption. CVE concurs with the dispute, so this identifier should not be used.
Microsoft Windows does not properly enforce the Autorun and NoDriveTypeAutoRun registry values, which allows physically proximate attackers to execute arbitrary code by (1) inserting CD-ROM media, (2) inserting DVD media, (3) connecting a USB device, and (4) connecting a Firewire device; (5) allows user-assisted remote attackers to execute arbitrary code by mapping a network drive; and allows user-assisted attackers to execute arbitrary code by clicking on (6) an icon under My Computer\Devices with Removable Storage and (7) an option in an AutoPlay dialog, related to the Autorun.inf file. NOTE: vectors 1 and 3 on Vista are already covered by CVE-2008-0951.
[http://isc.sans.org/diary.html?storyid=5695]
[1021629]
[TA09-020A]
Directory traversal vulnerability in the OBEX FTP Service in the Microsoft Bluetooth stack in Windows Mobile 6 Professional, and probably Windows Mobile 5.0 for Pocket PC and 5.0 for Pocket PC Phone Edition, allows remote authenticated users to list arbitrary directories, and create or read arbitrary files, via a .. (dot dot) in a pathname. NOTE: this can be leveraged for code execution by writing to a Startup folder.
per: http://www.seguridadmobile.com/windows-mobile/windows-mobile-security/Microsoft-Bluetooth-Stack-Directory-Traversal.html
"Non vulnerable products: Windows Mobile devices 5.0 and 6 not using Microsoft Bluetooth Stack (for example: ASUS P525, ASUS P535, ... using Widcomm/Broadcom Bluetooth Stack)"
[4938]
[20090119 Microsoft Bluetooth Stack OBEX Directory Traversal]
[33359]
[http://www.seguridadmobile.com/windows-mobile/windows-mobile-security/Microsoft-Bluetooth-Stack-Directory-Traversal.html]
[winmobile-obexftp-directory-traversal(48124)]
Cross-site scripting (XSS) vulnerability in Usagi Project MyNETS 1.2.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2008-4629.
[JVN#36802959]
[JVNDB-2009-000001]
[http://usagi-project.org/PRESS/archives/57]
[33145]
Stack-based buffer overflow in easyHDR PRO 1.60.2 allows user-assisted attackers to execute arbitrary code via an invalid Radiance RGBE (aka .hdr) file.
[http://easyhdr.com/version.php]
[4941]
[20090120 Secunia Research: EasyHDR Pro Radiance RGBE Buffer Overflow]
[33363]
[ADV-2009-0190]
[easyhdrpro-hdr-bo(48119)]
The server for 53KF Web IM 2009 Home, Professional, and Enterprise editions relies on client-side protection mechanisms against cross-site scripting (XSS), which allows remote attackers to conduct XSS attacks by using a modified client to send a crafted IM message, related to the msg variable.
[20090119 53KF Web IM 2009 Cross-Site Scripting Vulnerabilities]
[33341]
[53kfwebim-msg-xss(48096)]
Cross-site scripting (XSS) vulnerability in rankup.asp in Katy Whitton RankEm allows remote attackers to inject arbitrary web script or HTML via the siteID parameter.
[33324]
[rankem-rankup-xss(48071)]
[rankem-siteid-xss(48072)]
[7805]
Katy Whitton RankEm stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing credentials via a direct request for database/topsites.mdb.
[rankem-topsites-information-disclosure(48070)]
[7805]
Ryneezy phoSheezy 0.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the file containing the administrator's password hash via a direct request for config/password.
[4935]
[phosheezy-configpassword-info-disclosure(48056)]
[7780]
Static code injection vulnerability in admin.php in Ryneezy phoSheezy 0.2 allows remote authenticated administrators to inject arbitrary PHP code into config/footer via the footer parameter. NOTE: this can be exploited by unauthenticated attackers by leveraging CVE-2009-0250. NOTE: some of these details are obtained from third party information.
[4935]
[7780]
Multiple SQL injection vulnerabilities in default.asp in Enthrallweb eReservations allow remote attackers to execute arbitrary SQL commands via the (1) Login parameter (aka username field) or the (2) Password parameter (aka password field). NOTE: some of these details are obtained from third party information.
[33321]
[ereservations-login-sql-injection(48062)]
[7801]
Mozilla Firefox 3.0.5 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick action that moves a crafted element to the current mouse position, related to a "Status Bar Obfuscation" and "Clickjacking" attack.
[4936]
[firefox-onclickaction-click-hijacking(48212)]
[7842]
Stack-based buffer overflow in easyHDR PRO 1.60.2 allows user-assisted attackers to execute arbitrary code via an invalid Flexible Image Transport System (FITS) file. NOTE: some of these details are obtained from third party information.
[http://easyhdr.com/version.php]
[33363]
[ADV-2009-0190]
The System extension Install tool in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 creates the encryption key with an insufficiently random seed, which makes it easier for attackers to crack the key.
[http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001/]
[DSA-1711]
[33376]
[typo3-installtool-weak-security(48132)]
Session fixation vulnerability in the authentication library in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to hijack web sessions via unspecified vectors related to (1) frontend and (2) backend authentication.
[http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001/]
[DSA-1711]
[33376]
[typo3-library-session-hijacking(48133)]
Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) content of indexed files to the (a) Indexed Search Engine (indexed_search) system extension; (b) unspecified test scripts in the ADOdb system extension; and (c) unspecified vectors in the Workspace module.
[http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001/]
[DSA-1711]
[33376]
[typo3-library-session-hijacking(48133)]
[typo3-indexedsearchengine-xss(48135)]
[typo3-workspace-xss(48136)]
[typo3-adodb-xss(48137)]
The Indexed Search Engine (indexed_search) system extension in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to execute arbitrary commands via a crafted filename containing shell metacharacters, which is not properly handled by the command-line indexer.
[http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001/]
[DSA-1711]
[[oss-security] 20090123 Re: CVE id request: typo3 SA-2009-001]
[33376]
[typo3-indexedsearch-command-execution(48138)]
The Word processor in OpenOffice.org 1.1.2 through 1.1.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) .doc, (2) .wri, or (3) .rtf Word 97 file that triggers memory corruption, as exploited in the wild in December 2008, as demonstrated by 2008-crash.doc.rar, and a similar issue to CVE-2008-4841.
[http://milw0rm.com/sploits/2008-crash.doc.rar]
[[oss-security] 20090121 CVE Request -- openoffice.org (CVE-2008-4841)]
[33383]
[openoffice-wordprocessor-code-execution(48213)]
[6560]
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter (aka the basename variable).
[http://hg.moinmo.in/moin/1.8/rev/8cb4d34ccbc1]
[http://moinmo.in/SecurityFixes#moin1.8.1]
[20090120 MoinMoin Wiki Engine XSS Vulnerability]
[33365]
[ADV-2009-0195]
[moinmoin-attachfilepy-xss(48126)]
[USN-716-1]
[DSA-1715]
Stack-based buffer overflow in EffectMatrix Total Video Player 1.31 allows user-assisted attackers to execute arbitrary code via a Skins\DefaultSkin\DefaultSkin.ini file with a large ColumnHeaderSpan value.
[33373]
[totalvideoplayer-defaultskin-bo(48140)]
[7839]
Stack-based buffer overflow in Triologic Media Player 7 and 8.0.0.0 allows user-assisted remote attackers to execute arbitrary code via a long string in a .m3u playlist file. NOTE: some of these details are obtained from third party information.
[33221]
[ADV-2009-0097]
[7737]
Multiple buffer overflows in Winamp 5.541 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) a large Common Chunk (COMM) header value in an AIFF file and (2) a large invalid value in an MP3 file.
[33226]
[ADV-2009-0113]
[oval:org.mitre.oval:def:14756]
[7742]
Buffer overflow in the Registry Setting Tool in Fujitsu SystemcastWizard Lite 2.0A, 2.0, 1.9, and earlier has unknown impact and attack vectors.
[http://www.fujitsu.com/global/services/computing/server/primequest/products/os/windows-server-2008-2.html]
[33644]
[systemcast-registrytool-bo(48315)]
Internet Systems Consortium (ISC) BIND 9.6.0 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077 and CVE-2009-0025.
[http://groups.google.com/group/comp.protocols.dns.bind/browse_thread/thread/49ef622c8329fd33]
[SSA:2009-014-02]
[MDVSA-2009:037]
[ADV-2009-0043]
[https://www.isc.org/node/373]
Stack-based buffer overflow in Triologic Media Player 8.0.0.0 allows user-assisted remote attackers to execute arbitrary code via a long string in a .m3l playlist file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
libike in Sun Solaris 9 and 10, and OpenSolaris before snv_100, does not properly check packets, which allows remote attackers to cause a denial of service (in.iked daemon crash) via an unspecified IKE packet, a different vulnerability than CVE-2007-2989.
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-113451-15-1]
[247406]
[http://support.avaya.com/elmodocs2/security/ASA-2009-032.htm]
[33407]
[sun-solaris-libike-dos(48178)]
[oval:org.mitre.oval:def:6116]
Race condition in the pseudo-terminal (aka pty) driver module in Sun Solaris 8 through 10, and OpenSolaris before snv_103, allows local users to cause a denial of service (panic) via unspecified vectors related to lack of "properly sequenced code" in ptc and ptsl.
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-113685-07-1]
[249586]
[http://support.avaya.com/elmodocs2/security/ASA-2009-034.htm]
[33406]
[1021640]
[solaris-pseudo-terminal-dos(48179)]
[oval:org.mitre.oval:def:6061]
fs/ecryptfs/inode.c in the eCryptfs subsystem in the Linux kernel before 2.6.28.1 allows local users to cause a denial of service (fault or memory corruption), or possibly have unspecified other impact, via a readlink call that results in an error, leading to use of a -1 return value as an array index.
[http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.27.y.git;a=commit;h=a17d5232de7b53d34229de79ec22f4bb04adb7e4]
[SUSE-SA:2009:010]
[SUSE-SA:2009:030]
[SUSE-SA:2009:031]
[DSA-1749]
[DSA-1787]
[http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.1]
[MDVSA-2009:118]
[RHSA-2009:0326]
[RHSA-2009:0360]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[33412]
[USN-751-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-3316]
[linux-kernel-readlink-bo(48188)]
[[ecryptfs-devel] 20081222 Re: [PATCH, v5] eCryptfs: check readlink result was not an error before using it]
[[ecryptfs-devel] 20081222 Re: [PATCH, v5] eCryptfs: check readlink result was not an error before using it]
[oval:org.mitre.oval:def:8169]
[oval:org.mitre.oval:def:8944]
Stack-based buffer overflow in PXEService.exe in Fujitsu SystemcastWizard Lite 2.0A, 2.0, 1.9, and earlier allows remote attackers to execute arbitrary code via a large PXE protocol request in a UDP packet.
[http://www.fujitsu.com/global/services/computing/server/primequest/products/os/windows-server-2008-2.html]
[20090119 [Wintercore Research ] Fujitsu SystemcastWizard Lite PXEService Remote Buffer Overflow.]
[33342]
[ADV-2009-0176]
[http://www.wintercore.com/advisories/advisory_W010109.html]
Directory traversal vulnerability in the TFTP service in Fujitsu SystemcastWizard Lite 2.0A, 2.0, 1.9, and earlier allows remote attackers to read arbitrary files via directory traversal sequences in unspecified vectors.
[http://www.fujitsu.com/global/services/computing/server/primequest/products/os/windows-server-2008-2.html]
[33344]
[ADV-2009-0176]
Cross-site request forgery (CSRF) vulnerability in Novell GroupWise WebAccess 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 allows remote attackers to insert e-mail forwarding rules, and modify unspecified other configuration settings, as arbitrary users via unknown vectors.
[http://www.novell.com/support/search.do?usemicrosite=true&searchString=7002319]
[http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr08-21]
[20090130 PR08-21: Cross-site Request Forgery (CSRF) on Novell GroupWise WebAccess allows email theft and other attacks]
Multiple cross-site scripting (XSS) vulnerabilities in Novell GroupWise WebAccess 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 allow remote attackers to inject arbitrary web script or HTML via the (1) User.id and (2) Library.queryText parameters to gw/webacc, and other vectors involving (3) HTML e-mail and (4) HTML attachments.
[http://www.novell.com/support/search.do?usemicrosite=true&searchString=7002320]
[http://www.novell.com/support/search.do?usemicrosite=true&searchString=7002321]
[http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr08-22]
[http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr08-23]
[20090130 PR08-22: Persistent XSS on Novell GroupWise WebAccess]
[20090130 PR08-23: XSS on Novell GroupWise WebAccess]
[33537]
[33541]
Unspecified vulnerability in WebAccess in Novell GroupWise 6.5, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 might allow remote attackers to obtain sensitive information via a crafted URL, related to conversion of POST requests to GET requests.
[http://www.novell.com/support/viewContent.do?externalId=7002322]
[33559]
Static code injection vulnerability in admin.php in Ryneezy phoSheezy 0.2 allows remote authenticated administrators to inject arbitrary PHP code into config/header via the header parameter. NOTE: this can be exploited by unauthenticated attackers by leveraging CVE-2009-0250. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Cross-domain vulnerability in the V8 JavaScript engine in Google Chrome before 1.0.154.46 allows remote attackers to bypass the Same Origin Policy via a crafted script that accesses another frame and reads its full URL and possibly other sensitive information, or modifies the URL of this frame.
[http://codereview.chromium.org/18531]
[http://googlechromereleases.blogspot.com/2009/01/stable-beta-update-yahoo-mail-and.html]
[http://sites.google.com/a/chromium.org/dev/getting-involved/dev-channel/release-notes]
[http://src.chromium.org/viewvc/chrome?view=rev&revision=8524]
Unspecified vulnerability in the kernel in OpenSolaris snv_100 through snv_102 on the Sun UltraSPARC T2 and T2+ sun4v platforms allows local users to cause a denial of service (panic) via unknown vectors.
[250066]
[33398]
[ADV-2009-0209]
[solaris-ultrasparct2-dos(48164)]
Sun Java System Application Server (AS) 8.1 and 8.2 allows remote attackers to read the Web Application configuration files in the (1) WEB-INF or (2) META-INF directory via a malformed request.
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-119166-35-1]
[245446]
[33397]
[ADV-2009-0208]
[javasystem-webinf-metainf-info-disclosure(48161)]
SQL injection vulnerability in comentar.php in Pardal CMS 0.2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
[33404]
[pardalcms-comentar-sql-injection(48175)]
[7851]
Asp Project Management 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the crypt cookie to 1.
[20090122 Asp-project Cookie Handling]
[33401]
[aspproject-cookie-security-bypass(48172)]
[7850]
SQL injection vulnerability in login.aspx in WarHound Walking Club allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
[33317]
[walkingclub-login-sql-injection(48061)]
[7802]
Integer overflow in Ralink Technology USB wireless adapter (RT73) 3.08 for Windows, and other wireless card drivers including rt2400, rt2500, rt2570, and rt61, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Probe Request packet with a long SSID, possibly related to an integer signedness error.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512995]
[GLSA-200907-08]
[DSA-1712]
[DSA-1713]
[DSA-1714]
[20090118 Ralinktech wireless cards drivers vulnerability]
[33340]
Cross-site scripting (XSS) vulnerability in err.asp in Oblog allows remote attackers to inject arbitrary web script or HTML via the message parameter.
[20090123 Oblog XSS valnerability]
[20090124 Re: Oblog XSS valnerability]
[33416]
SQL injection vulnerability in category.php in Flax Article Manager 1.1 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
[http://www.flaxweb.com/products/articles]
[33422]
[7862]
Cross-site scripting (XSS) vulnerability in error.asp in BBSXP 5.13 and earlier allows remote attackers to inject arbitrary web script or HTML via the message parameter.
[20090123 BBSxp Xss vulnerability]
[33411]
[bbsxp-error-xss(48187)]
Directory traversal vulnerability in upgrade/index.php in OpenGoo 1.1, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the form_data[script_class] parameter.
[33421]
[7863]
SQL injection vulnerability in lib/patUser.php in KEEP Toolkit before 2.5.1 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password.
[http://keeptoolkit.svn.sourceforge.net/viewvc/keeptoolkit?view=rev&revision=56]
[http://sourceforge.net/project/shownotes.php?release_id=655845&group_id=227492]
[33425]
Directory traversal vulnerability in k23productions TFTPUtil GUI 1.2.0 and 1.3.0 allows remote attackers to read arbitrary files outside the TFTP root directory via directory traversal sequences in a GET request.
[http://sourceforge.net/forum/forum.php?forum_id=894598]
[http://www.princeofnigeria.org/blogs/index.php/2009/01/14/tftputil-gui-tftp-directory-traversal]
[20090115 TFTPUtil GUI TFTP Directory Traversal]
[33287]
[tftputil-tftpget-directory-traversal(48019)]
k23productions TFTPUtil GUI 1.2.0 and 1.3.0 allows remote attackers to cause a denial of service (service crash) via a long filename in a crafted request.
[http://sourceforge.net/forum/forum.php?forum_id=894598]
[http://www.princeofnigeria.org/blogs/index.php/2009/01/14/tftputil-gui-tftp-server-denial-of-servi?blog=1]
[20090115 TFTPUtil GUI TFTP Server Denial of Service Vulnerability]
[33289]
Directory traversal vulnerability in common.php in SIR GNUBoard 4.31.03 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the g4_path parameter. NOTE: in some environments, this can be leveraged for remote code execution via a data: URI or a UNC share pathname.
[33304]
[gnuboard-common-file-include(48015)]
[7792]
Directory traversal vulnerability in fc.php in OpenX 2.6.3 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the MAX_type parameter.
[20090127 OpenX 2.6.3 - Local File Inclusion]
[33458]
[7883]
SQL injection vulnerability in show_cat2.php in SHOP-INET 4 allows remote attackers to execute arbitrary SQL commands via the grid parameter.
[7874]
SQL injection vulnerability in profile_view.php in Wazzum Dating Software, possibly 2.0, allows remote attackers to execute arbitrary SQL commands via the userid parameter.
[33461]
[7877]
Multiple PHP remote file inclusion vulnerabilities in WB News 2.0.1, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the config[installdir] parameter to (1) search.php, (2) archive.php, (3) comments.php, and (4) news.php; (5) News.php, (6) SendFriend.php, (7) Archive.php, and (8) Comments.php in base/; and possibly other components, different vectors than CVE-2007-1288.
[20090125 WB News v2.0.X Remote File include ..]
[33434]
SQL injection vulnerability in index.php in Information Technology Light Poll Information (ITLPoll) 2.7 Stable 2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.
[33452]
[7867]
SQL injection vulnerability in shop_display_products.php in Script Toko Online 5.01 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
[7873]
SQL injection vulnerability in login_check.asp in ClickAuction allows remote attackers to execute arbitrary SQL commands via the (1) txtEmail and (2) txtPassword parameters. NOTE: some of these details are obtained from third party information.
[7880]
Heap-based buffer overflow in MW6 Technologies Barcode ActiveX control (Barcode.MW6Barcode.1, Barcode.dll) 3.0.0.1 allows remote attackers to execute arbitrary code via a long Supplement property.
[33451]
[7869]
SQL injection vulnerability in index.php in Groone GLinks 2.1 allows remote attackers to execute arbitrary SQL commands via the cat parameter.
[33460]
[7878]
[9236]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-2636. Reason: This candidate is a duplicate of CVE-2006-2636. Notes: All CVE users should reference CVE-2006-2636 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Multiple insecure method vulnerabilities in the FlexCell.Grid ActiveX control (FlexCell.ocx) in FlexCell Grid Control 5.6.9 allow remote attackers to create and overwrite arbitrary files via the (1) SaveFile and (2) ExportToXML methods.
[33453]
[7868]
SQL injection vulnerability in the Downloads module for PHP-Nuke 8.0 8.1.0.3.5b and earlier allows remote authenticated users to execute arbitrary SQL commands via the url parameter in the Add operation to modules.php.
[http://1337day.com/exploits/15481]
[18148]
[20090123 PHP-Nuke 8.0 Downloads Blind Sql Injection]
[33410]
[50770]
[downloads-module-sql-injection(48186)]
[phpnuke-uri-sql-injection(71475)]
Cross-site scripting (XSS) vulnerability in Web Help Desk before 9.1.18 allows remote attackers to inject arbitrary web script or HTML via vectors related to "encoded JavaScript" and Helpdesk.woa.
[http://updates.webhelpdesk.com/weblog/updates/StableReleases/2009/01/23/911812309.html]
[33429]
The kernel in Sun Solaris 10 and 11 snv_101b, and OpenSolaris before snv_108, allows remote attackers to cause a denial of service (system crash) via a crafted IPv6 packet, related to an "insufficient validation security vulnerability," as demonstrated by SunOSipv6.c.
[20090126 Solaris Devs Are Smoking Pot]
[1021635]
[251006]
[33435]
[ADV-2009-0232]
[sun-solaris-ipv6packets-dos(48208)]
[7865]
Multiple stack-based buffer overflows in the Research in Motion RIM AxLoader ActiveX control in AxLoader.ocx and AxLoader.dll in BlackBerry Application Web Loader 1.0 allow remote attackers to execute arbitrary code via unspecified use of the (1) load or (2) loadJad method.
[http://blackberry.com/btsc/KB16248]
[VU#131100]
[http://www.microsoft.com/technet/security/advisory/960715.mspx]
[33663]
Buffer overflow in the IBM Lotus Notes Intellisync ActiveX control in lnresobject.dll in BlackBerry Desktop Manager in Research In Motion (RIM) BlackBerry Desktop Software before 5.0.1 allows remote attackers to execute arbitrary code via a crafted web page. NOTE: some of these details are obtained from third party information.
[http://www.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB19701]
[36903]
[ADV-2009-3133]
Cross-site scripting (XSS) vulnerability in the "Customize Statistics Page" (admin/statistics/ConfigureStatistics) in the MDS Connection Service in Research in Motion (RIM) BlackBerry Enterprise Server (BES) before 4.1.6 MR5 allows remote attackers to inject arbitrary web script or HTML via the (1) customDate, (2) interval, (3) lastCustomInterval, (4) lastIntervalLength, (5) nextCustomInterval, (6) nextIntervalLength, (7) action, (8) delIntervalIndex, (9) addStatIndex, (10) delStatIndex, and (11) referenceTime parameters.
[20090417 ERNW Security Advisory 01-2009: XSS in Blackberries Mobile Data Service Connection Service]
[http://www.blackberry.com/btsc/dynamickc.do?externalId=KB17969&sliceID=1&command=show&forward=nonthreadedKC&kcId=KB17969]
[34573]
[1022081]
[ADV-2009-1090]
Buffer overflow in SUSE blinux (aka sbl) in SUSE openSUSE 10.3 through 11.0 has unknown impact and attack vectors related to "incoming data and authentication-strings."
Following information confirms LOCAL Access Vector reported in Hyperlink Record 1058524:
http://xforce.iss.net/xforce/xfdb/48797
The SUSE blinux (sbl) package is vulnerable to a buffer overflow. By sending a specially-crafted request, a local attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
[SUSE-SR:2009:004]
[33794]
[suse-blinux-bo(48797)]
The Backbone service (ftbackbone.exe) in EMC AutoStart before 5.3 SP2 allows remote attackers to execute arbitrary code via a packet with a crafted value that is dereferenced as a function pointer.
[20090123 ZDI-09-009: EMC AutoStart Backbone Engine Trusted Pointer Code Execution Vulnerability]
[33415]
[1021636]
[http://zerodayinitiative.com/advisories/ZDI-09-009/]
[autostart-backbone-code-execution(48197)]
Cross-site scripting (XSS) vulnerability in the antispam feature (security/antispam.py) in MoinMoin 1.7 and 1.8.1 allows remote attackers to inject arbitrary web script or HTML via crafted, disallowed content.
[http://hg.moinmo.in/moin/1.7/rev/89b91bf87dad]
[http://hg.moinmo.in/moin/1.8/rev/89b91bf87dad]
[http://moinmo.in/SecurityFixes#moin1.8.1]
[[oss-security] 20090127 CVE Request: MoinMoin]
[moinmoin-antispam-xss(48306)]
[USN-716-1]
[DSA-1715]
winetricks before 20081223 allows local users to overwrite arbitrary files via a symlink attack on the x_showmenu.txt temporary file.
[http://code.google.com/p/winezeug/source/detail?r=253]
[SUSE-SR:2009:004]
[33474]
[winetricks-xshowmenu-symlink(48320)]
Untrusted search path vulnerability in the Python module in gedit allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
[http://bugzilla.gnome.org/show_bug.cgi?id=569214]
[GLSA-200903-41]
[MDVSA-2009:039]
[[oss-security] 20090126 CVE request -- Python < 2.6 PySys_SetArgv issues (epiphany, csound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric)]
[33445]
[https://bugzilla.redhat.com/show_bug.cgi?id=481556]
[gedit-pysyssetargv-privilege-escalation(48271)]
[FEDORA-2009-1189]
Untrusted search path vulnerability in the Python module in xchat allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
[MDVSA-2009:059]
[[oss-security] 20090126 CVE request -- Python < 2.6 PySys_SetArgv issues (epiphany, csound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric)]
[33444]
[https://bugzilla.redhat.com/show_bug.cgi?id=481560]
Untrusted search path vulnerability in src/if_python.c in the Python interface in Vim before 7.2.045 allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983), as demonstrated by an erroneous search path for plugin/bike.vim in bicyclerepair.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=484305]
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=493937]
[APPLE-SA-2010-03-29-1]
[http://support.apple.com/kb/HT4077]
[MDVSA-2009:047]
[[debian-bugs-rc] 20080805 Bug#484305: bicyclerepair: bike.vim imports untrusted python files from cwd]
[[oss-security] 20090126 CVE request -- Python < 2.6 PySys_SetArgv issues (epiphany, csound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric)]
[33447]
[https://bugzilla.redhat.com/show_bug.cgi?id=481565]
[vim-pysyssetargv-privilege-escalation(48275)]
[https://svn.pardus.org.tr/pardus/2008/applications/editors/vim/files/official/7.2.045]
Untrusted search path vulnerability in the Python language bindings for Nautilus (nautilus-python) allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
[[oss-security] 20090126 CVE request -- Python < 2.6 PySys_SetArgv issues (epiphany, csound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric)]
[33442]
[https://bugzilla.redhat.com/show_bug.cgi?id=481570]
Untrusted search path vulnerability in the GObject Python interpreter wrapper in Gnumeric allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
[http://bugzilla.gnome.org/show_bug.cgi?id=569648]
[GLSA-200904-03]
[MDVSA-2009:043]
[[oss-security] 20090126 CVE request -- Python < 2.6 PySys_SetArgv issues (epiphany, csound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric)]
[33438]
[https://bugzilla.redhat.com/show_bug.cgi?id=481572]
[FEDORA-2009-1295]
Unspecified vulnerability in the autofs module in the kernel in Sun Solaris 8 through 10, and OpenSolaris before snv_108, allows local users to cause a denial of service (autofs mount outage) or possibly gain privileges via vectors related to "xdr processing problems."
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-128624-09-1]
[249966]
[http://support.avaya.com/elmodocs2/security/ASA-2009-041.htm]
[33459]
[1021644]
[ADV-2009-0256]
[ADV-2009-0363]
[solaris-autofs-code-execution(48234)]
[oval:org.mitre.oval:def:5977]
Microsoft Windows XP, Server 2003 and 2008, and Vista exposes I/O activity measurements of all processes, which allows local users to obtain sensitive information, as demonstrated by reading the I/O Other Bytes column in Task Manager (aka taskmgr.exe) to estimate the number of characters that a different user entered at a runas.exe password prompt, related to a "benchmarking attack."
[20090124 Benchmarking attacks and major security weakness on all recent Windows versions up to Windows 200]
[33440]
Apple Safari 3.2.1 (aka AppVer 3.525.27.1) on Windows allows remote attackers to cause a denial of service (infinite loop or access violation) via a link to an http URI in which the authority (aka hostname) portion is either a (1) . (dot) or (2) .. (dot dot) sequence.
[http://lostmon.blogspot.com/2009/01/safari-for-windows-321-remote-http-uri.html]
[33481]
[safari-httpuri-dos(48284)]
[oval:org.mitre.oval:def:6091]
drivers/firmware/dell_rbu.c in the Linux kernel before 2.6.27.13, and 2.6.28.x before 2.6.28.2, allows local users to cause a denial of service (system crash) via a read system call that specifies zero bytes from the (1) image_type or (2) packet_size file in /sys/devices/platform/dell_rbu/.
[http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.27.y.git;a=commit;h=81156928f8fe31621e467490b9d441c0285998c3]
[http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.13]
[http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.2]
[SUSE-SA:2009:010]
[SUSE-SA:2009:030]
[SUSE-SA:2009:031]
[http://support.avaya.com/elmodocs2/security/ASA-2009-114.htm]
[DSA-1749]
[DSA-1787]
[DSA-1794]
[RHSA-2009:0326]
[RHSA-2009:0331]
[RHSA-2009:0360]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[33428]
[USN-751-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-3316]
[oval:org.mitre.oval:def:10163]
[oval:org.mitre.oval:def:7734]
Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0 and 11.0 allow remote attackers to execute arbitrary code via (1) a long type parameter in an input tag, which is not properly handled by the EndOfXmlAttributeValue function; (2) an "HTML GI" in a start tag, which is not properly handled by the ProcessStartGI function; and unspecified vectors in (3) html2thot.c and (4) xml2thot.c, related to the msgBuffer variable. NOTE: these are different vectors than CVE-2008-6005.
[http://www.coresecurity.com/content/amaya-buffer-overflows]
[20090128 CORE-2008-1211: Amaya web editor XML and HTML parser vulnerabilities]
[amaya-html-tags-bo(48325)]
[7902]
Multiple SQL injection vulnerabilities in BibCiter 1.4 allow remote attackers to execute arbitrary SQL commands via the (1) idp parameter to reports/projects.php, the (2) idc parameter to reports/contacts.php, and the (3) idu parameter to reports/users.php.
[http://bibciter.sourceforge.net/?p=35]
[33329]
[bibciter-projects-sql-injection(48080)]
[7814]
Directory traversal vulnerability in entries/index.php in Ninja Blog 4.8, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the cat parameter.
[http://www.push55.co.uk/index.php?s=ad&id=6]
[33351]
[7831]
[https://www.push55.co.uk/poclibrary/ninjadesignscouk-1.txt]
SQL injection vulnerability in login.php in Dark Age CMS 0.2c beta allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[33271]
[darkagecms-login-sql-injection(48095)]
SQL injection vulnerability in readbible.php in Free Bible Search PHP Script 1.0 allows remote attackers to execute arbitrary SQL commands via the version parameter.
[http://freshmeat.net/projects/freebiblesearch/?branch_id=77256&release_id=292446]
[33301]
[http://www.seraphimtech.net/repository/Changes.txt]
[7798]
ROBS-PROJECTS Digital Sales IPN (aka DS-IPN.NET or DS-IPN Paypal Shop) stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing user credentials via a direct request for Database/Sales.mdb.
[digitalsales-sales-information-disclosure(48082)]
[7816]
SQL injection vulnerability in the PcCookBook (com_pccookbook) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the recipe_id parameter in a viewrecipe action to index.php, a different vector than CVE-2008-0844.
[33346]
[pccookbook-recipeid-sql-injection(48088)]
[7824]
Directory traversal vulnerability in index.php in Simple Content Management System (SCMS) 1 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the p parameter.
[33330]
[scms-index-file-include(48081)]
[7818]
Directory traversal vulnerability in gallery/comment.php in Enhanced Simple PHP Gallery (ESPG) 1.72 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. NOTE: the vulnerability may be in my little homepage Comment script. If so, then this should not be treated as a vulnerability in ESPG.
[33335]
[espg-comment-directory-traversal(48087)]
[7819]
Multiple SQL injection vulnerabilities in AV Book Library before 1.1 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) admin/edit.php, (2) admin/add.php, (3) lib/book_search.php, and possibly other components.
[http://sourceforge.net/project/shownotes.php?release_id=654214]
[http://sourceforge.net/tracker/index.php?func=detail&aid=2219743&group_id=209711&atid=1010816]
[avbook-edit-sql-injection(48084)]
SQL injection vulnerability in the WebAmoeba (WA) Ticket System (com_waticketsystem) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a category action to index.php.
[33353]
[7833]
SQL injection vulnerability in index.asp in Katy Whitton BlogIt! allows remote attackers to execute arbitrary SQL commands via the day parameter in an archive action.
[33325]
[blogit-index-sql-injection(48074)]
[7806]
Cross-site scripting (XSS) vulnerability in index.asp in Katy Whitton BlogIt! allows remote attackers to inject arbitrary web script or HTML via the view parameter.
[33325]
[blogit-index-xss(48073)]
[7806]
Katy Whitton BlogIt! stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing user credentials via a direct request for database/Blog.mdb. NOTE: some of these details are obtained from third party information.
[blogit-blog-information-disclosure(48075)]
[7806]
SQL injection vulnerability in index.asp in Katy Whitton BlogIt! allows remote attackers to execute arbitrary SQL commands via the (1) month and (2) year parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[7806]
Cross-site scripting (XSS) vulnerability in inc_webblogmanager.asp in DMXReady Blog Manager allows remote attackers to inject arbitrary web script or HTML via the CategoryID parameter in a refer action.
[http://dmxready.helpserve.com/index.php?_m=news&_a=viewnews&newsid=12]
[20090116 DMXReady Blog Manager (SQL/XSS)]
[33314]
[blogmanager-incwebblogmanager-xss(48053)]
SQL injection vulnerability in inc_webblogmanager.asp in DMXReady Blog Manager allows remote attackers to execute arbitrary SQL commands via the itemID parameter in a view action.
[http://dmxready.helpserve.com/index.php?_m=news&_a=viewnews&newsid=12]
[20090116 DMXReady Blog Manager (SQL/XSS)]
[33314]
[blogmanager-incwebblogmanager-sql-injection(48054)]
Multiple directory traversal vulnerabilities in Simple PHP Newsletter 1.5 allow remote attackers to read arbitrary files via a .. (dot dot) in the olang parameter to (1) mail.php and (2) mailbar.php.
[33327]
[simplephpnewsletter-mail-file-include(48089)]
[7813]
The shell32 module in Microsoft Internet Explorer 7.0 on Windows XP SP3 might allow remote attackers to execute arbitrary code via a long VALUE attribute in an INPUT element, possibly related to a stack consumption vulnerability.
[20090128 Internet explorer 7.0 stack overflow]
[33494]
Niels Provos Systrace before 1.6f on the x86_64 Linux platform allows local users to bypass intended access restrictions by making a 64-bit syscall with a syscall number that corresponds to a policy-compliant 32-bit syscall.
[http://scary.beasts.org/security/CESA-2009-001.html]
[http://scarybeastsecurity.blogspot.com/2009/01/bypassing-syscall-filtering.html]
[http://www.citi.umich.edu/u/provos/systrace/]
[20090123 Problems with syscall filtering technologies on Linux]
[33417]
Niels Provos Systrace 1.6f and earlier on the x86_64 Linux platform allows local users to bypass intended access restrictions by making a 32-bit syscall with a syscall number that corresponds to a policy-compliant 64-bit syscall, related to race conditions that occur in monitoring 64-bit processes.
[http://scary.beasts.org/security/CESA-2009-001.html]
[http://scarybeastsecurity.blogspot.com/2009/01/bypassing-syscall-filtering.html]
[http://www.citi.umich.edu/u/provos/systrace/]
[20090123 Problems with syscall filtering technologies on Linux]
[33417]
Unspecified vulnerability in the Embedded Lights Out Manager (ELOM) on the Sun Fire X2100 M2 and X2200 M2 x86 platforms before SP/BMC firmware 3.20 allows remote attackers to obtain privileged ELOM login access or execute arbitrary Service Processor (SP) commands via unknown vectors, aka Bug ID 6633175, a different vulnerability than CVE-2007-5717.
[239886]
[33506]
[1021646]
[ADV-2009-0281]
[sunfire-elom-unauth-access(48329)]
Unspecified vulnerability in the Embedded Lights Out Manager (ELOM) on the Sun Fire X2100 M2 and X2200 M2 x86 platforms before SP/BMC firmware 3.20 allows remote attackers to obtain privileged ELOM login access or execute arbitrary Service Processor (SP) commands via unknown vectors, aka Bug ID 6648082, a different vulnerability than CVE-2007-5717.
[239886]
[33506]
[1021646]
[ADV-2009-0281]
[sunfire-elom-unauth-access(48329)]
The IP-in-IP packet processing implementation in the IPsec and IP stacks in the kernel in Sun Solaris 9 and 10, and OpenSolaris snv_01 though snv_85, allows local users to cause a denial of service (panic) via a self-encapsulated packet that lacks IPsec protection.
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-114344-38-1]
[240086]
[http://support.avaya.com/elmodocs2/security/ASA-2009-043.htm]
[33504]
[ADV-2009-0365]
[solaris-ipinip-dos(48328)]
[oval:org.mitre.oval:def:6088]
Open redirect vulnerability in cs.html in the Autonomy (formerly Verity) Ultraseek search engine allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter.
[http://sunbeltblog.blogspot.com/2009/01/constant-stream-of-ultraseek-redirects.html]
[VU#202753]
[33500]
[http://www.ultraseek.com/forums/thread.jspa?messageID=9818]
[ultraseek-cs-phishing(48336)]
The login module in Sun Java System Access Manager 6 2005Q1 (aka 6.3), 7 2005Q4 (aka 7.0), and 7.1 responds differently to a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-119465-15-1]
[242026]
[33489]
[ADV-2009-0269]
[sun-jsam-username-info-disclosure(48283)]
Stack-based buffer overflow in FTPShell Server 4.3 allows user-assisted remote attackers to cause a denial of service (persistent daemon crash) and possibly execute arbitrary code via a long string in a licensing key (aka .key) file.
[7852]
Stack-based buffer overflow in Merak Media Player 3.2 allows remote attackers to execute arbitrary code via a long string in a .m3u playlist file, related to the status bar icon's tooltip. NOTE: some of these details are obtained from third party information.
[7857]
Stack-based buffer overflow in WFTPSRV.exe in WinFTP 2.3.0 allows remote authenticated users to execute arbitrary code via a long LIST argument beginning with an * (asterisk) character.
[33454]
[ADV-2009-0254]
[winftp-list-bo(48263)]
[7875]
Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.6, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the layout engine and destruction of arbitrary layout objects by the nsViewManager::Composite function.
[SUSE-SA:2009:009]
[SUSE-SA:2009:023]
[RHSA-2009:0256]
[SSA:2009-083-02]
[SSA:2009-083-03]
[http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm]
[DSA-1830]
[MDVSA-2009:044]
[MDVSA-2009:083]
[http://www.mozilla.org/security/announce/2009/mfsa2009-01.html]
[RHSA-2009:0257]
[RHSA-2009:0258]
[33598]
[1021663]
[USN-717-1]
[ADV-2009-0313]
[https://bugzilla.mozilla.org/show_bug.cgi?id=331088]
[https://bugzilla.mozilla.org/show_bug.cgi?id=401042]
[https://bugzilla.mozilla.org/show_bug.cgi?id=416461]
[https://bugzilla.mozilla.org/show_bug.cgi?id=420697]
[https://bugzilla.mozilla.org/show_bug.cgi?id=421839]
[https://bugzilla.mozilla.org/show_bug.cgi?id=422283]
[https://bugzilla.mozilla.org/show_bug.cgi?id=422301]
[https://bugzilla.mozilla.org/show_bug.cgi?id=431705]
[https://bugzilla.mozilla.org/show_bug.cgi?id=437142]
[https://bugzilla.mozilla.org/show_bug.cgi?id=449006]
[https://bugzilla.mozilla.org/show_bug.cgi?id=461027]
[oval:org.mitre.oval:def:10699]
[USN-741-1]
[FEDORA-2009-1399]
[FEDORA-2009-2882]
[FEDORA-2009-2884]
[FEDORA-2009-3101]
Unspecified vulnerability in Mozilla Firefox 3.x before 3.0.6, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the JavaScript engine.
[SUSE-SA:2009:009]
[SUSE-SA:2009:023]
[RHSA-2009:0256]
[SSA:2009-083-02]
[SSA:2009-083-03]
[http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm]
[DSA-1830]
[MDVSA-2009:044]
[MDVSA-2009:083]
[http://www.mozilla.org/security/announce/2009/mfsa2009-01.html]
[RHSA-2009:0257]
[RHSA-2009:0258]
[33598]
[1021663]
[USN-717-1]
[ADV-2009-0313]
[https://bugzilla.mozilla.org/show_bug.cgi?id=452913]
[oval:org.mitre.oval:def:11193]
[FEDORA-2009-1399]
[FEDORA-2009-2882]
[FEDORA-2009-2884]
[FEDORA-2009-3101]
Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and conduct cross-site scripting (XSS) attacks, via vectors involving a chrome XBL method and the window.eval function.
[SUSE-SA:2009:009]
[RHSA-2009:0256]
[http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm]
[MDVSA-2009:044]
[http://www.mozilla.org/security/announce/2009/mfsa2009-02.html]
[33598]
[1021664]
[USN-717-1]
[ADV-2009-0313]
[https://bugzilla.mozilla.org/show_bug.cgi?id=468581]
[oval:org.mitre.oval:def:9796]
[FEDORA-2009-1399]
components/sessionstore/src/nsSessionStore.js in Mozilla Firefox before 3.0.6 does not block changes of INPUT elements to type="file" during tab restoration, which allows user-assisted remote attackers to read arbitrary files on a client machine via a crafted INPUT element.
[SUSE-SA:2009:009]
[RHSA-2009:0256]
[http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm]
[MDVSA-2009:044]
[http://www.mozilla.org/security/announce/2009/mfsa2009-03.html]
[RHSA-2009:0257]
[RHSA-2009:0258]
[33598]
[1021665]
[USN-717-1]
[USN-717-2]
[ADV-2009-0313]
[https://bugzilla.mozilla.org/show_bug.cgi?id=466937]
[oval:org.mitre.oval:def:9161]
[FEDORA-2009-1399]
[FEDORA-2009-2882]
[FEDORA-2009-2884]
Mozilla Firefox before 3.0.6 and SeaMonkey do not block links to the (1) about:plugins and (2) about:config URIs from .desktop files, which allows user-assisted remote attackers to bypass the Same Origin Policy and execute arbitrary code with chrome privileges via vectors involving the URL field in a Desktop Entry section of a .desktop file, related to representation of about: URIs as jar:file:// URIs. NOTE: this issue exists because of an incomplete fix for CVE-2008-4582.
[SUSE-SA:2009:009]
[RHSA-2009:0256]
[http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm]
[MDVSA-2009:044]
[http://www.mozilla.org/security/announce/2009/mfsa2009-04.html]
[33598]
[1021666]
[ADV-2009-0313]
[https://bugzilla.mozilla.org/show_bug.cgi?id=460425]
[oval:org.mitre.oval:def:9922]
[FEDORA-2009-1399]
Mozilla Firefox before 3.0.6 and SeaMonkey before 1.1.15 do not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly protection mechanism.
[http://ha.ckers.org/blog/20070511/bluehat-errata/]
[SUSE-SA:2009:009]
[RHSA-2009:0256]
[SSA:2009-083-02]
[http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm]
[MDVSA-2009:044]
[http://www.mozilla.org/security/announce/2009/mfsa2009-05.html]
[RHSA-2009:0257]
[33598]
[1021668]
[USN-717-1]
[USN-717-2]
[ADV-2009-0313]
[https://bugzilla.mozilla.org/show_bug.cgi?id=380418]
[oval:org.mitre.oval:def:9459]
[FEDORA-2009-1399]
[FEDORA-2009-3101]
Mozilla Firefox 3.x before 3.0.6 does not properly implement the (1) no-store and (2) no-cache Cache-Control directives, which allows local users to obtain sensitive information by using the (a) back button or (b) history list of the victim's browser, as demonstrated by reading the response page of an https POST request.
[http://blogs.imeta.co.uk/JDeabill/archive/2008/07/14/303.aspx]
[SUSE-SA:2009:009]
[RHSA-2009:0256]
[http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm]
[MDVSA-2009:044]
[http://www.mozilla.org/security/announce/2009/mfsa2009-06.html]
[33598]
[1021667]
[USN-717-1]
[ADV-2009-0313]
[https://bugzilla.mozilla.org/show_bug.cgi?id=441751]
[oval:org.mitre.oval:def:10610]
[FEDORA-2009-1399]
Multiple cross-site scripting (XSS) vulnerabilities in Samizdat before 0.6.2 allow remote authenticated users to inject arbitrary web script or HTML via the (1) message title or (2) user full name.
[http://samizdat.nongnu.org/release-notes/samizdat-0.6.1-xss-escape-title.patch]
[[debian-testing-security-announce] 20090211 Security update for Debian Testing - 2009-02-12]
[http://www.nongnu.org/samizdat/release-notes/samizdat-0.6.2.html]
[20090213 Cross-site scripting in Samizdat 0.6.1]
[33768]
Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application.
Per vendor advisory:
http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html
"This advisory is only for my pam-krb5 module, as distributed from my web site and packaged by Debian, Ubuntu, and Gentoo."
[GLSA-200903-39]
[1021711]
[252767]
[http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm]
[DSA-1721]
[http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html]
[20090211 pam-krb5 security advisory (3.12 and earlier)]
[33740]
[USN-719-1]
[ADV-2009-0410]
[ADV-2009-0426]
[ADV-2009-0979]
[oval:org.mitre.oval:def:5669]
[oval:org.mitre.oval:def:5732]
Russ Allbery pam-krb5 before 3.13, as used by libpam-heimdal, su in Solaris 10, and other software, does not properly handle calls to pam_setcred when running setuid, which allows local users to overwrite and change the ownership of arbitrary files by setting the KRB5CCNAME environment variable, and then launching a setuid application that performs certain pam_setcred operations.
[GLSA-200903-39]
[1021711]
[252767]
[http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm]
[DSA-1721]
[DSA-1722]
[http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html]
[20090211 pam-krb5 security advisory (3.12 and earlier)]
[33741]
[USN-719-1]
[ADV-2009-0410]
[ADV-2009-0426]
[ADV-2009-0979]
[oval:org.mitre.oval:def:5403]
[oval:org.mitre.oval:def:5521]
filter.d/wuftpd.conf in Fail2ban 0.8.3 uses an incorrect regular expression that allows remote attackers to cause a denial of service (forced authentication failures) via a crafted reverse-resolved DNS name (rhost) entry that contains a substring that is interpreted as an IP address, a different vulnerability than CVE-2007-4321.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=514163]
[33734]
Multiple buffer overflows in (a) BarnOwl before 1.0.5 and (b) owl 2.1.11 allow remote attackers to execute arbitrary code via vectors involving (1) a crafted zcrypt message, related to zcrypt.c; (2) a reply command on a message with a Zephyr Cc: list, related to zwrite.c; and unspecified other use of the products.
[http://barnowl.mit.edu/browser/ChangeLog]
[http://barnowl.mit.edu/wiki/barnowl-1.0.5-announce]
[http://bugs.debian.org/515118]
[[debian-testing-security-announce] 20090213 Security update for Debian Testing - 2009-02-14]
[https://bugs.launchpad.net/ubuntu/+source/owl/+bug/329165]
[barnowl-owl-zcrypt-bo(48824)]
Format string vulnerability in the mini_calendar component in Citadel.org WebCit 7.22, and other versions before 7.39, allows remote attackers to execute arbitrary code via unspecified vectors.
[http://www.citadel.org/doku.php/news:webcit.security.advisory.-.2009-march-23]
[DSA-1752]
[34206]
nm-applet.conf in GNOME NetworkManager before 0.7.0.99 contains an incorrect deny setting, which allows local users to discover (1) network connection passwords and (2) pre-shared keys via calls to the GetSecrets method in the dbus request handler.
[SUSE-SA:2009:013]
[SUSE-SR:2009:009]
[1021910]
[1021911]
[http://svn.gnome.org/viewvc/network-manager-applet/trunk/nm-applet.conf?r1=1133&r2=1207&pathrev=1207]
[http://svn.gnome.org/viewvc/network-manager-applet?view=revision&revision=1207]
[DSA-1955]
[RHSA-2009:0361]
[RHSA-2009:0362]
[33966]
[1021908]
[USN-727-1]
[USN-727-2]
[https://bugzilla.redhat.com/show_bug.cgi?id=487722]
[https://bugzilla.redhat.com/show_bug.cgi?id=487752]
[networkmanager-dbus-info-disclosure(49062)]
[oval:org.mitre.oval:def:10828]
The uncompress_buffer function in src/server/simple_wml.cpp in Wesnoth before r33069 allows remote attackers to cause a denial of service via a large compressed WML document.
[http://launchpad.net/bugs/335089]
[http://launchpad.net/bugs/336396]
[http://launchpad.net/bugs/cve/2009-0366]
[http://packages.debian.org/changelogs/pool/main/w/wesnoth/wesnoth_1.4.7-4/changelog]
[http://packages.debian.org/changelogs/pool/main/w/wesnoth/wesnoth_1.5.12-1/changelog]
[http://svn.gna.org/viewcvs/wesnoth/trunk/src/server/simple_wml.cpp?rev=33069&r1=32990&r2=33069]
[http://svn.gna.org/viewcvs/wesnoth/trunk/src/server/simple_wml.cpp?rev=33069&view=log]
[DSA-1737]
[34085]
[https://gna.org/bugs/index.php?13037]
The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by using a whitelisted module that imports an unsafe module, then using a hierarchical module name to access the unsafe module through the whitelisted module.
[http://launchpad.net/bugs/335089]
[http://launchpad.net/bugs/336396]
[http://launchpad.net/bugs/cve/2009-0367]
[http://packages.debian.org/changelogs/pool/main/w/wesnoth/wesnoth_1.4.7-4/changelog]
[http://packages.debian.org/changelogs/pool/main/w/wesnoth/wesnoth_1.5.12-1/changelog]
[DSA-1737]
[ADV-2009-0595]
[http://www.wesnoth.org/forum/viewtopic.php?t=24247]
[http://www.wesnoth.org/forum/viewtopic.php?t=24340]
[wesnoth-pythonai-code-execution(49058)]
[https://gna.org/bugs/index.php?13048]
OpenSC before 0.11.7 allows physically proximate attackers to bypass intended PIN requirements and read private data objects via a (1) low level APDU command or (2) debugging tool, as demonstrated by reading the 4601 or 4701 file with the opensc-explorer or opensc-tool program.
[SUSE-SR:2009:010]
[[oss-security] 20090226 OpenSC Security Advisory]
[GLSA-200908-01]
[DSA-1734]
[[opensc-announce] 20090226 OpenSC Security Advisory]
[33922]
[opensc-pkcs-unauth-access(48958)]
[FEDORA-2009-2266]
[FEDORA-2009-2267]
Microsoft Internet Explorer 7 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick action that moves a crafted element to the current mouse position, related to a "Clickjacking" vulnerability.
[ie-onclickaction-click-hijacking(48542)]
[7912]
Multiple unspecified vulnerabilities in IBM AIX 5.2.0 through 6.1.2 allow local users to append data to arbitrary files, related to (1) rmsock and (2) rmsock64 not creating "secure log files."
[http://aix.software.ibm.com/aix/efixes/security/rmsock_advisory.asc]
[IZ40386]
[IZ41510]
[IZ41593]
[IZ41599]
[IZ42785]
[IZ42786]
[IZ42787]
[IZ42788]
[33522]
[oval:org.mitre.oval:def:6028]
Directory traversal vulnerability in post.php in SiteXS CMS 0.1.1 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the type parameter.
[33457]
[ADV-2009-0247]
[sitexs-type-file-include(48236)]
[7879]
Unrestricted file upload vulnerability in index.php in Miltenovik Manojlo MemHT Portal 4.0.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and an image content type via a users editProfile action, then accessing this file via a direct request to the file in images/avatar/uploaded/.
[33424]
[memht-avatar-file-upload(48199)]
[7859]
SQL injection vulnerability in the ElearningForce Flash Magazine Deluxe (com_flashmagazinedeluxe) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the mag_id parameter in a magazine action to index.php.
[33455]
[ADV-2009-0249]
[flashmagazine-index-sql-injection(48226)]
[7881]
** DISPUTED ** Google Chrome 1.0.154.43 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick action that moves a crafted element to the current mouse position, related to a "Clickjacking" vulnerability. NOTE: a third party disputes the relevance of this issue, stating that "every sufficiently featured browser is and likely will remain susceptible to the behavior known as clickjacking," and adding that the exploit code "is not a valid demonstration of the issue."
[http://www.secniche.org/gcr_clkj/]
[20090128 Advisory: Google Chrome 1.0.154.43 ClickJacking Vulnerability.]
[20090128 Re: Advisory: Google Chrome 1.0.154.43 ClickJacking Vulnerability.]
[7903]
Buffer overflow in a DLL file in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to execute arbitrary code via a crafted Internet Video Recording (IVR) file with a filename length field containing a large integer, which triggers overwrite of an arbitrary memory location with a 0x00 byte value, related to use of RealPlayer through a Windows Explorer plugin.
Per http://www.fortiguardcenter.com/advisory/FGA-2009-04.html:
"It should be noted that the victim does not necessarily have to open the malicious file for exploitation to occur: the vulnerabilities lie in a DLL that is also used as a plugin for the Windows Explorer shell. A successful attack could take place by merely previewing the IVR file through Windows Explorer. "
[http://service.real.com/realplayer/security/01192010_player/en/]
[http://www.fortiguardcenter.com/advisory/FGA-2009-04.html]
[20090206 RealNetworks RealPlayer IVR File Processing Multiple Code Execute Vulnerabilities]
[33652]
[ADV-2010-0178]
[realplayer-ivr-bo(48567)]
Heap-based buffer overflow in a DLL file in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to execute arbitrary code via a crafted Internet Video Recording (IVR) file with a modified field that controls an unspecified structure length and triggers heap corruption, related to use of RealPlayer through a Windows Explorer plugin.
[http://service.real.com/realplayer/security/01192010_player/en/]
[http://www.fortiguardcenter.com/advisory/FGA-2009-04.html]
[20090206 RealNetworks RealPlayer IVR File Processing Multiple Code Execute Vulnerabilities]
[20100121 ZDI-10-009: RealNetworks RealPlayer IVR Format Remote Code Execution Vulnerability]
[33652]
[ADV-2010-0178]
[http://www.zerodayinitiative.com/advisories/ZDI-10-009/]
[realplayer-ivr-code-execution(48568)]
SQL injection vulnerability in the beamospetition (com_beamospetition) 1.0.12 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the mpid parameter in a sign action to index.php, a different vector than CVE-2008-3132.
[20090121 Joomla component beamospetition 1.0.12 Sql Injection]
[33391]
[7847]
Cross-site scripting (XSS) vulnerability in index.php in the beamospetition (com_beamospetition) 1.0.12 component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the pet parameter in a sign action.
[20090121 Joomla component beamospetition 1.0.12 Sql Injection]
[33391]
[7847]
SQL injection vulnerability in the Prince Clan Chess Club (com_pcchess) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the game_id parameter in a showgame action to index.php, a different vector than CVE-2008-0761.
[33394]
[joomla-pcchess-gameid-sql-injection(48144)]
[7846]
** DISPUTED ** SQL injection vulnerability in the Sigsiu Online Business Index 2 (SOBI2, com_sobi2) RC 2.8.2 component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the bid parameter in a showbiz action to index.php, a different vector than CVE-2008-0607. NOTE: CVE disputes this issue, since neither "showbiz" nor "bid" appears in the source code for SOBI2.
[20090130 SOBI2 showbiz SQL injection - false, or site-specific]
[33378]
[sobi2-bid-sql-injection(48131)]
[7841]
SQL injection vulnerability in the BazaarBuilder Ecommerce Shopping Cart (com_prod) 5.0 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid parameter in a products action to index.php.
[33380]
[bazaarbuilder-index-sql-injection(48141)]
[7840]
Unspecified vulnerability in Internationalization (i18n) Translation 5.x before 5.x-2.5, a module for Drupal, allows remote attackers with "translate node" permissions to bypass intended access restrictions and read unpublished nodes via unspecified vectors.
[http://drupal.org/node/358958]
[33283]
delete.php in Max.Blog 1.0.6 does not properly restrict access, which allows remote attackers to delete arbitrary blog posts via a direct request.
[http://www.mzbservices.com/show_post.php?id=72]
[33368]
[maxblog-delete-security-bypass(48125)]
[7835]
SQL injection vulnerability in autor.php in OwnRS CMS 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
[7849]
Integer signedness error in the fourxm_read_header function in libavformat/4xm.c in FFmpeg before revision 16846 allows remote attackers to execute arbitrary code via a malformed 4X movie file with a large current_track value, which triggers a NULL pointer dereference.
[http://git.ffmpeg.org/?p=ffmpeg;a=commitdiff;h=72e715fb798f2cb79fd24a6d2eaeafb7c6eeda17]
[GLSA-200903-33]
[http://svn.mplayerhq.hu/ffmpeg/trunk/libavformat/4xm.c?r1=16838&r2=16846&pathrev=16846]
[http://svn.mplayerhq.hu/ffmpeg?view=rev&revision=16846]
[DSA-1781]
[DSA-1782]
[MDVSA-2009:297]
[20090128 [TKADV2009-004] FFmpeg Type Conversion Vulnerability]
[33502]
[http://www.trapkit.de/advisories/TKADV2009-004.txt]
[USN-734-1]
[ADV-2009-0277]
[ffmpeg-fourxmreadheader-code-execution(48330)]
[FEDORA-2009-3428]
[FEDORA-2009-3433]
Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11 might allow remote attackers to execute arbitrary code via crafted Composition Time To Sample (ctts) atom data in a malformed QuickTime media .mov file.
[http://cgit.freedesktop.org/gstreamer/gst-plugins-good/commit/?id=bdc20b9baf13564d9a061343416395f8f9a92b53]
[http://gstreamer.freedesktop.org/releases/gst-plugins-good/0.10.12.html]
[SUSE-SR:2009:005]
[GLSA-200907-11]
[http://trapkit.de/advisories/TKADV2009-003.txt]
[MDVSA-2009:035]
[[oss-security] 20090129 CVE Request -- (sort of urgent) gstreamer-plugins-good (repost) (more details about affected versions -- final version)]
[RHSA-2009:0271]
[20090122 [TKADV2009-003] GStreamer Heap Overflow and Array Index out of Bounds Vulnerabilities]
[33405]
[USN-736-1]
[ADV-2009-0225]
[https://bugzilla.redhat.com/show_bug.cgi?id=481267]
[oval:org.mitre.oval:def:10306]
Array index error in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted Sync Sample (aka stss) atom data in a malformed QuickTime media .mov file, related to "mark keyframes."
[http://cgit.freedesktop.org/gstreamer/gst-plugins-good/commit/?id=bdc20b9baf13564d9a061343416395f8f9a92b53]
[http://gstreamer.freedesktop.org/releases/gst-plugins-good/0.10.12.html]
[SUSE-SR:2009:005]
[GLSA-200907-11]
[http://trapkit.de/advisories/TKADV2009-003.txt]
[MDVSA-2009:035]
[[oss-security] 20090129 CVE Request -- (sort of urgent) gstreamer-plugins-good (repost) (more details about affected versions -- final version)]
[RHSA-2009:0271]
[20090122 [TKADV2009-003] GStreamer Heap Overflow and Array Index out of Bounds Vulnerabilities]
[33405]
[USN-736-1]
[ADV-2009-0225]
[https://bugzilla.redhat.com/show_bug.cgi?id=481267]
[oval:org.mitre.oval:def:10611]
Multiple integer signedness errors in (1) UltraVNC 1.0.2 and 1.0.5 and (2) TightVnc 1.3.9 allow remote VNC servers to cause a denial of service (heap corruption and application crash) or possibly execute arbitrary code via a large length value in a message, related to the (a) ClientConnection::CheckBufferSize and (b) ClientConnection::CheckFileZipBufferSize functions in ClientConnection.cpp.
[http://forum.ultravnc.info/viewtopic.php?t=14654]
[http://vnc-tight.svn.sourceforge.net/viewvc/vnc-tight?view=rev&revision=3564]
[http://www.coresecurity.com/content/vnc-integer-overflows]
[20090203 CORE-2008-1009 - VNC Multiple Integer Overflows]
[33568]
[ADV-2009-0321]
[ADV-2009-0322]
[7990]
[8024]
Multiple insecure method vulnerabilities in the Web On Windows (WOW) ActiveX control in WOW ActiveX 2 allow remote attackers to (1) create and overwrite arbitrary files via the WriteIniFileString method, (2) execute arbitrary programs via the ShellExecute method, (3) read from the registry via unspecified vectors, and (4) write to the registry via unspecified vectors. NOTE: vectors 1 and 2 can be used together to execute arbitrary code.
[33515]
[wow-writeinifilestring-code-execution(48337)]
[7910]
Argument injection vulnerability in Enomaly Elastic Computing Platform (ECP), formerly Enomalism, before 2.1.1 allows local users to send signals to arbitrary processes by populating the /tmp/enomalism2.pid file with command-line arguments for the kill program.
[20090130 CVE-2008-4990 Enomaly ECP/Enomalism: Insecure temporary file creation vulnerabilities]
Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.0.1 on z/OS allows attackers to read arbitrary files via unknown vectors.
[33533]
[1021658]
[ADV-2009-0423]
[PK79232]
Directory traversal vulnerability in sysconf.cgi in Motorola Wimax modem CPEi300 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the page parameter.
[20090129 Motorola Wimax Modem CPEi300 Multiple Vulnerabilities]
[33519]
[7915]
Cross-site scripting (XSS) vulnerability in sysconf.cgi in Motorola Wimax modem CPEi300 allows remote authenticated users to inject arbitrary web script or HTML via the page parameter.
[20090129 Motorola Wimax Modem CPEi300 Multiple Vulnerabilities]
[33519]
[7915]
SQL injection vulnerability in login.php in Pre Lecture Exercises (PLEs) CMS 1.0 beta 4.2 allows remote attackers to execute arbitrary SQL commands via the school parameter.
[33524]
[7917]
SQL injection vulnerability in the login feature in NetArt Media Car Portal 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
[33521]
[7916]
The Sony Ericsson W910i, W660i, K618i, K610i, Z610i, K810i, K660i, W880i, and K530i phones allow remote attackers to cause a denial of service (device reboot or hang-up) via a malformed WAP Push packet to (1) SMS or (2) UDP port 2948.
[http://www.mseclab.com/index.php?page_id=123]
[20090126 SonyEricsson WAP Push Denial of Service]
[33433]
[1021634]
Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11, and GStreamer Plug-ins (aka gstreamer-plugins) 0.8.5, might allow remote attackers to execute arbitrary code via crafted Time-to-sample (aka stts) atom data in a malformed QuickTime media .mov file.
[http://cgit.freedesktop.org/gstreamer/gst-plugins-good/commit/?id=bdc20b9baf13564d9a061343416395f8f9a92b53]
[http://gstreamer.freedesktop.org/releases/gst-plugins-good/0.10.12.html]
[SUSE-SR:2009:005]
[GLSA-200907-11]
[http://support.avaya.com/elmodocs2/security/ASA-2009-052.htm]
[http://trapkit.de/advisories/TKADV2009-003.txt]
[MDVSA-2009:035]
[[oss-security] 20090129 CVE Request -- (sort of urgent) gstreamer-plugins-good (repost) (more details about affected versions -- final version)]
[RHSA-2009:0270]
[RHSA-2009:0271]
[20090122 [TKADV2009-003] GStreamer Heap Overflow and Array Index out of Bounds Vulnerabilities]
[33405]
[USN-736-1]
[ADV-2009-0225]
[https://bugzilla.redhat.com/show_bug.cgi?id=481267]
[gstreamer-qtdemuxparse-bo(48555)]
[oval:org.mitre.oval:def:9942]
Array index error in the gst_qtp_trak_handler function in gst/qtdemux/qtdemux.c in GStreamer Plug-ins (aka gstreamer-plugins) 0.6.0 allows remote attackers to have an unknown impact via a crafted QuickTime media file.
[[oss-security] 20090129 CVE Request -- (sort of urgent) gstreamer-plugins-good (repost) (more details about affected versions -- final version)]
[RHSA-2009:0269]
[oval:org.mitre.oval:def:9886]
Chipmunk Blogger Script allows remote attackers to gain administrator privileges via a direct request to admin/reguser.php. NOTE: this is only a vulnerability when the administrator does not properly follow installation directions.
[7894]
SQL injection vulnerability in blog.php in SocialEngine 3.06 trial allows remote attackers to execute arbitrary SQL commands via the category_id parameter.
[33495]
[socialengine-blog-sql-injection(48316)]
[7900]
SQL injection vulnerability in browsecats.php in E-Php CMS allows remote attackers to execute arbitrary SQL commands via the cid parameter.
[http://packetstormsecurity.org/0901-exploits/ephpcmscid-sql.txt]
[33470]
[ephpcms-browsecats-sql-injection(48297)]
SQL injection vulnerability in client/new_account.php in Domain Technologie Control (DTC) before 0.29.16 allows remote attackers to execute arbitrary SQL commands via the (1) familyname, (2) christname, (3) company_name, (4) is_company, (5) email, (6) phone, (7) fax, (8) addr1, (9) addr2, (10) addr3, (11) zipcode, (12) city, (13) state, (14) country, and (15) vat_num parameters.
[http://freshmeat.net/projects/dtc/?branch_id=22759&release_id=292973]
[http://git.gplhost.com/gitweb/?p=dtc.git;a=commitdiff;h=056e1d1849ff3aa183a410e2aab1c1c3e969247d]
[33496]
[domaintechnologie-newaccount-sql-injection(48292)]
SQL injection vulnerability in admin/authenticate.php in Chipmunk Blogger Script allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
[ADV-2009-0267]
[chipmunkblog-authenticate-sql-injection(48313)]
[7894]
Multiple cross-site scripting (XSS) vulnerabilities in Bioinformatics htmLawed 1.1.3 and 1.1.4 allow remote attackers to inject arbitrary web script or HTML via invalid Cascading Style Sheets (CSS) expressions in the style attribute, which is processed by Internet Explorer 7.
[http://freshmeat.net/projects/htmlawed/?branch_id=74760&release_id=293026]
[http://freshmeat.net/projects/htmlawed/?branch_id=74760&release_id=293090]
[http://www.bioinformatics.org/phplabware/forum/viewtopic.php?id=85]
[http://www.bioinformatics.org/phplabware/internal_utilities/htmLawed/htmLawed_README.htm#s4.3]
[33507]
[htmlawed-unspecified-xss(48333)]
SQL injection vulnerability in articles.php in smartSite CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the var parameter.
[33497]
[smartsitecms-articles-sql-injection(48321)]
[7901]
SQL injection vulnerability in index.php in Community CMS 0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
[33484]
[ADV-2009-0265]
[communitycms-index-sql-injection(48304)]
[7892]
SQL injection vulnerability in admin/login.php in PHP-CMS Project 1 allows remote attackers to execute arbitrary SQL commands via the username parameter.
[33473]
[ADV-2009-0244]
[phpcms-login-sql-injection(48267)]
[7876]
Cross-site request forgery (CSRF) vulnerability in osCommerce 2.2 RC 2a allows remote attackers to hijack the authentication of administrators.
[oscommerce-unspecified-csrf(48289)]
SQL injection vulnerability in offline_auth.php in Max.Blog 1.0.6 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.
[20090127 Max.Blog <= 1.0.6 (offline_auth.php) Offline Authentication Bypass]
[33493]
[7899]
Off-by-one error in the SMTP daemon in GroupWise Internet Agent (GWIA) in Novell GroupWise 6.5x, 7.0, 7.01, 7.02, 7.03, 7.03HP1a, and 8.0 allows remote attackers to execute arbitrary code via a long e-mail address in a malformed RCPT command, leading to a buffer overflow.
[http://download.novell.com/Download?buildid=GjZRRdqCFW0]
[http://www.novell.com/support/viewContent.do?externalId=7002502]
[20090202 ZDI-09-010: Novell Netware Groupwise GWIA RCPT Command Buffer Overflow Vulnerability]
[33560]
[http://www.zerodayinitiative.com/advisories/ZDI-09-010/]
Google Chrome before 1.0.154.46 does not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls and other web script.
[http://codereview.chromium.org/11264]
[http://codereview.chromium.org/18533]
[http://sites.google.com/a/chromium.org/dev/getting-involved/dev-channel/release-notes]
[http://src.chromium.org/viewvc/chrome?view=rev&revision=8529]
[googlechrome-xmlhttprequest-info-disclosure(48554)]
The ProcessLogin function in class.auth.php in Interspire Shopping Cart (ISC) 4.0.1 Ultimate edition allows remote attackers to bypass authentication and obtain administrative access by reusing the RememberToken cookie after a failed admin login attempt.
[20090112 [BMSA-2009-01] Authentication bypass in Interspire Shopping Cart v4.0.1 and below]
[33212]
[1021557]
[interspire-classauth-security-bypass(47899)]
Cross-site scripting (XSS) vulnerability in RoundCube Webmail (roundcubemail) 0.2 stable allows remote attackers to inject arbitrary web script or HTML via the background attribute embedded in an HTML e-mail message.
[http://trac.roundcube.net/changeset/2245]
[33372]
[ADV-2009-0192]
[roundcube-html-xss(48129)]
[FEDORA-2009-1256]
Unspecified vulnerability in Tor before 0.2.0.33 has unspecified impact and remote attack vectors that trigger heap corruption.
[[or-announce] 20090122 Tor 0.2.0.33 is released]
[http://blog.torproject.org/blog/tor-0.2.0.33-stable-released]
[GLSA-200904-11]
[33399]
[1021633]
[ADV-2009-0210]
[FEDORA-2009-0897]
Untrusted search path vulnerability in trickle 1.07 allows local users to execute arbitrary code via a Trojan horse trickle-overload.so in the current working directory, which is referenced in the LD_PRELOAD path.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=513456]
[[oss-security] 20090129 CVE Request (trickle)]
[33516]
The SSL certificate setup program (genSslCert.sh) in Standards Based Linux Instrumentation for Manageability (SBLIM) sblim-sfcb 1.3.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /var/tmp/key.pem, (2) /var/tmp/cert.pem, and (3) /var/tmp/ssl.cnf temporary files.
[SUSE-SR:2009:004]
[[oss-security] 20090203 CVE Request: sblim-sfcb genSslCert.sh temp race]
[http://sourceforge.net/tracker/index.php?func=detail&aid=2561165&group_id=128809&atid=712784]
[33583]
Cross-site scripting (XSS) vulnerability in the AgaviWebRouting::gen(null) method in Agavi 0.11 before 0.11.6 and 1.0 before 1.0.0 beta 8 allows remote attackers to inject arbitrary web script or HTML via a crafted URL with certain characters that are not properly handled by web browsers that do not strictly follow RFC 3986, such as Internet Explorer 6 and 7.
[http://blog.agavi.org/post/75829956/agavi-0-11-6-released-fixes-vulnerability]
[http://blog.agavi.org/post/75830918/agavi-1-0-0-beta-8-released-fixes-vulnerability]
[http://trac.agavi.org/ticket/1019]
[33826]
The IPv6 Neighbor Discovery Protocol (NDP) implementation in HP HP-UX B.11.11, B.11.23, and B.11.31 does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity), read private network traffic, and possibly execute arbitrary code via a spoofed message that modifies the Forward Information Base (FIB), a related issue to CVE-2008-2476.
[1021660]
[ADV-2009-0312]
[oval:org.mitre.oval:def:5943]
Microsoft XML Core Services, as used in Microsoft Expression Web, Office, Internet Explorer 6 and 7, and other products, does not properly restrict access from web pages to Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly protection mechanism. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-4033.
[https://bugzilla.mozilla.org/show_bug.cgi?id=380418]
[msxml-httponly-cookie-information-disclosure(48815)]
SQL injection vulnerability in the RD-Autos (com_rdautos) 1.5.5 Stable component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
[33297]
[7795]
SQL injection vulnerability in the Eventing (com_eventing) 1.6.x component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.
[33296]
[eventing-index-sql-injection(48016)]
[7793]
Dynamic variable evaluation vulnerability in lists/admin.php in phpList 2.10.8 and earlier, when register_globals is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the _SERVER[ConfigFile] parameter to admin/index.php.
Register Globals are disabled by default, so this will not increase access complexity.
[http://www.bugreport.ir/index_60.htm]
[20090114 phpList <= 2.10.8 Local File inclusion]
[phplist-indexphp-file-include(47945)]
[7778]
Directory traversal vulnerability in index.php in Php Photo Album (PHPPA) 0.8 BETA allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the preview parameter.
[33277]
[phpphotoalbum-index-file-include(48017)]
[7786]
Cross-site scripting (XSS) vulnerability in sign1.php in AN Guestbook (ANG) before 0.7.7 allows remote attackers to inject arbitrary web script or HTML via the country parameter, which is not properly handled in (1) administrator/manage.php or (2) administrator/trash.php. NOTE: some of these details are obtained from third party information.
[http://sourceforge.net/forum/forum.php?forum_id=907703]
[http://sourceforge.net/project/shownotes.php?release_id=653720]
[33292]
[anguestbook-sign1-xss(48018)]
SQL injection vulnerability in index.php in Blue Eye CMS 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the clanek parameter.
[33303]
[7797]
SQL injection vulnerability in CategoryManager/upload_image_category.asp in DMXReady Classified Listings Manager 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cid parameter.
[33253]
[classifieds-uploadimage-sql-injection(47959)]
[7767]
SQL injection vulnerability in CategoryManager/upload_image_category.asp in DMXReady Member Directory Manager 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cid parameter.
[http://dmxready.helpserve.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=93]
[http://dmxready.helpserve.com/index.php?_m=news&_a=viewnews&newsid=12]
[33253]
[memberdirectory-uploadimage-sql-injection(47960)]
[7773]
SQL injection vulnerability in CategoryManager/upload_image_category.asp in DMXReady Secure Document Library 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cid parameter.
[http://dmxready.helpserve.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=93]
[http://dmxready.helpserve.com/index.php?_m=news&_a=viewnews&newsid=12]
[33253]
[securedocumentlibrary-uploadimage-sql-inj(48013)]
[7787]
Multiple SQL injection vulnerabilities in Active Bids allow remote attackers to execute arbitrary SQL commands via the (1) search parameter to search.asp, (2) SortDir parameter to auctionsended.asp, and the (3) catid parameter to wishlist.php.
[20090116 Active Bids]
[33306]
Multiple cross-site scripting (XSS) vulnerabilities in Active Bids allow remote attackers to inject arbitrary web script or HTML via the (1) search parameter to search.asp and the (2) URL parameter to tellafriend.asp.
[20090116 Active Bids]
[33306]
SQL injection vulnerability in Default.asp in LinksPro Standard Edition allows remote attackers to execute arbitrary SQL commands via the OrderDirection parameter.
[http://packetstormsecurity.org/0901-exploits/linkspro-sql.txt]
[33305]
The installation process for the File Transfer servlet in the System Management/Repository component in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.19 does not enable the secure version, which allows remote attackers to obtain sensitive information via unspecified vectors.
[33700]
[http://www-01.ibm.com/support/docview.wss?uid=swg27007951]
[websphere-file-transfer-info-disclosure(48522)]
Unspecified vulnerability in IBM WebSphere Application Server (WAS) 5.1.x before 5.1.1.19, 6.0.x before 6.0.2.29, and 6.1.x before 6.1.0.19, when Web Server plug-in content buffering is enabled, allows attackers to cause a denial of service (daemon crash) via unknown vectors, related to a mishandling of client read failures in which clients receive many 500 HTTP error responses and backend servers are incorrectly labeled as down.
[33700]
[http://www-01.ibm.com/support/docview.wss?uid=swg27006879]
[http://www-01.ibm.com/support/docview.wss?uid=swg27007033]
[http://www-01.ibm.com/support/docview.wss?uid=swg27007951]
[PK63499]
[websphere-server-plugin-dos(48523)]
PerfServlet in the PMI/Performance Tools component in IBM WebSphere Application Server (WAS) 6.0.x before 6.0.2.31, 6.1.x before 6.1.0.21, and 7.0.x before 7.0.0.1, when Performance Monitoring Infrastructure (PMI) is enabled, allows local users to obtain sensitive information by reading the (1) systemout.log and (2) ffdc files. NOTE: this is probably a duplicate of CVE-2008-5413.
[33700]
[ADV-2009-0423]
[http://www-01.ibm.com/support/docview.wss?uid=swg27006876]
[http://www-01.ibm.com/support/docview.wss?uid=swg27007951]
[http://www-01.ibm.com/support/docview.wss?uid=swg27014463]
[PK79230]
[websphere-pmi-information-disclosure(48524)]
Unspecified vulnerability in the IBM Asynchronous I/O (aka AIO or libibmaio) library in the Java Message Service (JMS) component in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.17 on AIX 5.3 allows attackers to cause a denial of service (daemon crash) via vectors related to the aio_getioev2 and getEvent methods.
[33700]
[PK64529]
[http://www-01.ibm.com/support/docview.wss?uid=swg27007951]
[websphere-libibmaio-dos(48525)]
The (1) mod_ibm_ssl and (2) mod_cgid modules in IBM HTTP Server 6.0.x before 6.0.2.31 and 6.1.x before 6.1.0.19, as used in WebSphere Application Server (WAS), set incorrect permissions for AF_UNIX sockets, which has unknown impact and local attack vectors.
[33700]
[http://www-01.ibm.com/support/docview.wss?uid=swg27006876]
[http://www-01.ibm.com/support/docview.wss?uid=swg27007033]
[http://www-01.ibm.com/support/docview.wss?uid=swg27007951]
[http://www-01.ibm.com/support/docview.wss?uid=swg27008517]
[websphere-http-afunix-incorrect-permissions(48526)]
The Installation Factory installation process for IBM WebSphere Application Server (WAS) 6.0.2 on Windows, when WAS is registered as a Windows service, allows local users to obtain sensitive information by reading the logs/instconfigifwas6.log log file.
[33849]
[websphere-install-log-info-disclosure(48527)]
IBM WebSphere Application Server (WAS) 7 before 7.0.0.1 on Windows allows remote attackers to bypass "Authorization checking" and obtain sensitive information from JSP pages via a crafted request. NOTE: this is probably a duplicate of CVE-2008-5412.
[33700]
[http://www-01.ibm.com/support/docview.wss?uid=swg27014463]
[websphere-jsp-win-information-disclosure(48528)]
Unspecified vulnerability in the queue manager in IBM WebSphere MQ (WMQ) 5.3, 6.0 before 6.0.2.6, and 7.0 before 7.0.0.2 allows local users to gain privileges via vectors related to the (1) setmqaut, (2) dmpmqaut, and (3) dspmqaut authorization commands.
[33857]
[http://www-01.ibm.com/support/docview.wss?rs=171&uid=swg27006037]
[websphere-mq-privilege-escalation(48529)]
IBM WebSphere Partner Gateway (WPG) 6.0.0 through 6.0.0.7 does not properly handle failures of signature verification, which might allow remote authenticated users to submit a crafted RosettaNet (aka RNIF) document to a backend application, related to (1) "altered service content" and (2) "digital signature foot-print."
[33839]
[http://www-01.ibm.com/support/docview.wss?uid=swg21330341]
[JR31231]
[websphere-pgateway-rnif-signatures(48530)]
PHP remote file inclusion vulnerability in skin_shop/standard/2_view_body/body_default.php in TECHNOTE 7.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the shop_this_skin_path parameter, a different vector than CVE-2008-4138.
[33592]
[7965]
Directory traversal vulnerability in bbcode.php in PHPbbBook 1.3 and 1.3h allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the l parameter.
[33603]
[ADV-2009-0317]
[7980]
Stack-based buffer overflow in Elecard AVC HD PLAYER 5.5.90116 allows remote attackers to execute arbitrary code via an M3U file containing a long string in a URL.
[33089]
[7942]
Multiple PHP remote file inclusion vulnerabilities in GRBoard 1.8, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) theme parameter to (a) 179_squarebox_pds_list/view.php, (b) 179_squarebox_minishop_expand/view.php, (c) 179_squarebox_gallery_list_pds/view.php, (d) 179_squarebox_gallery_list/view.php, (e) 179_squarebox_gallery/view.php, (f) 179_squarebox_board_swfupload/view.php, (g) 179_squarebox_board_expand/view.php, (h) 179_squarebox_board_basic_with_grcode/view.php, (i) 179_squarebox_board_basic/view.php, (j) 179_simplebar_pds_list/view.php, (k) 179_simplebar_notice/view.php, (l) 179_simplebar_gallery_list_pds/view.php, (m) 179_simplebar_gallery/view.php, and (n) 179_simplebar_basic/view.php in theme/; the (2) path parameter to (o) latest/sirini_gallery_latest/list.php; and the (3) grboard parameter to (p) include.php and (q) form_mail.php.
[33602]
[7979]
SQL injection vulnerability in index.php in Dreampics Gallery Builder allows remote attackers to execute arbitrary SQL commands via the exhibition_id parameter in a gallery.viewPhotos action.
[33596]
[dreampics-exhibitionid-sql-injection(48468)]
[7968]
[9451]
SQL injection vulnerability in photo.php in WEBalbum 2.4b allows remote attackers to execute arbitrary SQL commands via the id parameter.
[33590]
[7961]
Multiple SQL injection vulnerabilities in default.asp in MyDesign Sayac 2.0 allow remote attackers to execute arbitrary SQL commands via (1) the user parameter (aka UserName field) or (2) the pass parameter (aka Pass field) to (a) admin/admin.asp or (b) the default URI under admin/. NOTE: some of these details are obtained from third party information.
[33593]
[7963]
Directory traversal vulnerability in admin/modules/aa/preview.php in Syntax Desktop 2.7 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the synTarget parameter.
[33601]
[ADV-2009-0319]
[syntax-desktop-preview-file-include(48496)]
[7977]
Buffer overflow in klim5.sys in Kaspersky Anti-Virus for Workstations 6.0 and Anti-Virus 2008 allows local users to gain privileges via an IOCTL 0x80052110 call.
[http://kartoffel.reversemode.com/downloads/kaspersky_klim5_plugin.zip]
[http://www.reversemode.com/index.php?option=com_content&task=view&id=60&Itemid=1]
[20090202 [Wintercore Research WS02-0209] Kaspersky Products Klim5.sys local privilege escalation]
[33561]
[1021661]
[http://www.wintercore.com/advisories/advisory_W020209.html]
Stack-based buffer overflow in BlazeVideo HDTV Player 3.5 and earlier allows remote attackers to execute arbitrary code via a long string in a playlist (aka .plf) file.
[33588]
[blazevideo-hdtv-plf-bo(48498)]
[7975]
SQL injection vulnerability in Skalfa SkaLinks 1.5 allows remote attackers to execute arbitrary SQL commands via the Admin name field to the default URI under admin/.
[33546]
[7932]
Multiple SQL injection vulnerabilities in parents/login.php in Online Grades 3.2.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) uname or (2) pass parameter.
[33576]
[7956]
Online Grades 3.2.4 allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function.
[7956]
Multiple SQL injection vulnerabilities in DMXReady Online Notebook Manager 1.1 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password field. NOTE: some third parties report inability to verify this issue.
[33600]
[onm-login-sql-injection(48503)]
[7970]
Cross-site scripting (XSS) vulnerability in the anonymous comments feature in lib-comment.php in glFusion 1.1.0, 1.1.1, and earlier versions allows remote attackers to inject arbitrary web script or HTML via the username parameter to comment.php.
[http://www.fortconsult.net/images/pdf/advisories/glFusion-xss-advisory.pdf]
[http://www.glfusion.org/article.php/xsscomments]
[33683]
[glfusion-libcomment-xss(48603)]
PHP remote file inclusion vulnerability in examples/example_clientside_javascript.php in patForms, as used in Sourdough 0.3.5, allows remote attackers to execute arbitrary PHP code via a URL in the neededFiles[patForms] parameter.
[33569]
[7946]
Multiple directory traversal vulnerabilities in AJA Portal 1.2 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the currentlang parameter to admin/case.php in the (1) Contact_Plus and (2) Reviews modules, and (3) the module_name parameter to admin/includes/FANCYNLOptions.php in the Fancy_NewsLetter module.
[33565]
[7939]
Multiple SQL injection vulnerabilities in admin/login_submit.php in Whole Hog Ware Support 1.x allow remote attackers to execute arbitrary SQL commands via (1) the uid parameter (aka Username field) or (2) the pwd parameter (aka Password field). NOTE: some of these details are obtained from third party information.
[33564]
[7940]
Multiple SQL injection vulnerabilities in admin/login_submit.php in Whole Hog Password Protect: Enhanced 1.x allow remote attackers to execute arbitrary SQL commands via (1) the uid parameter (aka Username field) or (2) the pwd parameter (aka Password field). NOTE: some of these details are obtained from third party information.
[33564]
[7941]
Whole Hog Ware Support 1.x allows remote attackers to bypass authentication and obtain administrative access via an integer value in the adminid cookie.
[33577]
[7951]
Whole Hog Password Protect: Enhanced 1.x allows remote attackers to bypass authentication and obtain administrative access via an integer value in the adminid cookie.
[33577]
[7952]
Multiple SQL injection vulnerabilities in customer_login_check.asp in ClickTech ClickCart 6.0 allow remote attackers to execute arbitrary SQL commands via (1) the txtEmail parameter (aka E-MAIL field) or (2) the txtPassword parameter (aka password field) to customer_login.asp. NOTE: some of these details are obtained from third party information.
[33575]
[7953]
PHP remote file inclusion vulnerability in includes/header.php in Groone GLinks 2.1 allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.
[33578]
[7954]
PHP remote file inclusion vulnerability in includes/header.php in Groone GBook 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.
[33578]
[7955]
The SaveDoc method in the All_In_The_Box.AllBox ActiveX control in ALL_IN_THE_BOX.OCX in Synactis ALL In-The-Box ActiveX 3 allows remote attackers to create and overwrite arbitrary files via an argument ending in a '\0' character, which bypasses the intended .box filename extension, as demonstrated by a C:\boot.ini\0 argument.
[http://www.dsecrg.com/pages/vul/show.php?id=62]
[33535]
[ADV-2009-0298]
[7928]
Cross-site scripting (XSS) vulnerability in Vivvo CMS before 4.1.1 allows remote attackers to inject arbitrary web script or HTML via a URI that triggers a 404 Page Not Found response.
[33582]
[http://www.vivvo.net/changelog.php]
Cross-site scripting (XSS) vulnerability in proxy.html in Profense Web Application Firewall 2.6.2 and 2.6.3 allows remote attackers to inject arbitrary web script or HTML via the proxy parameter in a deny_log manage action.
[33523]
[7919]
Multiple cross-site request forgery (CSRF) vulnerabilities in ajax.html in Profense Web Application Firewall 2.6.2 and 2.6.3 allow remote attackers to hijack the authentication of administrators for requests that (1) shutdown the server, (2) send ping packets, (3) enable network services, (4) configure a proxy server, and (5) modify other settings via parameters in the query string.
[33523]
[7919]
Unspecified vulnerability in futomi's CGI Cafe Fulltext search CGI 1.1.2 allows remote attackers to gain administrative privileges via unknown vectors.
[JVN#80771386]
[JVNDB-2009-000008]
[http://www.futomi.com/library/info/2009/20090123.html]
[33409]
Multiple cross-site scripting (XSS) vulnerabilities in the HTTP server in Cisco IOS 12.4(23) allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under (1) level/15/exec/-/ or (2) exec/, a different vulnerability than CVE-2008-3821.
[20090204 Cisco IOS XSS/CSRF Vulnerability]
[33625]
Cross-site request forgery (CSRF) vulnerability in the HTTP server in Cisco IOS 12.4(23) allows remote attackers to execute arbitrary commands, as demonstrated by executing the hostname command with a level/15/configure/-/hostname request.
[20090204 Cisco IOS XSS/CSRF Vulnerability]
Multiple cross-site scripting (XSS) vulnerabilities in the web interface in the Rockwell Automation ControlLogix 1756-ENBT/A EtherNet/IP Bridge Module allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://rockwellautomation.custhelp.com/cgi-bin/rockwellautomation.cfg/php/enduser/std_adp.php?p_faqid=57729]
[VU#882619]
[33638]
[ADV-2009-0347]
Open redirect vulnerability in the web interface in the Rockwell Automation ControlLogix 1756-ENBT/A EtherNet/IP Bridge Module allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
[http://rockwellautomation.custhelp.com/cgi-bin/rockwellautomation.cfg/php/enduser/std_adp.php?p_faqid=57729]
[VU#619499]
[33636]
[ADV-2009-0347]
The web interface in the Rockwell Automation ControlLogix 1756-ENBT/A EtherNet/IP Bridge Module allows remote attackers to obtain "internal web page information" and "internal information about the module" via unspecified vectors. NOTE: this may overlap CVE-2002-1603.
[http://rockwellautomation.custhelp.com/cgi-bin/rockwellautomation.cfg/php/enduser/std_adp.php?p_faqid=57729]
[VU#124059]
[http://www.kb.cert.org/vuls/id/RGII-7MWKZ3]
[ADV-2009-0347]
Integer underflow in the Huffman decoding functionality (pvmp3_huffman_parsing.cpp) in OpenCORE 2.0 and earlier allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a crafted MP3 file that triggers heap corruption.
[http://android.git.kernel.org/?p=platform/external/opencore.git;a=commit;h=7b466cd0ecfdba72c4cbd0f3a8c2001141376b0f]
[http://review.source.android.com/Gerrit#change,8815]
[http://www.ocert.org/advisories/ocert-2009-002.html]
[20090207 [oCERT-2009-002] OpenCORE insufficient bounds checking during MP3 decoding]
[33673]
Stack-based buffer overflow in MultiMedia Soft AdjMmsEng.dll 7.11.1.0 and 7.11.2.7, as distributed in multiple MultiMedia Soft audio components for .NET, allows remote attackers to execute arbitrary code via a long string in a playlist (.pls) file, as originally reported for Euphonics Audio Player 1.0. NOTE: some of these details are obtained from third party information.
[20090203 Euphonics Audio Player v1.0 (.pls) Local BOF POC]
[33589]
[ADV-2009-0316]
[7958]
[7973]
[7974]
Unspecified vulnerability in the process (aka proc) filesystem in Sun OpenSolaris snv_85 through snv_100 allows local users to gain privileges via vectors related to the contract filesystem.
[244026]
[http://www.ioactive.com/pdfs/OpenSolarisUPtrDeref.pdf]
[33654]
[ADV-2009-0352]
Squid 2.7 to 2.7.STABLE5, 3.0 to 3.0.STABLE12, and 3.1 to 3.1.0.4 allows remote attackers to cause a denial of service via an HTTP request with an invalid version number, which triggers a reachable assertion in (1) HttpMsg.c and (2) HttpStatusLine.c.
[SUSE-SR:2009:005]
[GLSA-200903-38]
[MDVSA-2009:034]
[20090204 Squid Proxy Cache Denial of Service in request handling]
[33604]
[1021684]
[http://www.squid-cache.org/Advisories/SQUID-2009_1.txt]
[http://www.squid-cache.org/Versions/v2/2.7/changesets/12432.patch]
[https://bugzilla.redhat.com/show_bug.cgi?id=484246]
[8021]
Multiple SQL injection vulnerabilities in admin/admin_login.php in Online Grades 3.2.4 allow remote attackers to execute arbitrary SQL commands via the (1) uname or (2) pword parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
The IP implementation in Sun Solaris 8 through 10, and OpenSolaris before snv_82, uses an improper arena when allocating minor numbers for sockets, which allows local users to cause a denial of service (32-bit application failure and login outage) by opening a large number of sockets.
[1021653]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-116965-34-1]
[248026]
[http://support.avaya.com/elmodocs2/security/ASA-2009-042.htm]
[33550]
[ADV-2009-0364]
[oval:org.mitre.oval:def:6038]
Bugzilla 2.x before 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote authenticated users to conduct cross-site scripting (XSS) and related attacks by uploading HTML and JavaScript attachments that are rendered by web browsers.
[http://www.bugzilla.org/security/2.22.6/]
[33580]
[FEDORA-2009-2418]
[FEDORA-2009-2417]
Cross-site request forgery (CSRF) vulnerability in Bugzilla before 3.2 before 3.2.1, 3.3 before 3.3.2, and other versions before 3.2 allows remote attackers to perform bug updating activities as other users via a link or IMG tag to process_bug.cgi.
[http://www.bugzilla.org/security/2.22.6/]
[33580]
[FEDORA-2009-2418]
[FEDORA-2009-2417]
Cross-site request forgery (CSRF) vulnerability in Bugzilla 2.22 before 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote attackers to delete keywords and user preferences via a link or IMG tag to (1) editkeywords.cgi or (2) userprefs.cgi.
[http://www.bugzilla.org/security/2.22.6/]
[33580]
[https://bugzilla.mozilla.org/show_bug.cgi?id=466692]
[https://bugzilla.mozilla.org/show_bug.cgi?id=472362]
[FEDORA-2009-2418]
[FEDORA-2009-2417]
Cross-site request forgery (CSRF) vulnerability in Bugzilla 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote attackers to delete shared or saved searches via a link or IMG tag to buglist.cgi.
[http://www.bugzilla.org/security/2.22.6/]
[33580]
[https://bugzilla.mozilla.org/show_bug.cgi?id=466748]
[FEDORA-2009-2418]
[FEDORA-2009-2417]
Cross-site request forgery (CSRF) vulnerability in Bugzilla 2.17 to 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote attackers to delete unused flag types via a link or IMG tag to editflagtypes.cgi.
[http://www.bugzilla.org/security/2.22.6/]
[33580]
[https://bugzilla.mozilla.org/show_bug.cgi?id=466692]
[FEDORA-2009-2418]
[FEDORA-2009-2417]
Bugzilla 3.2.1, 3.0.7, and 3.3.2, when running under mod_perl, calls the srand function at startup time, which causes Apache children to have the same seed and produce insufficiently random numbers for random tokens, which allows remote attackers to bypass cross-site request forgery (CSRF) protection mechanisms and conduct unauthorized activities as other users.
[http://www.bugzilla.org/security/3.0.7/]
[33581]
[FEDORA-2009-2418]
[FEDORA-2009-2417]
Cross-site scripting (XSS) vulnerability in Mahara before 1.0.9 allows remote attackers to inject arbitrary web script or HTML via a crafted forum post.
[http://mahara.org/interaction/forum/topic.php?id=198]
[33619]
[mahara-unspecified-xss(48518)]
Cross-site scripting (XSS) vulnerability in Phorum before 5.2.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://www.phorum.org/phorum5/read.php?64,136129]
[33657]
The DBus configuration file for Wicd before 1.5.9 allows arbitrary users to own org.wicd.daemon, which allows local users to receive messages that were intended for the Wicd daemon, possibly including credentials.
[http://bazaar.launchpad.net/~wicd-devel/wicd/trunk/revision/222]
[GLSA-200904-12]
[http://sourceforge.net/project/shownotes.php?group_id=194573&release_id=659059]
[[oss-security] 20090206 CVE Request - Wicd <= 1.5.8]
Stack-based buffer overflow in the String_parse::get_nonspace_quoted function in lib-src/allegro/strparse.cpp in Audacity 1.2.6 and other versions before 1.3.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a .gro file containing a long string.
[http://bugs.gentoo.org/show_bug.cgi?id=253493]
[SUSE-SR:2009:004]
[[audacity-devel] 20090110 Audacity "String_parse::get_nonspace_quoted()" Buffer Overflow]
[33090]
[ADV-2009-0008]
[7634]
Stack-based buffer overflow in Elecard MPEG Player 5.5 build 15884.081218 allows remote attackers to execute arbitrary code via a M3U file containing a long URL.
[ADV-2009-0007]
[7637]
Unspecified vulnerability in SimpleIrcBot before 1.0 Stable has unknown impact and attack vectors related to an "auth vulnerability."
[http://sourceforge.net/project/shownotes.php?group_id=249202&release_id=650796]
[33127]
[ADV-2009-0020]
SQL injection vulnerability in login.php in IT!CMS 2.1a and earlier allows remote attackers to execute arbitrary SQL commands via the Username.
[33139]
[itcms-login-sql-injection(47791)]
[7686]
SQL injection vulnerability in the Portfol (com_portfol) 1.2 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the vcatid parameter in a viewcategory action to index.php.
[33218]
[7734]
PHP remote file inclusion vulnerability in include/define.php in REALTOR 747 4.11 allows remote attackers to execute arbitrary PHP code via a URL in the INC_DIR parameter.
[33227]
[7743]
Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.6.2 allow remote attackers to inject arbitrary web script or HTML via the (1) log parameter to (a) logviewer.jsp and (b) log.jsp; (2) search parameter to (c) group-summary.jsp; (3) username parameter to (d) user-properties.jsp; (4) logDir, (5) maxTotalSize, (6) maxFileSize, (7) maxDays, and (8) logTimeout parameters to (e) audit-policy.jsp; (9) propName parameter to (f) server-properties.jsp; and the (10) roomconfig_roomname and (11) roomconfig_roomdesc parameters to (g) muc-room-edit-form.jsp. NOTE: this can be leveraged for arbitrary code execution by using XSS to upload a malicious plugin.
[http://www.coresecurity.com/content/openfire-multiple-vulnerabilities]
[http://www.igniterealtime.org/issues/browse/JM-1506]
[20090108 CORE-2008-1128: Openfire multiple vulnerabilities]
[32935]
[32937]
[32938]
[32939]
[32940]
[32943]
[32944]
[https://bugs.gentoo.org/show_bug.cgi?id=254309]
[openfire-multiple-scripts-xss(47834)]
[openfire-serverproperties-xss(47835)]
[openfire-mucroomeditform-xss(47845)]
Directory traversal vulnerability in log.jsp in Ignite Realtime Openfire 3.6.2 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the log parameter.
[http://svn.igniterealtime.org/svn/repos/openfire/trunk/src/web/log.jsp]
[http://www.coresecurity.com/content/openfire-multiple-vulnerabilities]
[20090108 CORE-2008-1128: Openfire multiple vulnerabilities]
[32945]
[https://bugs.gentoo.org/show_bug.cgi?id=257585]
[openfire-log-directory-traversal(47806)]
Virtual GuestBook (vgbook) 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request to guestbook.mdb.
[7744]
Cross-site request forgery (CSRF) vulnerability in the forum code in Moodle 1.7 before 1.7.7, 1.8 before 1.8.8, and 1.9 before 1.9.4 allows remote attackers to delete unauthorized forum posts via a link or IMG tag to post.php.
[http://cvs.moodle.org/moodle/mod/forum/post.php?r1=1.154.2.14&r2=1.154.2.15]
[SUSE-SR:2009:007]
[http://moodle.org/security/]
[[oss-security] 20090204 CVS request - Moodle]
Cross-site scripting (XSS) vulnerability in course/lib.php in Moodle 1.6 before 1.6.9, 1.7 before 1.7.7, 1.8 before 1.8.8, and 1.9 before 1.9.4 allows remote attackers to inject arbitrary web script or HTML via crafted log table information that is not properly handled when it is displayed in a log report.
[SUSE-SR:2009:007]
[http://moodle.org/security/]
[DSA-1724]
[[oss-security] 20090204 CVS request - Moodle]
Unspecified vulnerability in the Calendar export feature in Moodle 1.8 before 1.8.8 and 1.9 before 1.9.4 allows attackers to obtain sensitive information and conduct "brute force attacks on user accounts" via unknown vectors.
[SUSE-SR:2009:007]
[http://moodle.org/security/]
[[oss-security] 20090204 CVS request - Moodle]
Cross-site scripting (XSS) vulnerability in blocks/html/block_html.php in Snoopy 1.2.3, as used in Moodle 1.6 before 1.6.9, 1.7 before 1.7.7, 1.8 before 1.8.8, and 1.9 before 1.9.4, allows remote attackers to inject arbitrary web script or HTML via an HTML block, which is not properly handled when the "Login as" feature is used to visit a MyMoodle or Blog page.
[SUSE-SR:2009:007]
[http://moodle.org/security/]
[DSA-1724]
[[oss-security] 20090204 CVS request - Moodle]
IBM WebSphere Message Broker 6.1.x before 6.1.0.2 writes a database connection password to the Event Log and System Log during exception handling for a JDBC error, which allows local users to obtain sensitive information by reading these logs.
[33819]
[1021735]
[ADV-2009-0460]
[http://www-01.ibm.com/support/docview.wss?rs=849&uid=swg27011431]
[IC55298]
[websphere-msgbroker-info-disclosure(48642)]
WSPolicy in the Web Services component in IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.1 does not properly recognize the IDAssertion.isUsed binding property, which allows local users to discover a password by reading a SOAP message.
[http://www-01.ibm.com/support/docview.wss?uid=swg27014463]
[PK73573]
[websphere-wspolicy-information-disclosure(48700)]
The CICS listener in IBM TXSeries for Multiplatforms 6.2 GA waits for a forcepurge acknowledgement from the CICS Application Server (CICSAS) after an eci response timeout, which might allow remote authenticated users to cause a denial of service (forcepurge handling delay), or have unspecified other impact, via vectors involving slow or nonexistent acknowledgement.
[33883]
[ADV-2009-0911]
[http://www-01.ibm.com/support/docview.wss?uid=swg24019725]
[txseries-forcepurge-wait-unspecified(48885)]
Unspecified vulnerability in IBM WebSphere Application Server (WAS) 5.1 and 6.0.2 before 6.0.2.33 on z/OS, when CSIv2 Identity Assertion is enabled and Enterprise JavaBeans (EJB) interaction occurs between a WAS 6.1 instance and a WAS pre-6.1 instance, allows local users to have an unknown impact via vectors related to (1) use of the wrong subject and (2) multiple CBIND checks.
Per http://www-01.ibm.com/support/docview.wss?uid=swg27006876#60223:
"Note: WebSphere Application Server V6.0.2 Fix Pack 2 (6.0.2.2), Fix Pack 4 (6.0.2.4), Fix Pack 6 (6.0.2.6), Fix Pack 8 (6.0.2.8), Fix Pack 10 (6.0.2.10), Fix Pack 12 (6.0.2.12), Fix Pack 14 (6.0.2.14), Fix Pack 16 (6.0.2.16), Fix Pack 18 (6.0.2.18), Fix Pack 20 (6.0.2.20), Fix Pack 22 (6.0.2.22) and Fix Pack 24 (6.0.2.24) were only published for the z/OS® platform."
[33884]
[http://www-01.ibm.com/support/docview.wss?uid=swg27006876]
[websphere-zos-csiv2-unspecified(48886)]
IBM WebSphere Process Server (WPS) 6.1.2 before 6.1.2.3 and 6.2 before 6.2.0.1 does not properly restrict configuration data during an export of the cluster configuration file from the administrative console, which allows remote authenticated users to obtain the (1) JMSAPI, (2) ESCALATION, and (3) MAILSESSION (aka mail session) cleartext passwords via vectors involving access to a cluster member.
[ADV-2009-0670]
[http://www-01.ibm.com/support/docview.wss?uid=swg27015580]
[JR30088]
[websphere-process-server-info-disclosure(48892)]
The Servlet Engine/Web Container and JSP components in IBM WebSphere Application Server (WAS) 5.1.0, 5.1.1.19, 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.23, and 7.0 before 7.0.0.3 allow remote attackers to read arbitrary files contained in war files in (1) web-inf, (2) meta-inf, and unspecified other directories via unknown vectors, related to (a) web-based applications and (b) the administrative console.
Per: http://xforce.iss.net/xforce/xfdb/49085
CVSS score based on information provided by ISS.
[34104]
[ADV-2009-0704]
[ADV-2009-1188]
[ADV-2009-1464]
[http://www-01.ibm.com/support/docview.wss?rs=180&uid=swg24022456]
[http://www-01.ibm.com/support/docview.wss?uid=swg21380233]
[http://www-01.ibm.com/support/docview.wss?uid=swg21380376]
[http://www-01.ibm.com/support/docview.wss?uid=swg27006876]
[websphere-web-app-information-disclosure(49085)]
Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 allows remote attackers to execute arbitrary code via a crafted file that triggers memory corruption.
[SUSE-SA:2009:035]
[SUSE-SR:2009:012]
[GLSA-200907-06]
[1022361]
[http://www.adobe.com/support/security/bulletins/apsb09-07.html]
[RHSA-2009:1109]
[35274]
[TA09-161A]
[ADV-2009-1547]
[reader-text-bo(49239)]
Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-0511, CVE-2009-0512, CVE-2009-0888, and CVE-2009-0889.
[SUSE-SA:2009:035]
[SUSE-SR:2009:012]
[GLSA-200907-06]
[1022361]
[http://www.adobe.com/support/security/bulletins/apsb09-07.html]
[RHSA-2009:1109]
[35274]
[TA09-161A]
[ADV-2009-1547]
Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-0510, CVE-2009-0512, CVE-2009-0888, and CVE-2009-0889.
[SUSE-SA:2009:035]
[SUSE-SR:2009:012]
[GLSA-200907-06]
[1022361]
[http://www.adobe.com/support/security/bulletins/apsb09-07.html]
[RHSA-2009:1109]
[35274]
[TA09-161A]
[ADV-2009-1547]
Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-0510, CVE-2009-0511, CVE-2009-0888, and CVE-2009-0889.
[SUSE-SA:2009:035]
[SUSE-SR:2009:012]
[GLSA-200907-06]
[1022361]
[http://www.adobe.com/support/security/bulletins/apsb09-07.html]
[RHSA-2009:1109]
[35274]
[35293]
[TA09-161A]
[ADV-2009-1547]
Multiple PHP remote file inclusion vulnerabilities in WebFrame 0.76 allow remote attackers to execute arbitrary PHP code via a URL in the classFiles parameter to (1) admin/doc/index.php, (2) index.php, and (3) base/menu.php in mod/.
[33701]
[8025]
Multiple directory traversal vulnerabilities in WebFrame 0.76 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) currentmod and (2) LANG parameters to mod/index.php.
[33701]
[8025]
Directory traversal vulnerability in check_lang.php in Yet Another NOCC (YANOCC) 0.1.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.
[33704]
[ADV-2009-0383]
[yanocc-checklang-file-include(48608)]
[8020]
SQL injection vulnerability in the classified page (classified.php) in BusinessSpace 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
[20090209 [ECHO_ADV_102$2009] BusinessSpace <= 1.2 (id) Remote SQL Injection Vulnerability]
[33692]
[businessspace-index-sql-injection(48606)]
[8011]
Eval injection vulnerability in index.php in phpSlash 0.8.1.1 and earlier allows remote attackers to execute arbitrary PHP code via the fields parameter, which is supplied to an eval function call within the generic function in include/class/tz_env.class. NOTE: some of these details are obtained from third party information.
[20090201 phpslash <= 0.8.1.1 Remote Code Execution Exploit]
[33572]
[phpslash-generic-code-execution(48441)]
[7948]
VI Client in VMware VirtualCenter before 2.5 Update 4, VMware ESXi 3.5 before Update 4, and VMware ESX 3.5 before Update 4 retains the VirtualCenter Server password in process memory, which might allow local users to obtain this password.
[[security-announce] 20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues]
[20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues]
[34373]
[http://www.vmware.com/security/advisories/VMSA-2009-0005.html]
[ADV-2009-0944]
[oval:org.mitre.oval:def:6376]
Unspecified vulnerability in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a crafted Shockwave Flash (aka .swf) file.
[http://isc.sans.org/diary.html?storyid=5929]
[APPLE-SA-2009-05-12]
[RHSA-2009:0332]
[RHSA-2009:0334]
[GLSA-200903-23]
[254909]
[http://support.apple.com/kb/HT3549]
[http://www.adobe.com/support/security/bulletins/apsb09-01.html]
[33890]
[TA09-133A]
[ADV-2009-0513]
[ADV-2009-0743]
[ADV-2009-1297]
[https://bugzilla.redhat.com/show_bug.cgi?id=487141]
[flash-swf-unspecified-dos(48900)]
[oval:org.mitre.oval:def:15837]
[oval:org.mitre.oval:def:6470]
Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove references to destroyed objects during Shockwave Flash file processing, which allows remote attackers to execute arbitrary code via a crafted file, related to a "buffer overflow issue."
[http://isc.sans.org/diary.html?storyid=5929]
[20090224 Adobe Flash Player Invalid Object Reference Vulnerability]
[APPLE-SA-2009-05-12]
[RHSA-2009:0332]
[RHSA-2009:0334]
[GLSA-200903-23]
[1021750]
[254909]
[http://support.apple.com/kb/HT3549]
[http://www.adobe.com/support/security/bulletins/apsb09-01.html]
[33880]
[TA09-133A]
[ADV-2009-0513]
[ADV-2009-0743]
[ADV-2009-1297]
[https://bugzilla.redhat.com/show_bug.cgi?id=487142]
[flash-invalid-object-bo(48887)]
[oval:org.mitre.oval:def:16057]
[oval:org.mitre.oval:def:6593]
Untrusted search path vulnerability in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 on Linux allows local users to obtain sensitive information or gain privileges via a crafted library in a directory contained in the RPATH.
http://www.adobe.com/support/security/bulletins/apsb09-01.html
"This update prevents a potential Linux-only information disclosure issue in the Flash Player binary that could lead to privilege escalation. (CVE-2009-0521)"
[http://isc.sans.org/diary.html?storyid=5929]
[RHSA-2009:0332]
[GLSA-200903-23]
[http://www.adobe.com/support/security/bulletins/apsb09-01.html]
[ADV-2009-0513]
[https://bugzilla.redhat.com/show_bug.cgi?id=487144]
[flash-unspecified-information-disclosure(48904)]
[oval:org.mitre.oval:def:6160]
Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 on Windows allows remote attackers to trick a user into visiting an arbitrary URL via an unspecified manipulation of the "mouse pointer display," related to a "Clickjacking attack."
Per: http://www.adobe.com/support/security/bulletins/apsb09-01.html
"This update resolves a Windows-only issue with mouse pointer display that could potentially contribute to a Clickjacking attack. (CVE-2009-0522)"
[http://isc.sans.org/diary.html?storyid=5929]
[1021752]
[http://www.adobe.com/support/security/bulletins/apsb09-01.html]
[ADV-2009-0513]
[flash-unspecified-click-hijacking(48903)]
[oval:org.mitre.oval:def:6674]
Cross-site scripting (XSS) vulnerability in Adobe RoboHelp Server 6 and 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, which is not properly handled when displaying the Help Errors log.
[1021755]
[http://www.adobe.com/support/security/bulletins/apsb09-02.html]
[33887]
[ADV-2009-0512]
[robohelp-errors-log-xss(48890)]
Cross-site scripting (XSS) vulnerability in Adobe RoboHelp 6 and 7, and RoboHelp Server 6 and 7, allows remote attackers to inject arbitrary web script or HTML via vectors involving files produced by RoboHelp.
[1021755]
[http://www.adobe.com/support/security/bulletins/apsb09-02.html]
[33888]
[ADV-2009-0512]
[robohelp-generated-files-xss(48889)]
Cross-site scripting (XSS) vulnerability in the sajax_get_common_js function in php/Sajax.php in Sajax 0.12 allows remote attackers to inject arbitrary web script or HTML via the URL parameter, which is not properly handled when using browsers that do not URL-encode requests, such as Internet Explorer 6. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[33711]
Multiple cross-site scripting (XSS) vulnerabilities in index.php in AdaptCMS Lite 1.4 allow remote attackers to inject arbitrary web script or HTML via the (1) url and (2) acuparam parameters, and (3) the URI.
[33698]
[adaptcms-index-xss(48611)]
[8016]
PHP remote file inclusion vulnerability in plugins/rss_importer_functions.php in AdaptCMS Lite 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the sitepath parameter.
[33698]
[adaptcms-sitepath-file-include(48610)]
[8016]
SQL injection vulnerability in frame.php in Rhadrix If-CMS 2.07 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
[33697]
[8007]
Cross-site scripting (XSS) vulnerability in index.php in SnippetMaster Webpage Editor 2.2.2 allows remote attackers to inject arbitrary web script or HTML via the language parameter.
[33705]
[8017]
Multiple PHP remote file inclusion vulnerabilities in SnippetMaster 2.2.2, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) _SESSION[SCRIPT_PATH] parameter to includes/vars.inc.php and the (2) g_pcltar_lib_dir parameter to includes/tar_lib/pcltar.lib.php.
[33705]
[8017]
SQL injection vulnerability in gallery/view.asp in A Better Member-Based ASP Photo Gallery before 1.2 allows remote attackers to execute arbitrary SQL commands via the entry parameter.
Version 1.2 released which fixed the SQL injection bug. It also properly deletes thumbnails for invalid filetypes (invalid files were removed but the thumbnails remained).
http://www.ontarioabandonedplaces.com/ipguardian/
[http://www.ontarioabandonedplaces.com/ipguardian/gallery/readme.txt]
[33693]
[bettermember-view-sql-injection(48612)]
[8012]
Cross-site scripting (XSS) vulnerability in password.php in Scripts For Sites (SFS) EZ Baby allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly involving the u2 parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[33635]
[ezbaby-password-xss(48547)]
Cross-site scripting (XSS) vulnerability in password.php in Scripts for Sites EZ Reminder allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly involving the u2 parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[33641]
[ezreminder-password-xss(48548)]
SQL injection vulnerability in FlexCMS allows remote attackers to execute arbitrary SQL commands via the catId parameter.
[33696]
[flexcms-catid-sql-injection(48609)]
[8018]
Directory traversal vulnerability in export.php in Thyme 1.3 and earlier, when register_globals is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the export_to parameter.
[8029]
at in bos.rte.cron on IBM AIX 5.2.0, 5.3.0 through 5.3.9, and 6.1.0 through 6.1.2 allows local users to read arbitrary files via unspecified vectors, related to failure to drop root privileges.
[http://aix.software.ibm.com/aix/efixes/security/at_advisory.asc]
[IZ43452]
[IZ43453]
[IZ43454]
[IZ43455]
[IZ43456]
[IZ43457]
[IZ43458]
[IZ43459]
[33730]
[1021704]
[ADV-2009-0405]
[http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=4558]
[ibm-aix-at-information-disclosure(48660)]
[oval:org.mitre.oval:def:6155]
Integer overflow in the fts_build function in fts.c in libc in (1) OpenBSD 4.4 and earlier and (2) Microsoft Interix 6.0 build 10.0.6030.0 allows context-dependent attackers to cause a denial of service (application crash) via a deep directory tree, related to the fts_level structure member, as demonstrated by (a) du, (b) rm, (c) chmod, and (d) chgrp on OpenBSD; and (e) SearchIndexer.exe on Vista Enterprise.
[20090304 libc:fts_*():multiple vendors, Denial-of-service]
[http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gen/fts.c]
[http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gen/fts.c.diff?r1=1.41;r2=1.42;f=h]
[20090305 libc:fts_*():multiple vendors, Denial-of-service]
[34008]
[1021818]
[8163]
Format string vulnerability in Symantec pcAnywhere before 12.5 SP1 allows local users to read and modify arbitrary memory locations, and cause a denial of service (application crash) or possibly have unspecified other impact, via format string specifiers in the pathname of a remote control file (aka .CHF file).
[http://securityresponse.symantec.com/avcenter/security/Content/2009.03.17.html]
[1021855]
[http://www.layereddefense.com/pcanywhere17mar.html]
[20090318 Layered Defense Research Advisory: Format String Vulnerablity in Symantec PcAnywhere v10-12.5]
[33845]
[ADV-2009-0755]
[symantec-pcanywhere-unspecified-dos(49291)]
Cross-site scripting (XSS) vulnerability in Libero 5.3 SP5, and possibly other versions before 5.5 SP1, allows remote attackers to inject arbitrary web script or HTML via the search term field.
[20090222 Libero Cross-Site Scripting Vulnerability - Security Advisory - SOS-09-001]
[33856]
[ADV-2009-0493]
[libero-searchterm-xss(48870)]
Multiple cross-site scripting (XSS) vulnerabilities in Magento 1.2.0 and 1.2.1.1 allow remote attackers to inject arbitrary web script or HTML via (1) the username field in an admin/ request to index.php, possibly related to the login[username] parameter and the app/code/core/Mage/Admin/Model/Session.php login function; (2) the email address field in an admin/index/forgotpassword/ request to index.php, possibly related to the email parameter and the app/code/core/Mage/Adminhtml/controllers/IndexController.php forgotpasswordAction function; or (3) the return parameter to the default URI under downloader/.
[20090223 Magento Multiple Cross-Site Scripting Vulnerabilities - Security Advisory - SOS-09-002]
[1021746]
[33872]
[magento-login-xss(48876)]
[magento-forgotpasswordaction-xss(48877)]
[magneto-downloader-xss(48878)]
SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" (percent) character in the username, which introduces a "'" (single quote) character during variable substitution by mod_sql.
[http://bugs.proftpd.org/show_bug.cgi?id=3180]
[GLSA-200903-27]
[DSA-1730]
[MDVSA-2009:061]
[[oss-security] 20090211 CVE request for proftpd]
[[oss-security] 20090211 Re: CVE request for proftpd]
[[oss-security] 20090211 Re: CVE request for proftpd]
[20090210 Another SQL injection in ProFTPd with mod_mysql (probably postgres as well)]
[20090210 Re: Another SQL injection in ProFTPd with mod_mysql (probably postgres as well)]
[20090210 ProFTPd with mod_mysql Authentication Bypass Exploit]
[20090211 Re: Re: Another SQL injection in ProFTPd with mod_mysql (probably postgres as well)]
[8037]
ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in (1) mod_sql_mysql and (2) mod_sql_postgres.
[http://bugs.proftpd.org/show_bug.cgi?id=3173]
[GLSA-200903-27]
[DSA-1730]
[MDVSA-2009:061]
[[oss-security] 20090211 CVE request for proftpd]
[[oss-security] 20090211 Re: CVE request for proftpd]
Buffer overflow in the PyCrypto ARC2 module 2.0.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large ARC2 key length.
[http://gitweb2.dlitz.net/?p=crypto/pycrypto-2.x.git;a=commitdiff;h=d1c4875e1f220652fe7ff8358f56dee3b2aba31b]
[http://gitweb2.dlitz.net/?p=crypto/pycrypto-2.x.git;a=commitdiff;h=fd73731dfad451a81056fbb01e09aa78ab82eb5d]
[SUSE-SR:2009:010]
[GLSA-200903-11]
[MDVSA-2009:049]
[MDVSA-2009:050]
[[oss-security] 20090207 CVE Request: pycrypto]
[[oss-security] 20090212 Re: CVE Request: pycrypto]
[33674]
[pycrypto-arc2module-bo(48617)]
cgi-bin/kerbynet in ZeroShell 1.0beta11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the type parameter in a NoAuthREQ x509List action.
[http://www.ikkisoft.com/stuff/LC-2009-01.txt]
[20090209 ZeroShell <= 1.0beta11 Remote Code Execution]
[ADV-2009-0385]
[http://www.zeroshell.net/eng/announcements/]
[http://www.zeroshell.net/eng/patch-details/#C100]
[8023]
Stack-based buffer overflow in NewsGator FeedDemon 2.7 and earlier allows user-assisted remote attackers to execute arbitrary code via a long text attribute in an outline element in a .opml file.
[http://security.bkis.vn/?p=329]
[20090205 [SVRT-02-09] FeedDemon (ver<=2.7) Buffer Overflow Vulnerability]
[33630]
[7995]
[8010]
Evolution 2.22.3.1 checks S/MIME signatures against a copy of the e-mail text within a signed-data blob, not the copy of the e-mail text displayed to the user, which allows remote attackers to spoof a signature by modifying the latter copy, a different vulnerability than CVE-2008-5077.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508479]
[http://bugzilla.gnome.org/show_bug.cgi?id=564465]
[SUSE-SR:2010:006]
[SUSE-SR:2010:011]
[SUSE-SR:2010:012]
[[oss-security] 20090210 CVE Request -- evolution]
[DSA-1813]
[MDVSA-2009:078]
[RHSA-2009:0354]
[RHSA-2009:0355]
[33720]
[ADV-2010-1107]
[https://bugzilla.redhat.com/show_bug.cgi?id=484925]
[oval:org.mitre.oval:def:9619]
[FEDORA-2009-2784]
[FEDORA-2009-2792]
Cross-site scripting (XSS) vulnerability in the Additional Report Settings interface in ESET Remote Administrator before 3.0.105 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party information.
[http://www.eset.eu/support/changelog-eset-remote-administrator-3]
[ADV-2009-0339]
Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; and Microsoft Office Excel Viewer 2003 SP3 allow remote attackers to execute arbitrary code via a crafted Excel file with a malformed record object, aka "Record Pointer Corruption Vulnerability."
[35215]
[1022351]
[TA09-160A]
[ADV-2009-1540]
[MS09-021]
[oval:org.mitre.oval:def:5830]
Windows HTTP Services (aka WinHTTP) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008; and WinINet in Microsoft Internet Explorer 5.01 SP4, 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and 7 on Windows Server 2008; allows remote web servers to capture and replay NTLM credentials, and execute arbitrary code, via vectors related to absence of a "credential-reflection protections" opt-in step, aka "Windows HTTP Services Credential Reflection Vulnerability" and "WinINet Credential Reflection Vulnerability."
[http://blogs.technet.com/srd/archive/2009/04/14/ntlm-credential-reflection-updates-for-http-clients.aspx]
[http://support.avaya.com/elmodocs2/security/ASA-2009-133.htm]
[http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=871138]
[34439]
[1022041]
[TA09-104A]
[ADV-2009-1027]
[ADV-2009-1028]
[MS09-013]
[MS09-014]
[oval:org.mitre.oval:def:5320]
[oval:org.mitre.oval:def:6233]
[oval:org.mitre.oval:def:7569]
Microsoft Internet Explorer 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and 7 on Windows Server 2008 does not properly handle transition errors in a request for one HTTP document followed by a request for a second HTTP document, which allows remote attackers to execute arbitrary code via vectors involving (1) multiple crafted pages on a web site or (2) a web page with crafted inline content such as banner advertisements, aka "Page Transition Memory Corruption Vulnerability."
[http://support.avaya.com/elmodocs2/security/ASA-2009-133.htm]
[http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=871138]
[1022042]
[TA09-104A]
[ADV-2009-1028]
[MS09-014]
[oval:org.mitre.oval:def:6164]
Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4, 6 SP1, 6 on Windows XP SP2 and SP3, and 6 on Windows Server 2003 SP1 and SP2 allows remote attackers to execute arbitrary code via a web page that triggers presence of an object in memory that was (1) not properly initialized or (2) deleted, aka "Uninitialized Memory Corruption Vulnerability."
[http://support.avaya.com/elmodocs2/security/ASA-2009-133.htm]
[1022042]
[TA09-104A]
[ADV-2009-1028]
[MS09-014]
[oval:org.mitre.oval:def:5551]
Microsoft Internet Explorer 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and 7 on Windows Server 2008 allows remote attackers to execute arbitrary code via a web page that triggers presence of an object in memory that was (1) not properly initialized or (2) deleted, aka "Uninitialized Memory Corruption Vulnerability."
[http://skypher.com/index.php/2009/04/19/ms09-014-embed-element-memory-corruption/]
[http://support.avaya.com/elmodocs2/security/ASA-2009-133.htm]
[34424]
[1022042]
[TA09-104A]
[ADV-2009-1028]
[MS09-014]
[oval:org.mitre.oval:def:6069]
Microsoft Internet Explorer 5.01 SP4, 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and 7 on Windows Server 2008 allows remote attackers to execute arbitrary code via a web page that triggers presence of an object in memory that was (1) not properly initialized or (2) deleted, aka "Uninitialized Memory Corruption Vulnerability."
[http://support.avaya.com/elmodocs2/security/ASA-2009-133.htm]
[1022042]
[TA09-104A]
[ADV-2009-1028]
[MS09-014]
[oval:org.mitre.oval:def:5723]
Microsoft Windows Media Runtime, as used in DirectShow WMA Voice Codec, Windows Media Audio Voice Decoder, and Audio Compression Manager (ACM), does not properly process Advanced Systems Format (ASF) files, which allows remote attackers to execute arbitrary code via a crafted audio file that uses the Windows Media Speech codec, aka "Windows Media Runtime Voice Sample Rate Vulnerability."
[TA09-286A]
[MS09-051]
[oval:org.mitre.oval:def:6407]
Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in the wild in April 2009 by Exploit:Win32/Apptom.gen, aka "Memory Corruption Vulnerability."
[http://blogs.technet.com/mmpc/archive/2009/04/02/new-0-day-exploits-using-powerpoint-files.aspx]
[http://blogs.technet.com/msrc/archive/2009/04/02/microsoft-security-advisory-969136.aspx]
[http://blogs.technet.com/srd/archive/2009/04/02/investigating-the-new-powerpoint-issue.aspx]
[VU#627331]
[http://www.microsoft.com/technet/security/advisory/969136.mspx]
[20090512 ZDI-09-019: Microsoft Office PowerPoint OutlineTextRefAtom Parsing Memory Corruption Vulnerability]
[34351]
[1021967]
[TA09-132A]
[ADV-2009-0915]
[ADV-2009-1290]
[http://www.zerodayinitiative.com/advisories/ZDI-09-019]
[MS09-017]
[powerpoint-unspecified-code-execution(49632)]
[oval:org.mitre.oval:def:6204]
[oval:org.mitre.oval:def:6279]
Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a crafted Excel file with a malformed record object, aka "Object Record Corruption Vulnerability."
[35241]
[1022351]
[TA09-160A]
[ADV-2009-1540]
[MS09-021]
[oval:org.mitre.oval:def:5564]
Array index error in Excel in Microsoft Office 2000 SP3 and Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac, allows remote attackers to execute arbitrary code via a crafted Excel file with a malformed record object, aka "Array Indexing Memory Corruption Vulnerability."
[20090609 Secunia Research: Microsoft Excel Record Parsing Array Indexing Vulnerability]
[35242]
[1022351]
[TA09-160A]
[ADV-2009-1540]
[MS09-021]
[oval:org.mitre.oval:def:11525]
Stack-based buffer overflow in Excel in Microsoft Office 2000 SP3 and Office XP SP3 allows remote attackers to execute arbitrary code via a crafted Excel file with a malformed record object, aka "String Copy Stack-Based Overrun Vulnerability."
[35243]
[1022351]
[TA09-160A]
[ADV-2009-1540]
[MS09-021]
[oval:org.mitre.oval:def:6273]
Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a crafted Excel file with a malformed record object, aka "Field Sanitization Memory Corruption Vulnerability."
[35244]
[1022351]
[TA09-160A]
[ADV-2009-1540]
[MS09-021]
[oval:org.mitre.oval:def:6178]
Integer overflow in Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel Viewer; Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2; and Microsoft Office SharePoint Server 2007 SP1 and SP2 allows remote attackers to execute arbitrary code via an Excel file with a Shared String Table (SST) record with a numeric field that specifies an invalid number of unique strings, which triggers a heap-based buffer overflow, aka "Record Integer Overflow Vulnerability."
[20090609 Microsoft Excel SST Record Integer Overflow Vulnerability]
[20090609 Secunia Research: Microsoft Excel String Parsing Integer Overflow Vulnerability]
[35245]
[1022351]
[TA09-160A]
[ADV-2009-1540]
[MS09-021]
[oval:org.mitre.oval:def:5925]
The Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 SP1, and Office Small Business Accounting 2006 does not properly allocate memory, which allows remote attackers to execute arbitrary code via unspecified vectors that trigger "system state" corruption, aka "Office Web Components Memory Allocation Vulnerability."
[1022708]
[TA09-223A]
[MS09-043]
[oval:org.mitre.oval:def:6337]
Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; Microsoft Office Word Viewer 2003 SP3; Microsoft Office Word Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a Word document with a crafted tag containing an invalid length field, aka "Word Buffer Overflow Vulnerability."
[20090610 ZDI-09-035: Microsoft Word Document Stack Based Buffer Overflow Vulnerability]
[35188]
[1022356]
[TA09-160A]
[ADV-2009-1546]
[http://www.zerodayinitiative.com/advisories/ZDI-09-035]
[MS09-027]
[oval:org.mitre.oval:def:6133]
Buffer overflow in Microsoft Office Word 2000 SP3, 2002 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a Word document with a malformed record that triggers memory corruption, aka "Word Buffer Overflow Vulnerability."
[8206]
[35190]
[1022356]
[TA09-160A]
[ADV-2009-1546]
[MS09-027]
[oval:org.mitre.oval:def:6334]
Microsoft Office Publisher 2007 SP1 does not properly calculate object handler data for Publisher files, which allows remote attackers to execute arbitrary code via a crafted file in a legacy format that triggers memory corruption, aka "Pointer Dereference Vulnerability."
[35599]
[1022546]
[TA09-195A]
[ADV-2009-1888]
[MS09-030]
[oval:org.mitre.oval:def:6285]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2009. Notes: none.
The RPC Marshalling Engine (aka NDR) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly maintain its internal state, which allows remote attackers to overwrite arbitrary memory locations via a crafted RPC message that triggers incorrect pointer reading, related to "IDL interfaces containing a non-conformant varying array" and FC_SMVARRAY, FC_LGVARRAY, FC_VARIABLE_REPEAT, and FC_VARIABLE_OFFSET, aka "RPC Marshalling Engine Vulnerability."
[http://blogs.technet.com/srd/archive/2009/06/09/ms09-026-how-a-developer-can-know-if-their-rpc-interface-is-affected.aspx]
[35219]
[1022357]
[TA09-160A]
[ADV-2009-1545]
[MS09-026]
[oval:org.mitre.oval:def:6227]
Buffer overflow in Becky! Internet Mail 2.48.02 and earlier allows remote attackers to execute arbitrary code via a mail message with a crafted return receipt request.
[JVN#29641290]
[JVNDB-2009-000011]
[http://www.rimarts.jp/downloads/B2/Readme-e.txt]
[33756]
[becky-readreceipt-bo(48684)]
Directory traversal vulnerability in send.php in Ninja Designs Mailist 3.0, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the load parameter. NOTE: some of these details are obtained from third party information.
[33648]
[8001]
admin.php in Ninja Designs Mailist 3.0 stores backup copies of maillist.php under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to the backup directory.
[8001]
PHP remote file inclusion vulnerability in include/flatnux.php in FlatnuX CMS (aka Flatnuke3) 2009-01-27 and 2009-02-04, when register_globals is enabled and magic_quotes_gpc disabled, allows remote attackers to execute arbitrary PHP code via a URL in the _FNROOTPATH parameter to (1) index.php and (2) filemanager.php.
[20090202 flatnux Flatnux-2009-01-27 Remote File Include]
[33599]
[flatnuxcms-fnrootpath-file-include(48491)]
[7969]
Multiple cross-site scripting (XSS) vulnerabilities in FotoWeb 6.0 (Build 273) allow remote attackers to inject arbitrary web script or HTML via the (1) s parameter to cmdrequest/Login.fwx and the (2) search parameter to Grid.fwx.
[http://www.fortconsult.net/images/pdf/advisories/FotoWebXSS_final.pdf]
[33677]
SQL injection vulnerability in index.php in Easy CafeEngine allows remote attackers to execute arbitrary SQL commands via the catid parameter, a different vector than CVE-2008-4604.
[33655]
[ADV-2009-0359]
[8002]
Cross-site scripting (XSS) vulnerability in the theme_views_bulk_operations_confirmation function in views_bulk_operations.module in Views Bulk Operations 5.x before 5.x-1.3 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to node titles. NOTE: some of these details are obtained from third party information.
[http://drupal.org/node/369223]
[33622]
[viewsbulk-themeviewsbulk-xss(48516)]
Unspecified vulnerability in Sun Java System Directory Server 5.2 p6 and earlier, and Enterprise Edition 5, allows remote attackers to cause a denial of service (daemon crash) via crafted LDAP requests.
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-116837-04-1]
[250086]
[33732]
[ADV-2009-0409]
[sun-java-sds-ldap-dos(48662)]
Integer overflow in the WriteProlog function in texttops in CUPS 1.1.17 on Red Hat Enterprise Linux (RHEL) 3 allows remote attackers to execute arbitrary code via a crafted PostScript file that triggers a heap-based buffer overflow. NOTE: this issue exists because of an incorrect fix for CVE-2008-3640.
[http://support.avaya.com/elmodocs2/security/ASA-2009-064.htm]
[RHSA-2009:0308]
[https://bugzilla.redhat.com/show_bug.cgi?id=486052]
[cups-texttops-writeprolog-bo(48977)]
[oval:org.mitre.oval:def:9968]
GNOME NetworkManager before 0.7.0.99 does not properly verify privileges for dbus (1) modify and (2) delete requests, which allows local users to change or remove the network connections of arbitrary users via unspecified vectors related to org.freedesktop.NetworkManagerUserSettings and at_console.
[SUSE-SA:2009:013]
[SUSE-SR:2009:009]
[RHSA-2009:0361]
[33966]
[1021909]
[USN-727-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=487752]
[networkmanager-dbus-security-bypass(49063)]
[oval:org.mitre.oval:def:8931]
Linux-PAM before 1.0.4 does not enforce the minimum password age (MINDAYS) as specified in /etc/shadow, which allows local users to bypass intended security policy and change their passwords sooner than specified.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=514437]
[https://bugzilla.redhat.com/show_bug.cgi?id=487216]
[FEDORA-2009-3204]
[FEDORA-2009-3231]
[[pam-list] 20090309 Linux-PAM 1.0.4 released]
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.
[APPLE-SA-2010-03-29-1]
[SUSE-SR:2009:012]
[HPSBMA02535]
[HPSBUX02579]
[HPSBOV02762]
[HPSBUX02860]
[1022332]
[263529]
[http://support.apple.com/kb/HT4077]
[http://svn.apache.org/viewvc?rev=747840&view=rev]
[http://svn.apache.org/viewvc?rev=781379&view=rev]
[http://svn.apache.org/viewvc?rev=781382&view=rev]
[http://tomcat.apache.org/security-4.html]
[http://tomcat.apache.org/security-5.html]
[http://tomcat.apache.org/security-6.html]
[DSA-2207]
[MDVSA-2009:136]
[MDVSA-2009:138]
[MDVSA-2010:176]
[20090603 [SECURITY] CVE-2009-0580 Apache Tomcat User enumeration vulnerability with FORM authentication]
[20090604 Re: [SECURITY] CVE-2009-0580 Apache Tomcat User enumeration vulnerability with FORM authentication]
[20090605 [SECURITY] CVE-2009-0580 UPDATED Apache Tomcat User enumeration vulnerability with FORM authentication]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[35196]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-1496]
[ADV-2009-1856]
[ADV-2009-3316]
[ADV-2010-3056]
[tomcat-jsecuritycheck-info-disclosure(50930)]
[[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/]
[[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/]
[oval:org.mitre.oval:def:18915]
[oval:org.mitre.oval:def:6628]
[oval:org.mitre.oval:def:9101]
[FEDORA-2009-11374]
[FEDORA-2009-11352]
[FEDORA-2009-11356]
Memory leak in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted image file.
[SUSE-SR:2009:007]
[http://scary.beasts.org/security/CESA-2009-003.html]
[http://scarybeastsecurity.blogspot.com/2009/03/littlecms-vulnerabilities.html]
[GLSA-200904-19]
[SSA:2009-083-01]
[DSA-1745]
[DSA-1769]
[MDVSA-2009:121]
[MDVSA-2009:137]
[MDVSA-2009:162]
[http://www.ocert.org/advisories/ocert-2009-003.html]
[RHSA-2009:0339]
[20090320 LittleCMS vulnerabilities (OpenJDK, Firefox, GIMP, etc. impacted)]
[20090320 [oCERT-2009-003] LittleCMS integer errors]
[34185]
[1021870]
[USN-744-1]
[ADV-2009-0775]
[https://bugzilla.redhat.com/show_bug.cgi?id=487509]
[littlecms-unspecified-dos(49328)]
[oval:org.mitre.oval:def:10023]
[RHSA-2009:0377]
[FEDORA-2009-2903]
[FEDORA-2009-2910]
[FEDORA-2009-2928]
[FEDORA-2009-2970]
[FEDORA-2009-2982]
[FEDORA-2009-2983]
[FEDORA-2009-3034]
The ntlm_challenge function in the NTLM SASL authentication mechanism in camel/camel-sasl-ntlm.c in Camel in Evolution Data Server (aka evolution-data-server) 2.24.5 and earlier, and 2.25.92 and earlier 2.25.x versions, does not validate whether a certain length value is consistent with the amount of data in a challenge packet, which allows remote mail servers to read information from the process memory of a client, or cause a denial of service (client crash), via an NTLM authentication type 2 packet with a length value that exceeds the amount of packet data.
[SUSE-SR:2009:010]
[[release-team] 20090312 Another Evolution-Data-Server freeze break]
[1021845]
[DSA-1813]
[MDVSA-2009:078]
[RHSA-2009:0354]
[RHSA-2009:0355]
[RHSA-2009:0358]
[34109]
[ADV-2009-0716]
[https://bugzilla.redhat.com/show_bug.cgi?id=487685]
[evolution-ntlmsasl-info-disclosure(49233)]
[oval:org.mitre.oval:def:10081]
[FEDORA-2009-2784]
[FEDORA-2009-2792]
Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.
[http://bugs.gentoo.org/show_bug.cgi?id=261087]
[SUSE-SR:2009:007]
[1021868]
[262288]
[http://support.avaya.com/elmodocs2/security/ASA-2009-098.htm]
[http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0050]
[ESB-2009.0259]
[DSA-1746]
[GLSA-200903-37]
[MDVSA-2009:095]
[MDVSA-2009:096]
[RHSA-2009:0345]
[20090319 rPSA-2009-0050-1 ghostscript]
[34184]
[USN-743-1]
[ADV-2009-0776]
[ADV-2009-0777]
[ADV-2009-0816]
[ADV-2009-1708]
[https://bugzilla.redhat.com/show_bug.cgi?id=487742]
[ghostscript-icclib-native-color-bo(49329)]
[https://issues.rpath.com/browse/RPL-2991]
[oval:org.mitre.oval:def:10795]
[USN-757-1]
[FEDORA-2009-2883]
[FEDORA-2009-2885]
[FEDORA-2009-3011]
[FEDORA-2009-3031]
icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using a device file for processing a crafted image file associated with large integer values for certain sizes, related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.
[http://bugs.gentoo.org/show_bug.cgi?id=261087]
[SUSE-SR:2009:007]
[1021868]
[262288]
[http://support.avaya.com/elmodocs2/security/ASA-2009-098.htm]
[http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0050]
[ESB-2009.0259]
[DSA-1746]
[GLSA-200903-37]
[MDVSA-2009:095]
[MDVSA-2009:096]
[RHSA-2009:0345]
[20090319 rPSA-2009-0050-1 ghostscript]
[34184]
[USN-743-1]
[ADV-2009-0776]
[ADV-2009-0777]
[ADV-2009-0816]
[ADV-2009-1708]
[https://bugzilla.redhat.com/show_bug.cgi?id=487744]
[ghostscript-icclib-bo(49327)]
[https://issues.rpath.com/browse/RPL-2991]
[oval:org.mitre.oval:def:10544]
[USN-757-1]
[FEDORA-2009-2883]
[FEDORA-2009-2885]
[FEDORA-2009-3011]
[FEDORA-2009-3031]
Integer overflow in the soup_base64_encode function in soup-misc.c in libsoup 2.x.x before 2.2.x, and 2.x before 2.24, allows context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation.
[SUSE-SR:2009:010]
[http://ocert.org/patches/2008-015/libsoup-CVE-2009-0585.diff]
[[oss-security] 20090312 [oCERT-2008-015] glib and glib-predecessor heap overflows]
[http://support.avaya.com/elmodocs2/security/ASA-2009-088.htm]
[DSA-1748]
[MDVSA-2009:081]
[http://www.ocert.org/advisories/ocert-2008-015.html]
[RHSA-2009:0344]
[20090312 [oCERT-2008-015] glib and glib-predecessor heap overflows]
[34100]
[USN-737-1]
[libsoup-soupmisc-bo(49273)]
[oval:org.mitre.oval:def:9599]
Integer overflow in the gst_vorbis_tag_add_coverart function (gst-libs/gst/tag/gstvorbistag.c) in vorbistag in gst-plugins-base (aka gstreamer-plugins-base) before 0.10.23 in GStreamer allows context-dependent attackers to execute arbitrary code via a crafted COVERART tag that is converted from a base64 representation, which triggers a heap-based buffer overflow.
[http://cgit.freedesktop.org/gstreamer/gst-plugins-base/commit/?id=566583e87147f774e7fc4c78b5f7e61d427e40a9]
[SUSE-SR:2009:009]
[http://ocert.org/patches/2008-015/gst-plugins-base-CVE-2009-0586.diff]
[[oss-security] 20090312 [oCERT-2008-015] glib and glib-predecessor heap overflows]
[GLSA-200907-11]
[MDVSA-2009:085]
[http://www.ocert.org/advisories/ocert-2008-015.html]
[20090312 [oCERT-2008-015] glib and glib-predecessor heap overflows]
[34100]
[USN-735-1]
[gstreamer-gstvorbistagaddcoverart-bo(49274)]
[oval:org.mitre.oval:def:9694]
Multiple integer overflows in Evolution Data Server (aka evolution-data-server) before 2.24.5 allow context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation in (1) addressbook/libebook/e-vcard.c in evc or (2) camel/camel-mime-utils.c in libcamel.
[SUSE-SR:2010:012]
[http://ocert.org/patches/2008-015/camel-CVE-2009-0587.diff]
[http://ocert.org/patches/2008-015/evc-CVE-2009-0587.diff]
[[oss-security] 20090312 [oCERT-2008-015] glib and glib-predecessor heap overflows]
[DSA-1813]
[MDVSA-2009:078]
[http://www.ocert.org/advisories/ocert-2008-015.html]
[RHSA-2009:0354]
[RHSA-2009:0355]
[RHSA-2009:0358]
[20090312 [oCERT-2008-015] glib and glib-predecessor heap overflows]
[34100]
[USN-733-1]
[oval:org.mitre.oval:def:11385]
agent/request/op.cgi in the Registration Authority (RA) component in Red Hat Certificate System (RHCS) 7.3 and Dogtag Certificate System allows remote authenticated users to approve certificate requests queued for arbitrary agent groups via a modified request ID field.
[RHSA-2009:1065]
[35104]
[1022278]
[https://bugzilla.redhat.com/show_bug.cgi?id=484828]
[https://bugzilla.redhat.com/show_bug.cgi?id=488706]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
The ASN1_STRING_print_ex function in OpenSSL before 0.9.8k allows remote attackers to cause a denial of service (invalid memory access and application crash) via vectors that trigger printing of a (1) BMPString or (2) UniversalString with an invalid encoded length.
[NetBSD-SA2009-008]
[APPLE-SA-2009-09-10-2]
[SUSE-SR:2009:010]
[openSUSE-SU-2011:0845]
[SUSE-SU-2011:0847]
[[security-announce] 20100303 VMSA-2010-0004 ESX Service Console and vMA third party updates]
[SSRT090059]
[HPSBMA02447]
[HPSBOV02540]
[FreeBSD-SA-09:08]
[1021905]
[http://sourceforge.net/project/shownotes.php?release_id=671059&group_id=116847]
[258048]
[http://support.apple.com/kb/HT3865]
[http://support.avaya.com/elmodocs2/security/ASA-2009-172.htm]
[http://voodoo-circle.sourceforge.net/sa/sa-20090326-01.html]
[http://wiki.rpath.com/Advisories:rPSA-2009-0057]
[http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0057]
[DSA-1763]
[MDVSA-2009:087]
[http://www.openssl.org/news/secadv_20090325.txt]
[http://www.php.net/archive/2009.php#id2009-04-08-1]
[RHSA-2009:1335]
[20090403 rPSA-2009-0057-1 m2crypto openssl openssl-scripts]
[20101207 VMSA-2010-0019 VMware ESX third party updates for Service Console]
[34256]
[USN-750-1]
[http://www.vmware.com/security/advisories/VMSA-2010-0019.html]
[ADV-2009-0850]
[ADV-2009-1020]
[ADV-2009-1175]
[ADV-2009-1220]
[ADV-2009-1548]
[ADV-2010-0528]
[ADV-2010-3126]
[openssl-asn1-stringprintex-dos(49431)]
[https://kb.bluecoat.com/index?page=content&id=SA50]
[[syslog-ng-announce] 20110110 syslog-ng Premium Edition 3.0.6a has been released]
[[syslog-ng-announce] 20110110 syslog-ng Premium Edition 3.2.1a has been released]
[oval:org.mitre.oval:def:10198]
[oval:org.mitre.oval:def:6996]
The CMS_verify function in OpenSSL 0.9.8h through 0.9.8j, when CMS is enabled, does not properly handle errors associated with malformed signed attributes, which allows remote attackers to repudiate a signature that originally appeared to be valid but was actually invalid.
[NetBSD-SA2009-008]
[APPLE-SA-2009-09-10-2]
[SUSE-SR:2009:010]
[SSRT090059]
[HPSBOV02540]
[1021907]
[http://sourceforge.net/project/shownotes.php?release_id=671059&group_id=116847]
[http://support.apple.com/kb/HT3865]
[http://voodoo-circle.sourceforge.net/sa/sa-20090326-01.html]
[http://www.openssl.org/news/secadv_20090325.txt]
[http://www.php.net/archive/2009.php#id2009-04-08-1]
[34256]
[ADV-2009-0850]
[ADV-2009-1020]
[ADV-2009-1175]
[ADV-2009-1548]
[openssl-cmsverify-security-bypass(49432)]
[https://kb.bluecoat.com/index?page=content&id=SA50]
Multiple directory traversal vulnerabilities in PNphpBB2 1.2i and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ModName parameter to (1) admin_words.php, (2) admin_groups_reapir.php, (3) admin_smilies.php, (4) admin_ranks.php, (5) admin_styles.php, and (6) admin_users.php in admin/.
[33103]
[7658]
SQL injection vulnerability in members.php in plx Auto Reminder 3.7 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a newar action.
[33106]
[7663]
Cross-site scripting (XSS) vulnerability in index.php in phpSkelSite 1.4 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
[33092]
[7648]
PHP remote file inclusion vulnerability in skysilver/login.tpl.php in phpSkelSite 1.4, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the theme parameter.
[33092]
[7648]
Directory traversal vulnerability in skysilver/login.tpl.php in phpSkelSite 1.4, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the TplSuffix parameter.
[33092]
[7648]
SQL injection vulnerability in admin/index.php in w3b>cms (aka w3blabor CMS) before 3.4.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the benutzername parameter (aka Username field) in a login action.
[http://forum.w3bcms.de/viewtopic.php?f=5&t=256]
[33082]
[7640]
SQL injection vulnerability in index.php in PhpMesFilms 1.0 and 1.8 allows remote attackers to execute arbitrary SQL commands via the id parameter.
[33105]
[7660]
Buffer overflow in wiretap/netscreen.c in Wireshark 0.99.7 through 1.0.5 allows user-assisted remote attackers to cause a denial of service (application crash) via a malformed NetScreen snoop file.
[SUSE-SR:2009:005]
[http://support.avaya.com/elmodocs2/security/ASA-2009-082.htm]
[http://wiki.rpath.com/Advisories:rPSA-2009-0040]
[RHSA-2009:0313]
[20090312 rPSA-2009-0040-1 tshark wireshark]
[33690]
[1021697]
[ADV-2009-0370]
[http://www.wireshark.org/security/wnpa-sec-2009-01.html]
[https://bugs.wireshark.org/bugzilla/attachment.cgi?id=2590]
[https://issues.rpath.com/browse/RPL-2984]
[oval:org.mitre.oval:def:14732]
[oval:org.mitre.oval:def:9677]
[FEDORA-2009-1877]
Wireshark 0.99.6 through 1.0.5 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted Tektronix K12 text capture file, as demonstrated by a file with exactly one frame.
[SUSE-SR:2009:005]
[http://support.avaya.com/elmodocs2/security/ASA-2009-082.htm]
[http://wiki.rpath.com/Advisories:rPSA-2009-0040]
[RHSA-2009:0313]
[20090312 rPSA-2009-0040-1 tshark wireshark]
[33690]
[1021697]
[ADV-2009-0370]
[http://www.wireshark.org/security/wnpa-sec-2009-01.html]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1937]
[https://issues.rpath.com/browse/RPL-2984]
[oval:org.mitre.oval:def:10853]
[oval:org.mitre.oval:def:15041]
[FEDORA-2009-1877]
Format string vulnerability in Wireshark 0.99.8 through 1.0.5 on non-Windows platforms allows local users to cause a denial of service (application crash) via format string specifiers in the HOME environment variable.
Per http://www.vupen.com/english/advisories/2009/0370:
"Multiple vulnerabilities have been identified in Wireshark, which could be exploited by local or remote attackers to cause a denial of service or compromise a vulnerable system."
[SUSE-SR:2009:005]
[http://wiki.rpath.com/Advisories:rPSA-2009-0040]
[20090312 rPSA-2009-0040-1 tshark wireshark]
[33690]
[1021697]
[ADV-2009-0370]
[http://www.wireshark.org/security/wnpa-sec-2009-01.html]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3150]
[https://issues.rpath.com/browse/RPL-2984]
Unrestricted file upload vulnerability in upload.php in WikkiTikkiTavi 1.11 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in img/.
[33647]
[wikkitikkitavi-upload-file-upload(48571)]
[7998]
Cross-site scripting (XSS) vulnerability in index.php in the Link module 5.x-2.5 for Drupal 5.10 allows remote authenticated users, with "administer content types" privileges, to inject arbitrary web script or HTML via the description parameter (aka the Help field). NOTE: some of these details are obtained from third party information.
[20090205 Drupal Link Module XSS Vulnerability]
[33642]
[link-description-xss(48553)]
SQL injection vulnerability in index.php in PHP Director 0.21 and earlier allows remote attackers to execute arbitrary SQL commands via the searching parameter.
[33694]
[ADV-2009-0379]
[8014]
Stack consumption vulnerability in the do_page_fault function in arch/x86/mm/fault.c in the Linux kernel before 2.6.28.5 allows local users to cause a denial of service (memory corruption) or possibly gain privileges via unspecified vectors that trigger page faults on a machine that has a registered Kprobes probe.
[http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.27.y.git;a=commit;h=9be260a646bf76fa418ee519afa10196b3164681]
[http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.5]
[33758]
[USN-751-1]
The link_image function in linker/linker.c in the dynamic linker in Bionic in Open Handset Alliance Android 1.0 on the T-Mobile G1 phone does not properly handle file descriptors 0, 1, and 2 for a setgid program, which allows local users to create arbitrary files owned by certain groups, possibly a related issue to CVE-2002-0820.
[20090208 rooting your own phone: android security]
[33695]
[android-dynamic-linker-privilege-escalation(48840)]
Multiple integer overflows in malloc_leak.c in Bionic in Open Handset Alliance Android 1.0 have unknown impact and attack vectors, related to the (1) chk_calloc and (2) leak_calloc functions.
[20090208 rooting your own phone: android security]
[33695]
[android-malloc-overflow(48841)]
Integer overflow in the showLog function in fake_log_device.c in liblog in Open Handset Alliance Android 1.0 allows attackers to trigger a buffer overflow and possibly have unspecified other impact by sending a large number of input lines.
[20090208 rooting your own phone: android security]
[33695]
[android-showlog-bo(48842)]
Sun Java System Directory Proxy Server in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3, when a JDBC data source is used, does not properly handle (1) a long value in an ADD or (2) long string attributes, which allows remote attackers to cause a denial of service (JDBC backend outage) via crafted LDAP requests.
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-125276-08-1]
[251086]
[33761]
Multiple static code injection vulnerabilities in post.php in Simple PHP News 1.0 final allow remote attackers to inject arbitrary PHP code into news.txt via the (1) title or (2) date parameter, and then execute the code via a direct request to display.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Multiple cross-site scripting (XSS) vulnerabilities in qfsearch/AdminServlet in QuickFinder Server in Novell Open Enterprise Server 1.x allow remote attackers to inject arbitrary web script or HTML via (1) the siteloc parameter in a displayaddsite action, the site parameter in a (2) generalproperties or (3) clusterserviceproperties action, (4) the adminurl parameter in a global action, or (5) the print-list parameter.
[http://packetstormsecurity.org/0902-exploits/nqfs-xss.txt]
[33708]
[1021695]
[ADV-2009-0421]
[quickfinderserver-multiple-xss(48619)]
Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 3.x and InterScan Web Security Suite (IWSS) 3.x, when basic authorization is enabled on the standalone proxy, forwards the Proxy-Authorization header from Windows Media Player, which allows remote web servers to obtain credentials by offering a media stream and then capturing this header.
[20090209 Trend micro - IWSVA/IWSS - Authorization module password leak]
[33687]
[1021716]
[interscan-proxyauthorization-info-disc(48681)]
Trend Micro InterScan Web Security Suite (IWSS) 3.1 before build 1237 allows remote authenticated Auditor and Report Only users to bypass intended permission settings, and modify the system configuration, via requests to unspecified JSP pages.
[1021694]
[http://www.trendmicro.com/ftp/documentation/readme/iwss_31_win_en_readme_CP_1237_EN.txt]
[ADV-2009-0369]
Unspecified vulnerability in the Web Server in Cisco Unified MeetingPlace Web Conferencing 6.0 before 6.0(517.0) (aka 6.0 MR4) and 7.0 before 7.0(2) (aka 7.0 MR1) allows remote attackers to bypass authentication and obtain administrative access via a crafted URL.
[20090225 Cisco Unified MeetingPlace Web Conferencing Authentication Bypass Vulnerability]
[33901]
[cisco-meetingplace-unauth-access(48888)]
Directory traversal vulnerability in Cisco Application Networking Manager (ANM) before 2.0 and Application Control Engine (ACE) Device Manager before A3(2.1) allows remote authenticated users to read or modify arbitrary files via unspecified vectors, related to "invalid directory permissions."
[20090225 Cisco ACE Application Control Engine Device Manager and Application Networking Manager Vulnerabilities]
[33903]
[1021770]
Cisco Application Networking Manager (ANM) before 2.0 uses default usernames and passwords, which makes it easier for remote attackers to access the application, or cause a denial of service via configuration changes, related to "default user credentials during installation."
[20090225 Cisco ACE Application Control Engine Device Manager and Application Networking Manager Vulnerabilities]
[33903]
[1021771]
Cisco Application Networking Manager (ANM) before 2.0 uses a default MySQL root password, which makes it easier for remote attackers to execute arbitrary operating-system commands or change system files.
[20090225 Cisco ACE Application Control Engine Device Manager and Application Networking Manager Vulnerabilities]
[33903]
[1021771]
Unspecified vulnerability in the Java agent in Cisco Application Networking Manager (ANM) before 2.0 Update A allows remote attackers to gain privileges, and cause a denial of service (service outage) by stopping processes, or obtain sensitive information by reading configuration files.
[20090225 Cisco ACE Application Control Engine Device Manager and Application Networking Manager Vulnerabilities]
[33903]
[1021772]
Unspecified vulnerability in the Session Border Controller (SBC) before 3.0(2) for Cisco 7600 series routers allows remote attackers to cause a denial of service (SBC card reload) via crafted packets to TCP port 2000.
[20090304 Cisco 7600 Series Router Session Border Controller Denial of Service Vulnerability]
[33975]
[1021787]
[cisco-sbc-dos(49055)]
Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.1) uses default (1) usernames and (2) passwords for (a) the administrator and (b) web management, which makes it easier for remote attackers to perform configuration changes or obtain operating-system access.
[20090225 Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine]
[33900]
Cisco ACE 4710 Application Control Engine Appliance before A1(8a) uses default (1) usernames and (2) passwords for (a) the administrator, (b) web management, and (c) device management, which makes it easier for remote attackers to perform configuration changes to the Device Manager and other components, or obtain operating-system access.
[20090225 Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine]
[33900]
Unspecified vulnerability in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.2) and Cisco ACE 4710 Application Control Engine Appliance before A1(8a) allows remote authenticated users to execute arbitrary operating-system commands through a command line interface (CLI).
Per: http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml
Cisco ACE module software can be downloaded from:
http://tools.cisco.com/support/downloads/go/Redirect.x?mdfid=280557289
Cisco ACE 4710 Application Control Engine appliance software can be downloaded from:
http://tools.cisco.com/support/downloads/go/Redirect.x?mdfid=281222179
[20090225 Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine]
[33900]
Unspecified vulnerability in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.3) and Cisco ACE 4710 Application Control Engine Appliance before A3(2.1) allows remote attackers to cause a denial of service (device reload) via a crafted SSH packet.
[20090225 Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine]
[33900]
Unspecified vulnerability in the SNMPv2c implementation in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.3) and Cisco ACE 4710 Application Control Engine Appliance before A3(2.1) allows remote attackers to cause a denial of service (device reload) via a crafted SNMPv1 packet.
Per: http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml
"Note: SNMPv2c must be explicitly configured in an affected device in order to process any SNMPv2c transactions. SNMPv2c is not enabled by default."
[20090225 Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine]
[33900]
[1021769]
Unspecified vulnerability in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.2) and Cisco ACE 4710 Application Control Engine Appliance before A1(8.0) allows remote attackers to cause a denial of service (device reload) via a crafted SNMPv3 packet.
[20090225 Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine]
[33900]
[1021769]
The SSLVPN feature in Cisco IOS 12.3 through 12.4 allows remote attackers to cause a denial of service (device reload or hang) via a crafted HTTPS packet.
[1021896]
[20090325 Cisco IOS Software WebVPN and SSLVPN Vulnerabilities]
[http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml]
[34239]
[ADV-2009-0851]
[ios-sslvpn-dos(49425)]
[oval:org.mitre.oval:def:6919]
Unspecified vulnerability in Cisco NX-OS before 4.0(1a)N2(1), when running on Nexus 5000 platforms, allows remote attackers to cause a denial of service (crash) via an unspecified "sequence of TCP packets" related to "TCP State manipulation," possibly related to separate attacks against CVE-2008-4609.
[20090908 TCP State Manipulation Denial of Service Vulnerabilities in Multiple Cisco Products]
[1022847]
Memory leak in the SSLVPN feature in Cisco IOS 12.3 through 12.4 allows remote attackers to cause a denial of service (memory consumption and device crash) by disconnecting an SSL session in an abnormal manner, leading to a Transmission Control Block (TCB) leak.
[1021896]
[20090325 Cisco IOS Software WebVPN and SSLVPN Vulnerabilities]
[http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml]
[34239]
[ADV-2009-0851]
[ios-sslvpn-tcbleak-dos(49427)]
[oval:org.mitre.oval:def:12092]
The (1) Airline Product Set (aka ALPS), (2) Serial Tunnel Code (aka STUN), (3) Block Serial Tunnel Code (aka BSTUN), (4) Native Client Interface Architecture (NCIA) support, (5) Data-link switching (aka DLSw), (6) Remote Source-Route Bridging (RSRB), (7) Point to Point Tunneling Protocol (PPTP), (8) X.25 for Record Boundary Preservation (RBP), (9) X.25 over TCP (XOT), and (10) X.25 Routing features in Cisco IOS 12.2 and 12.4 allows remote attackers to cause a denial of service (device reload) via a series of crafted TCP packets.
[1021903]
[http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml]
[20090325 Cisco IOS Software Multiple Features Crafted TCP Sequence Vulnerability]
[34238]
[ADV-2009-0851]
[ios-tcp-dos(49420)]
The (1) Cisco Unified Communications Manager Express; (2) SIP Gateway Signaling Support Over Transport Layer Security (TLS) Transport; (3) Secure Signaling and Media Encryption; (4) Blocks Extensible Exchange Protocol (BEEP); (5) Network Admission Control HTTP Authentication Proxy; (6) Per-user URL Redirect for EAPoUDP, Dot1x, and MAC Authentication Bypass; (7) Distributed Director with HTTP Redirects; and (8) TCP DNS features in Cisco IOS 12.0 through 12.4 do not properly handle IP sockets, which allows remote attackers to cause a denial of service (outage or resource consumption) via a series of crafted TCP packets.
[1021897]
[http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml]
[20090325 Cisco IOS Software Multiple Features IP Sockets Vulnerability]
[34242]
[ADV-2009-0851]
[ios-ipsockets-dos(49418)]
Unspecified vulnerability in Cisco IOS 12.0 through 12.4, when configured with (1) IP Service Level Agreements (SLAs) Responder, (2) Session Initiation Protocol (SIP), (3) H.323 Annex E Call Signaling Transport, or (4) Media Gateway Control Protocol (MGCP) allows remote attackers to cause a denial of service (blocked input queue on the inbound interface) via a crafted UDP packet.
[20090325 Cisco IOS Software Multiple Features Crafted UDP Packet Vulnerability]
[http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml]
[34245]
[1021904]
[ios-udp-dos(49419)]
[oval:org.mitre.oval:def:6720]
The IP Phone Personal Address Book (PAB) Synchronizer feature in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.1, 4.2 before 4.2(3)SR4b, 4.3 before 4.3(2)SR1b, 5.x before 5.1(3e), 6.x before 6.1(3), and 7.0 before 7.0(2) sends privileged directory-service account credentials to the client in cleartext, which allows remote attackers to modify the CUCM configuration and perform other privileged actions by intercepting these credentials, and then using them in requests unrelated to the intended synchronization task, as demonstrated by (1) DC Directory account credentials in CUCM 4.x and (2) TabSyncSysUser account credentials in CUCM 5.x through 7.x.
Per: http://www.cisco.com/en/US/products/products_security_advisory09186a0080a8643c.shtml
"Impact
Successful exploitation of this vulnerability may allow an attacker to intercept user credentials that allow the attacker to escalate their privilege level and obtain complete administrative access to a vulnerable Cisco Unified Communications Manager system. If integrated with an external directory service, the intercepted user credentials may allow an attacker to gain access to additional systems configured to use the directory service for authentication."
[20090311 Identifying and Mitigating Exploitation of the Cisco Unified Communications Manager IP Phone Personal Address Book Synchronizer Privilege Escalation Vulnerability]
[20090311 Cisco Unified Communications Manager IP Phone Personal Address Book Synchronizer Privilege Escalation Vulnerability]
[34082]
[1021839]
[ADV-2009-0675]
[cucm-pab-privilege-escalation(49196)]
Multiple unspecified vulnerabilities in the (1) Mobile IP NAT Traversal feature and (2) Mobile IPv6 subsystem in Cisco IOS 12.3 through 12.4 allow remote attackers to cause a denial of service (input queue wedge and interface outage) via MIPv6 packets, aka Bug ID CSCsm97220.
[1021898]
[20090325 Cisco IOS Software Mobile IP and Mobile IPv6 Vulnerabilities]
[http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml]
[34241]
[ADV-2009-0851]
[ios-mobile-dos(49424)]
[oval:org.mitre.oval:def:12290]
Multiple unspecified vulnerabilities in the home agent (HA) implementation in the (1) Mobile IP NAT Traversal feature and (2) Mobile IPv6 subsystem in Cisco IOS 12.3 through 12.4 allow remote attackers to cause a denial of service (input queue wedge and interface outage) via an ICMP packet, aka Bug ID CSCso05337.
[1021898]
[20090325 Cisco IOS Software Mobile IP and Mobile IPv6 Vulnerabilities]
[http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml]
[34241]
[ADV-2009-0851]
[ios-mobile-dos(49424)]
[ios-mobile-ha-dos(49585)]
[oval:org.mitre.oval:def:12043]
Memory leak in the Cisco Tunneling Control Protocol (cTCP) encapsulation feature in Cisco IOS 12.4, when an Easy VPN (aka EZVPN) server is enabled, allows remote attackers to cause a denial of service (memory consumption and device crash) via a sequence of TCP packets.
Per: http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml
Obtaining Fixed Software
Cisco has released free software updates that address these vulnerabilities. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html , or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml .
[20090325 Cisco IOS cTCP Denial of Service Vulnerability]
[http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml]
[34246]
[1021895]
[ADV-2009-0851]
[ios-ctcp-dos(49417)]
Unspecified vulnerability in Cisco IOS 12.0 through 12.4, when SIP voice services are enabled, allows remote attackers to cause a denial of service (device crash) via a valid SIP message.
[1021902]
[http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml]
[20090325 Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability]
[34243]
[ADV-2009-0851]
[ios-sip-dos(49421)]
The SCP server in Cisco IOS 12.2 through 12.4, when Role-Based CLI Access is enabled, does not enforce the CLI view configuration for file transfers, which allows remote authenticated users with an attached CLI view to (1) read or (2) overwrite arbitrary files via an SCP command.
[1021899]
[http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml]
[20090325 Cisco IOS Software Secure Copy Privilege Escalation Vulnerability]
[34247]
[ADV-2009-0851]
[ios-scp-priv-escalation(49423)]
The Cisco Firewall Services Module (FWSM) 2.x, 3.1 before 3.1(16), 3.2 before 3.2(13), and 4.0 before 4.0(6) for Cisco Catalyst 6500 switches and Cisco 7600 routers allows remote attackers to cause a denial of service (traffic-handling outage) via a series of malformed ICMP messages.
[1022747]
[20090819 Firewall Services Module Crafted ICMP Message Vulnerability]
[36085]
[ADV-2009-2329]
[cisco-fwsm-icmp-dos(52591)]
PHP remote file inclusion vulnerability in moduli/libri/index.php in phpyabs 0.1.2 allows remote attackers to execute arbitrary PHP code via a URL in the Azione parameter.
[33670]
[ADV-2009-0361]
[8005]
Directory traversal vulnerability in the administrative web server in Swann DVR4-SecuraNet allows remote attackers to read arbitrary files via a .. (dot dot) in the URI, as demonstrated by reading the vy_netman.cfg file that contains passwords.
[http://packetstorm.linuxsecurity.com/0902-exploits/cctv-disclose.txt]
[20090210 Remote Authentication Bypass - Swann DVR4 SecuraNet (possibly DVR9 as well)]
[33716]
sys_term.c in telnetd in FreeBSD 7.0-RELEASE and other 7.x versions deletes dangerous environment variables with a method that was valid only in older FreeBSD distributions, which might allow remote attackers to execute arbitrary code by passing a crafted environment variable from a telnet client, as demonstrated by an LD_PRELOAD value that references a malicious library.
[20090214 FreeBSD zeroday]
[FreeBSD-SA-09:05]
[33777]
[freebsd-telnet-ldpreload-code-execution(48780)]
[8055]
ext/openssl/ossl_ocsp.c in Ruby 1.8 and 1.9 does not properly check the return value from the OCSP_basic_verify function, which might allow remote attackers to successfully present an invalid X.509 certificate, possibly involving a revoked certificate.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=513528]
[http://redmine.ruby-lang.org/issues/show/1091]
[MDVSA-2009:193]
[RHSA-2009:1140]
[33769]
[1022505]
[USN-805-1]
[ruby-ocspbasicverify-spoofing(48761)]
[oval:org.mitre.oval:def:11450]
Static code injection vulnerability in post.php in Simple PHP News 1.0 final allows remote attackers to inject arbitrary PHP code into news.txt via the post parameter, and then execute the code via a direct request to display.php. NOTE: some of these details are obtained from third party information.
[ADV-2009-0357]
[simplephpnews-news-code-execution(48829)]
[7999]
The HTTP interface in Swann DVR4-SecuraNet has a certain default administrative username and password, which makes it easier for remote attackers to obtain privileged access.
[http://packetstorm.linuxsecurity.com/0902-exploits/cctv-disclose.txt]
[20090210 Remote Authentication Bypass - Swann DVR4 SecuraNet (possibly DVR9 as well)]
Directory traversal vulnerability in index.php in Jaws 0.8.8 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the (1) language, (2) Introduction_complete, and (3) use_log parameters, different vectors than CVE-2004-2445.
Reference links indicate file inclusion and script or code execution in addition to information exposure.
[http://www.jaws-project.com/blog/show/jaws-089-released]
[33607]
[jaws-index-file-include(48476)]
[7976]
Multiple SQL injection vulnerabilities in 4Site CMS 2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login and (2) password parameters to pcgi/4site.pl, (3) page parameter to print/print.shtml, (4) s and (5) i parameters to portfolio/index.shtml, (6) h parameter to hotel/index.php, (7) id parameter to news/news1.shtml, and the (8) th parameter to faq/index.shtml.
[http://wsec.ru/wsec-09-002-4site-cms-26-multiple-sql-injections/]
[http://www.htbridge.ch/advisory/sql_injection_in_4site_cms.html]
[20101019 SQL Injection in 4site CMS]
[33594]
[4sitecms-pages-sql-injection(48483)]
[4sitecms-hotels-sql-injection(48486)]
[4sitecms-news-sql-injection(48487)]
[4sitecms-faq-sql-injection(48488)]
[7964]
msnmsgr.exe in Windows Live Messenger (WLM) 2009 build 14.0.8064.206, and other 14.0.8064.x builds, allows remote attackers to cause a denial of service (application crash) via a modified header in a packet, as possibly demonstrated by a UTF-8.0 value of the charset field in the Content-Type header line. NOTE: this has been reported as a format string vulnerability by some sources, but the provenance of that information is unknown.
[20090218 RE: hello bug in windows live messenger]
[33825]
[ADV-2009-0466]
[wlm-packets-dos(48810)]
Multiple cross-site request forgery (CSRF) vulnerabilities in the manage_users handler in admin/index.php in Falt4 CMS (aka Falt4 Extreme) RC4 allow remote attackers to hijack the authentication of administrators for requests that change passwords via the (1) edit and (2) edit_now actions.
[http://packetstorm.linuxsecurity.com/0902-exploits/falt4-cms-xsrf.txt]
[falt4-admin-index-csrf(48786)]
The web browser in Symbian OS on the Nokia N95 cell phone allows remote attackers to cause a denial of service (crash) via JavaScript code that calls the setAttributeNode method.
[20090213 Nokia N95 browser "setAttributeNode" method crash]
[33767]
[nokian95-setattributenode-dos(48763)]
[8051]
Stack-based buffer overflow in the GetStatsFromLine function in TPTEST 3.1.7 and earlier, and possibly 5.02, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a STATS line with a long pwd field. NOTE: some of these details are obtained from third party information.
[33785]
[tptest-pwd-bo(48781)]
[8058]
Unspecified vulnerability in the Veritas network daemon (aka vnetd) in Symantec Veritas NetBackup Server / Enterprise Server 5.x, 6.0 before MP7 SP1, and 6.5 before 6.5.3.1 allows remote attackers to execute arbitrary code via unknown vectors related to "initial communications setup."
[http://securityresponse.symantec.com/avcenter/security/Content/2009.02.17.html]
[http://seer.entsupport.symantec.com/docs/317828.htm]
[253287]
[33772]
[1021734]
[ADV-2009-0461]
[ADV-2009-1097]
[veritas-netbackup-vnetd-privilege-escalation(48795)]
The Internationalized Domain Names (IDN) blacklist in Mozilla Firefox 3.0.6 and other versions before 3.0.9; Thunderbird before 2.0.0.21; and SeaMonkey before 1.1.15 does not include box-drawing characters, which allows remote attackers to spoof URLs and conduct phishing attacks, as demonstrated by homoglyphs of the / (slash) and ? (question mark) characters in a subdomain of a .cn domain name, a different vulnerability than CVE-2005-0233. NOTE: some third parties claim that 3.0.6 is not affected, but much older versions perhaps are affected.
[[dailydave] 20090219 SSL MITM fun.]
[[dailydave] 20090220 SSL MITM fun.]
[SUSE-SR:2009:010]
[RHSA-2009:0437]
[http://www.blackhat.com/html/bh-dc-09/bh-dc-09-speakers.html#Marlinspike]
[DSA-1797]
[DSA-1830]
[MDVSA-2009:111]
[http://www.mozilla.org/security/announce/2009/mfsa2009-15.html]
[RHSA-2009:0436]
[33837]
[ADV-2009-1125]
[mozilla-firefox-homoglyph-spoofing(48974)]
[oval:org.mitre.oval:def:11396]
[USN-764-1]
[https://www.blackhat.com/presentations/bh-dc-09/Marlinspike/BlackHat-DC-09-Marlinspike-Defeating-SSL.pdf]
[FEDORA-2009-3875]
OpenSSL, probably 0.9.6, does not verify the Basic Constraints for an intermediate CA-signed certificate, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack, a related issue to CVE-2002-0970.
[http://www.blackhat.com/html/bh-dc-09/bh-dc-09-speakers.html#Marlinspike]
[https://www.blackhat.com/presentations/bh-dc-09/Marlinspike/BlackHat-DC-09-Marlinspike-Defeating-SSL.pdf]
Tor 0.2.0.28, and probably 0.2.0.34 and earlier, allows remote attackers, with control of an entry router and an exit router, to confirm that a sender and receiver are communicating via vectors involving (1) replaying, (2) modifying, (3) inserting, or (4) deleting a single cell, and then observing cell recognition errors at the exit router. NOTE: the vendor disputes the significance of this issue, noting that the product's design "accepted end-to-end correlation as an attack that is too expensive to solve."
[http://blog.torproject.org/blog/one-cell-enough]
[http://www.blackhat.com/html/bh-dc-09/bh-dc-09-archives.html#Fu]
[http://www.blackhat.com/presentations/bh-dc-09/Fu/BlackHat-DC-09-Fu-Break-Tors-Anonymity.pdf]
Lenovo Veriface III allows physically proximate attackers to login to a Windows account by presenting a "plain image" of the authorized user.
[http://security.bkis.vn/?p=292]
[http://www.blackhat.com/html/bh-dc-09/bh-dc-09-archives.html#Nguyen]
[http://www.blackhat.com/presentations/bh-dc-09/Nguyen/BlackHat-DC-09-Nguyen-Face-not-your-password.pdf]
[20081208 [SVRT-07-08] Vulnerability in Face Recognition Authentication Mechanism of Lenovo-Asus-Toshiba Laptops]
[32700]
[lenovo-plainimage-unauth-access(48961)]
Asus SmartLogon 1.0.0005 allows physically proximate attackers to bypass "security functions" by presenting an image with a modified viewpoint that matches the posture of a stored image of the authorized notebook user.
[http://security.bkis.vn/?p=292]
[http://www.blackhat.com/html/bh-dc-09/bh-dc-09-archives.html#Nguyen]
[http://www.blackhat.com/presentations/bh-dc-09/Nguyen/BlackHat-DC-09-Nguyen-Face-not-your-password.pdf]
[20081208 [SVRT-07-08] Vulnerability in Face Recognition Authentication Mechanism of Lenovo-Asus-Toshiba Laptops]
[32700]
[asus-image-security-bypass(48962)]
Toshiba Face Recognition 2.0.2.32 allows physically proximate attackers to obtain notebook access by presenting a large number of images for which the viewpoint and lighting have been modified to match a stored image of the authorized notebook user.
[http://security.bkis.vn/?p=292]
[http://www.blackhat.com/html/bh-dc-09/bh-dc-09-archives.html#Nguyen]
[http://www.blackhat.com/presentations/bh-dc-09/Nguyen/BlackHat-DC-09-Nguyen-Face-not-your-password.pdf]
[20081208 [SVRT-07-08] Vulnerability in Face Recognition Authentication Mechanism of Lenovo-Asus-Toshiba Laptops]
[32700]
[toshibaface-notebook-unauth-access(48963)]
Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier, allows remote attackers to execute arbitrary code via a crafted PDF document, related to a non-JavaScript function call and possibly an embedded JBIG2 image stream, as exploited in the wild in February 2009 by Trojan.Pidief.E.
[http://isc.sans.org/diary.html?n&storyid=5902]
[SUSE-SA:2009:014]
[SUSE-SR:2009:009]
[GLSA-200904-17]
[256788]
[http://www.adobe.com/support/security/advisories/apsa09-01.html]
[http://www.adobe.com/support/security/bulletins/apsb09-04.html]
[VU#905281]
[RHSA-2009:0376]
[33751]
[1021739]
[http://www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20090219]
[http://www.symantec.com/security_response/writeup.jsp?docid=2009-021212-5523-99&tabid=2]
[TA09-051A]
[ADV-2009-0472]
[ADV-2009-1019]
[adobe-acrobat-reader-image-bo(48825)]
[oval:org.mitre.oval:def:5697]
[8090]
[8099]
Stack-based buffer overflow in the GetStatsFromLine function in TPTEST 3.1.7 allows remote attackers to have an unknown impact via a STATS line with a long email field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[tptest-pwd-bo(48781)]
[tptest-getstatsfromline-bo(48953)]
Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.0 before 1.0.10 and 1.1 before 1.1.2 allow remote attackers to inject arbitrary web script or HTML via a (1) profile and (2) blog, a different vulnerability than CVE-2009-0487.
[http://mahara.org/interaction/forum/topic.php?id=350]
[http://wiki.mahara.org/Release_Notes/1.1.2]
[DSA-1736]
[34064]
[ADV-2009-0665]
[mahara-userprofile-xss(49168)]
Wee Enhanced Environment for Chat (WeeChat) 0.2.6 allows remote attackers to cause a denial of service (crash) via an IRC PRIVMSG command containing crafted color codes that trigger an out-of-bounds read.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=519940]
[http://savannah.nongnu.org/bugs/index.php?25862]
[http://weechat.flashtux.org/]
[DSA-1744]
[[oss-security] 20090317 Re: CVE request -- firefox, vlc, WeeChat]
[34148]
[ADV-2009-0758]
[weechat-ircmessage-dos(49295)]
The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors.
[http://plone.org/products/plone/security/advisories/cve-2009-0662]
[34664]
[plone-unspecified-session-hijacking(50061)]
Heap-based buffer overflow in the DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module 1.49 for Perl might allow context-dependent attackers to execute arbitrary code via unspecified input to an application that uses the getline and pg_getline functions to read database rows.
[SUSE-SR:2009:012]
[http://security.debian.org/pool/updates/main/libd/libdbd-pg-perl/libdbd-pg-perl_1.49-2+etch1.diff.gz]
[DSA-1780]
[RHSA-2009:0479]
[RHSA-2009:1067]
[34755]
[libdbdpgperl-unspecified-bo(50467)]
[https://launchpad.net/bugs/cve/2009-0663]
[oval:org.mitre.oval:def:9499]
Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.0.x before 1.0.11 and 1.1.x before 1.1.3 allow remote attackers to inject arbitrary web script or HTML via (1) the introduction field in a user profile or (2) an arbitrary text block in a user view.
[http://mahara.org/interaction/forum/topic.php?id=532]
[DSA-1778]
[34677]
Untrusted search path vulnerability in Agent/Backend.pm in Ocsinventory-Agent before 0.0.9.3, and 1.x before 1.0.1, in OCS Inventory allows local users to gain privileges via a Trojan horse Perl module in an arbitrary directory.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506416]
[http://nana.rulezlan.org/~goneri/ocsinventory-agent/Ocsinventory-Agent-0.0.9.3.tar.gz]
[http://security.debian.org/pool/updates/main/o/ocsinventory-agent/ocsinventory-agent_0.0.9.2repack1-4lenny1.diff.gz]
[DSA-1828]
[http://www.ocsinventory-ng.org/index.php?mact=News,cntnt01,detail,0&cntnt01articleid=144]
[35593]
[ADV-2009-1809]
Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to execute arbitrary Python code via vectors involving the ZEO network protocol.
[[zope-announce] 20090806 CVE-2009-0668 and CVE-2009-0669: Releases to fix ZODB ZEO server vulnerabilities]
[http://pypi.python.org/pypi/ZODB3/3.8.2#whats-new-in-zodb-3-8-2]
[35987]
[ADV-2009-2217]
[zope-protocol-code-execution(52377)]
Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to bypass authentication via vectors involving the ZEO network protocol.
[[zope-announce] 20090806 CVE-2009-0668 and CVE-2009-0669: Releases to fix ZODB ZEO server vulnerabilities]
[http://pypi.python.org/pypi/ZODB3/3.8.2#whats-new-in-zodb-3-8-2]
[35987]
[ADV-2009-2217]
[zope-protocol-auth-bypass(52379)]
** REJECT ** Format string vulnerability in the University of Washington (UW) c-client library, as used by the UW IMAP toolkit imap-2007d and other applications, allows remote attackers to execute arbitrary code via format string specifiers in the initial request to the IMAP port (143/tcp). NOTE: Red Hat has disputed the vulnerability, stating "The Red Hat Security Response Team have been unable to confirm the existence of this format string vulnerability in the toolkit, and the sample published exploit is not complete or functional." CVE agrees that the exploit contains syntax errors and uses Unix-only include files while invoking Windows functions.
SQL injection vulnerability in the Resend_Email module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary SQL commands via the user_prefix parameter to modules.php.
[http://ravenphpscripts.com/postt17156.html]
[20090216 [waraxe-2009-SA#072] - Multiple Vulnerabilities in RavenNuke 2.3.0]
[33787]
[http://www.waraxe.us/advisory-72.html]
[ravennuke-modules-sql-injection(48791)]
[8068]
Eval injection vulnerability in the Custom Fields feature in the Your Account module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary PHP code via the ID Field Name box in a yaCustomFields action to admin.php.
[http://ravenphpscripts.com/postt17156.html]
[20090216 [waraxe-2009-SA#072] - Multiple Vulnerabilities in RavenNuke 2.3.0]
[33787]
[http://www.waraxe.us/advisory-72.html]
[ravennuke-admin-code-execution(48790)]
[8068]
images/captcha.php in Raven Web Services RavenNuke 2.30, when register_globals and display_errors are enabled, allows remote attackers to determine the existence of local files by sending requests with full pathnames in the aFonts array parameter, and then observing the error messages, which differ between existing and nonexistent pathnames.
[http://ravenphpscripts.com/postt17156.html]
[20090216 [waraxe-2009-SA#072] - Multiple Vulnerabilities in RavenNuke 2.3.0]
[33787]
[http://www.waraxe.us/advisory-72.html]
[ravennuke-captcha-info-disclosure(48792)]
[ravennuke-captcha-afonts-info-disclosure(48983)]
[8068]
The skfp_ioctl function in drivers/net/skfp/skfddi.c in the Linux kernel before 2.6.28.6 permits SKFP_CLR_STATS requests only when the CAP_NET_ADMIN capability is absent, instead of when this capability is present, which allows local users to reset the driver statistics, related to an "inverted logic" issue.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c25b9abbc2c2c0da88e180c3933d6e773245815a]
[SUSE-SA:2009:031]
[[netdev] 20090128 [PATCH] drivers/net/skfp: if !capable(CAP_NET_ADMIN): inverted logic]
[[oss-security] 20090220 CVE request: kernel: skfp_ioctl inverted logic flaw]
[DSA-1749]
[DSA-1787]
[DSA-1794]
[http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.6]
[MDVSA-2009:071]
[RHSA-2009:0326]
[RHSA-2009:0360]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[USN-751-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-3316]
[https://bugzilla.redhat.com/show_bug.cgi?id=486534]
[oval:org.mitre.oval:def:11529]
[oval:org.mitre.oval:def:8685]
The sock_getsockopt function in net/core/sock.c in the Linux kernel before 2.6.28.6 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel memory via an SO_BSDCOMPAT getsockopt request.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=df0bca049d01c0ee94afb7cd5dfd959541e6c8da]
[SUSE-SA:2009:021]
[SUSE-SA:2009:030]
[SUSE-SA:2009:031]
[[linux-kernel] 20090212 [PATCH] 4 bytes kernel memory disclosure in SO_BSDCOMPAT gsopt try #2]
[[linux-kernel] 20090223 net: amend the fix for SO_BSDCOMPAT gsopt infoleak]
[[oss-security] 20090220 CVE request: kernel: memory disclosure in SO_BSDCOMPAT gsopt]
[http://patchwork.kernel.org/patch/6816/]
[RHSA-2009:0459]
[DSA-1749]
[DSA-1787]
[DSA-1794]
[http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.6]
[MDVSA-2009:071]
[[oss-security] 20090224 Re: CVE request: kernel: memory disclosure in SO_BSDCOMPAT gsopt]
[[oss-security] 20090302 Re: CVE request: kernel: memory disclosure in SO_BSDCOMPAT gsopt]
[RHSA-2009:0326]
[RHSA-2009:0360]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[33846]
[USN-751-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-3316]
[https://bugzilla.redhat.com/show_bug.cgi?id=486305]
[kernel-sock-information-disclosure(48847)]
[oval:org.mitre.oval:def:11653]
[oval:org.mitre.oval:def:8618]
avatarlist.php in the Your Account module, reached through modules.php, in Raven Web Services RavenNuke 2.30 allows remote authenticated users to execute arbitrary code via PHP sequences in an element of the replacements array, which is processed by the preg_replace function with the eval switch, as specified in an element of the patterns array.
[http://ravenphpscripts.com/postt17156.html&sid=12d1201371612260a42fa846ebce7bad]
[20090216 [waraxe-2009-SA#072] - Multiple Vulnerabilities in RavenNuke 2.3.0]
[33787]
[http://www.waraxe.us/advisory-72.html]
[ravennuke-avatarlist-code-execution(48789)]
[8068]
images/captcha.php in RavenNuke 2.30 allows remote attackers to obtain sensitive information via an aFonts array parameter value that does not correspond to a valid font file, which reveals the installation path in an error message.
[http://ravenphpscripts.com/postt17156.html]
[20090216 [waraxe-2009-SA#072] - Multiple Vulnerabilities in RavenNuke 2.3.0]
[http://www.waraxe.us/advisory-72.html]
[ravennuke-captcha-info-disclosure(48792)]
[8068]
Cross-site scripting (XSS) vulnerability in the Your Account module in RavenNuke 2.30 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://ravenphpscripts.com/postt17156.html]
[ravennuke-youraccount-xss(48978)]
cgi-bin/welcome/VPN_only in the web interface in Netgear SSL312 allows remote attackers to cause a denial of service (device crash) via a crafted query string, as demonstrated using directory traversal sequences.
[20090208 Netgear SSL312 Router - remote DoS]
[http://www.helith.net/txt/netgear_ssl312_remote_dos.txt]
[33675]
[netgear-ssl312-dos(48605)]
[8008]
PGP Desktop before 9.10 allows local users to (1) cause a denial of service (crash) via a crafted IOCTL request to pgpdisk.sys, and (2) cause a denial of service (crash) and execute arbitrary code via a crafted IRP in an IOCTL request to pgpwded.sys.
[http://en.securitylab.ru/lab/PT-2009-01]
[20090413 [Suspected Spam][Positive Technologies SA 2009-01] PGP Desktop Pgpdisk.sys And Pgpwded.sys Multiple Vulnerabilities]
[1022034]
[https://pgp.custhelp.com/cgi-bin/pgp.cfg/php/enduser/std_adp.php?p_faqid=1014&p_topview=1]
vetmonnt.sys in CA Internet Security Suite r3, vetmonnt.sys before 9.0.0.184 in Internet Security Suite r4, and vetmonnt.sys before 10.0.0.217 in Internet Security Suite r5 do not properly verify IOCTL calls, which allows local users to cause a denial of service (system crash) via a crafted call.
[http://en.securitylab.ru/lab/PT-2009-05]
[20090818 CA20090818-02: Security Notice for CA Internet Security Suite]
[20090826 [PT-2009-05] CA Internet Security Suite Denial of Service Vulnerability]
[https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=214673]
The TrendMicro Activity Monitor Module (tmactmon.sys) 2.52.0.1002 in Trend Micro Internet Pro 2008 and 2009, and Security Pro 2008 and 2009, allows local users to gain privileges via a crafted IRP in a METHOD_NEITHER IOCTL request to \Device\tmactmon that overwrites memory.
[http://en.securitylab.ru/lab/PT-2009-09]
[http://milw0rm.com/sploits/2009-trendmicro_local_expl_0day.zip]
[20090331 [Positive Technologies SA 2009-09] Trend Micro Internet Security Pro 2009 tmactmon.sys Priviliege Escalation Vulnerabilities]
[34304]
[1021955]
[trend-tmactmon-privilege-escalation(49513)]
[8322]
The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirOS 10 and earlier, and MidnightBSD 0.3-current allows remote attackers to cause a denial of service (panic) via crafted IP packets that trigger a NULL pointer dereference during translation, related to an IPv4 packet with an ICMPv6 payload.
[ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/013_pf.patch]
[NetBSD-SA2009-001]
[http://www.helith.net/txt/multiple_vendor-PF_null_pointer_dereference.txt]
[[4.3] 013: RELIABILITY FIX: April 11, 2009]
[[4.4] 013: RELIABILITY FIX: April 11, 2009]
[[4.5] 002: RELIABILITY FIX: April 11, 2009]
[20090413 OpenBSD 4.3 up to OpenBSD-current: PF null pointer dereference - remote DoS (kernel panic)]
[ADV-2009-1015]
[openbsd-packetfilter-dos(49837)]
[8406]
[8581]
Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via strings that are used as input to the sasl_encode64 function in lib/saslutil.c.
[ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/cyrus-sasl-2.1.23.tar.gz]
[APPLE-SA-2010-03-29-1]
[SUSE-SR:2009:011]
[GLSA-200907-09]
[SSA:2009-134-01]
[259148]
[264248]
[273910]
[1020755]
[1021699]
[http://support.apple.com/kb/HT4077]
[http://support.avaya.com/elmodocs2/security/ASA-2009-184.htm]
[http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0091]
[DSA-1807]
[VU#238019]
[MDVSA-2009:113]
[http://www.oracle.com/technetwork/topics/security/cpuapr2010-099504.html]
[RHSA-2009:1116]
[34961]
[1022231]
[USN-790-1]
[TA10-103B]
[ADV-2009-1313]
[ADV-2009-2012]
[solaris-sasl-saslencode64-bo(50554)]
[oval:org.mitre.oval:def:10687]
[oval:org.mitre.oval:def:6136]
Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4, K-Meleon 1.5.3, SeaMonkey 1.1.8, and other products, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large precision value in the format argument to a printf function, which triggers incorrect memory allocation and a heap-based buffer overflow during conversion to a floating-point number.
[http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gdtoa/gdtoaimp.h]
[APPLE-SA-2010-03-29-1]
[APPLE-SA-2010-06-21-1]
[SUSE-SR:2009:018]
[SUSE-SR:2010:013]
[RHSA-2014:0311]
[RHSA-2014:0312]
[20090625 Multiple Vendors libc/gdtoa printf(3) Array Overrun]
[20091030 Multiple BSD printf(1) and multiple dtoa/*printf(3) vulnerabilities]
[20091120 SeaMonkey 1.1.8 Remote Array Overrun (Arbitrary code execution)]
[20091120 K-Meleon 1.5.3 Remote Array Overrun (Arbitrary code execution)]
[20091120 Opera 10.01 Remote Array Overrun (Arbitrary code execution)]
[20091211 Flock 2.5.2 Remote Array Overrun (Arbitrary code execution)]
[20091211 Camino 1.6.10 Remote Array Overrun (Arbitrary code execution)]
[20091211 Sunbird 0.9 Array Overrun (code execution)]
[20091211 Thunderbird 2.0.0.23 (lib) Remote Array Overrun (Arbitrary code execution)]
[20100108 MacOS X 10.5/10.6 libc/strtod(3) buffer overflow]
[1022478]
[272909]
[http://support.apple.com/kb/HT4077]
[http://support.apple.com/kb/HT4225]
[MDVSA-2009:294]
[MDVSA-2009:330]
[http://www.mozilla.org/security/announce/2009/mfsa2009-59.html]
[http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/misc.c]
[http://www.opera.com/support/kb/view/942/]
[RHSA-2009:1601]
[RHSA-2010:0153]
[RHSA-2010:0154]
[20091120 K-Meleon 1.5.3 Remote Array Overrun (Arbitrary code execution)]
[20091120 SeaMonkey 1.1.8 Remote Array Overrun (Arbitrary code execution)]
[20091210 Flock 2.5.2 Remote Array Overrun (Arbitrary code execution)]
[20091210 Camino 1.6.10 Remote Array Overrun (Arbitrary code execution)]
[35510]
[USN-915-1]
[ADV-2009-3297]
[ADV-2009-3299]
[ADV-2009-3334]
[ADV-2010-0094]
[ADV-2010-0648]
[ADV-2010-0650]
[https://bugzilla.mozilla.org/show_bug.cgi?id=516396]
[https://bugzilla.mozilla.org/show_bug.cgi?id=516862]
[[debian-lts-announce] 20181101 [SECURITY] [DLA 1564-1] mono security update]
[oval:org.mitre.oval:def:6528]
[oval:org.mitre.oval:def:9541]
The Foxit JPEG2000/JBIG2 Decoder add-on before 2.0.2009.616 for Foxit Reader 3.0 before Build 1817 does not properly handle a negative value for the stream offset in a JPEG2000 (aka JPX) stream, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted PDF file that triggers an out-of-bounds read.
[1022425]
[http://www.foxitsoftware.com/pdf/reader/security.htm#0602]
[VU#251793]
[35442]
[ADV-2009-1640]
The Foxit JPEG2000/JBIG2 Decoder add-on before 2.0.2009.616 for Foxit Reader 3.0 before Build 1817 does not properly handle a fatal error during decoding of a JPEG2000 (aka JPX) header, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted PDF file that triggers an invalid memory access.
[1022425]
[http://www.foxitsoftware.com/pdf/reader/security.htm#0602]
[VU#251793]
[35443]
[ADV-2009-1640]
Stack-based buffer overflow in the script_write_params method in client/dhclient.c in ISC DHCP dhclient 4.1 before 4.1.0p1, 4.0 before 4.0.1p1, 3.1 before 3.1.2p1, 3.0, and 2.0 allows remote DHCP servers to execute arbitrary code via a crafted subnet-mask option.
[NetBSD-SA2009-010]
[SSRT100018]
[SUSE-SA:2009:037]
[GLSA-200907-12]
[SSA:2009-195-01]
[DSA-1833]
[VU#410676]
[MDVSA-2009:151]
[RHSA-2009:1136]
[RHSA-2009:1154]
[35668]
[1022548]
[USN-803-1]
[ADV-2009-1891]
[ADV-2010-1796]
[https://bugzilla.redhat.com/show_bug.cgi?id=507717]
[oval:org.mitre.oval:def:10758]
[oval:org.mitre.oval:def:5941]
[https://www.isc.org/downloadables/12]
[https://www.isc.org/node/468]
[FEDORA-2009-8344]
[FEDORA-2009-9075]
Multiple buffer overflows in Wyse Device Manager (WDM) 4.7.x allow remote attackers to execute arbitrary code via (1) the User-Agent HTTP header to hserver.dll or (2) unspecified input to hagent.exe.
[20090710 'Secure' Wyse thin clients vulnerable to remote exploit bugs]
[VU#654545]
[http://www.theregister.co.uk/2009/07/10/wyse_remote_exploit_bugs/]
[http://www.wyse.com/serviceandsupport/Wyse%20Security%20Bulletin%20WSB09-01.pdf]
hagent.exe in Wyse Device Manager (WDM) 4.7.x does not require authentication for commands, which allows remote attackers to obtain management access via a crafted query, as demonstrated by a V52 query that triggers a power-off action.
[20090710 'Secure' Wyse thin clients vulnerable to remote exploit bugs]
[19137]
[VU#654545]
[http://www.theregister.co.uk/2009/07/10/wyse_remote_exploit_bugs/]
[http://www.wyse.com/serviceandsupport/Wyse%20Security%20Bulletin%20WSB09-01.pdf]
The dns_db_findrdataset function in db.c in named in ISC BIND 9.4 before 9.4.3-P3, 9.5 before 9.5.1-P3, and 9.6 before 9.6.1-P1, when configured as a master server, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an ANY record in the prerequisite section of a crafted dynamic update message, as exploited in the wild in July 2009.
[NetBSD-SA2009-013]
[ftp://ftp.sco.com/pub/unixware7/714/security/p535243_uw7/p535243b.txt]
[http://aix.software.ibm.com/aix/efixes/security/bind_advisory.asc]
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=538975]
[264828]
[1020788]
[http://up2date.astaro.com/2009/08/up2date_7505_released.html]
[http://wiki.rpath.com/Advisories:rPSA-2009-0113]
[VU#725188]
[[4.4] 014: RELIABILITY FIX: July 29, 2009]
[20090729 rPSA-2009-0113-1 bind bind-utils]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[1022613]
[SSA:2009-210-01]
[USN-808-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-2036]
[ADV-2009-2088]
[ADV-2009-2171]
[ADV-2009-2247]
[ADV-2009-3316]
[oval:org.mitre.oval:def:10414]
[oval:org.mitre.oval:def:12245]
[oval:org.mitre.oval:def:7806]
[https://www.isc.org/node/474]
[FEDORA-2009-8119]
Integer overflow in the 4xm demuxer (demuxers/demux_4xm.c) in xine-lib 1.1.16.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a 4X movie file with a large current_track value, a similar issue to CVE-2009-0385.
[http://bugs.xine-project.org/show_bug.cgi?id=205]
[SUSE-SR:2009:009]
[http://sourceforge.net/project/shownotes.php?release_id=660071]
[MDVSA-2009:298]
[MDVSA-2009:299]
[20090128 [TKADV2009-004] FFmpeg Type Conversion Vulnerability]
[http://www.trapkit.de/advisories/TKADV2009-004.txt]
[USN-746-1]
[xinelib-4xmdemuxer-code-execution(48954)]
Cross-site scripting (XSS) vulnerability in pagesUTF8/auftrag_allgemeinauftrag.jsp in Plunet BusinessManager 4.1 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the (1) QUB and (2) Bez74 parameters.
[20090107 Plunet BusinessManager failure in access controls and multiple stored cross site scripting]
[20090109 Re: Plunet BusinessManager failure in access controls and multiple stored cross site scripting]
[http://www.securenetwork.it/ricerca/advisory/download/SN-2008-04.txt]
[33153]
[businessmanager-qub-bez74-xss(47795)]
Plunet BusinessManager 4.1 and earlier allows remote authenticated users to bypass access restrictions and (1) read sensitive Customer or Order data via a modified Pfad parameter to pagesUTF8/Sys_DirAnzeige.jsp, or (2) list sensitive Jobs via a direct request to pagesUTF8/auftrag_job.jsp.
[20090107 Plunet BusinessManager failure in access controls and multiple stored cross site scripting]
[20090109 Re: Plunet BusinessManager failure in access controls and multiple stored cross site scripting]
[http://www.securenetwork.it/ricerca/advisory/download/SN-2008-04.txt]
[33153]
[businessmanager-multiple-security-bypass(47794)]
Multiple PHP remote file inclusion vulnerabilities in index.php in Cybershade CMS 0.2b, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) THEME_header and (2) THEME_footer parameters.
[33101]
[cybershadecms-index-file-include(47725)]
[7668]
SQL injection vulnerability in the Phoca Documentation (com_phocadocumentation) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a section action to index.php.
[33114]
[ADV-2009-0026]
[7670]
SQL injection vulnerability in bview.asp in ASPThai.Net Webboard 6.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
[33084]
[webboard-bview-sql-injection(47722)]
[7635]
SQL injection vulnerability in search.php in WSN Guest 1.23 allows remote attackers to execute arbitrary SQL commands via the search parameter in an advanced action.
[33097]
[wsnguest-search-sql-injection(47723)]
[7659]
SQL injection vulnerability in news.php in PowerScripts PowerNews 2.5.4, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the newsid parameter.
[33081]
[powernews-news-sql-injection(47701)]
[7641]
SQL injection vulnerability in the Simple Review (com_simple_review) component 1.3.5 for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the category parameter to index.php.
[http://packetstormsecurity.org/0901-exploits/joomlasimplereview-sql.txt]
[33102]
[simplereview-index-sql-injection(47726)]
SQL injection vulnerability in admin/index.php in PowerClan 1.14a allows remote attackers to execute arbitrary SQL commands via the loginemail parameter (aka login field). NOTE: some of these details are obtained from third party information.
[33083]
[powerclan-index-sql-injection(47702)]
[7642]
Multiple cross-site request forgery (CSRF) vulnerabilities in SemanticScuttle before 0.91 allow remote attackers to (1) hijack the authentication of administrators via unknown vectors or (2) hijack the authentication of arbitrary users via vectors involving the profile page.
[http://sourceforge.net/project/shownotes.php?release_id=651587]
SQL injection vulnerability in login.php in PHPFootball 1.6 allows remote attackers to execute arbitrary SQL commands via the user parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[phpfootball-login-sql-injection(47720)]
Multiple cross-site scripting (XSS) vulnerabilities in PHPFootball 1.6 allow remote attackers to inject arbitrary web script or HTML via (1) the user parameter to login.php or (2) the dbfield parameter to filter.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[phpfootball-filter-xss(47719)]
[phpfootball-login-xss(47721)]
filter.php in PHPFootball 1.6 and earlier allows remote attackers to retrieve password hashes via a request with an Accounts value for the dbtable parameter, in conjunction with a Password value for the dbfield parameter. NOTE: this has been reported as a SQL injection vulnerability by some sources, but the provenance of that information is unknown.
[7636]
Unspecified vulnerability in WMI Mapper for HP Systems Insight Manager before 2.5.2.0 allows local users to gain privileges via unknown vectors.
[SSRT080040]
[HPSBMA02413]
[34078]
[1021835]
[ADV-2009-0671]
Unspecified vulnerability in WMI Mapper for HP Systems Insight Manager before 2.5.2.0 allows remote attackers to obtain sensitive information via unknown vectors.
[SSRT080040]
[HPSBMA02413]
[34078]
[1021836]
[ADV-2009-0671]
Unspecified vulnerability in the dpwinsup module (dpwinsup.dll) for dpwingad (dpwingad.exe) in HP Data Protector Express and Express SSE 3.x before build 47065, and Express and Express SSE 4.x before build 46537, allows remote attackers to cause a denial of service (application crash) or read portions of memory via one or more crafted packets.
[HPSBMA02417]
[http://ivizsecurity.com/security-advisory-iviz-sr-09002.html]
[34955]
[1022220]
[ADV-2009-1309]
[9006]
[9007]
Unspecified vulnerability in Secure NaviCLI in HP Storage Essentials 6.0.2 through 6.0.4 allows remote authenticated users to obtain "access" or "extended privileges" via unknown vectors.
[1022084]
[ADV-2009-1109]
Unspecified vulnerability in HP StorageWorks Storage Mirroring 5 before 5.1.1.1090.15 allows remote attackers to cause a denial of service or obtain "access" via unknown vectors.
[HPSBMA02422]
[1022085]
[ADV-2009-1108]
Unspecified vulnerability in HP StorageWorks Storage Mirroring 5 before 5.1.1.1090.15 allows remote attackers to cause a denial of service via unknown vectors.
[1022086]
[ADV-2009-1108]
Unspecified vulnerability in HP StorageWorks Storage Mirroring 5 before 5.1.1.1090.15 allows remote attackers to execute arbitrary code via unknown vectors.
[HPSBMA02422]
[1022087]
[ADV-2009-1108]
Unspecified vulnerability in useradd in HP HP-UX B.11.11, B.11.23, and B.11.31 allows local users to access arbitrary files and directories via unknown vectors, a different issue than CVE-2008-1660.
[HPSBUX02366]
[34748]
[oval:org.mitre.oval:def:5791]
Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via unknown vectors.
[SSRT080091]
[1022163]
[ADV-2009-1250]
Unspecified vulnerability in Easy Login in the Sender module in HP Remote Graphics Software (RGS) 4.0.0 through 5.2.4 allows remote attackers to execute arbitrary code via unknown vectors.
[1022221]
[SSRT090069]
[34980]
[ADV-2009-1323]
Directory traversal vulnerability in admin.php in Potato News 1.0.0 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the user cookie parameter.
[33729]
[8032]
Multiple integer overflows in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent attackers to execute arbitrary code via a crafted image file that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.
[SUSE-SR:2009:007]
[http://scary.beasts.org/security/CESA-2009-003.html]
[http://scarybeastsecurity.blogspot.com/2009/03/littlecms-vulnerabilities.html]
[GLSA-200904-19]
[SSA:2009-083-01]
[DSA-1745]
[DSA-1769]
[MDVSA-2009:121]
[MDVSA-2009:137]
[MDVSA-2009:162]
[http://www.ocert.org/advisories/ocert-2009-003.html]
[RHSA-2009:0339]
[20090320 LittleCMS vulnerabilities (OpenJDK, Firefox, GIMP, etc. impacted)]
[20090320 [oCERT-2009-003] LittleCMS integer errors]
[34185]
[1021869]
[USN-744-1]
[ADV-2009-0775]
[https://bugzilla.redhat.com/show_bug.cgi?id=487508]
[littlecms-unspecified-bo(49326)]
[oval:org.mitre.oval:def:11780]
[RHSA-2009:0377]
[FEDORA-2009-2903]
[FEDORA-2009-2910]
[FEDORA-2009-2928]
[FEDORA-2009-2970]
[FEDORA-2009-2982]
[FEDORA-2009-2983]
[FEDORA-2009-3034]
SQL injection vulnerability in the GigCalendar (com_gigcal) component 1.0 for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the gigcal_gigs_id parameter in a details action to index.php.
[33241]
[gigcalendar-index-sql-injection(47919)]
[7746]
SQL injection vulnerability in jobdetails.php in taifajobs 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the jobid parameter.
[http://e-rdc.org/v1/news.php?readmore=126]
[20090223 [ECHO_ADV_103$2009] taifajobs <= 1.0 (jobid) Remote SQL Injection Vulnerability]
[33864]
[8098]
SQL injection vulnerability in the My_eGallery module for MAXdev MDPro (MD-Pro) and Postnuke allows remote attackers to execute arbitrary SQL commands via the pid parameter in a showpic action to index.php.
[33871]
[8100]
Multiple directory traversal vulnerabilities in Page Engine CMS 2.0 Basic and Pro allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the fPrefix parameter to (1) modules/recent_poll_include.php, (2) modules/login_include.php, and (3) modules/statistics_include.php and (4) configuration.inc.php in includes/. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[33860]
[pageengine-fprefix-file-include(48856)]
Multiple SQL injection vulnerabilities in the GigCalendar (com_gigcal) component 1.0 for Mambo and Joomla!, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the gigcal _venues_id parameter in a details action to index.php, which is not properly handled by venuedetails.php, and (2) the gigcal_bands_id parameter in a details action to index.php, which is not properly handled by banddetails.php, different vectors than CVE-2009-0726.
[20090221 gigCalendar Joomla Component 1.0 SQL Injection]
[20090221 gigCalendar 1.0 (venuedetails.php) Joomla Component SQL Injection]
[20090221 gigCalendar 1.0 (banddetails.php) Joomla Component SQL Injection]
[33859]
[33863]
[gigcalendar-venuedetails-sql-injection(48865)]
Directory traversal vulnerability in pages/play.php in Free Arcade Script 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the template parameter.
[33869]
[8094]
Downloadcenter 2.1 stores common.h under the web root with insufficient access control, which allows remote attackers to obtain user credentials and other sensitive information via a direct request. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[downloadcenter-common-info-disclosure(48862)]
Multiple stack-based buffer overflows in the ReadSetOfCurves function in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent attackers to execute arbitrary code via a crafted image file associated with a large integer value for the (1) input or (2) output channel, related to the ReadLUT_A2B and ReadLUT_B2A functions.
[SUSE-SR:2009:007]
[http://scary.beasts.org/security/CESA-2009-003.html]
[http://scarybeastsecurity.blogspot.com/2009/03/littlecms-vulnerabilities.html]
[GLSA-200904-19]
[SSA:2009-083-01]
[DSA-1745]
[DSA-1769]
[MDVSA-2009:121]
[MDVSA-2009:137]
[MDVSA-2009:162]
[http://www.ocert.org/advisories/ocert-2009-003.html]
[RHSA-2009:0339]
[20090320 LittleCMS vulnerabilities (OpenJDK, Firefox, GIMP, etc. impacted)]
[20090320 [oCERT-2009-003] LittleCMS integer errors]
[34185]
[1021869]
[USN-744-1]
[ADV-2009-0775]
[https://bugzilla.redhat.com/show_bug.cgi?id=487512]
[littlecms-readsetofcurves-bo(49330)]
[oval:org.mitre.oval:def:9742]
[RHSA-2009:0377]
[FEDORA-2009-2903]
[FEDORA-2009-2910]
[FEDORA-2009-2928]
[FEDORA-2009-2970]
[FEDORA-2009-2982]
[FEDORA-2009-2983]
[FEDORA-2009-3034]
Heap-based buffer overflow in MultimediaPlayer.exe 6.86.240.7 in Nokia PC Suite 6.86.9.3 allows remote attackers to execute arbitrary code via a long string in a .m3u playlist file.
[20090203 Nokia Multimedia Player v1.1 .m3u Heap Overflow PoC exploit]
[ADV-2009-0318]
Directory traversal vulnerability in lib/classes/message_class.php in Papoo CMS 3.6, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to read and possibly execute arbitrary files via a .. (dot dot) in the pfadhier parameter. NOTE: some of these details are obtained from third party information.
[33718]
[8030]
Cross-site scripting (XSS) vulnerability in Pebble before 2.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://sourceforge.net/forum/forum.php?forum_id=917656]
[http://sourceforge.net/project/shownotes.php?release_id=660130]
[33733]
Multiple cross-site scripting (XSS) vulnerabilities in the web-based installer (config/index.php) in MediaWiki 1.6 before 1.6.12, 1.12 before 1.12.4, and 1.13 before 1.13.4, when the installer is in active use, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[[MediaWiki-announce] 20090207 MediaWiki releases: security update and new major branch]
[http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_12_4/phase3/RELEASE-NOTES]
[http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_13_4/phase3/RELEASE-NOTES]
[http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_6_12/phase3/RELEASE-NOTES]
[DSA-1901]
[33681]
[ADV-2009-0368]
SQL injection vulnerability in login.php in Auth Php 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) passwd parameters.
[33723]
[8033]
SQL injection vulnerability in login.php in MyNews 0.10 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) passwd parameters.
[33728]
[8034]
SQL injection vulnerability in login.php in BlueBird Prelease allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) passwd parameters.
[33725]
[8035]
SQL injection vulnerability in Login.asp in Craft Silicon Banking@Home 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the LoginName parameter.
[20090210 Craft Silicon Banking at Home SQL Injection]
[20090210 Craft Silicon Banking@Home SQL Injection]
[33721]
The username command in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers and Cisco ACE 4710 Application Control Engine Appliance stores a cleartext password by default, which allows context-dependent attackers to obtain sensitive information.
Note that CVE-2009-0742 is not referenced on the vendor advisory page at:
http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml
[20090225 Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine]
Cross-site scripting (XSS) vulnerability in the edit account page in the Web Server in Cisco Unified MeetingPlace Web Conferencing 6.0 before 6.0(517.0) (aka 6.0 MR4) and 7.0 before 7.0(2) (aka 7.0 MR1) allows remote authenticated users to inject arbitrary web script or HTML via the E-mail Address field.
[20090226 Cisco Unified MeetingPlace Stored Cross-Site Scripting Vulnerability]
[20090225 Cisco Unified MeetingPlace Web Conferencing Stored Cross Site Scripting Vulnerability]
[33915]
[1021778]
[cisco-meetingplace-emailaddress-xss(48965)]
Apple Safari 4 Beta build 528.16 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a feeds: URI beginning with a (1) % (percent), (2) { (open curly bracket), (3) } (close curly bracket), (4) ^ (caret), (5) ` (backquote), or (6) | (pipe) character, followed by an & (ampersand) character.
[20090225 Apple Safari 4 Beta feeds: URI NULL Pointer Dereference Denial of Service Vulnerability]
[33909]
[safari-feedsuri-dos(48943)]
[oval:org.mitre.oval:def:6066]
The ext4_group_add function in fs/ext4/resize.c in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 does not properly initialize the group descriptor during a resize (aka resize2fs) operation, which might allow local users to cause a denial of service (OOPS) by arranging for crafted values to be present in available memory.
[http://bugzilla.kernel.org/show_bug.cgi?id=12433]
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=fdff73f094e7220602cc3f8959c7230517976412]
[http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.19]
[http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.7]
[RHSA-2009:1243]
[DSA-1749]
[DSA-1787]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[USN-751-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-0509]
[ADV-2009-3316]
[oval:org.mitre.oval:def:10942]
[oval:org.mitre.oval:def:7765]
The make_indexed_dir function in fs/ext4/namei.c in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 does not validate a certain rec_len field, which allows local users to cause a denial of service (OOPS) by attempting to mount a crafted ext4 filesystem.
[http://bugzilla.kernel.org/show_bug.cgi?id=12430]
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e6b8bc09ba2075cd91fbffefcd2778b1a00bd76f]
[http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.19]
[http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.7]
[RHSA-2009:1243]
[DSA-1749]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[USN-751-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-0509]
[ADV-2009-3316]
[linux-kernel-makeindexeddir-ext4-dos(48872)]
[oval:org.mitre.oval:def:10342]
[oval:org.mitre.oval:def:8039]
The ext4_isize function in fs/ext4/ext4.h in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 uses the i_size_high structure member during operations on arbitrary types of files, which allows local users to cause a denial of service (CPU consumption and error-message flood) by attempting to mount a crafted ext4 filesystem.
[http://bugzilla.kernel.org/show_bug.cgi?id=12375]
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=06a279d636734da32bb62dd2f7b0ade666f65d7c]
[http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.19]
[http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.7]
[RHSA-2009:1243]
[DSA-1749]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[USN-751-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-0509]
[ADV-2009-3316]
[oval:org.mitre.oval:def:8585]
[oval:org.mitre.oval:def:9200]
The ext4_fill_super function in fs/ext4/super.c in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 does not validate the superblock configuration, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) by attempting to mount a crafted ext4 filesystem.
[http://bugzilla.kernel.org/show_bug.cgi?id=12371]
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4ec110281379826c5cf6ed14735e47027c3c5765]
[http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.19]
[http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.7]
[RHSA-2009:1243]
[DSA-1749]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[USN-751-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-0509]
[ADV-2009-3316]
[oval:org.mitre.oval:def:10683]
[oval:org.mitre.oval:def:8526]
Use-after-free vulnerability in the GIFReadNextExtension function in lib/pngxtern/gif/gifread.c in OptiPNG 0.6.2 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a crafted GIF image that causes the realloc function to return a new pointer, which triggers memory corruption when the old pointer is accessed.
[SUSE-SR:2009:006]
[SUSE-SR:2009:012]
[http://optipng.sourceforge.net]
[http://sourceforge.net/tracker/index.php?func=detail&aid=2582013&group_id=151404&atid=780913]
[GLSA-200903-12]
[[oss-security] 20090224 CVE request: optipng security release]
[[oss-security] 20090225 Re: CVE request: optipng security release]
[33873]
[ADV-2009-0510]
[optipng-gifreadnextextension-code-execution(48879)]
SQL injection vulnerability in login.php in the smNews example script for txtSQL 2.2 Final allows remote attackers to execute arbitrary SQL commands via the username parameter.
[smnews-login-sql-injection(48813)]
[8076]
Yaws before 1.80 allows remote attackers to cause a denial of service (memory consumption and crash) via a request with a large number of headers.
[DSA-1740]
[[oss-security] 20090219 CVE request for yaws]
[33834]
[ADV-2009-0590]
[http://yaws.hyber.org/]
[8148]
Unspecified vulnerability in Movable Type Pro and Community Solution 4.x before 4.24 has unknown impact and attack vectors, possibly related to the password recovery mechanism.
[http://www.movabletype.com/blog/2009/02/movable-type-424-get-updated-with-better-password-recovery.html]
Absolute path traversal vulnerability in MLDonkey 2.8.4 through 2.9.7 allows remote attackers to read arbitrary files via a leading "//" (double slash) in the filename.
[http://savannah.nongnu.org/bugs/?25667]
[DSA-1739]
[GLSA-200903-36]
[[oss-security] 20090223 CVE request: mldonkey arbitrary file download vulnerability]
[33865]
[8097]
[FEDORA-2009-2703]
[FEDORA-2009-2758]
PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.func_overload setting within .htaccess, which causes this setting to be applied to other virtual hosts on the same server.
[http://bugs.php.net/bug.php?id=27421]
[SUSE-SR:2009:008]
[DSA-1789]
[[oss-security] 20090130 CVE Request - php (PHP BZ#27421)]
[[oss-security] 20090203 Re: CVE Request - php (PHP BZ#27421)]
[[oss-security] 20090225 Re: CVE Request - php (PHP BZ#27421)]
[RHSA-2009:0350]
[1021979]
[oval:org.mitre.oval:def:11035]
[USN-761-1]
[FEDORA-2009-3768]
[FEDORA-2009-3848]
The FormWidgetChoice::loadDefaults function in Poppler before 0.10.4 allows remote attackers to cause a denial of service (crash) via a PDF file with an invalid Form Opt entry.
[http://bugs.freedesktop.org/show_bug.cgi?id=19790]
[[poppler] 20090128 poppler/Form.cc]
[SUSE-SR:2009:012]
[http://wiki.rpath.com/Advisories:rPSA-2009-0059]
[DSA-1941]
[[oss-security] 20090213 CVE Request: Poppler -Two Denial of Service Vulnerabilities]
[[oss-security] 20090219 Re: CVE Request: Poppler -Two Denial of Service Vulnerabilities]
[20090417 rPSA-2009-0059-1 poppler]
[33749]
[USN-850-1]
The JBIG2Stream::readSymbolDictSeg function in Poppler before 0.10.4 allows remote attackers to cause a denial of service (crash) via a PDF file that triggers a parsing error, which is not properly handled by JBIG2SymbolDict::~JBIG2SymbolDict and triggers an invalid memory dereference.
[http://bugs.freedesktop.org/show_bug.cgi?id=19702]
[[poppler] 20090123 poppler/JBIG2Stream.cc]
[SUSE-SR:2009:012]
[http://wiki.rpath.com/Advisories:rPSA-2009-0059]
[[oss-security] 20090213 CVE Request: Poppler -Two Denial of Service Vulnerabilities]
[[oss-security] 20090219 Re: CVE Request: Poppler -Two Denial of Service Vulnerabilities]
[20090417 rPSA-2009-0059-1 poppler]
[33749]
Multiple buffer overflows in GNU MPFR 2.4.0 allow context-dependent attackers to cause a denial of service (crash) via the (1) mpfr_snprintf and (2) mpfr_vsnprintf functions.
[http://mpfr.loria.fr/mpfr-2.4.1/]
[[oss-security] 20090302 CVE Request: mpfr (Buffer Overflow)]
[33945]
[USN-772-1]
The originates_from_local_legacy_unicast_socket function in avahi-core/server.c in avahi-daemon 0.6.23 does not account for the network byte order of a port number when processing incoming multicast packets, which allows remote attackers to cause a denial of service (network bandwidth and CPU consumption) via a crafted legacy unicast mDNS query packet that triggers a multicast packet storm.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=517683]
[SUSE-SR:2010:002]
[DSA-2086]
[MDVSA-2009:076]
[[oss-security] 20090302 CVE id request: avahi]
[33946]
Multiple CRLF injection vulnerabilities in webadmin in ZNC before 0.066 allow remote authenticated users to modify the znc.conf configuration file and gain privileges via CRLF sequences in the quit message and other vectors.
[DSA-1735]
[[oss-security] 20090301 CVE id request: znc]
[http://znc.svn.sourceforge.net/viewvc/znc/trunk/modules/webadmin.cpp?view=log&sortby=rev&sortdir=down&pathrev=1395]
[http://znc.svn.sourceforge.net/viewvc/znc?view=rev&sortby=rev&sortdir=down&revision=1395]
[http://znc.svn.sourceforge.net/viewvc/znc?view=rev&sortby=rev&sortdir=down&revision=1396]
Team Board 1.x and 2.x stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing credentials via a direct request for data/team.mdb.
[http://packetstorm.linuxsecurity.com/0902-exploits/teamboard-ddxss.txt]
[7982]
Cross-site scripting (XSS) vulnerability in online.asp in Team Board 1.x allows remote attackers to inject arbitrary web script or HTML via the lookname parameter.
[33614]
[7982]
Cross-site scripting (XSS) vulnerability in ScriptsEz Ez PHP Comment allows remote attackers to inject arbitrary web script or HTML via the name parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[33587]
Cross-site scripting (XSS) vulnerability in default.php in Kipper 2.01 allows remote attackers to inject arbitrary web script or HTML via the charm parameter.
[33640]
[7993]
Multiple cross-site scripting (XSS) vulnerabilities in Kipper 2.01 allow remote attackers to inject arbitrary web script or HTML via the charm parameter to (1) index.php and (2) kipper.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Directory traversal vulnerability in index.php in Kipper 2.01 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the configfile parameter.
[33640]
[kipper-index-file-include(49271)]
[7993]
Directory traversal vulnerability in default.php in Kipper 2.01 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the configfile parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Kipper 2.01 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing credentials via a direct request for job/config.data.
[7993]
SQL injection vulnerability in forumhop.php in YapBB 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the forumID parameter in a next action.
[33620]
[7984]
QIP 2005 build 8082 allows remote attackers to cause a denial of service (CPU consumption and application hang) via a crafted Rich Text Format (RTF) ICQ message, as demonstrated by an {\rtf\pict\&&} message. NOTE: the vulnerability may be in Sergey Tkachenko TRichView. If so, then this should not be treated as a vulnerability in QIP.
[20090204 QIP 2005 Denial of Service Vulnerability]
[33609]
dkim-milter 2.6.0 through 2.8.0 allows remote attackers to cause a denial of service (crash) by signing a message with a key that has been revoked in DNS, which triggers an assertion error.
[http://sourceforge.net/project/shownotes.php?release_id=654247]
[http://sourceforge.net/tracker/index.php?func=detail&aid=2508602&group_id=139420&atid=744358]
[DSA-1728]
[[oss-security] 20090302 CVE id request: dkim-milter]
[33337]
[dkimmilter-p-dos(48085)]
The layout engine in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain vectors that trigger memory corruption and assertion failures.
[SUSE-SA:2009:012]
[SSA:2009-083-02]
[SSA:2009-083-03]
[http://support.avaya.com/elmodocs2/security/ASA-2009-069.htm]
[http://support.avaya.com/japple/css/japple?temp.documentID=366362&temp.productID=154235&temp.releaseID=361845&temp.bucketID=126655&PAGE=Document]
[DSA-1751]
[DSA-1830]
[MDVSA-2009:075]
[MDVSA-2009:083]
[http://www.mozilla.org/security/announce/2009/mfsa2009-07.html]
[RHSA-2009:0315]
[33990]
[1021795]
[ADV-2009-0632]
[https://bugzilla.mozilla.org/buglist.cgi?bug_id=424276,435209,436965,460706,466057,468578,471594,472502]
[oval:org.mitre.oval:def:11314]
[oval:org.mitre.oval:def:5250]
[oval:org.mitre.oval:def:6163]
[oval:org.mitre.oval:def:6196]
[oval:org.mitre.oval:def:6755]
[FEDORA-2009-3101]
The layout engine in Mozilla Firefox 2 and 3 before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to nsCSSStyleSheet::GetOwnerNode, events, and garbage collection, which triggers memory corruption.
[SUSE-SA:2009:012]
[SUSE-SA:2009:023]
[SSA:2009-083-02]
[SSA:2009-083-03]
[http://support.avaya.com/elmodocs2/security/ASA-2009-069.htm]
[http://support.avaya.com/japple/css/japple?temp.documentID=366362&temp.productID=154235&temp.releaseID=361845&temp.bucketID=126655&PAGE=Document]
[DSA-1751]
[DSA-1830]
[MDVSA-2009:075]
[MDVSA-2009:083]
[http://www.mozilla.org/security/announce/2009/mfsa2009-07.html]
[RHSA-2009:0258]
[RHSA-2009:0315]
[RHSA-2009:0325]
[33990]
[1021795]
[ADV-2009-0632]
[https://bugzilla.mozilla.org/show_bug.cgi?id=475136]
[oval:org.mitre.oval:def:5703]
[oval:org.mitre.oval:def:5945]
[oval:org.mitre.oval:def:6097]
[oval:org.mitre.oval:def:6811]
[oval:org.mitre.oval:def:9609]
[USN-741-1]
[FEDORA-2009-2882]
[FEDORA-2009-2884]
[FEDORA-2009-3101]
The JavaScript engine in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) a splice of an array that contains "some non-set elements," which causes jsarray.cpp to pass an incorrect argument to the ResizeSlots function, which triggers memory corruption; (2) vectors related to js_DecompileValueGenerator, jsopcode.cpp, __defineSetter__, and watch, which triggers an assertion failure or a segmentation fault; and (3) vectors related to gczeal, __defineSetter__, and watch, which triggers a hang.
[SUSE-SA:2009:012]
[SSA:2009-083-02]
[SSA:2009-083-03]
[http://support.avaya.com/elmodocs2/security/ASA-2009-069.htm]
[http://support.avaya.com/japple/css/japple?temp.documentID=366362&temp.productID=154235&temp.releaseID=361845&temp.bucketID=126655&PAGE=Document]
[DSA-1751]
[DSA-1830]
[MDVSA-2009:075]
[MDVSA-2009:083]
[http://www.mozilla.org/security/announce/2009/mfsa2009-07.html]
[RHSA-2009:0315]
[33990]
[1021795]
[ADV-2009-0632]
[https://bugzilla.mozilla.org/show_bug.cgi?id=457521]
[https://bugzilla.mozilla.org/show_bug.cgi?id=467499]
[https://bugzilla.mozilla.org/show_bug.cgi?id=472787]
[oval:org.mitre.oval:def:10491]
[oval:org.mitre.oval:def:5856]
[oval:org.mitre.oval:def:5980]
[oval:org.mitre.oval:def:6141]
[oval:org.mitre.oval:def:6708]
[FEDORA-2009-3101]
The layout engine in Mozilla Firefox 2 and 3 before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to gczeal, a different vulnerability than CVE-2009-0773.
[SUSE-SA:2009:012]
[SUSE-SA:2009:023]
[SSA:2009-083-02]
[SSA:2009-083-03]
[http://support.avaya.com/elmodocs2/security/ASA-2009-069.htm]
[http://support.avaya.com/japple/css/japple?temp.documentID=366362&temp.productID=154235&temp.releaseID=361845&temp.bucketID=126655&PAGE=Document]
[DSA-1751]
[DSA-1830]
[MDVSA-2009:075]
[MDVSA-2009:083]
[http://www.mozilla.org/security/announce/2009/mfsa2009-07.html]
[RHSA-2009:0258]
[RHSA-2009:0315]
[RHSA-2009:0325]
[33990]
[1021795]
[ADV-2009-0632]
[https://bugzilla.mozilla.org/show_bug.cgi?id=473709]
[oval:org.mitre.oval:def:11138]
[oval:org.mitre.oval:def:5947]
[oval:org.mitre.oval:def:6057]
[oval:org.mitre.oval:def:6121]
[oval:org.mitre.oval:def:6945]
[USN-741-1]
[FEDORA-2009-2882]
[FEDORA-2009-2884]
[FEDORA-2009-3101]
Double free vulnerability in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to execute arbitrary code via "cloned XUL DOM elements which were linked as a parent and child," which are not properly handled during garbage collection.
[SUSE-SA:2009:012]
[http://support.avaya.com/elmodocs2/security/ASA-2009-069.htm]
[http://support.avaya.com/japple/css/japple?temp.documentID=366362&temp.productID=154235&temp.releaseID=361845&temp.bucketID=126655&PAGE=Document]
[DSA-1751]
[MDVSA-2009:075]
[http://www.mozilla.org/security/announce/2009/mfsa2009-08.html]
[RHSA-2009:0258]
[RHSA-2009:0315]
[RHSA-2009:0325]
[33990]
[1021796]
[ADV-2009-0632]
[https://bugzilla.mozilla.org/show_bug.cgi?id=474456]
[oval:org.mitre.oval:def:5806]
[oval:org.mitre.oval:def:5816]
[oval:org.mitre.oval:def:6207]
[oval:org.mitre.oval:def:7584]
[oval:org.mitre.oval:def:9681]
[FEDORA-2009-2882]
[FEDORA-2009-2884]
nsIRDFService in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to bypass the same-origin policy and read XML data from another domain via a cross-domain redirect.
[SUSE-SA:2009:012]
[SUSE-SA:2009:023]
[SSA:2009-083-02]
[SSA:2009-083-03]
[http://support.avaya.com/elmodocs2/security/ASA-2009-069.htm]
[http://support.avaya.com/japple/css/japple?temp.documentID=366362&temp.productID=154235&temp.releaseID=361845&temp.bucketID=126655&PAGE=Document]
[DSA-1751]
[DSA-1830]
[MDVSA-2009:075]
[MDVSA-2009:083]
[http://www.mozilla.org/security/announce/2009/mfsa2009-09.html]
[RHSA-2009:0258]
[RHSA-2009:0315]
[RHSA-2009:0325]
[33990]
[1021797]
[ADV-2009-0632]
[https://bugzilla.mozilla.org/show_bug.cgi?id=414540]
[oval:org.mitre.oval:def:5956]
[oval:org.mitre.oval:def:6017]
[oval:org.mitre.oval:def:6191]
[oval:org.mitre.oval:def:7390]
[oval:org.mitre.oval:def:9241]
[USN-741-1]
[FEDORA-2009-2882]
[FEDORA-2009-2884]
[FEDORA-2009-3101]
Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 decode invisible characters when they are displayed in the location bar, which causes an incorrect address to be displayed and makes it easier for remote attackers to spoof URLs and conduct phishing attacks.
[SUSE-SA:2009:012]
[1021799]
[http://support.avaya.com/elmodocs2/security/ASA-2009-069.htm]
[http://support.avaya.com/japple/css/japple?temp.documentID=366362&temp.productID=154235&temp.releaseID=361845&temp.bucketID=126655&PAGE=Document]
[MDVSA-2009:075]
[http://www.mozilla.org/security/announce/2009/mfsa2009-11.html]
[RHSA-2009:0315]
[33990]
[ADV-2009-0632]
[https://bugzilla.mozilla.org/show_bug.cgi?id=452979]
[mozilla-invisible-url-spoofing(49087)]
[oval:org.mitre.oval:def:11222]
[oval:org.mitre.oval:def:6039]
[oval:org.mitre.oval:def:6157]
[oval:org.mitre.oval:def:6229]
[oval:org.mitre.oval:def:7435]
The icmp_send function in net/ipv4/icmp.c in the Linux kernel before 2.6.25, when configured as a router with a REJECT route, does not properly manage the Protocol Independent Destination Cache (aka DST) in some situations involving transmission of an ICMP Host Unreachable message, which allows remote attackers to cause a denial of service (connectivity outage) by sending a large series of packets to many destination IP addresses within this REJECT route, related to an "rt_cache leak."
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7c0ecc4c4f8fd90988aab8a95297b9c0038b6160]
[[oss-security] 20090311 CVE-2009-0778 kernel: rt_cache leak]
[http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25]
[RHSA-2009:0326]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[34084]
[1021958]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-3316]
[https://bugzilla.redhat.com/show_bug.cgi?id=485163]
[linux-kernel-rtcache-dos(49199)]
[oval:org.mitre.oval:def:10215]
[oval:org.mitre.oval:def:7867]
Buffer overflow in pppdial in IBM AIX 5.3 and 6.1 allows local users to gain privileges via a long "input string."
[1021741]
[33852]
[ADV-2009-0487]
[IZ44199]
[IZ44220]
[IZ44332]
[IZ44388]
The aspath_prepend function in rde_attr.c in bgpd in OpenBSD 4.3 and 4.4 allows remote attackers to cause a denial of service (application crash) via an Autonomous System (AS) advertisement containing a long AS path.
[[4.3] 010: RELIABILITY FIX: February 18, 2009]
[[4.4] 010: RELIABILITY FIX: February 18, 2009]
[33828]
[1021736]
[openbsd-aspathprepend-dos(48812)]
Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML."
[APPLE-SA-2010-03-29-1]
[SUSE-SR:2009:012]
[HPSBMA02535]
[HPSBUX02579]
[HPSBOV02762]
[HPSBUX02860]
[263529]
[http://support.apple.com/kb/HT4077]
[http://tomcat.apache.org/security-4.html]
[http://tomcat.apache.org/security-5.html]
[http://tomcat.apache.org/security-6.html]
[DSA-2207]
[MDVSA-2009:136]
[MDVSA-2009:138]
[20090306 [SECURITY] CVE-2009-0781 XSS in Apache Tomcat examples web application]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-1856]
[ADV-2009-3316]
[ADV-2010-3056]
[tomcat-cal2-xss(49213)]
[[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/]
[[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/]
[oval:org.mitre.oval:def:11041]
[oval:org.mitre.oval:def:19345]
[oval:org.mitre.oval:def:6564]
[FEDORA-2009-11374]
[FEDORA-2009-11352]
[FEDORA-2009-11356]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.
[APPLE-SA-2010-03-29-1]
[SUSE-SR:2009:012]
[HPSBMA02535]
[HPSBUX02579]
[HPSBUX02860]
[263529]
[http://support.apple.com/kb/HT4077]
[http://svn.apache.org/viewvc?rev=652592&view=rev]
[http://svn.apache.org/viewvc?rev=681156&view=rev]
[http://svn.apache.org/viewvc?rev=739522&view=rev]
[http://svn.apache.org/viewvc?rev=781542&view=rev]
[http://svn.apache.org/viewvc?rev=781708&view=rev]
[http://tomcat.apache.org/security-4.html]
[http://tomcat.apache.org/security-5.html]
[http://tomcat.apache.org/security-6.html]
[DSA-2207]
[MDVSA-2009:136]
[MDVSA-2009:138]
[MDVSA-2010:176]
[20090604 [SECURITY] CVE-2009-0783 Apache Tomcat Information disclosure]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[35416]
[1022336]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-1856]
[ADV-2009-3316]
[ADV-2010-3056]
[tomcat-xml-information-disclosure(51195)]
[https://issues.apache.org/bugzilla/show_bug.cgi?id=29936]
[https://issues.apache.org/bugzilla/show_bug.cgi?id=45933]
[[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/]
[[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/]
[oval:org.mitre.oval:def:10716]
[oval:org.mitre.oval:def:18913]
[oval:org.mitre.oval:def:6450]
[FEDORA-2009-11374]
[FEDORA-2009-11352]
[FEDORA-2009-11356]
Race condition in the SystemTap stap tool 0.0.20080705 and 0.0.20090314 allows local users in the stapusr group to insert arbitrary SystemTap kernel modules and gain privileges via unknown vectors.
[http://support.avaya.com/elmodocs2/security/ASA-2009-110.htm]
[DSA-1755]
[RHSA-2009:0373]
[ADV-2009-0907]
[oval:org.mitre.oval:def:11613]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This was originally intended for a report about TCP Wrappers and the hosts_ctl API function, but further investigation showed that this was documented behavior by that function. Notes: Future CVE identifiers might be assigned to applications that mis-use the API in a security-relevant fashion.
The ecryptfs_write_metadata_to_contents function in the eCryptfs functionality in the Linux kernel 2.6.28 before 2.6.28.9 uses an incorrect size when writing kernel memory to an eCryptfs file header, which triggers an out-of-bounds read and allows local users to obtain portions of kernel memory.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=8faece5f906725c10e7a1f6caf84452abadbdc7b]
[RHSA-2009:0473]
[http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.9]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[34216]
[1022177]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-0802]
[ADV-2009-3316]
[linux-kernel-ecryptfs-information-disclosure(49355)]
[oval:org.mitre.oval:def:11068]
[oval:org.mitre.oval:def:8319]
Red Hat Network (RHN) Satellite Server 5.3 and 5.4 does not properly rewrite unspecified URLs, which allows remote attackers to (1) obtain unspecified sensitive host information or (2) use the server as an inadvertent proxy to connect to arbitrary services and IP addresses via unspecified vectors.
[RHSA-2011:0434]
[47316]
[1025316]
[ADV-2011-0967]
[https://bugzilla.redhat.com/show_bug.cgi?id=491365]
[rhnss-url-security-bypass(66691)]
OpenSSL before 0.9.8k on WIN64 and certain other platforms does not properly handle a malformed ASN.1 structure, which allows remote attackers to cause a denial of service (invalid memory access and application crash) by placing this structure in the public key of a certificate, as demonstrated by an RSA public key.
[NetBSD-SA2009-008]
[APPLE-SA-2009-09-10-2]
[SUSE-SR:2009:010]
[openSUSE-SU-2011:0845]
[SUSE-SU-2011:0847]
[SSRT090059]
[HPSBOV02540]
[1021906]
[http://sourceforge.net/project/shownotes.php?release_id=671059&group_id=116847]
[http://support.apple.com/kb/HT3865]
[http://voodoo-circle.sourceforge.net/sa/sa-20090326-01.html]
[http://www.openssl.org/news/secadv_20090325.txt]
[http://www.php.net/archive/2009.php#id2009-04-08-1]
[34256]
[ADV-2009-0850]
[ADV-2009-1020]
[ADV-2009-1175]
[ADV-2009-1548]
[openssl-asn1-structure-dos(49433)]
[https://kb.bluecoat.com/index?page=content&id=SA50]
The pluto IKE daemon in Openswan and Strongswan IPsec 2.6 before 2.6.21 and 2.4 before 2.4.14, and Strongswan 4.2 before 4.2.14 and 2.8 before 2.8.9, allows remote attackers to cause a denial of service (daemon crash and restart) via a crafted (1) R_U_THERE or (2) R_U_THERE_ACK Dead Peer Detection (DPD) IPsec IKE Notification message that triggers a NULL pointer dereference related to inconsistent ISAKMP state and the lack of a phase2 state association in DPD.
[http://download.strongswan.org/CHANGES4.txt]
[SUSE-SR:2009:009]
[DSA-1759]
[DSA-1760]
[http://www.openswan.org/CVE-2009-0790/CVE-2009-0790.txt]
[RHSA-2009:0402]
[20090330 CVE-2009-0790: ISAKMP DPD Remote Vulnerability with Openswan & Strongswan IPsec]
[34296]
[1021949]
[1021950]
[ADV-2009-0886]
[openswan-strongswan-dpd-dos(49523)]
[oval:org.mitre.oval:def:11171]
Multiple integer overflows in Xpdf 2.x and 3.x and Poppler 0.x, as used in the pdftops filter in CUPS 1.1.17, 1.1.22, and 1.3.7, GPdf, and kdegraphics KPDF, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file that triggers a heap-based buffer overflow, possibly related to (1) Decrypt.cxx, (2) FoFiTrueType.cxx, (3) gmem.c, (4) JBIG2Stream.cxx, and (5) PSOutputDev.cxx in pdftops/. NOTE: the JBIG2Stream.cxx vector may overlap CVE-2009-1179.
[SUSE-SR:2009:012]
[1022326]
[MDVSA-2009:334]
[RHSA-2009:1083]
[35195]
[ADV-2009-1488]
[ADV-2009-2928]
[https://bugzilla.redhat.com/show_bug.cgi?id=491840]
[cups-pdftops-filter-bo(50941)]
[oval:org.mitre.oval:def:10534]
[RHSA-2009:1500]
[RHSA-2009:1501]
[RHSA-2009:1502]
[RHSA-2009:1503]
[RHSA-2009:1512]
Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images. NOTE: this issue exists because of an incomplete fix for CVE-2009-0583.
[SUSE-SR:2009:009]
[SUSE-SR:2009:011]
[GLSA-201412-17]
[262288]
[http://support.avaya.com/elmodocs2/security/ASA-2009-155.htm]
[http://wiki.rpath.com/Advisories:rPSA-2009-0060]
[MDVSA-2009:095]
[MDVSA-2009:096]
[RHSA-2009:0420]
[RHSA-2009:0421]
[20090417 rPSA-2009-0060-1 ghostscript]
[ADV-2009-1708]
[https://bugzilla.redhat.com/show_bug.cgi?id=491853]
[ghostscript-icc-bo(50381)]
[oval:org.mitre.oval:def:11207]
[USN-757-1]
[FEDORA-2009-3430]
[FEDORA-2009-3435]
[FEDORA-2009-3709]
[FEDORA-2009-3710]
cmsxform.c in LittleCMS (aka lcms or liblcms) 1.18, as used in OpenJDK and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted image that triggers execution of incorrect code for "transformations of monochrome profiles."
[GLSA-200904-19]
[DSA-1769]
[MDVSA-2009:121]
[MDVSA-2009:137]
[MDVSA-2009:162]
[34411]
[34420]
[USN-1043-1]
[ADV-2009-0963]
[ADV-2009-0964]
[ADV-2011-0087]
[https://bugzilla.redhat.com/show_bug.cgi?id=492353]
[oval:org.mitre.oval:def:11340]
[RHSA-2009:0377]
[FEDORA-2009-3425]
[FEDORA-2009-3426]
[FEDORA-2009-3914]
[FEDORA-2009-3967]
Integer overflow in the PulseAudioTargetDataL class in src/java/org/classpath/icedtea/pulseaudio/PulseAudioTargetDataLine.java in Pulse-Java, as used in OpenJDK 1.6.0.0 and other products, allows remote attackers to cause a denial of service (applet crash) via a crafted Pulse Audio source data line.
[[distro-pkg-dev] 20090211 changeset in /hg/icedtea6: 2009-02-11 Omair Majid <omajid at redh...]
[MDVSA-2009:137]
[MDVSA-2009:162]
[ADV-2009-0965]
[https://bugzilla.redhat.com/show_bug.cgi?id=492367]
[pulsejava--pulseaudiotargetdatal-dos(50383)]
[FEDORA-2009-3425]
[FEDORA-2009-3426]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2009-0796, CVE-2009-1265. Reason: this candidate was intended for one issue, but a typo caused it to be associated with a different issue. Notes: All CVE users should consult CVE-2009-0796 and CVE-2009-1265 to determine which ID is appropriate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Cross-site scripting (XSS) vulnerability in Status.pm in Apache::Status and Apache2::Status in mod_perl1 and mod_perl2 for the Apache HTTP Server, when /perl-status is accessible, allows remote attackers to inject arbitrary web script or HTML via the URI.
[APPLE-SA-2010-11-10-1]
[1021508]
[1021709]
[http://support.apple.com/kb/HT4435]
[http://svn.apache.org/viewvc/perl/modperl/branches/1.x/lib/Apache/Status.pm?r1=177851&r2=761081&pathrev=761081&diff_format=h]
[http://svn.apache.org/viewvc?view=rev&revision=761081]
[[modperl] 20090401 [SECURITY] [CVE-2009-0796] Vulnerability found in Apache::Status and Apache2::Status]
[[modperl-cvs] 20090401 svn commit: r761081 - in /perl/modperl/branches/1.x: Changes lib/Apache/Status.pm]
[MDVSA-2009:091]
[20090415 XSS with mod_perl perl_status utility]
[34383]
[1021988]
[ADV-2009-0943]
[https://bugzilla.redhat.com/show_bug.cgi?id=494402]
[https://launchpad.net/bugs/cve/2009-0796]
[oval:org.mitre.oval:def:8488]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
ACPI Event Daemon (acpid) before 1.0.10 allows remote attackers to cause a denial of service (CPU consumption and connectivity loss) by opening a large number of UNIX sockets without closing them, which triggers an infinite loop.
[DSA-1786]
[GLSA-200905-06]
[MDVSA-2009:107]
[RHSA-2009:0474]
[34692]
[1022182]
[USN-766-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=494443]
[https://bugzilla.redhat.com/show_bug.cgi?id=502583]
[acpid-socket-dos(50060)]
[oval:org.mitre.oval:def:7560]
[oval:org.mitre.oval:def:9955]
[FEDORA-2009-5578]
[FEDORA-2009-5608]
The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers an out-of-bounds read.
[http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=495886]
[SUSE-SA:2009:024]
[SUSE-SR:2009:010]
[SUSE-SR:2009:012]
[http://poppler.freedesktop.org/releases.html]
[RHSA-2009:0458]
[SSA:2009-129-01]
[DSA-1790]
[DSA-1793]
[VU#196617]
[MDVSA-2009:101]
[MDVSA-2010:087]
[MDVSA-2011:175]
[RHSA-2009:0429]
[RHSA-2009:0430]
[RHSA-2009:0431]
[RHSA-2009:0480]
[34568]
[1022072]
[ADV-2009-1065]
[ADV-2009-1066]
[ADV-2009-1076]
[ADV-2009-1077]
[ADV-2010-1040]
[oval:org.mitre.oval:def:10204]
[FEDORA-2009-6972]
[FEDORA-2009-6973]
[FEDORA-2009-6982]
Multiple "input validation flaws" in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF file.
[SUSE-SA:2009:024]
[SUSE-SR:2009:010]
[SUSE-SR:2009:012]
[http://poppler.freedesktop.org/releases.html]
[RHSA-2009:0458]
[SSA:2009-129-01]
[DSA-1790]
[DSA-1793]
[VU#196617]
[MDVSA-2009:101]
[MDVSA-2010:087]
[MDVSA-2011:175]
[RHSA-2009:0429]
[RHSA-2009:0430]
[RHSA-2009:0431]
[RHSA-2009:0480]
[34568]
[1022073]
[ADV-2009-1065]
[ADV-2009-1066]
[ADV-2009-1076]
[ADV-2009-1077]
[ADV-2010-1040]
[https://bugzilla.redhat.com/show_bug.cgi?id=495887]
[oval:org.mitre.oval:def:11323]
[FEDORA-2009-6972]
[FEDORA-2009-6973]
[FEDORA-2009-6982]
Squid, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web page that causes a client to send HTTP requests with a modified Host header.
[VU#435052]
[33858]
Qbik WinGate, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web page that causes a client to send HTTP requests with a modified Host header.
[VU#435052]
[33858]
SmoothWall SmoothGuardian, as used in SmoothWall Firewall, NetworkGuardian, and SchoolGuardian 2008, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web page that causes a client to send HTTP requests with a modified Host header.
[VU#435052]
[http://www.kb.cert.org/vuls/id/MAPG-7M6SM7]
[33858]
Ziproxy 2.6.0, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web page that causes a client to send HTTP requests with a modified Host header.
[VU#435052]
[http://www.kb.cert.org/vuls/id/MAPG-7N9GN8]
[33858]
Cross-site scripting (XSS) vulnerability in piCal 0.91h and earlier, a module for XOOPS, allows remote attackers to inject arbitrary web script or HTML via the event_id parameter in index.php.
[JVN#91591874]
[JVNDB-2009-000013]
[33896]
[http://xoops.peak.ne.jp/md/news/]
[http://xoops.peak.ne.jp/md/news/index.php?page=article&storyid=476&easiestml_lang=xlang%3Aen]
Unspecified vulnerability in OpenGoo before 1.2.1 allows remote authenticated users to modify their own permissions via unknown attack vectors.
[http://sourceforge.net/project/shownotes.php?release_id=663706]
[33897]
zFeeder 1.6 allows remote attackers to gain administrative access via a direct request to admin.php.
[zfeeder-admin-security-bypass(48866)]
[8092]
Multiple SQL injection vulnerabilities in SimpleCMMS before 0.1.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
[http://sourceforge.net/project/shownotes.php?release_id=661656&group_id=245458]
[ADV-2009-0490]
[simplecmms-unspecified-sql-injection(48883)]
The Web Editor in Dassault Systemes ENOVIA SmarTeam V5 before Release 18 Service Pack 8, and possibly CATIA and other products, allows remote authenticated users to read the profile card of an object in the document class via a link that is sent from the owner of the document object.
Per http://www-01.ibm.com/support/docview.wss?uid=swg1HD80332
"Scenario:
1. Create a document class and give permissions to joe only.
2. When someone else but joe logs onto Web editor, and does a
search on this new class no results are returned as expected.
3. Login as joe and search for an object created for this new
class. click on the email icon, and send the mail to bob.
4. When bob clicks on the link in the email, he can view the
profile card of the object, but when he clicks on viewer he
gets an unauthorized operation error. Bob shouldn't be able
to view the profile card in the first place as he doesn't
have any access to this class. This is a security hole in
the web editor."
[33895]
[ADV-2009-0525]
[HD80332]
SQL injection vulnerability in login.php in xGuestbook 2.0 allows remote attackers to execute arbitrary SQL commands via the user parameter.
[33875]
[ADV-2009-0523]
[xguestbook-login-sql-injection(48881)]
[8101]
Insecure method vulnerability in the SopCast SopCore ActiveX control in sopocx.ocx 3.0.3.501 allows remote attackers to execute arbitrary programs via an executable file name in the argument to the SetExternalPlayer method.
[http://retrogod.altervista.org/9sg_sopcastia.html]
[20090226 Sopcast SopCore Control (sopocx.ocx 3.0.3.501) SetExternalPlayer() user assisted remote code execution poc]
[33920]
[sopcast-setexternalplayer-code-execution(48955)]
Stack-based buffer overflow in BreakPoint Software Hex Workshop 4.23, 6.0.1.4603, and other 6.x and earlier versions allows remote attackers to execute arbitrary code via a crafted Intel Hex Code (.hex) file. NOTE: some of these details are obtained from third party information.
[9550]
[20090227 Hex Workshop <= v6 (.hex) File Local Code]
[33932]
[hexworkshop-hex-bo(48970)]
[8121]
Insecure method vulnerability in the ImeraIEPlugin ActiveX control (ImeraIEPlugin.dll 1.0.2.54) in Imera TeamLinks Client allows remote attackers to force the download and execution of arbitrary URLs via modified DownloadProtocol, DownloadHost, DownloadPort, and DownloadURI parameters.
[ADV-2009-0591]
[imera-imeraieplugin-code-execution(49028)]
[8144]
Cross-site scripting (XSS) vulnerability in Widgets.aspx in Blogsa 1.0 Beta 3 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchText parameter.
[20090302 Blogsa <= 1.0 Beta 3 XSS Vulnerability]
[33957]
[blogsa-widgets-xss(49024)]
The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 leaks a hash secret (juHash) in an error message, which allows remote attackers to read arbitrary files by including the hash in a request.
[http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-002/]
[DSA-1720]
[[oss-security] 20090210 CVE request: typo3 xss (typo3-sa-2009-002)]
[1021710]
Multiple cross-site scripting (XSS) vulnerabilities in the backend user interface in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 allow remote attackers to inject arbitrary web script or HTML via unspecified fields.
[http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-002/]
[DSA-1720]
[[oss-security] 20090210 CVE request: typo3 xss (typo3-sa-2009-002)]
[1021709]
Cross-site scripting (XSS) vulnerability in the Protected Node module 5.x before 5.x-1.4 and 6.x before 6.x-1.5, a module for Drupal, allows remote authenticated users with "administer site configuration" permissions to inject arbitrary web script or HTML via the Password page info field, which is not properly handled by the protected_node_enterpassword function in protected_node.module.
[http://drupal.org/node/385950]
[http://drupal.org/node/386604]
[http://drupal.org/node/386606]
[http://lampsecurity.org/node/28]
[ADV-2009-0572]
[protectednode-passwordpage-xss(48980)]
Cross-site scripting (XSS) vulnerability in the taxonomy_theme_admin_table_builder function (taxonomy_theme_admin.inc) in Taxonomy Theme module before 5.x-1.2, a module for Drupal, allows remote authenticated users with the "administer taxonomy" permission, or the ability to create pages when tagging is enabled, to inject arbitrary web script or HTML via the Vocabulary name (name parameter) to index.php. NOTE: some of these details are obtained from third party information.
[http://drupal.org/node/386940]
[http://drupal.org/node/386942]
[33923]
[drupal-taxonomy-name-xss(48979)]
sql/item_xmlfunc.cc in MySQL 5.1 before 5.1.32 and 6.0 before 6.0.10 allows remote authenticated users to cause a denial of service (crash) via "an XPath expression employing a scalar expression as a FilterExpr with ExtractValue() or UpdateXML()," which triggers an assertion failure.
[http://bugs.mysql.com/bug.php?id=42495]
[http://dev.mysql.com/doc/refman/5.1/en/news-5-1-32.html]
[http://dev.mysql.com/doc/refman/6.0/en/news-6-0-10.html]
[33972]
[1021786]
[ADV-2009-0594]
[mysql-xpath-dos(49050)]
[oval:org.mitre.oval:def:7544]
Multiple eval injection vulnerabilities in phpScheduleIt before 1.2.11 allow remote attackers to execute arbitrary code via (1) the end_date parameter to reserve.php and (2) the start_date and end_date parameters to check.php. NOTE: the start_date/reserve.php vector is already covered by CVE-2008-6132.
[http://phpscheduleit.svn.sourceforge.net/viewvc/phpscheduleit/1.2.11/check.php?r1=318&r2=332]
[http://phpscheduleit.svn.sourceforge.net/viewvc/phpscheduleit/1.2.11/reserve.php?r1=318&r2=328]
[http://sourceforge.net/project/shownotes.php?release_id=662749]
[ADV-2009-0491]
Mozilla Firefox 2.0.0.20 and earlier allows remote attackers to cause a denial of service (application crash) via nested calls to the window.print function, as demonstrated by a window.print(window.print()) in the onclick attribute of an INPUT element.
[http://downloads.securityfocus.com/vulnerabilities/exploits/33969.html]
[33969]
Elaborate Bytes ElbyCDIO.sys 6.0.2.0 and earlier, as distributed in SlySoft AnyDVD before 6.5.2.6, Virtual CloneDrive 5.4.2.3 and earlier, CloneDVD 2.9.2.0 and earlier, and CloneCD 5.3.1.3 and earlier, uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to cause a denial of service (system crash) via a crafted IOCTL call.
[http://en.securitylab.ru/lab/PT-2009-11]
[20090312 [Suspected Spam][PT-2009-11] SlySoft Multiple Products ElbyCDIO.sys Denial of Service]
[34103]
[http://www.slysoft.com/download/changes_anydvd.txt]
[http://www.slysoft.com/download/changes_clonedvd.txt]
[slysoft-elbycdio-dos(49232)]
SQL injection vulnerability in system/rss.php in TinX/cms 3.x before 3.5.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
[http://en.securitylab.ru/lab/PT-2009-13]
[http://sourceforge.net/project/showfiles.php?group_id=133415]
[http://sourceforge.net/project/shownotes.php?group_id=133415&release_id=658540]
[20090306 [Positive Technologies SA:2009-13] TinX CMS 3.x SQL Injection Vulnerability]
[34021]
[tinxcms-rss-sql-injection(49115)]
BlogHelper stores common_db.inc under the web root with insufficient access control, which allows remote attackers to download the database file containing user credentials via a direct request.
[bloghelper-commondb-info-disclosure(47799)]
[7689]
PollHelper stores poll.inc under the web root with insufficient access control, which allows remote attackers to download the database file containing user credentials via a direct request.
[pollhelper-poll-info-disclosure(47797)]
[7690]
QuoteBook stores quotes.inc under the web root with insufficient access control, which allows remote attackers to obtain sensitive database information, including user credentials, via a direct request.
[33166]
[7699]
Multiple SQL injection vulnerabilities in QuoteBook allow remote attackers to execute arbitrary SQL commands via the (1) MyBox and (2) selectFavorites parameters to (a) quotes.php and the (3) QuoteName and (4) QuoteText parameters to (b) quotesadd.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[33166]
Cross-site scripting (XSS) vulnerability in QuoteBook allows remote attackers to inject arbitrary web script or HTML via the (1) QuoteName and (2) QuoteText parameters to quotesadd.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[33166]
SQL injection vulnerability in members.php in the Members CV (job) module 1.0 for PHP-Fusion, when magic_quotes_gpc is disabled, allows remote authenticated users to execute arbitrary SQL commands via the sortby parameter.
[33156]
[7697]
SQL injection vulnerability in items.php in the E-Cart module 1.3 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the CA parameter.
[20090107 PHP-Fusion Mod E-Cart Sql Injection]
[33155]
[7698]
Heap-based buffer overflow in gen_msn.dll in the gen_msn plugin 0.31 for Winamp 5.541 allows remote attackers to execute arbitrary code via a playlist (.pls) file with a long URL in the File1 field. NOTE: some of these details are obtained from third party information.
[33159]
[oval:org.mitre.oval:def:15659]
[7696]
The audit_syscall_entry function in the Linux kernel 2.6.28.7 and earlier on the x86_64 platform does not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass certain syscall audit configurations via crafted syscalls, a related issue to CVE-2009-0342 and CVE-2009-0343.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ccbe495caa5e604b04d5a31d7459a6f6a76a756c]
[SUSE-SA:2009:028]
[SUSE-SA:2009:030]
[SUSE-SA:2009:031]
[[linux-kernel] 20090228 [PATCH 0/2] x86-64: 32/64 syscall arch holes]
[[linux-kernel] 20090228 [PATCH 1/2] x86-64: syscall-audit: fix 32/64 syscall hole]
[[oss-security] 20090302 CVE request: kernel: x86-64: syscall-audit: 32/64 syscall hole]
[RHSA-2009:0459]
[RHSA-2009:0473]
[http://scary.beasts.org/security/CESA-2009-001.html]
[http://wiki.rpath.com/Advisories:rPSA-2009-0084]
[DSA-1787]
[DSA-1794]
[DSA-1800]
[MDVSA-2009:118]
[RHSA-2009:0451]
[20090516 rPSA-2009-0084-1 kernel]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[33951]
[1022153]
[USN-751-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-3316]
[https://bugzilla.redhat.com/show_bug.cgi?id=487990]
[linux-kernel-auditsyscallentry-sec-bypass(49061)]
[oval:org.mitre.oval:def:8508]
[oval:org.mitre.oval:def:9600]
The __secure_computing function in kernel/seccomp.c in the seccomp subsystem in the Linux kernel 2.6.28.7 and earlier on the x86_64 platform, when CONFIG_SECCOMP is enabled, does not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass intended access restrictions via crafted syscalls that are misinterpreted as (a) stat or (b) chmod, a related issue to CVE-2009-0342 and CVE-2009-0343.
[SUSE-SA:2009:021]
[SUSE-SA:2009:028]
[SUSE-SA:2009:030]
[SUSE-SA:2009:031]
[[linux-kernel] 20090227 Re: [PATCH 2/2] x86-64: seccomp: fix 32/64 syscall hole]
[[linux-kernel] 20090228 [PATCH 0/2] x86-64: 32/64 syscall arch holes]
[[linux-kernel] 20090228 [PATCH 2/2] x86-64: seccomp: fix 32/64 syscall hole]
[[oss-security] 20090302 CVE request: kernel: x86-64: seccomp: 32/64 syscall hole]
[http://scary.beasts.org/security/CESA-2009-001.html]
[http://scary.beasts.org/security/CESA-2009-004.html]
[http://scarybeastsecurity.blogspot.com/2009/02/linux-kernel-minor-seccomp.html]
[DSA-1800]
[MDVSA-2009:118]
[RHSA-2009:0451]
[33948]
[USN-751-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=487255]
Foxit Reader 2.3 before Build 3902 and 3.0 before Build 1506, including 1120 and 1301, does not require user confirmation before performing dangerous actions defined in a PDF file, which allows remote attackers to execute arbitrary programs and have unspecified other impact via a crafted file, as demonstrated by the "Open/Execute a file" action.
[http://blog.zoller.lu/2009/03/remote-code-execution-in-pdf-still.html]
[[dailydave] 20100402 0day, it may not be]
[http://www.coresecurity.com/content/foxit-reader-vulnerabilities]
[http://www.foxitsoftware.com/pdf/reader/security.htm#bypass]
[20090309 Foxit Reader Multiple Vulnerabilities (CORE-2009-0218)]
[34035]
[1021824]
[ADV-2009-0634]
Stack-based buffer overflow in Foxit Reader 3.0 before Build 1506, including 1120 and 1301, allows remote attackers to execute arbitrary code via a long (1) relative path or (2) absolute path in the filename argument in an action, as demonstrated by the "Open/Execute a file" action.
[http://www.coresecurity.com/content/foxit-reader-vulnerabilities]
[http://www.foxitsoftware.com/pdf/reader/security.htm#Stackbased]
[20090309 Foxit Reader Multiple Vulnerabilities (CORE-2009-0218)]
[34035]
[1021824]
[ADV-2009-0634]
[foxitreader-pdf-bo(49136)]
The crypto pseudo device driver in Sun Solaris 10, and OpenSolaris snv_88 through snv_102, does not properly free memory, which allows local users to cause a denial of service (panic) via unspecified vectors, related to the vmem_hash_delete function.
[1021810]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-139498-04-1]
[254088]
[http://support.avaya.com/elmodocs2/security/ASA-2009-097.htm]
[34000]
[ADV-2009-0606]
[ADV-2009-0815]
[sun-solaris-cryptodriver-dos(49105)]
[oval:org.mitre.oval:def:5641]
Stack-based buffer overflow in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when the server has a map with a long IMAGEPATH or NAME attribute, allows remote attackers to execute arbitrary code via a crafted id parameter in a query action.
[[mapserver-users] 20090326 MapServer 5.2.2 and 4.10.4 released with security fixes]
[http://trac.osgeo.org/mapserver/ticket/2944]
[DSA-1914]
[http://www.positronsecurity.com/advisories/2009-000.html]
[20090330 Positron Security Advisory #2009-000: Multiple Vulnerabilities in MapServer v5.2.1 and v4.10.3]
[34306]
[1021952]
[FEDORA-2009-3357]
[FEDORA-2009-3383]
Heap-based buffer underflow in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to have an unknown impact via a negative value in the Content-Length HTTP header.
[[mapserver-users] 20090326 MapServer 5.2.2 and 4.10.4 released with security fixes]
[http://trac.osgeo.org/mapserver/ticket/2943]
[DSA-1914]
[http://www.positronsecurity.com/advisories/2009-000.html]
[20090330 Positron Security Advisory #2009-000: Multiple Vulnerabilities in MapServer v5.2.1 and v4.10.3]
[34306]
[1021952]
[mapserver-contentlength-bo(49545)]
[FEDORA-2009-3357]
[FEDORA-2009-3383]
Directory traversal vulnerability in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when running on Windows with Cygwin, allows remote attackers to create arbitrary files via a .. (dot dot) in the id parameter.
[[mapserver-users] 20090326 MapServer 5.2.2 and 4.10.4 released with security fixes]
[http://trac.osgeo.org/mapserver/ticket/2942]
[DSA-1914]
[http://www.positronsecurity.com/advisories/2009-000.html]
[20090330 Positron Security Advisory #2009-000: Multiple Vulnerabilities in MapServer v5.2.1 and v4.10.3]
[34306]
[1021952]
[mapserver-mapserv-dir-traversal(49548)]
[FEDORA-2009-3357]
[FEDORA-2009-3383]
mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to read arbitrary invalid .map files via a full pathname in the map parameter, which triggers the display of partial file contents within an error message, as demonstrated by a /tmp/sekrut.map symlink.
[[mapserver-users] 20090326 MapServer 5.2.2 and 4.10.4 released with security fixes]
[http://trac.osgeo.org/mapserver/ticket/2941]
[DSA-1914]
[http://www.positronsecurity.com/advisories/2009-000.html]
[20090330 Positron Security Advisory #2009-000: Multiple Vulnerabilities in MapServer v5.2.1 and v4.10.3]
[34306]
[1021952]
[FEDORA-2009-3357]
[FEDORA-2009-3383]
The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists.
[[mapserver-users] 20090326 MapServer 5.2.2 and 4.10.4 released with security fixes]
[http://trac.osgeo.org/mapserver/ticket/2939]
[DSA-1914]
[http://www.positronsecurity.com/advisories/2009-000.html]
[20090330 Positron Security Advisory #2009-000: Multiple Vulnerabilities in MapServer v5.2.1 and v4.10.3]
[34306]
[1021952]
[FEDORA-2009-3357]
[FEDORA-2009-3383]
The get_input_token function in the SPNEGO implementation in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote attackers to cause a denial of service (daemon crash) and possibly obtain sensitive information via a crafted length value that triggers a buffer over-read.
[APPLE-SA-2009-05-12]
[GLSA-200904-09]
[256728]
[http://support.apple.com/kb/HT3549]
[http://support.avaya.com/elmodocs2/security/ASA-2009-142.htm]
[http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047180.html]
[http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047181.html]
[http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2009-001.txt]
[http://wiki.rpath.com/Advisories:rPSA-2009-0058]
[http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0058]
[VU#662091]
[MDVSA-2009:098]
[RHSA-2009:0408]
[20090407 MITKRB5-SA-2009-001: multiple vulnerabilities in SPNEGO, ASN.1 decoder [CVE-2009-0844 CVE-2009-0845 CVE-2009-0847]]
[20090407 rPSA-2009-0058-1 krb5 krb5-server krb5-services krb5-test krb5-workstation]
[34408]
[1021867]
[USN-755-1]
[TA09-133A]
[ADV-2009-0960]
[ADV-2009-0976]
[ADV-2009-1057]
[ADV-2009-1106]
[ADV-2009-1297]
[ADV-2009-2248]
[http://www-01.ibm.com/support/docview.wss?uid=swg21396120]
[oval:org.mitre.oval:def:6339]
[oval:org.mitre.oval:def:9474]
[FEDORA-2009-2834]
[FEDORA-2009-2852]
The spnego_gss_accept_sec_context function in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3, when SPNEGO is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via invalid ContextFlags data in the reqFlags field in a negTokenInit token.
[http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=6402]
[APPLE-SA-2009-05-12]
[GLSA-200904-09]
[http://src.mit.edu/fisheye/browse/krb5/trunk/src/lib/gssapi/spnego/spnego_mech.c?r1=21875&r2=22084]
[http://src.mit.edu/fisheye/changelog/krb5/?cs=22084]
[256728]
[http://support.apple.com/kb/HT3549]
[http://support.avaya.com/elmodocs2/security/ASA-2009-142.htm]
[http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047180.html]
[http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047181.html]
[http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2009-001.txt]
[http://wiki.rpath.com/Advisories:rPSA-2009-0058]
[http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0058]
[VU#662091]
[MDVSA-2009:082]
[RHSA-2009:0408]
[20090407 MITKRB5-SA-2009-001: multiple vulnerabilities in SPNEGO, ASN.1 decoder [CVE-2009-0844 CVE-2009-0845 CVE-2009-0847]]
[20090407 rPSA-2009-0058-1 krb5 krb5-server krb5-services krb5-test krb5-workstation]
[34257]
[1021867]
[USN-755-1]
[TA09-133A]
[ADV-2009-0847]
[ADV-2009-0976]
[ADV-2009-1057]
[ADV-2009-1106]
[ADV-2009-1297]
[ADV-2009-2248]
[http://www-01.ibm.com/support/docview.wss?uid=swg21396120]
[kerberos-spnego-dos(49448)]
[oval:org.mitre.oval:def:10044]
[oval:org.mitre.oval:def:6449]
[FEDORA-2009-2834]
[FEDORA-2009-2852]
The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer.
[APPLE-SA-2009-05-12]
[[security-announce] 20090701 VMSA-2009-0008 ESX Service Console update for krb5]
[HPSBUX02421]
[SSRT100495]
[RHSA-2009:0409]
[RHSA-2009:0410]
[GLSA-200904-09]
[256728]
[http://support.apple.com/kb/HT3549]
[http://support.avaya.com/elmodocs2/security/ASA-2009-142.htm]
[http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047180.html]
[http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047181.html]
[http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2009-002.txt]
[http://wiki.rpath.com/Advisories:rPSA-2009-0058]
[http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0058]
[MDVSA-2009:098]
[RHSA-2009:0408]
[20090407 MITKRB5-SA-2009-002: ASN.1 decoder frees uninitialized pointer [CVE-2009-0846]]
[20090407 rPSA-2009-0058-1 krb5 krb5-server krb5-services krb5-test krb5-workstation]
[20090701 VMSA-2009-0008 ESX Service Console update for krb5]
[34409]
[1021994]
[USN-755-1]
[TA09-133A]
[http://www.vmware.com/security/advisories/VMSA-2009-0008.html]
[ADV-2009-0960]
[ADV-2009-0976]
[ADV-2009-1057]
[ADV-2009-1106]
[ADV-2009-1297]
[ADV-2009-2084]
[ADV-2009-2248]
[http://www-01.ibm.com/support/docview.wss?uid=swg21396120]
[oval:org.mitre.oval:def:10694]
[oval:org.mitre.oval:def:5483]
[oval:org.mitre.oval:def:6301]
[FEDORA-2009-2834]
[FEDORA-2009-2852]
The asn1buf_imbed function in the ASN.1 decoder in MIT Kerberos 5 (aka krb5) 1.6.3, when PK-INIT is used, allows remote attackers to cause a denial of service (application crash) via a crafted length value that triggers an erroneous malloc call, related to incorrect calculations with pointer arithmetic.
[APPLE-SA-2009-05-12]
[HPSBUX02421]
[GLSA-200904-09]
[256728]
[http://support.apple.com/kb/HT3549]
[http://support.avaya.com/elmodocs2/security/ASA-2009-142.htm]
[http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047180.html]
[http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047181.html]
[http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2009-001.txt]
[http://wiki.rpath.com/Advisories:rPSA-2009-0058]
[http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0058]
[MDVSA-2009:098]
[20090407 MITKRB5-SA-2009-001: multiple vulnerabilities in SPNEGO, ASN.1 decoder [CVE-2009-0844 CVE-2009-0845 CVE-2009-0847]]
[20090407 rPSA-2009-0058-1 krb5 krb5-server krb5-services krb5-test krb5-workstation]
[34408]
[1021993]
[USN-755-1]
[TA09-133A]
[ADV-2009-0960]
[ADV-2009-0976]
[ADV-2009-1057]
[ADV-2009-1106]
[ADV-2009-1297]
[ADV-2009-2084]
[ADV-2009-2248]
[http://www-01.ibm.com/support/docview.wss?uid=swg21396120]
[oval:org.mitre.oval:def:6387]
[FEDORA-2009-2834]
[FEDORA-2009-2852]
Untrusted search path vulnerability in GTK2 in OpenSUSE 11.0 and 11.1 allows local users to execute arbitrary code via a Trojan horse GTK module in an unspecified "relative search path."
[SUSE-SR:2009:006]
[opensuse-gtk2-code-execution(49228)]
Stack-based buffer overflow in the DtbClsLogin function in NovaStor NovaNET 12 allows remote attackers to (1) execute arbitrary code on Linux platforms via a long username field during backup domain authentication, related to libnnlindtb.so; or (2) cause a denial of service (daemon crash) on Windows platforms via a long username field during backup domain authentication, related to nnwindtb.dll. NOTE: some of these details are obtained from third party information.
Per: http://secunia.com/advisories/34024
Successful exploitation allows to crash the application on a Windows system and reportedly allows to execute arbitrary code on a Linux system.
[http://www.insight-tech.org/index.php?p=NovaNET-12-Remote-Buffer-Oveflow]
[33954]
[novanet-dtbclslogin-bo(49074)]
Cross-site scripting (XSS) vulnerability in BitDefender Internet Security 2009 allows user-assisted remote attackers to inject arbitrary web script or HTML via the filename of a virus-infected file, as demonstrated by a filename inside a (1) rar or (2) zip archive file.
[20090226 BitDefender Internet Security XSS]
[20090227 Re: BitDefender Internet Security XSS]
[33921]
[ADV-2009-0557]
Multiple SQL injection vulnerabilities in CelerBB 0.0.2, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) viewforum.php and (2) viewtopic.php.
[20090305 CelerBB 0.0.2 Multiple Vulnerabilities]
[34014]
[8161]
showme.php in CelerBB 0.0.2 allows remote attackers to obtain "reserved information" via the user parameter.
[20090305 CelerBB 0.0.2 Multiple Vulnerabilities]
[34014]
[8161]
login.php in CelerBB 0.0.2, when magic_quotes_gpc is disabled, allows remote attackers to bypass authentication and obtain administrative access via special characters in the Username parameter, as demonstrated by an admin'# parameter value.
[20090305 CelerBB 0.0.2 Multiple Vulnerabilities]
[34014]
[8161]
Untrusted search path vulnerability in dash 0.5.4, when used as a login shell, allows local users to execute arbitrary code via a Trojan horse .profile file in the current working directory.
[34092]
[USN-732-1]
[dash-profile-code-execution(49216)]
Cross-site scripting (XSS) vulnerability in the administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 on z/OS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[34001]
[34259]
[ADV-2009-0607]
[ADV-2009-0854]
[PK77505]
[PK81212]
[PK82988]
Multiple cross-site scripting (XSS) vulnerabilities in sample applications in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35, and 6.1 before 6.1.0.23 on z/OS, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[1021811]
[34001]
[ADV-2009-0607]
[ADV-2009-1464]
[PK81212]
[http://www-01.ibm.com/support/docview.wss?uid=swg27006876]
Cross-site scripting (XSS) vulnerability in /prm/reports in the Performance Reporting Module (PRM) for Sun Management Center (SunMC) 3.6.1 and 4.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: this can be leveraged for access to the SunMC Web Console.
[1021809]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-125191-04-1]
[247046]
[33999]
[ADV-2009-0605]
[sunmc-performancereportingmodule-xss(49076)]
The response_addname function in response.c in Daniel J. Bernstein djbdns 1.05 and earlier does not constrain offsets in the required manner, which allows remote attackers, with control over a third-party subdomain served by tinydns and axfrdns, to trigger DNS responses containing arbitrary records via crafted zone data for this subdomain.
[http://it.slashdot.org/article.pl?sid=09/03/05/2014249]
[[dns] 20090225 djbdns misformats some long response packets; patch and example]
[[dns] 20090304 djbdns<=1.05 lets AXFRed subdomains overwrite domains]
[http://securityandthe.net/2009/03/05/security-issue-in-djbdns-confirmed/]
[DSA-1831]
[20090226 djbdns misformats some long response packets; patch and example attack]
[20090228 Re: djbdns misformats some long response packets; patch and example attack]
[20090305 Re: djbdns misformats some long response packets; patch and example attack]
[33937]
[djbdns-response-packet-spoofing(49003)]
The shm_get_stat function in ipc/shm.c in the shm subsystem in the Linux kernel before 2.6.28.5, when CONFIG_SHMEM is disabled, misinterprets the data type of an inode, which allows local users to cause a denial of service (system hang) via an SHM_INFO shmctl call, as demonstrated by running the ipcs program.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a68e61e8ff2d46327a37b69056998b47745db6fa]
[http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.5]
[SUSE-SA:2009:028]
[SUSE-SA:2009:030]
[SUSE-SA:2009:031]
[[git-commits-head] 20090205 shm: fix shmctl(SHM_INFO) lockup with !CONFIG_SHMEM]
[[linux-kernel] 20080229 [BUG] soft lockup detected with ipcs]
[[linux-kernel] 20090127 [PATCH 1/2] fix shmctl(SHM_INFO) lockup with !CONFIG_SHMEM]
[[oss-security] 20090306 CVE request: kernel: shm: fix shmctl(SHM_INFO) lockup with !CONFIG_SHMEM]
[http://patchwork.kernel.org/patch/6554/]
[DSA-1787]
[DSA-1794]
[DSA-1800]
[34020]
[USN-751-1]
[linux-kernel-shmgetstat-dos(49229)]
Cross-site scripting (XSS) vulnerability in the web user interface in the login application in NetMRI 3.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to error pages.
[http://connection.netcordia.com/forums/t/731.aspx]
[20090218 DDIVRT-2009-20 NetMRI Login Application Cross-site Scripting Vulnerability]
[33824]
Cross-site scripting (XSS) vulnerability in phpDenora before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via an IRC channel name. NOTE: some of these details are obtained from third party information.
[http://sourceforge.net/project/shownotes.php?release_id=661189]
[33822]
[phpdenora-ircchannel-xss(48799)]
Cross-site scripting (XSS) vulnerability in the hook_cntrlr_error_output function in modules/page/hooks/listeners.php in the admincp component in TangoCMS 2.2.x (aka Eagle) before 2.2.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party information.
[http://tangocms.org/article/view/2.2.4-released]
[http://tangocms.org/changelog]
[33833]
SQL injection vulnerability in admin/delete_page.php in S-Cms 1.1 Stable allows remote attackers to execute arbitrary SQL commands via the id parameter.
[33799]
[scms-deletepage-sql-injection(48806)]
[8071]
S-Cms 1.1 Stable allows remote attackers to bypass authentication and obtain administrative access via an OK value for the login cookie.
[33799]
[scms-cookie-security-bypass(48805)]
[8071]
Directory traversal vulnerability in the SnapShotToFile method in the GeoVision LiveX (aka LiveX_v8200) ActiveX control 8.1.2 and 8.2.0 in LIVEX_~1.OCX allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the argument, possibly involving the PlayX and SnapShotX methods.
[33782]
[geovision-livex-activex-file-overwrite(48773)]
[8059]
pHNews Alpha 1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for extra/genbackup.php.
[phnews-genbackup-info-disclosure(48801)]
[8073]
The HRM-S service in Fujitsu Enhanced Support Facility 3.0 and 3.0.1 allows remote attackers to obtain (1) hardware and (2) software information via unspecified requests in a client connection.
Per: http://www.fujitsu.com/global/support/software/security/products-f/esf-200901e.html
For the Patches, please contact a Fujitsu system engineer or your partner(s).
[http://www.fujitsu.com/global/support/software/security/products-f/esf-200901e.html]
[33831]
[fujitsu-enhanced-hrms-info-disclosure(48817)]
CRLF injection vulnerability in the WebLink template in Fujitsu Jasmine2000 Enterprise Edition allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
[http://www.fujitsu.com/global/support/software/security/products-f/jasmine-200901e.html]
[33832]
[jasmine2000-weblink-response-splitting(48818)]
Buffer overflow in the client in IBM Tivoli Storage Manager (TSM) HSM 5.3.2.0 through 5.3.5.0, 5.4.0.0 through 5.4.2.5, and 5.5.0.0 through 5.5.1.4 on Windows allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors.
[1021820]
[34034]
[ADV-2009-0638]
[http://www-01.ibm.com/support/docview.wss?uid=swg21329223]
The NFSv4 Server module in the kernel in Sun Solaris 10, and OpenSolaris before snv_111, allow local users to cause a denial of service (infinite loop and system hang) by accessing an hsfs filesystem that is shared through NFSv4, related to the rfs4_op_readdir function.
[1021819]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-139462-02-1]
[252469]
[http://support.avaya.com/elmodocs2/security/ASA-2009-090.htm]
[34031]
[ADV-2009-0635]
[ADV-2009-0765]
[solaris-nfsv4-hsfs-dos(49133)]
The SIP channel driver in Asterisk Open Source 1.4.22, 1.4.23, and 1.4.23.1; 1.6.0 before 1.6.0.6; 1.6.1 before 1.6.1.0-rc2; and Asterisk Business Edition C.2.3, with the pedantic option enabled, allows remote authenticated users to cause a denial of service (crash) via a SIP INVITE request without any headers, which triggers a NULL pointer dereference in the (1) sip_uri_headers_cmp and (2) sip_uri_params_cmp functions.
[http://bugs.digium.com/view.php?id=13547]
[http://bugs.digium.com/view.php?id=14417]
[http://downloads.digium.com/pub/security/AST-2009-002.html]
[20090310 AST-2009-002: Remote Crash Vulnerability in SIP channel driver]
[34070]
[1021834]
[ADV-2009-0667]
The NFS server in Sun Solaris 10, and OpenSolaris before snv_111, does not properly implement the AUTH_NONE (aka sec=none) security mode in combination with other security modes, which allows remote attackers to bypass intended access restrictions and read or modify files, as demonstrated by a combination of the AUTH_NONE and AUTH_SYS security modes.
[1021833]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-139462-02-1]
[253588]
[http://support.avaya.com/elmodocs2/security/ASA-2009-093.htm]
[34063]
[ADV-2009-0658]
[ADV-2009-0798]
[solaris-nfssec-unauthorized-access(49170)]
The NFS daemon (aka nfsd) in Sun Solaris 10 and OpenSolaris before snv_106, when NFSv3 is used, does not properly implement combinations of security modes, which allows remote attackers to bypass intended access restrictions and read or modify files, as demonstrated by a combination of the sec=sys and sec=krb5 security modes, related to modes that "override each other."
[1021832]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-139462-02-1]
[250306]
[http://support.avaya.com/elmodocs2/security/ASA-2009-096.htm]
[34062]
[ADV-2009-0657]
[ADV-2009-0814]
[solaris-nfsd-unauthorized-access(49171)]
Multiple unspecified vulnerabilities in the Doors subsystem in the kernel in Sun Solaris 8 through 10, and OpenSolaris before snv_94, allow local users to cause a denial of service (process hang), or possibly bypass file permissions or gain kernel-context privileges, via vectors including ones related to (1) an argument handling deadlock in a door server and (2) watchpoint problems in the door_call function.
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-117350-61-1]
[242486]
[http://support.avaya.com/elmodocs2/security/ASA-2009-095.htm]
[34081]
[1021840]
[ADV-2009-0673]
[ADV-2009-0766]
Race condition in the Doors subsystem in the kernel in Sun Solaris 8 through 10, and OpenSolaris before snv_94, allows local users to cause a denial of service (process hang), or possibly bypass file permissions or gain kernel-context privileges, via vectors involving the time at which control is transferred from a caller to a door server.
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-117350-61-1]
[242486]
[http://support.avaya.com/elmodocs2/security/ASA-2009-095.htm]
[34081]
[1021840]
[ADV-2009-0673]
[ADV-2009-0766]
Sun xVM VirtualBox 2.0.0, 2.0.2, 2.0.4, 2.0.6r39760, 2.1.0, 2.1.2, and 2.1.4r42893 on Linux allows local users to gain privileges via a hardlink attack, which preserves setuid/setgid bits on Linux, related to DT_RPATH:$ORIGIN.
Per: http://sunsolve.sun.com/search/document.do?assetkey=1-66-254568-1
"5. Resolution
This issue is addressed in the following releases:
Linux
* Sun xVM VirtualBox 2.0.6r43001
* Sun xVM VirtualBox 2.1.4r43001"
[254568]
[[oss-security] 20090316 CVE-2009-0876 (VirtualBox) references]
[[oss-security] 20090317 Re: CVE-2009-0876 (VirtualBox) references]
[34080]
[1021841]
[http://www.virtualbox.org/ticket/3444]
[ADV-2009-0674]
[https://bugs.gentoo.org/show_bug.cgi?id=260331]
[xvmvirtualbox-unspecified-priv-escalation(49193)]
Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Communications Express allow remote attackers to inject arbitrary web script or HTML via the (1) Full Name or (2) Subject field.
[http://sosoblood.freehostia.com/SJSC/html_injection.gif]
[20090310 Sun Java System Communications Express [HTML Injection]]
[34083]
The read_game_map function in src/terrain_translation.cpp in Wesnoth before r32987 allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a map with a large (1) width or (2) height.
[http://launchpad.net/bugs/335089]
[http://launchpad.net/bugs/336396]
[http://packages.debian.org/changelogs/pool/main/w/wesnoth/wesnoth_1.4.7-4/changelog]
[http://packages.debian.org/changelogs/pool/main/w/wesnoth/wesnoth_1.5.12-1/changelog]
[http://svn.gna.org/viewcvs/wesnoth/trunk/src/terrain_translation.cpp?r2=32987&rev=32987&r1=31859&dir_pagestart=200]
[http://svn.gna.org/viewcvs/wesnoth/trunk/src/terrain_translation.cpp?rev=33078&dir_pagestart=200&view=log]
[wesnoth-readgamemap-dos(49294)]
[https://gna.org/bugs/index.php?13031]
The CIM server in IBM Director before 5.20.3 Service Update 2 on Windows allows remote attackers to cause a denial of service (daemon crash) via a long consumer name, as demonstrated by an M-POST request to a long /CIMListener/ URI.
[1021825]
[20090310 SEC Consult SA-20090305-1 :: IBM Director CIM Server Remote Denial of Service Vulnerability]
[34061]
[ADV-2009-0656]
[director-cim-consumer-dos(49285)]
[8190]
[https://www.sec-consult.com/files/20090305-1_IBM_director_DoS.txt]
[https://www14.software.ibm.com/webapp/iwm/web/reg/download.do?source=dmp&S_PKG=director_x_520&S_TACT=sms&lang=en_US&cp=UTF-8]
Directory traversal vulnerability in the CIM server in IBM Director before 5.20.3 Service Update 2 on Windows allows remote attackers to load and execute arbitrary local DLL code via a .. (dot dot) in a /CIMListener/ URI in an M-POST request.
Per: http://www.securityfocus.com/archive/1/archive/1/501639/100/0/threaded
"The vendor has adressed this vulnerability in service update 2 for IBM
Director agent 5.20.3. Download link:
https://www14.software.ibm.com/webapp/iwm/web/reg/download.do?source=dmp
&S_PKG=director_x_520&S_TACT=sms<=en_US&cp=UTF-8"
[20090310 SEC Consult SA-20090305-2 :: IBM Director CIM Server Local Privilege Escalation Vulnerability]
[34065]
[ADV-2009-0656]
[director-cim-directory-traversal(49286)]
[https://www.sec-consult.com/files/20090305-2_IBM_director_privilege_escalation.txt]
[https://www14.software.ibm.com/webapp/iwm/web/reg/download.do?source=dmp&S_PKG=director_x_520&S_TACT=sms&lang=en_US&cp=UTF-8]
SQL injection vulnerability in ejemplo/paises.php in isiAJAX 1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
[isiajax-paises-sql-injection(49113)]
[8167]
Multiple SQL injection vulnerabilities in nForum 1.5 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to showtheme.php and the (2) user parameter to userinfo.php.
[20090306 nForum 1.5 Multiple SQL Injection]
[34030]
SQL injection vulnerability in Blue Eye CMS 1.0.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the BlueEyeCMS_login cookie parameter.
[34022]
[blueeyecms-blueeyecmslogin-sql-injection(49104)]
[8165]
Buffer overflow in FileZilla Server before 0.9.31 allows remote attackers to cause a denial of service via unspecified vectors related to SSL/TLS packets.
[http://filezilla-project.org/index.php]
[http://sourceforge.net/project/shownotes.php?release_id=665428]
[34006]
[1021812]
[ADV-2009-0603]
[filezillaserver-ssltls-dos(49107)]
Multiple heap-based buffer overflows in Media Commands 1.0 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a long string in a (1) M3U, (2) M3l, (3) TXT, and (4) LRC playlist file.
[33958]
[http://www.securityfocus.com/data/vulnerabilities/exploits/33958.py]
[http://www.securityfocus.com/data/vulnerabilities/exploits/33958.rb]
[http://www.securityfocus.com/data/vulnerabilities/exploits/33958-2.py]
[ADV-2009-0583]
[mediacommands-playlist-bo(49035)]
[8135]
Directory traversal vulnerability in login.php in OneOrZero Helpdesk 1.6.5.7 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the default_language parameter.
[34029]
[htms-login-file-include(49114)]
[8168]
[8169]
Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM (aka pam) 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and might allow remote authenticated users to obtain login access with a different user's non-ASCII username, via a login attempt.
[[oss-security] 20090305 CVE Request -- pam]
[http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/libpam/pam_misc.c?r1=1.9&r2=1.10&view=patch]
[http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/libpam/pam_misc.c?view=log]
[MDVSA-2009:077]
[34010]
[linuxpam-pamstrtok-priv-escalation(49110)]
[FEDORA-2009-3204]
[FEDORA-2009-3231]
Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-0510, CVE-2009-0511, CVE-2009-0512, and CVE-2009-0889.
[GLSA-200907-06]
[1022361]
[http://www.adobe.com/support/security/bulletins/apsb09-07.html]
[RHSA-2009:1109]
[35274]
[TA09-161A]
[ADV-2009-1547]
Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-0510, CVE-2009-0511, CVE-2009-0512, and CVE-2009-0888.
[GLSA-200907-06]
[1022361]
[http://www.adobe.com/support/security/bulletins/apsb09-07.html]
[RHSA-2009:1109]
[35274]
[TA09-161A]
[ADV-2009-1547]
The Web Services Security component in IBM WebSphere Application Server 7.0 before Fix Pack 1 (7.0.0.1), 6.1 before Fix Pack 23 (6.1.0.23),and 6.0.2 before Fix Pack 33 (6.0.2.33) does not properly enforce (1) nonce and (2) timestamp expiration values in WS-Security bindings as stored in the com.ibm.wsspi.wssecurity.core custom property, which allows remote authenticated users to conduct session hijacking attacks.
[http://www-01.ibm.com/support/docview.wss?uid=swg27006876]
[http://www-01.ibm.com/support/docview.wss?uid=swg27007951]
[http://www-01.ibm.com/support/docview.wss?uid=swg27014463]
[PK66676]
[websphere-ws-security-session-hijacking(49391)]
The administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 and 7.0 before 7.0.0.3 allows attackers to hijack user sessions in "specific scenarios" related to a forced logout.
[34501]
[http://www-01.ibm.com/support/docview.wss?uid=swg27007951]
[http://www-01.ibm.com/support/docview.wss?uid=swg27014463]
[websphere-console-session-hijacking(49499)]
Multiple heap-based buffer overflows in xvidcore/src/decoder.c in the xvidcore library in Xvid before 1.2.2, as used by Windows Media Player and other applications, allow remote attackers to execute arbitrary code by providing a crafted macroblock (aka MBlock) number in a video stream in a crafted movie file that triggers heap memory corruption, related to a "missing resync marker range check" and the (1) decoder_iframe, (2) decoder_pframe, and (3) decoder_bframe functions.
[http://cvs.xvid.org/cvs/viewvc.cgi/xvidcore/src/decoder.c]
[http://cvs.xvid.org/cvs/viewvc.cgi/xvidcore/src/decoder.c?r1=1.80&r2=1.81]
[35156]
[ADV-2009-1468]
[http://www.xvid.org/News.64.0.html?&cHash=0170b4e439&tx_ttnews[backPid]=64&tx_ttnews[tt_news]=7]
[https://www.it-isac.org/postings/cyber/alertdetail.php?id=4634&selyear=2009&menutype=menupublic]
Heap-based buffer overflow in the decoder_create function in the initialization functionality in xvidcore/src/decoder.c in Xvid before 1.2.2, as used by Windows Media Player and other applications, allows remote attackers to execute arbitrary code via vectors involving the DirectShow (aka DShow) frontend and improper handling of the XVID_ERR_MEMORY return code during processing of a crafted movie file. NOTE: some of these details are obtained from third party information.
[http://cvs.xvid.org/cvs/viewvc.cgi/xvidcore/src/decoder.c]
[http://cvs.xvid.org/cvs/viewvc.cgi/xvidcore/src/decoder.c?r1=1.80&r2=1.81]
[35158]
[http://www.xvid.org/News.64.0.html?&cHash=0170b4e439&tx_ttnews[backPid]=64&tx_ttnews[tt_news]=7]
[https://www.it-isac.org/postings/cyber/alertdetail.php?id=4635&selyear=2009&menutype=menupublic]
Integer overflow in Novell eDirectory 8.7.3.x before 8.7.3.10 ftf2 and 8.8.x before 8.8.5.2 allows remote attackers to execute arbitrary code via an NDS Verb 0x1 request containing a large integer value that triggers a heap-based buffer overflow.
[20091124 Novell eDirectory Remote Code Execution]
[http://www.novell.com/support/viewContent.do?externalId=7004912]
[37184]
[ADV-2009-3379]
[https://bugzilla.novell.com/show_bug.cgi?id=524344]
[https://bugzilla.novell.com/show_bug.cgi?id=545887]
[application-control-request-overflow(50616)]
Buffer overflow in the queue manager in IBM WebSphere MQ 6.x before 6.0.2.7 and 7.x before 7.0.1.0 allows remote attackers to execute arbitrary code via a crafted request.
[1022311]
[35170]
[ADV-2009-1463]
[http://www-01.ibm.com/support/docview.wss?uid=swg21386826]
[websphere-mq-clientconnection-bo(50641)]
IBM WebSphere Partner Gateway (WPG) 6.1.0 before 6.1.0.1 and 6.1.1 before 6.1.1.1 allows remote authenticated users to obtain sensitive information via vectors related to the "schema DB2 instance id" and the bcgarchive (aka the archiver script).
[35136]
[JR31482]
[websphere-pg-bcgarchive-info-disclosure(50643)]
Stack-based buffer overflow in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a crafted HTTP request.
[SSRT090101]
[SSRT090257]
[20091209 HP OpenView Network Node Manager Remote Code Execution]
[37261]
[37294]
IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.24 and 7.0 through 7.0.0.4, IBM WebSphere Portal Server 5.1 through 6.0, and IBM Integrated Solutions Console (ISC) 6.0.1 do not properly set the IsSecurityEnabled security flag during migration of WebSphere Member Manager (WMM) to Virtual Member Manager (VMM) and a Federated Repository, which allows attackers to obtain sensitive information from repositories via unspecified vectors.
[35406]
[http://www-01.ibm.com/support/docview.wss?uid=swg21375859]
[PK78134]
[websphere-issecurityenabled-info-disclosure(50882)]
Heap-based buffer overflow in the client in IBM WebSphere MQ 6.0 before 6.0.2.7 and 7.0 before 7.0.1.0 allows local users to gain privileges via crafted SSL information in a Client Channel Definition Table (CCDT) file.
[IC59375]
[websphere-mq-client-ccdt-bo(51038)]
The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not prevent VariantClear calls on an uninitialized VARIANT, which allows remote attackers to execute arbitrary code via a malformed stream to an ATL (1) component or (2) control, related to ATL headers and error handling, aka "ATL Uninitialized Object Vulnerability."
Please refer to this link http://www.microsoft.com/technet/security/Bulletin/MS09-035.mspx for mitigating factors and additional information.
[http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx]
[SSRT100013]
[266108]
[http://www.adobe.com/support/security/advisories/apsa09-04.html]
[http://www.adobe.com/support/security/bulletins/apsb09-10.html]
[http://www.adobe.com/support/security/bulletins/apsb09-11.html]
[http://www.adobe.com/support/security/bulletins/apsb09-13.html]
[http://www.novell.com/support/viewContent.do?externalId=7004997&sliceId=1]
[35832]
[TA09-195A]
[TA09-223A]
[TA09-286A]
[ADV-2009-2034]
[ADV-2009-2232]
[MS09-035]
[MS09-037]
[MS09-060]
[oval:org.mitre.oval:def:6289]
[oval:org.mitre.oval:def:6311]
[oval:org.mitre.oval:def:6373]
[oval:org.mitre.oval:def:7581]
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.3, and the Feature Pack for Web Services for WAS 6.1 before 6.1.0.25, when a WS-Security policy is established at the operation level, does not properly handle inbound requests that lack a SOAPAction or WS-Addressing Action, which allows remote attackers to bypass intended access restrictions via a crafted request to a JAX-WS application.
[35594]
[PK81944]
[PK87767]
[websphere-jaxws-wssecurity-sec-bypass(51293)]
The IBM Stax XMLStreamWriter in the Web Services component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 does not properly process XML encoding, which allows remote attackers to bypass intended access restrictions and possibly modify data via "XML fuzzing attacks" sent through SOAP requests.
[35741]
[http://www-01.ibm.com/support/docview.wss?uid=swg27007951]
[websphere-soap-security-bypass(51490)]
IBM WebSphere MQ 6.0 before 6.0.2.8 and 7.0 before 7.0.1.0 does not properly handle long group names, which might allow local users to gain privileges by leveraging combinations of group names with the same initial substring.
Per: http://xforce.iss.net/xforce/xfdb/51042
'Note: This vulnerability only affects platforms where group names are limited to 12 characters in length.IB'
[IZ37102]
[websphere-mq-group-weak-security(51042)]
The Service Component Architecture (SCA) feature pack for IBM WebSphere Application Server (WAS) SCA 1.0 before 1.0.0.3 allows remote authenticated users to bypass intended authentication.transport access restrictions and obtain unspecified access via unknown vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg27015429]
[was-sca-scaallauthorizedusers-sec-bypass(52074)]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2009-1899. Reason: This candidate is a duplicate of CVE-2009-1899. Notes: All CVE users should reference CVE-2009-1899 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Unspecified vulnerability in the ACE shared folders implementation in the VMware Host Guest File System (HGFS) shared folders feature in VMware ACE 2.5.1 and earlier allows attackers to enable a disabled shared folder.
[[security-announce] 20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues]
[20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues]
[34373]
[1021975]
[http://www.vmware.com/security/advisories/VMSA-2009-0005.html]
[ADV-2009-0944]
[oval:org.mitre.oval:def:6399]
Heap-based buffer overflow in the VNnc Codec in VMware Workstation 6.5.x before 6.5.2 build 156735, VMware Player 2.5.x before 2.5.2 build 156735, VMware ACE 2.5.x before 2.5.2 build 156735, and VMware Server 2.0.x before 2.0.1 build 156745 allows remote attackers to execute arbitrary code via a crafted web page or video file, aka ZDI-CAN-435.
[[security-announce] 20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues]
[20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues]
[GLSA-201209-25]
[34373]
[1021974]
[http://www.vmware.com/security/advisories/VMSA-2009-0005.html]
[ADV-2009-0944]
[oval:org.mitre.oval:def:6251]
Heap-based buffer overflow in the VNnc Codec in VMware Workstation 6.5.x before 6.5.2 build 156735, VMware Player 2.5.x before 2.5.2 build 156735, VMware ACE 2.5.x before 2.5.2 build 156735, and VMware Server 2.0.x before 2.0.1 build 156745 allows remote attackers to execute arbitrary code via a crafted web page or video file, aka ZDI-CAN-436.
[[security-announce] 20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues]
[20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues]
[GLSA-201209-25]
[34373]
[1021974]
[http://www.vmware.com/security/advisories/VMSA-2009-0005.html]
[ADV-2009-0944]
[oval:org.mitre.oval:def:5786]
perl-MDK-Common 1.1.11 and 1.1.24, 1.2.9 through 1.2.14, and possibly other versions, in Mandriva Linux does not properly handle strings when writing them to configuration files, which allows attackers to gain privileges via "special characters" in unspecified vectors.
[MDVSA-2009:072]
[34089]
[ADV-2009-0688]
[perlmdkcommon-unspecified-priv-escalation(49220)]
Unspecified vulnerability in the keysock kernel module in Solaris 10 and OpenSolaris builds snv_01 through snv_108 allows local users to cause a denial of service (system panic) via unknown vectors related to PF_KEY socket, probably related to setting socket options.
[253568]
[http://support.avaya.com/elmodocs2/security/ASA-2009-099.htm]
[34118]
[1021846]
[ADV-2009-0717]
[ADV-2009-0817]
[sun-solaris-keysock-dos(49247)]
[oval:org.mitre.oval:def:6203]
Opera before 9.64 allows remote attackers to execute arbitrary code via a crafted JPEG image that triggers memory corruption.
[SUSE-SR:2009:007]
[GLSA-200903-30]
[1021782]
[[oss-security] 20090307 CVE Request: Opera <9.64: Execution of arbitrary code]
[http://www.opera.com/docs/changelogs/freebsd/964/]
[http://www.opera.com/docs/changelogs/linux/964/]
[http://www.opera.com/docs/changelogs/mac/964/]
[http://www.opera.com/docs/changelogs/solaris/964/]
[http://www.opera.com/docs/changelogs/windows/964/]
[http://www.opera.com/support/kb/view/926/]
[33961]
[ADV-2009-0586]
[https://bugs.gentoo.org/show_bug.cgi?id=261032]
[oval:org.mitre.oval:def:5955]
[oval:org.mitre.oval:def:6230]
Opera before 9.64 allows remote attackers to conduct cross-domain scripting attacks via unspecified vectors related to plug-ins.
[SUSE-SR:2009:007]
[http://www.opera.com/docs/changelogs/freebsd/964/]
[http://www.opera.com/docs/changelogs/linux/964/]
[http://www.opera.com/docs/changelogs/mac/964/]
[http://www.opera.com/docs/changelogs/solaris/964/]
[http://www.opera.com/docs/changelogs/windows/964/]
[33961]
[ADV-2009-0586]
[oval:org.mitre.oval:def:6220]
Unspecified vulnerability in Opera before 9.64 has unknown impact and attack vectors, related to a "moderately severe issue."
[SUSE-SR:2009:007]
[http://www.opera.com/docs/changelogs/freebsd/964/]
[http://www.opera.com/docs/changelogs/linux/964/]
[http://www.opera.com/docs/changelogs/mac/964/]
[http://www.opera.com/docs/changelogs/solaris/964/]
[http://www.opera.com/docs/changelogs/windows/964/]
[33961]
[ADV-2009-0586]
Cross-site scripting (XSS) vulnerability in DFLabs PTK 1.0.0 through 1.0.4 allows remote attackers to inject arbitrary web script or HTML by providing a forensic image containing HTML documents, which are rendered in web browsers during inspection by PTK. NOTE: the vendor states that the product is intended for use in a laboratory with "no contact from / to internet."
[http://ptk.dflabs.com/faq.html]
[http://ptk.dflabs.com/security.html]
[VU#845747]
[http://www.kb.cert.org/vuls/id/RGII-7Q4GBJ]
[34111]
[ptk-unspecified-xss(49236)]
Multiple unspecified vulnerabilities in DFLabs PTK 1.0.0 through 1.0.4 allow remote attackers to execute arbitrary commands in processes launched by PTK's Apache HTTP Server via (1) "external tools" or (2) a crafted forensic image.
[http://ptk.dflabs.com/faq.html]
[http://ptk.dflabs.com/security.html]
[VU#845747]
[http://www.kb.cert.org/vuls/id/RGII-7Q4GBJ]
[34111]
[ptk-unspecified-command-execution(49235)]
XAMPP installs multiple packages with insecure default passwords, which makes it easier for remote attackers to obtain access via (1) the "lampp" default password for the "nobody" account within the included ProFTPD installation, (2) a blank default password for the "root" account within the included MySQL installation, (3) a blank default password for the "pma" account within the phpMyAdmin installation, and possibly other unspecified passwords. NOTE: this was originally reported as a problem in DFLabs PTK, but this issue affects any product that is installed within the XAMPP environment, and should not be viewed as a vulnerability within that product. NOTE: DFLabs states that PTK is intended for use in a laboratory with "no contact from / to internet."
[http://ptk.dflabs.com/security.html]
[http://www.apachefriends.org/en/faq-xampp-linux.html]
[http://www.debianhelp.co.uk/xampp.htm]
[http://www.ibm.com/developerworks/linux/library/l-xampp/]
[ptk-default-password(49306)]
Stack-based buffer overflow in OvCgi/Toolbar.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long OvOSLocale cookie, a variant of CVE-2008-0067.
[SSRT090008]
[8308]
[http://www.coresecurity.com/content/openview-buffer-overflows]
[20090323 CORE-2009-0122: HP OpenView Buffer Overflows]
[34294]
[1021883]
[ADV-2009-0819]
[hp-ovnnm-ovoslocale-bo(49364)]
Multiple heap-based buffer overflows in OvCgi/Toolbar.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via (1) a long OvAcceptLang cookie, which triggers the error in ov.dll and ovwww.dll, or (2) a long Accept-Language HTTP header, which triggers the error in ovwww.dll or libovwww.so.4.
[SSRT090008]
[http://www.coresecurity.com/content/openview-buffer-overflows]
[20090323 CORE-2009-0122: HP OpenView Buffer Overflows]
[34134]
[34135]
[1021883]
[ADV-2009-0819]
[hp-ovnnm-ovacceptlang-acceptlanguage-bo(49363)]
PostgreSQL before 8.3.7, 8.2.13, 8.1.17, 8.0.21, and 7.4.25 allows remote authenticated users to cause a denial of service (stack consumption and crash) by triggering a failure in the conversion of a localized error message to a client-specified encoding, as demonstrated using mismatched encoding conversion requests.
Per: https://bugzilla.redhat.com/show_bug.cgi?id=488156
"PostgreSQL allows remote authenticated users to cause a momentary denial
of service (crash due to stack consumption) when there is a failure to
convert a localized error message to the client-specified encoding.
In releases 8.3.6, 8.2.12, 8.1.16. 8.0.20, and 7.4.24, a trivial
misconfiguration is sufficient to provoke a crash. In older releases
it is necessary to select a locale and client encoding for which
specific messages fail to translate, and so a given installation may or
may not be vulnerable depending on the administrator-determined locale
setting.
Releases 8.3.7, 8.2.13, 8.1.17, 8.0.21, and 7.4.25 are secure against
all known variants of this issue."
[[pgsql-bugs] 20090227 Re: BUG #4680: Server crashed if using wrong (mismatch) conversion functions]
[[pgsql-bugs] 20090227 BUG #4680: Server crashed if using wrong (mismatch) conversion functions]
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=517405]
[SUSE-SR:2009:009]
[HPSBMU02781]
[258808]
[1020455]
[http://wiki.rpath.com/Advisories:rPSA-2009-0086]
[MDVSA-2009:079]
[[oss-security] 20090311 CVE request -- postgresql]
[http://www.postgresql.org/about/news.1065]
[RHSA-2009:1067]
[20090519 rPSA-2009-0086-1 postgresql postgresql-contrib postgresql-server]
[34090]
[1021860]
[ADV-2009-0767]
[ADV-2009-1316]
[https://bugzilla.redhat.com/show_bug.cgi?id=488156]
[oval:org.mitre.oval:def:10874]
[oval:org.mitre.oval:def:6252]
[FEDORA-2009-2927]
[FEDORA-2009-2959]
Unspecified vulnerability in Kerberos Incremental Propagation in Solaris 10 and OpenSolaris snv_01 through snv_110 allows remote attackers to cause a denial of service (loss of incremental propagation requests to slave KDC servers) via unknown vectors related to the master Key Distribution Center (KDC) server.
[249926]
[http://support.avaya.com/elmodocs2/security/ASA-2009-102.htm]
[34139]
[1021851]
[ADV-2009-0741]
[ADV-2009-0875]
[solaris-kerberos-dos(49276)]
[oval:org.mitre.oval:def:6174]
Unspecified vulnerability in Sun OpenSolaris snv_39 through snv_45, when running in 64-bit mode on x86 architectures, allows local users to cause a denial of service (hang of UFS filesystem write) via unknown vectors related to the (1) ufs_getpage and (2) ufs_putapage routines, aka CR 6442712.
[254628]
[http://support.avaya.com/elmodocs2/security/ASA-2009-103.htm]
[34137]
[1021850]
[ADV-2009-0742]
[ADV-2009-0876]
[solaris-ufs-filesystem-64bit-dos(49281)]
Unspecified vulnerability in Sun Solaris 10 on SPARC sun4v systems, and OpenSolaris snv_47 through snv_85, allows local users to cause a denial of service (hang of UFS filesystem write) via unknown vectors related to the (1) ufs_getpage and (2) ufs_putapage routines, aka CR 6425723.
[254628]
[http://support.avaya.com/elmodocs2/security/ASA-2009-103.htm]
[34137]
[1021850]
[ADV-2009-0742]
[ADV-2009-0876]
[solaris-ufs-filesystem-sun4vdos(49282)]
Unspecified vulnerability in the UFS filesystem functionality in Sun OpenSolaris snv_86 through snv_91, when running in 32-bit mode on x86 systems, allows local users to cause a denial of service (panic) via unknown vectors related to the (1) ufs_getpage and (2) ufs_putapage routines, aka CR 6679732.
[254628]
[http://support.avaya.com/elmodocs2/security/ASA-2009-103.htm]
[34137]
[1021850]
[ADV-2009-0742]
[ADV-2009-0876]
[solaris-ufs-filesystem-32bit-dos(49283)]
Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1, 8 before 8.1.3 , and 7 before 7.1.1 allows remote attackers to execute arbitrary code via a crafted argument to the getIcon method of a Collab object, a different vulnerability than CVE-2009-0658.
Per vendor advisory in the 'details' section it states:
"The Adobe Reader and Acrobat 9.1 and 7.1.1 updates resolve an input validation issue in a JavaScript method that could potentially lead to remote code execution. This issue has already been resolved in Adobe Reader 8.1.3 and Acrobat 8.1.3. (CVE-2009-0927)"
http://www.adobe.com/support/security/bulletins/apsb09-04.html
[SUSE-SA:2009:014]
[SUSE-SR:2009:009]
[GLSA-200904-17]
[256788]
[http://www.adobe.com/support/security/bulletins/apsb09-04.html]
[9579]
[20090324 ZDI-09-014: Adobe Acrobat getIcon() Stack Overflow Vulnerability]
[34169]
[1021861]
[ADV-2009-0770]
[ADV-2009-1019]
[http://www.zerodayinitiative.com/advisories/ZDI-09-014]
[adobe-unspecified-javascript-code-execution(49312)]
Heap-based buffer overflow in Adobe Acrobat Reader and Acrobat Professional 7.1.0, 8.1.3, 9.0.0, and other versions allows remote attackers to execute arbitrary code via a PDF file containing a JBIG2 stream with a size inconsistency related to an unspecified table.
[20090324 Adobe Reader and Acrobat JBIG2 Encoded Stream Heap Overflow Vulnerability]
[SUSE-SA:2009:014]
[SUSE-SR:2009:009]
[GLSA-200904-17]
[256788]
[http://www.adobe.com/support/security/bulletins/apsb09-04.html]
[RHSA-2009:0376]
[34229]
[1021892]
[ADV-2009-1019]
Directory traversal vulnerability in the media manager in Nucleus CMS before 3.40 allows remote attackers to read arbitrary files via unknown vectors.
[http://www.nucleuscms.org/index.php/item/index.php/item/3051]
[34040]
[ADV-2009-0637]
[nucleuscms-mediamanager-directory-traversal(49142)]
Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 4.2.2 and 4.3.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) smime.php, (2) pgp.php, and (3) message.php.
[http://cvs.horde.org/co.php/imp/docs/CHANGES?r=1.699.2.301.2.3]
[http://cvs.horde.org/co.php/imp/docs/CHANGES?r=1.699.2.375]
[[announce] 20090127 IMP 4.2.2 (final)]
[[announce] 20090127 IMP 4.3.3 (final)]
[SUSE-SR:2009:007]
[DSA-1770]
[33492]
Cross-site scripting (XSS) vulnerability in the tag cloud search script (horde/services/portal/cloud_search.php) in Horde before 3.2.4 and 3.3.3, and Horde Groupware before 1.1.5, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://cvs.horde.org/co.php/groupware/docs/groupware/CHANGES?r=1.28.2.5]
[http://cvs.horde.org/co.php/horde/docs/CHANGES?r=1.515.2.413.2.5]
[http://cvs.horde.org/co.php/horde/docs/CHANGES?r=1.515.2.503]
[[announce] 20090127 Horde 3.3.3 (final)]
[[announce] 20090127 Horde 3.2.4 (final)]
[[announce] 20090127 Horde Groupware 1.1.5 (final)]
[33491]
Directory traversal vulnerability in framework/Image/Image.php in Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the Horde_Image driver name.
[http://cvs.horde.org/co.php/groupware/docs/groupware/CHANGES?r=1.28.2.5]
[http://cvs.horde.org/co.php/horde/docs/CHANGES?r=1.515.2.413.2.5]
[http://cvs.horde.org/co.php/horde/docs/CHANGES?r=1.515.2.503]
[[announce] 20090127 Horde 3.3.3 (final)]
[[announce] 20090127 Horde 3.2.4 (final)]
[[announce] 20090127 Horde Groupware 1.1.5 (final)]
[SUSE-SR:2009:007]
[8077]
[33491]
Cross-site scripting (XSS) vulnerability in the administrative interface in Dotclear before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://dotclear.org/blog/post/2009/02/05/Dotclear-2.1.5]
[34036]
[ADV-2009-0636]
[dotclear-admin-interface-xss(49138)]
Cross-site scripting (XSS) vulnerability in ejabberd before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to links and MUC logs.
[DSA-1774]
[[oss-security] 20090316 CVE request: XSS in MUC logs of ejabberd]
[http://www.process-one.net/en/ejabberd/release_notes/release_note_ejabberd_204]
[34133]
[ejabberd-chatroom-xss(49289)]
[FEDORA-2009-2747]
[FEDORA-2009-2746]
The inotify_read function in the Linux kernel 2.6.27 to 2.6.27.13, 2.6.28 to 2.6.28.2, and 2.6.29-rc3 allows local users to cause a denial of service (OOPS) via a read with an invalid address to an inotify instance, which causes the device's event list mutex to be unlocked twice and prevents proper synchronization of a data structure for the inotify instance.
[[linux-kernel] 20090131 [patch 03/43] inotify: clean up inotify_read and fix locking]
[http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.3]
[[oss-security] 20090306 CVE request: kernel: inotify local DoS]
[[oss-security] 20090318 Re: CVE request: kernel: inotify local DoS]
[[oss-security] 20090319 Re: CVE request: kernel: inotify local DoS]
[33624]
[https://bugzilla.redhat.com/show_bug.cgi?id=488935]
[linux-kernel-inotify-read-dos(49331)]
Unspecified vulnerability in Tor before 0.2.0.34 allows attackers to cause a denial of service (infinite loop) via "corrupt votes."
[[or-announce] 20090209 Tor 0.2.0.34 is released (security fixes)]
[GLSA-200904-11]
[33713]
Unspecified vulnerability in Tor before 0.2.0.34 allows directory mirrors to cause a denial of service via unknown vectors.
[[or-announce] 20090209 Tor 0.2.0.34 is released (security fixes)]
[GLSA-200904-11]
[33713]
Unspecified vulnerability in Tor before 0.2.0.34 allows directory mirrors to cause a denial of service (exit node crash) via "malformed input."
[[or-announce] 20090209 Tor 0.2.0.34 is released (security fixes)]
[GLSA-200904-11]
[33713]
[tor-mirrors-dos(49323)]
Tor before 0.2.0.34 treats incomplete IPv4 addresses as valid, which has unknown impact and attack vectors related to "Spec conformance," as demonstrated using 192.168.0.
[[or-announce] 20090209 Tor 0.2.0.34 is released (security fixes)]
[GLSA-200904-11]
[33713]
Multiple cross-site request forgery (CSRF) vulnerabilities in the HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders allow remote attackers to hijack the intranet connectivity of arbitrary users for requests that (1) print documents via unknown vectors, (2) modify the network configuration via a NetIPChange request to hp/device/config_result_YesNo.html/config, or (3) change the password via the Password and ConfirmPassword parameters to hp/device/set_config_password.html/config.
[HPSN-2009-001]
[http://www.louhinetworks.fi/advisory/HP_20090317.txt]
[20090316 HP Laserjet multiple models web management CSRF vulnerability & insecure default configuration]
[34143]
[ADV-2009-0754]
The HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders has no management password by default, which makes it easier for remote attackers to obtain access.
[HPSN-2009-001]
[http://www.louhinetworks.fi/advisory/HP_20090317.txt]
[20090316 HP Laserjet multiple models web management CSRF vulnerability & insecure default configuration]
[ADV-2009-0754]
Help Viewer in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 does not verify that certain Cascading Style Sheets (CSS) are located in a registered help book, which allows remote attackers to execute arbitrary code via a help: URL that triggers invocation of AppleScript files.
[APPLE-SA-2009-05-12]
[http://support.apple.com/kb/HT3549]
[34926]
[1022216]
[TA09-133A]
[ADV-2009-1297]
[macos-helpviewer-css-code-execution(50485)]
Help Viewer in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 does not verify that HTML pathnames are located in a registered help book, which allows remote attackers to execute arbitrary code via a help: URL that triggers invocation of AppleScript files.
[APPLE-SA-2009-05-12]
[http://support.apple.com/kb/HT3549]
[34926]
[1022216]
[TA09-133A]
[ADV-2009-1297]
[macos-helpviewer-html-code-execution(50486)]
The Microsoft Office Spotlight Importer in Spotlight in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 does not properly validate Microsoft Office files, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a file that triggers memory corruption.
[APPLE-SA-2009-05-12]
[http://support.apple.com/kb/HT3549]
[34926]
[34939]
[1022215]
[TA09-133A]
[ADV-2009-1297]
Array index error in the insertItemBefore method in WebKit, as used in Apple Safari before 3.2.3 and 4 Public Beta, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Google Chrome Stable before 1.0.154.65, and possibly other products allows remote attackers to execute arbitrary code via a document with a SVGPathList data structure containing a negative index in the (1) SVGTransformList, (2) SVGStringList, (3) SVGNumberList, (4) SVGPathSegList, (5) SVGPointList, or (6) SVGLengthList SVGList object, which triggers memory corruption.
[http://code.google.com/p/chromium/issues/detail?id=9019]
[http://googlechromereleases.blogspot.com/2009/05/stable-update-bug-fix.html]
[APPLE-SA-2009-06-17-1]
[APPLE-SA-2009-05-12]
[APPLE-SA-2009-05-12]
[APPLE-SA-2009-05-12]
[SUSE-SR:2011:002]
[http://support.apple.com/kb/HT3549]
[http://support.apple.com/kb/HT3550]
[http://support.apple.com/kb/HT3639]
[DSA-1950]
[RHSA-2009:1130]
[20090519 ZDI-09-022: Apple Safari Malformed SVGList Parsing Code Execution Vulnerability]
[34924]
[1022207]
[USN-822-1]
[USN-836-1]
[USN-857-1]
[TA09-133A]
[ADV-2009-1297]
[ADV-2009-1298]
[ADV-2009-1321]
[ADV-2009-1621]
[ADV-2011-0212]
[http://www.zerodayinitiative.com/advisories/ZDI-09-022]
[safari-webkit-svglist-bo(50477)]
[oval:org.mitre.oval:def:11584]
[USN-823-1]
[FEDORA-2009-6166]
[FEDORA-2009-8039]
[FEDORA-2009-8049]
Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3) cff/cffload.c.
[http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0545ec1ca36b27cb928128870a83e5f668980bc5]
[http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=79972af4f0485a11dcb19551356c45245749fc5b]
[http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=a18788b14db60ae3673f932249cd02d33a227c4e]
[http://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/ChangeLog]
[APPLE-SA-2009-06-08-1]
[APPLE-SA-2009-06-17-1]
[APPLE-SA-2009-05-12]
[APPLE-SA-2010-11-10-1]
[SUSE-SR:2009:010]
[GLSA-200905-05]
[270268]
[http://support.apple.com/kb/HT3549]
[http://support.apple.com/kb/HT3613]
[http://support.apple.com/kb/HT3639]
[http://support.apple.com/kb/HT4435]
[DSA-1784]
[MDVSA-2009:243]
[RHSA-2009:0329]
[RHSA-2009:1061]
[RHSA-2009:1062]
[34550]
[USN-767-1]
[TA09-133A]
[ADV-2009-1058]
[ADV-2009-1297]
[ADV-2009-1522]
[ADV-2009-1621]
[https://bugzilla.redhat.com/show_bug.cgi?id=491384]
[oval:org.mitre.oval:def:10149]
The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a scheduler request with two consecutive IPP_TAG_UNSUPPORTED tags.
[APPLE-SA-2009-09-10-2]
[SUSE-SR:2009:012]
[1022321]
[http://support.apple.com/kb/HT3865]
[http://www.coresecurity.com/content/AppleCUPS-null-pointer-vulnerability]
[DSA-1811]
[RHSA-2009:1082]
[RHSA-2009:1083]
[20090602 CORE-2009-0420 - Apple CUPS IPP_TAG_UNSUPPORTED Handling null pointer Vulnerability]
[35169]
[USN-780-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=500972]
[apple-cups-ipptag-dos(50926)]
[oval:org.mitre.oval:def:9631]
Stack-based buffer overflow in Apple iTunes before 8.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an itms: URL with a long URL component after a colon.
[APPLE-SA-2009-06-01-2]
[http://redpig.dataspill.org/2009/05/drive-by-attack-for-itunes-811.html]
[http://static.dataspill.org/releases/itunes/itms_overflow.rb]
[http://support.apple.com/kb/HT3592]
[20090602 Re: TPTI-09-03: Apple iTunes Multiple Protocol Handler Buffer Overflow Vulnerabilities]
[35157]
[1022313]
[ADV-2009-1470]
[itunes-itms-bo(50899)]
[oval:org.mitre.oval:def:17099]
[8861]
[8934]
Heap-based buffer overflow in Apple QuickTime before 7.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted FLC compression file.
[APPLE-SA-2009-06-01-1]
[http://support.apple.com/kb/HT3591]
[35161]
[1022314]
[ADV-2009-1469]
[quicktime-flc-bo(50887)]
[oval:org.mitre.oval:def:16098]
Buffer overflow in Apple QuickTime before 7.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted compressed PSD image.
[APPLE-SA-2009-06-01-1]
[http://support.apple.com/kb/HT3591]
[35168]
[1022314]
[ADV-2009-1469]
[oval:org.mitre.oval:def:15793]
Heap-based buffer overflow in Apple QuickTime before 7.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PICT image.
[APPLE-SA-2009-06-01-1]
[http://support.apple.com/kb/HT3591]
[35164]
[1022314]
[ADV-2009-1469]
[quicktime-pictfile-bo(50890)]
[oval:org.mitre.oval:def:15939]
Heap-based buffer overflow in Apple QuickTime before 7.6.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a movie file containing crafted Clipping Region (CRGN) atom types.
[APPLE-SA-2009-06-01-1]
[http://support.apple.com/kb/HT3591]
[35167]
[1022314]
[ADV-2009-1469]
[quicktime-crgn-bo(50892)]
[oval:org.mitre.oval:def:15344]
Apple QuickTime before 7.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted image description atoms in an Apple video file, related to a "sign extension issue."
[APPLE-SA-2009-06-01-1]
[http://support.apple.com/kb/HT3591]
[35166]
[1022314]
[ADV-2009-1469]
[quicktime-image-description-code-exec(50895)]
[oval:org.mitre.oval:def:16159]
Apple QuickTime before 7.6.2 does not properly initialize memory before use in handling movie files, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a movie containing a user data atom of size zero.
[APPLE-SA-2009-06-01-1]
[http://support.apple.com/kb/HT3591]
[35162]
[1022314]
[ADV-2009-1469]
[quicktime-userdata-code-execution(50896)]
[oval:org.mitre.oval:def:16188]
Heap-based buffer overflow in Apple QuickTime before 7.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JP2 image.
[APPLE-SA-2009-06-01-1]
[http://support.apple.com/kb/HT3591]
[35165]
[1022314]
[ADV-2009-1469]
[quicktime-jp2-bo(50898)]
[oval:org.mitre.oval:def:16155]
Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 stores an exception for a hostname when the user accepts an untrusted Exchange server certificate, which causes it to be accepted without prompting in future usage and allows remote Exchange servers to obtain sensitive information such as credentials.
[APPLE-SA-2009-06-17-1]
[http://support.apple.com/kb/HT3639]
[35414]
[35447]
[ADV-2009-1621]
[iphone-ipod-certificate-info-disclosure(51208)]
The MPEG-4 video codec in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to cause a denial of service (device reset) via a crafted MPEG-4 video file that triggers an "input validation issue."
[APPLE-SA-2009-06-17-1]
[http://support.apple.com/kb/HT3639]
[35414]
[35433]
[ADV-2009-1621]
[ipod-iphone-mpeg4-dos(51211)]
The Mail component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 does not provide an option to disable remote image loading in HTML email, which allows remote attackers to determine the device address and when an e-mail is read via an HTML email containing an image URL.
[APPLE-SA-2009-06-17-1]
[http://support.apple.com/kb/HT3639]
[35414]
[35434]
[ADV-2009-1621]
[iphone-ipod-mail-weak-security(51209)]
The Mail component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 dismisses the call approval dialog when another alert appears, which might allow remote attackers to force the iPhone to place a call without user approval by causing an application to trigger an alert.
[APPLE-SA-2009-06-17-1]
[http://support.apple.com/kb/HT3639]
[35414]
[ADV-2009-1621]
[iphone-ipod-mail-security-bypass(51210)]
Unspecified vulnerability in Futomi's CGI Cafe MP Form Mail CGI eCommerce 1.3.0 and earlier, and CGI Professional 3.2.2 and earlier, allows remote attackers to gain administrative privileges via unknown attack vectors.
[JVN#84899898]
[JVNDB-2009-000014]
[http://www.futomi.com/library/info/2009/20090310.html]
[34071]
[mpformmailcgi-ecom-unspecified-sec-bypass(49179)]
[mpformmailcgi-pro-unspecified-sec-bypass(49180)]
Multiple SQL injection vulnerabilities in PHPRunner 4.2, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the SearchField parameter to (1) UserView_list.php, (2) orders_list.php, (3) users_list.php, and (4) Administrator_list.php.
[http://www.bugreport.ir/index_63.htm]
[20090317 PHPRunner SQL Injection]
[34146]
[ADV-2009-0750]
[phprunner-searchfield-sql-injection(49278)]
[8226]
UserView_list.php in PHPRunner 4.2, and possibly earlier, stores passwords in cleartext in the database, which allows attackers to gain privileges. NOTE: this can be leveraged with a separate SQL injection vulnerability to obtain passwords remotely without authentication.
[http://www.bugreport.ir/index_63.htm]
[20090317 PHPRunner SQL Injection]
[ADV-2009-0750]
[phprunner-userview-information-disclosure(49279)]
[8226]
SQL injection vulnerability in functions/browse.php in Ganesha Digital Library (GDL) 4.0 and 4.2 allows remote attackers to execute arbitrary SQL commands via the node parameter in a browse action to gdl.php.
[34144]
[ADV-2009-0751]
[gdl-node-sql-injection(49292)]
[8228]
PHP remote file inclusion vulnerability in cross.php in YABSoft Mega File Hosting 1.2 allows remote attackers to execute arbitrary PHP code via a URL in the url parameter. NOTE: this can also be leveraged to include and execute arbitrary local files via .. (dot dot) sequences.
[34157]
[megafile-cross-file-include(49302)]
[8230]
The FTP server in Serv-U 7.0.0.1 through 7.4.0.1 allows remote authenticated users to cause a denial of service (service hang) via a large number of SMNT commands without an argument.
[34127]
[servuftp-smnt-dos(49260)]
[8212]
SQL injection vulnerability in fmoblog.php in the fMoblog plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php. NOTE: some of these details are obtained from third party information.
[34147]
[ADV-2009-0752]
[fmoblog-index-sql-injection(49296)]
[8229]
Cross-site request forgery (CSRF) vulnerability in account/settings/account/index.php in phpFoX 1.6.21 allows remote attackers to hijack the authentication of administrators for requests that change the email address via the act[update] action.
[http://packetstormsecurity.org/0903-exploits/phpfox1621-xsrf.txt]
[phpfox-email-account-csrf(49288)]
PHP remote file inclusion vulnerability in includes/class_image.php in PHP Pro Bid 6.05, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the fileExtension parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[34145]
[phpprobid-classimage-file-include(49290)]
Cross-site scripting (XSS) vulnerability in futomi's CGI Cafe Access Analyzer CGI Standard Version 3.8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
[JVN#23558374]
[JVNDB-2009-000015]
[http://www.futomi.com/library/info/2009/20090316.html]
[34123]
[ADV-2009-0737]
[cgicafe-unspecified-xss(49264)]
Unspecified vulnerability in the Workspace Manager component in Oracle Database 11.1.0.6, 11.1.0.7, 10.2.0.3, 10.2.0.4, 10.1.0.5, 9.2.0.8, and 9.2.0.8DV allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022052]
[TA09-105A]
Unspecified vulnerability in the Cluster Ready Services component in Oracle Database 10.1.0.5 allows remote attackers to affect availability via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022052]
[TA09-105A]
Unspecified vulnerability in the Portal component in Oracle Application Server 10.1.2.3 and 10.1.4.2 allows remote attackers to affect integrity via unknown vectors, a different vulnerability than CVE-2009-0983 and CVE-2009-3407.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022055]
[TA09-105A]
Unspecified vulnerability in the Workspace Manager component in Oracle Database 10.2.0.4 and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-0978.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022052]
[TA09-105A]
Unspecified vulnerability in the Workspace Manager component in Oracle Database 10.2.0.4 and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity, related to LTADM.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022052]
[TA09-105A]
Unspecified vulnerability in the Advanced Queuing component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote authenticated users to affect confidentiality and integrity, related to DBMS_AQIN. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on reliable researcher claims that this issue is SQL injection in the GRANT_TYPE_ACCESS procedure in the DBMS_AQADM_SYS package.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_aqadm_sys.html]
[20090416 SQL Injection in package DBMS_AQADM_SYS]
[34461]
[1022052]
[TA09-105A]
Unspecified vulnerability in the Workspace Manager component in Oracle Database 10.2.0.4 and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-0975.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022052]
[TA09-105A]
Unspecified vulnerability in the Resource Manager component in Oracle Database 9.2.0.8 and 9.2.0.8DV allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022052]
[TA09-105A]
Unspecified vulnerability in the SQLX Functions component in Oracle Database 10.2.0.3 and 11.1.0.6 allows remote authenticated users to affect integrity and availability, related to AGGXQIMP.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022052]
[TA09-105A]
Unspecified vulnerability in the Application Express component in Oracle Database 11.1.0.7 allows remote authenticated users to affect confidentiality, related to APEX. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on reliable researcher claims that this issue allows remote authenticated users to obtain APEX password hashes from the WWV_FLOW_USERS table via a SELECT statement.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[http://www.red-database-security.com/advisory/apex_password_hashes.html]
[20090416 Unprivileged DB users can see APEX password hashes]
[34461]
[1022052]
[TA09-105A]
[8456]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.49.19 allows remote authenticated users to affect integrity via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022057]
[TA09-105A]
Unspecified vulnerability in the Portal component in Oracle Application Server 10.1.2.3 and 10.1.4.2 allows remote attackers to affect integrity via unknown vectors, a different vulnerability than CVE-2009-0974 and CVE-2009-3407.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022055]
[TA09-105A]
Unspecified vulnerability in the Database Vault component in Oracle Database 9.2.0.8DV, 10.2.0.4, and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity, related to DBMS_SYS_SQL.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022052]
[TA09-105A]
Unspecified vulnerability in the Core RDBMS component in Oracle Database 10.1.0.5, 10.2.0.4, and 11.1.0.6 allows remote authenticated users with the IMP_FULL_DATABASE role to affect confidentiality, integrity, and availability.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022052]
[TA09-105A]
Unspecified vulnerability in the Workspace Manager component in Oracle Database 10.2.0.4 and 11.1.0.6 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022052]
[TA09-105A]
Unspecified vulnerability in the Upgrade component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[35679]
[1022560]
[ADV-2009-1900]
[oracle-database-upgrade-unspecified(51746)]
Unspecified vulnerability in the Password Policy component in Oracle Database 11.1.0.6 allows remote authenticated users to affect confidentiality via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022052]
[TA09-105A]
Unspecified vulnerability in the BI Publisher component in Oracle Application Server 5.6.2, 10.1.3.2.1, and 10.1.3.3.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-0990.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022055]
[TA09-105A]
Unspecified vulnerability in the BI Publisher component in Oracle Application Server 5.6.2, 10.1.3.2.1, and 10.1.3.3.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-0989.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022055]
[TA09-105A]
Unspecified vulnerability in the Listener component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote attackers to affect availability via unknown vectors, a different vulnerability than CVE-2009-1970.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022052]
[TA09-105A]
[oracledatabase-tnslistener-dos(50026)]
Unspecified vulnerability in the Advanced Queuing component in Oracle Database 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote authenticated users to affect confidentiality and integrity, related to DBMS_AQIN. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on reliable researcher claims that this issue is SQL injection in the DEQ_EXEJOB procedure.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_aqin.html]
[20090416 SQL Injection in package DBMS_AQIN]
[34461]
[1022052]
[TA09-105A]
Unspecified vulnerability in the OPMN component in Oracle Application Server 10.1.2.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on reliable researcher claims that this issue is a format string vulnerability that allows remote attackers to execute arbitrary code via format string specifiers in an HTTP POST URI, which are not properly handled when logging to opmn/logs/opmn.log.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[20090414 ZDI-09-017: Oracle Applications Server 10g Format String Vulnerability]
[34461]
[1022055]
[TA09-105A]
[http://www.zerodayinitiative.com/advisories/ZDI-09-017]
[oracle-appserver-opmn-unspecified(50030)]
Unspecified vulnerability in the BI Publisher component in Oracle Application Server 5.6.2, 10.1.3.2.1, 10.1.3.3.3, and 10.1.3.4 allows remote authenticated users to affect confidentiality via unknown vectors, a different vulnerability than CVE-2009-1017.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022055]
[TA09-105A]
Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 12.0.6 and 11i10CU2 allows remote attackers to affect integrity via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022056]
[TA09-105A]
Unspecified vulnerability in the BI Publisher component in Oracle Application Server 10.1.3.2.1, 10.1.3.3.3, and 10.1.3.4 allows remote authenticated users to affect confidentiality via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022055]
[TA09-105A]
Unspecified vulnerability in the Database Vault component in Oracle Database 11.1.0.6 allows remote authenticated users to affect confidentiality, related to DBMS_SYS_SQL.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022052]
[TA09-105A]
Unspecified vulnerability in the PeopleSoft Enterprise HRMS - eBenefits component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.9.18 and 9.0.8 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[TA09-105A]
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.0.6 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022056]
[TA09-105A]
The Oracle Applications Framework component in Oracle E-Business Suite 12.0.6 and 11i10CU2 uses default passwords for unspecified "FND Applications Users (not DB users)," which has unknown impact and attack vectors.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022056]
[TA09-105A]
Unspecified vulnerability in Oracle BEA WebLogic Portal 8.1 Gold through SP6 allows remote authenticated users to gain privileges via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[http://www.oracle.com/technology/deploy/security/wls-security/1001.html]
[34461]
[1022059]
[TA09-105A]
[oracle-weblogic-wls-priv-escalation(50053)]
Unspecified vulnerability in Oracle BEA WebLogic Server 10.3, 10.0 Gold through MP1, 9.2 Gold through MP3, 9.1, 9.0, 8.1 Gold through SP6, and 7.0 Gold through SP7 allows remote attackers to gain privileges via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[http://www.oracle.com/technology/deploy/security/wls-security/1002.html]
[34461]
[1022059]
[TA09-105A]
[oracle-weblogic-wls-priv-escalation2(50052)]
Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, and 9.0 allows remote attackers to affect integrity via unknown vectors related to "access to source code of web pages."
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[http://www.oracle.com/technology/deploy/security/wls-security/1003.html]
[34461]
[1022059]
[TA09-105A]
[oracle-weblogic-wls-read-source(50054)]
Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3 allows remote attackers to affect confidentiality and integrity via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022059]
[TA09-105A]
Unspecified vulnerability in the Oracle Data Service Integrator (AquaLogic Data Services Platform) component in BEA Product Suite 10.3.0, 3.2, 3.0.1, and 3.0 allows local users to affect confidentiality, integrity, and availability via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[http://www.oracle.com/technology/deploy/security/wls-security/1005.html]
[34461]
[1022059]
[TA09-105A]
Unspecified vulnerability in the JRockit component in BEA Product Suite R27.6.2 and earlier, with SDK/JRE 1.4.2, JRE/JDK 5, and JRE/JDK 6, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022059]
[TA09-105A]
Unspecified vulnerability in the Data Mining component in Oracle Database 10.2.0.4 allows remote authenticated users to affect confidentiality, integrity, and availability, related to SYS.DMP_SYS.
[http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html]
[36750]
[1023057]
[TA09-294A]
Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.2.2 and 8.3.0 allows local users to affect confidentiality, integrity, and availability, related to HTML, a different vulnerability than CVE-2009-1010.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022055]
[TA09-105A]
[http://www-01.ibm.com/support/docview.wss?uid=swg21660640]
Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.1.9 allows local users to affect confidentiality, integrity, and availability, related to HTML.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022055]
[TA09-105A]
[http://www-01.ibm.com/support/docview.wss?uid=swg21660640]
Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.2.2 and 8.3.0 allows local users to affect confidentiality, integrity, and availability, related to HTML, a different vulnerability than CVE-2009-1008.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022055]
[TA09-105A]
[http://www-01.ibm.com/support/docview.wss?uid=swg21660640]
Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.2.2 and 8.3.0 allows local users to affect confidentiality, integrity, and availability, related to HTML. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on reliable researcher claims that this issue is for multiple integer overflows in a function that parses an optional data stream within a Microsoft Office file, leading to a heap-based buffer overflow.
[20090515 Multiple Vendor Outside In Multiple Integer Overflow Vulnerabilities]
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022055]
[TA09-105A]
[http://www-01.ibm.com/support/docview.wss?uid=swg21660640]
Unspecified vulnerability in the plug-ins for Apache and IIS web servers in Oracle BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP3, 10.0 Gold through MP1, and 10.3 allows remote attackers to affect confidentiality, integrity, and availability. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow in an unspecified plug-in that parses HTTP requests, which leads to a heap-based buffer overflow.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[http://www.oracle.com/technology/deploy/security/wls-security/1012.html]
[34461]
[1022059]
[TA09-105A]
[oracle-bea-http-bo(64935)]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.49.19 allows remote attackers to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-1014.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022057]
[TA09-105A]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.49.19 allows remote attackers to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-1013.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022057]
[TA09-105A]
Unspecified vulnerability in the Core RDBMS component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.05, and 10.2.04 allows remote authenticated users to affect integrity via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[35682]
[1022560]
[ADV-2009-1900]
[oracle-database-core-rdbms-unspecified(51747)]
Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, and 7.0 SP7 allows remote authenticated users to affect confidentiality, integrity, and availability, related to IIS. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on claims from a reliable researcher that this is a stack-based buffer overflow involving an unspecified Server Plug-in and a crafted SSL certificate.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022059]
[TA09-105A]
[oracle-bea-ssl-bo(64934)]
Unspecified vulnerability in the BI Publisher component in Oracle Application Server 5.6.2, 10.1.3.2.1, 10.1.3.3.3, and 10.1.3.4 allows remote authenticated users to affect confidentiality via unknown vectors, a different vulnerability than CVE-2009-0994.
[http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html]
[34461]
[1022055]
[TA09-105A]
Unspecified vulnerability in the Workspace Manager component in Oracle Database 10.2.0.4 allows remote authenticated users to affect confidentiality and integrity, related to SYS.LTRIC (WMSYS.LTRIC).
[http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html]
[36765]
[1023057]
[TA09-294A]
Unspecified vulnerability in the Network Authentication component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[35680]
[1022560]
[ADV-2009-1900]
[oracle-database-netauth-unspecified(51748)]
Unspecified vulnerability in the Network Foundation component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[35684]
[1022560]
[ADV-2009-1900]
[oracle-database-netfoundation-unspecified(51749)]
Unspecified vulnerability in the Advanced Replication component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[35685]
[1022560]
[ADV-2009-1900]
[oracle-database-adv-replication-unspecified(51750)]
Heap-based buffer overflow in the Preview/ Set Segment function in Gretech GOMlab GOM Encoder 1.0.0.11 and earlier allows user-assisted remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a long text field in a subtitle (.srt) file.
[http://security.bkis.vn/?p=352]
[20090316 [Bkis-04-2009] GOM Encoder Heap-based Buffer Overflow]
[34120]
[ADV-2009-0735]
[gomencoder-srt-bo(49252)]
[8225]
SQL injection vulnerability in index.php in phpComasy 0.9.1 allows remote attackers to execute arbitrary SQL commands via the entry_id parameter.
[34131]
[ADV-2009-0734]
[phpcomasy-entryid-sql-injection(49268)]
[8220]
Multiple SQL injection vulnerabilities in Beerwin PHPLinkAdmin 1.0 allow remote attackers to execute arbitrary SQL commands via the linkid parameter to edlink.php, and unspecified other vectors.
[34129]
[ADV-2009-0733]
[phplinkadmin-edlink-sql-injection(49265)]
[8216]
PHP remote file inclusion vulnerability in linkadmin.php in Beerwin PHPLinkAdmin 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
[34129]
[ADV-2009-0733]
[phplinkadmin-edlink-sql-injection(49265)]
[8216]
Multiple SQL injection vulnerabilities in login.php in Kim Websites 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
[34116]
[ADV-2009-0732]
[kimwebsites-login-sql-injection(49259)]
[8209]
SQL injection vulnerability in OpenCart 1.1.8 allows remote attackers to execute arbitrary SQL commands via the order parameter.
[http://www.ngenuity.org/wordpress/2009/03/10/ngenuity-2009-005-opencart-order-by-blind-sql-injection/]
[20090316 NGENUITY-2009-005 OpenCart Order By Blind SQL Injection]
[34121]
[opencart-order-sql-injection(49262)]
Stack-based buffer overflow in ediSys eZip Wizard 3.0 allows remote attackers to execute arbitrary code via a crafted .zip file.
[8217]
[34044]
[ezipwizard-zip-bo(49148)]
[8180]
Stack-based buffer overflow in POP Peeper 3.4.0.0 and earlier allows remote POP3 servers to execute arbitrary code via a long Date header, related to Imap.dll.
[http://www.krakowlabs.com/res/adv/KL0309ADV-poppeeper_date-bof.txt]
[20090312 POP Peeper 3.4.0.0 Date Remote Buffer Overflow Vulnerability]
[34093]
[poppeeper-date-bo(49215)]
[8203]
Cross-site scripting (XSS) vulnerability in the choose_primary_blog function in wp-includes/wpmu-functions.php in WordPress MU (WPMU) before 2.7 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header.
[HPSBUX02514]
[20090310 [ISecAuditors Security Advisories] WordPress MU HTTP Header XSS Vulnerability]
[34075]
[1021838]
[wordpressmu-wpmufunctions-xss(49184)]
[8196]
Directory traversal vulnerability in the FTP server in Rhino Software Serv-U File Server 7.0.0.1 through 7.4.0.1 allows remote attackers to create arbitrary directories via a \.. (backslash dot dot) in an MKD request.
[34125]
[ADV-2009-0738]
[servuftp-mkd-dir-traversal(49258)]
[8211]
SQL injection vulnerability in gallery_list.php in YABSoft Advanced Image Hosting (AIH) Script 2.3 allows remote attackers to execute arbitrary SQL commands via the gal parameter.
[34176]
[advancedimage-gallerylist-sql-injection(49316)]
[8238]
SQL injection vulnerability in misc.php in DeluxeBB 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the qorder parameter, a different vector than CVE-2005-2989 and CVE-2006-2503.
[34174]
[deluxebb-qorder-sql-injection(49313)]
[8240]
SQL injection vulnerability in the Tasklist module 5.x-1.x before 5.x-1.3 and 5.x-2.x before 5.x-2.0-alpha1, a module for Drupal, allows remote attackers to execute arbitrary SQL commands via values in the URI.
[http://drupal.org/node/406316]
[34171]
[tasklist-unspecifed-sql-injection(49320)]
Cross-site scripting (XSS) vulnerability in the Tasklist module 5.x-1.x before 5.x-1.3 and 5.x-2.x before 5.x-2.0-alpha1, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via Cascading Style Sheets (CSS).
[http://drupal.org/node/406316]
[34170]
[tasklist-css-xss(49319)]
Cross-site request forgery (CSRF) vulnerability in the Plus 1 module before 6.x-2.6, a module for Drupal, allows remote attackers to cast votes for content via unspecified aspects of the URI.
[http://drupal.org/node/405672]
[http://drupal.org/node/406314]
[34168]
[plus1-unspecified-csrf(49310)]
Unspecified vulnerability in the Send by e-mail module in the "Printer, e-mail and PDF versions" module 5.x before 5.x-4.4 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to send unlimited spam messages via unknown vectors related to the flood control API.
[http://drupal.org/node/406516]
[34173]
Multiple SQL injection vulnerabilities in YAP Blog 1.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) image_id parameter to comments.php, and remote authenticated administrators to execute arbitrary SQL commands via the (2) user parameter in a modif action to admin/index.php.
[34274]
[8217]
Buffer overflow in CDex 1.70b2 allows remote attackers to execute arbitrary code via a crafted Info header in an Ogg Vorbis (.ogg) file.
[http://retrogod.altervista.org/9sg_cdex_ogg.html]
[20090317 CDex v1.70b2 (.ogg) local buffer overflow exploit poc]
[34164]
[cdex-ogg-bo(49304)]
[8231]
Buffer overflow in WinAsm Studio 5.1.5.0 allows user-assisted remote attackers to execute arbitrary code via a crafted project (.wap) file.
[34132]
[winasmstudio-wap-bo(49266)]
[8224]
The ktimer feature (sys/kern/kern_time.c) in FreeBSD 7.0, 7.1, and 7.2 allows local users to overwrite arbitrary kernel memory via an out-of-bounds timer value.
[FreeBSD-SA-09:06]
[34196]
[1021882]
[freebsd-ktimer-memory-overwrite(49362)]
[8261]
Unspecified vulnerability in Apple Safari on Mac OS X 10.5.6 allows remote attackers to execute arbitrary code via unknown vectors triggered by clicking on a link, as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009.
[http://blogs.zdnet.com/security/?p=2934]
[http://cansecwest.com/index.html]
[http://dvlabs.tippingpoint.com/blog/2009/02/25/pwn2own-2009]
[http://dvlabs.tippingpoint.com/blog/2009/03/18/pwn2own-2009-day-1---safari-internet-explorer-and-firefox-taken-down-by-four-zero-day-exploits]
[http://news.cnet.com/8301-1009_3-10199652-83.html]
[http://twitter.com/tippingpoint1/status/1351485521]
[http://www.h-online.com/security/Pwn2Own-2009-Safari-IE-8-and-Firefox-exploited--/news/112889]
[34183]
[1021879]
[apple-safari-unspecified-code-execution(49388)]
Unspecified vulnerability in Microsoft Internet Explorer 8 on Windows 7 allows remote attackers to execute arbitrary code via unknown vectors triggered by clicking on a link, as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009.
[http://blogs.zdnet.com/security/?p=2934]
[http://cansecwest.com/index.html]
[http://dvlabs.tippingpoint.com/blog/2009/02/25/pwn2own-2009]
[http://dvlabs.tippingpoint.com/blog/2009/03/18/pwn2own-2009-day-1---safari-internet-explorer-and-firefox-taken-down-by-four-zero-day-exploits]
[http://dvlabs.tippingpoint.com/blog/2009/03/20/pwn2own-day-2]
[http://news.cnet.com/8301-1009_3-10199652-83.html]
[http://www.h-online.com/security/Pwn2Own-2009-Safari-IE-8-and-Firefox-exploited--/news/112889]
[34182]
[1021880]
[microsoft-ie-unspecified-code-execution(49389)]
Mozilla Firefox 3.0.7 on Windows 7 allows remote attackers to execute arbitrary code via unknown vectors related to the _moveToEdgeShift XUL tree method, which triggers garbage collection on objects that are still in use, as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009.
[http://blogs.zdnet.com/security/?p=2934]
[http://blogs.zdnet.com/security/?p=2941]
[http://cansecwest.com/index.html]
[http://dvlabs.tippingpoint.com/blog/2009/02/25/pwn2own-2009]
[http://dvlabs.tippingpoint.com/blog/2009/03/18/pwn2own-2009-day-1---safari-internet-explorer-and-firefox-taken-down-by-four-zero-day-exploits]
[SUSE-SA:2009:022]
[http://news.cnet.com/8301-1009_3-10199652-83.html]
[http://support.avaya.com/elmodocs2/security/ASA-2009-113.htm]
[http://twitter.com/tippingpoint1/status/1351635812]
[DSA-1756]
[http://www.h-online.com/security/Pwn2Own-2009-Safari-IE-8-and-Firefox-exploited--/news/112889]
[MDVSA-2009:084]
[http://www.mozilla.org/security/announce/2009/mfsa2009-13.html]
[RHSA-2009:0397]
[RHSA-2009:0398]
[20090330 ZDI-09-015: Mozilla Firefox XUL _moveToEdgeShift() Memory Corruption Vulnerability]
[34181]
[1021878]
[USN-745-1]
[ADV-2009-0864]
[http://www.zerodayinitiative.com/advisories/ZDI-09-015]
[https://bugzilla.mozilla.org/show_bug.cgi?id=484320]
[oval:org.mitre.oval:def:11368]
[FEDORA-2009-3099]
[FEDORA-2009-3100]
[FEDORA-2009-3101]
requests/status.xml in VLC 0.9.8a allows remote attackers to cause a denial of service (stack consumption and crash) via a long input argument in an in_play action.
[http://bugs.gentoo.org/show_bug.cgi?id=262708]
[[oss-security] 20090317 CVE request -- firefox, vlc, WeeChat]
[34126]
[vlcmediaplayer-web-status-bo(49249)]
[oval:org.mitre.oval:def:14357]
[8213]
The console selection feature in the Linux kernel 2.6.28 before 2.6.28.4, 2.6.25, and possibly earlier versions, when the UTF-8 console is used, allows physically proximate attackers to cause a denial of service (memory corruption) by selecting a small number of 3-byte UTF-8 characters, which triggers an "off-by-two memory error." NOTE: it is not clear whether this issue crosses privilege boundaries.
[[linux-kernel] 20090130 [PATCH] Fix memory corruption in console selection]
[[linux-kernel] 20090202 Re: [PATCH] Fix memory corruption in console selection]
[DSA-1787]
[DSA-1800]
[http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.4]
[[oss-security] 20090212 Re: http://www.securityfocus.com/bid/33672/info kernel]
[[oss-security] 20090212 Re: http://www.securityfocus.com/bid/33672/info kernel issue]
[[oss-security] 20090212 http://www.securityfocus.com/bid/33672/info kernel issue]
[RHSA-2009:0451]
[33672]
[USN-751-1]
Cross-site scripting (XSS) vulnerability in the Send by e-mail module in the "Printer, e-mail and PDF versions" module 5.x before 5.x-4.4 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via vectors involving outbound HTML e-mail.
[http://drupal.org/node/406516]
The web interface on the snom VoIP phones snom 300, snom 320, snom 360, snom 370, and snom 820 with firmware 6.5 before 6.5.20, 7.1 before 7.1.39, and 7.3 before 7.3.14 allows remote attackers to bypass authentication, and reconfigure the phone or make arbitrary use of the phone, via a (1) http or (2) https request with 127.0.0.1 in the Host header.
[http://www.csnc.ch/misc/files/advisories/cve-2009-1048.txt]
[20090812 Authentication Bypass of Snom Phone Web Interface]
[snom-httphost-security-bypass(52424)]
SQL injection vulnerability in articleCall.php in Bloginator 1A allows remote attackers to execute arbitrary SQL commands via the id parameter.
[34187]
[bloginator-articlecall-sql-injection(49325)]
[8243]
[8244]
Bloginator 1A allows remote attackers to bypass authentication and gain administrative access by setting the identifyYourself cookie.
[34187]
[bloginator-cookie-security-bypass(49324)]
[8243]
FubarForum 1.6 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user credentials via a direct request for user.tsv.
[http://e-rdc.org/v1/news.php?readmore=131]
[20090317 [ECHO_ADV_107$2009] FubarForum <= 1.6 Critical File Disclosure Vulnerability]
FireAnt 1.3 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user credentials via a direct request for user.tsv.
Additional information available at:
http://secunia.com/advisories/34359/
[http://e-rdc.org/v1/news.php?readmore=130]
[20090317 [ECHO_ADV_106$2009] FireAnt <= 1.3 Critical File Disclosure Vulnerability]
chaozzDB 1.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user credentials via a direct request for user.tsv.
[http://e-rdc.org/v1/news.php?readmore=129]
[20090317 [ECHO_ADV_105$2009] chaozzDB <= 1.2 Critical File Disclosure Vulnerability]
Unspecified vulnerability in JustSystems Ichitaro 13, 2004 through 2008, Lite2, and Ichitaro viewer 5.1.5.0 and earlier allows remote attackers to execute arbitrary code via a crafted file, as exploited in the wild by Trojan.Tarodrop.H in March 2009.
[http://www.justsystems.com/jp/info/js09001.html]
[34138]
[http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-031608-2424-99]
[ADV-2009-0769]
[ichitaro-webpuraguinbyua-code-execution(49280)]
Unspecified vulnerability in the web service in Sitecore CMS 5.3.1 rev. 071114 allows remote authenticated users to gain access to security databases, and obtain administrative and user credentials, via unknown vectors related to SOAP and XML requests.
[http://sdn5.sitecore.net/Products/Sitecore%20V5/Sitecore%20CMS%205,-d-,3/ReleaseNotes/V5,-d-,3,-d-,2/ChangeLog.aspx]
[20090317 Sitecore .NET 5.3.x - web service information disclosure]
[34162]
[ADV-2009-0753]
[sitecore-web-service-info-disclosure(49298)]
IBM Rational AppScan Enterprise before 5.5 FP1 allows remote attackers to read arbitrary exported reports by "forcefully browsing."
[34163]
[1021863]
[ADV-2009-0768]
[PK79991]
MicroSmarts Enterprise ZipItFast! 3.0 allows remote attackers to execute arbitrary code via a crafted .zip file that triggers memory corruption, related to a "format string buffer overflow." NOTE: CVE has not investigated whether the specified file.zip file can be used for exploitation of this product.
[zipitfast-zip-bo(49491)]
[8180]
Stack-based buffer overflow in ZipGenius might allow remote attackers to execute arbitrary code via a crafted .zip file that triggers an SEH overwrite. NOTE: it is possible that this overlaps CVE-2005-3317. NOTE: CVE has not investigated whether the specified file.zip file can be used for exploitation of this product.
[zipgenius-zip-bo(49490)]
[8180]
Stack-based buffer overflow in Trident PowerZip 7.2 might allow remote attackers to execute arbitrary code via a crafted .zip file. NOTE: CVE has not investigated whether the specified file.zip file can be used for exploitation of this product.
[powerzip-zip-bo(49492)]
[8180]
Unspecified vulnerability in Apple Safari on Mac OS X 10.5.6 allows remote attackers to execute arbitrary code via unknown vectors triggered by clicking on a link, as demonstrated by Charlie Miller during a PWN2OWN competition at CanSecWest 2009.
[http://cansecwest.com/index.html]
[http://dvlabs.tippingpoint.com/blog/2009/02/25/pwn2own-2009]
[http://dvlabs.tippingpoint.com/blog/2009/03/18/pwn2own-2009-day-1---safari-internet-explorer-and-firefox-taken-down-by-four-zero-day-exploits]
[http://news.cnet.com/8301-1009_3-10199652-83.html]
[http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9129978]
[34179]
[1021879]
[apple-safari-unspecified-code-execution1(49463)]
Unspecified vulnerability in Adobe Acrobat Reader 9 before 9.1, 8 before 8.1.4, and 7 before 7.1.1 might allow remote attackers to execute arbitrary code via unknown attack vectors related to JBIG2 and "input validation," a different vulnerability than CVE-2009-0193 and CVE-2009-1062.
[SUSE-SA:2009:014]
[SUSE-SR:2009:009]
[GLSA-200904-17]
[256788]
[http://www.adobe.com/support/security/bulletins/apsb09-04.html]
[RHSA-2009:0376]
[34229]
[1021892]
[ADV-2009-1019]
Adobe Acrobat Reader 9 before 9.1, 8 before 8.1.4, and 7 before 7.1.1 might allow remote attackers to trigger memory corruption and possibly execute arbitrary code via unknown attack vectors related to JBIG2, a different vulnerability than CVE-2009-0193 and CVE-2009-1061.
[SUSE-SA:2009:014]
[SUSE-SR:2009:009]
[GLSA-200904-17]
[256788]
[http://www.adobe.com/support/security/bulletins/apsb09-04.html]
[http://www.ivizsecurity.com/security-advisory-iviz-sr-09001.html]
[RHSA-2009:0376]
[34229]
[1021892]
[ADV-2009-1019]
Buffer overflow in eXeScope 6.50 allows user-assisted remote attackers to execute arbitrary code via a crafted executable (.exe) file.
[34219]
[ADV-2009-0821]
[exescope-exe-bo(49379)]
[8270]
Argument injection vulnerability in orbitmxt.dll 2.1.0.2 in the Orbit Downloader 2.8.7 and earlier ActiveX control allows remote attackers to overwrite arbitrary files via whitespace and a command-line switch, followed by a full pathname, in the third argument to the download method.
[34200]
[http://www.waraxe.us/advisory-73.html]
[orbitdownloader-activex-file-deletion(49353)]
[8257]
SQL injection vulnerability in index.php in Pixie CMS 1.01a allows remote attackers to execute arbitrary SQL commands via the x parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[pixiecms-index-sql-injection(49334)]
SQL injection vulnerability in the referral function in admin/lib/lib_logs.php in Pixie CMS 1.01a allows remote attackers to execute arbitrary SQL commands via the Referer HTTP header in a request.
[20090319 Pixie CMS Multiple Vulnerabilities]
[http://lampsecurity.org/Pixie-CMS-Multiple-Vulnerabilities]
[34189]
[pixiecms-referral-sql-injection(49335)]
[8252]
Cross-site scripting (XSS) vulnerability in index.php in Pixie CMS 1.01a allows remote attackers to inject arbitrary web script or HTML via the x parameter.
[20090319 Pixie CMS Multiple Vulnerabilities]
[http://lampsecurity.org/Pixie-CMS-Multiple-Vulnerabilities]
[34189]
[pixiecms-index-xss(49333)]
[8252]
Stack-based buffer overflow in BS.Player (bsplayer) 2.32 Build 975 Free and 2.34 Build 980 PRO and earlier allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a long hostname in a .bsl playlist file.
[http://retrogod.altervista.org/9sg_bsplayer_seh.html]
[20090320 Bs.Player <= 2.34 Build 980 (.bsl) local buffer overflow 0day exploit (seh)]
[34190]
[ADV-2009-0800]
[bsplayer-bsl-bo(49342)]
[8249]
[8251]
Multiple cross-site scripting (XSS) vulnerabilities in the node edit form feature in Drupal Content Construction Kit (CCK) 6.x before 6.x-2.2, a module for Drupal, allow remote attackers to inject arbitrary web script or HTML via the (1) titles of candidate referenced nodes in the Node reference sub-module and the (2) names of candidate referenced users in the User reference sub-module.
[http://drupal.org/node/406520]
[34172]
[cck-node-user-xss(49317)]
Cross-site scripting (XSS) vulnerability in system/index.php in ExpressionEngine 1.6.4 through 1.6.6, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the avatar parameter.
[http://expressionengine.com/docs/changelog.html#v167]
[http://www.ngenuity.org/wordpress/2009/01/28/ngenuity-2009-003-expressionengine-persistent-cross-site-scripting/]
[20090322 ExpressionEngine Persistent Cross-Site Scripting]
[34193]
[expressionengine-avatar-xss(49359)]
Stack-based buffer overflow in Icarus 2.0 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted Portable Game Notation (.pgn) file.
[34167]
[icarus-pgn-bo(49309)]
[8236]
nfsd in the Linux kernel before 2.6.28.9 does not drop the CAP_MKNOD capability before handling a user request in a thread, which allows local users to create device nodes, as demonstrated on a filesystem that has been exported with the root_squash option.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=76a67ec6fb79ff3570dcb5342142c16098299911]
[SUSE-SA:2009:021]
[SUSE-SA:2009:028]
[SUSE-SA:2009:030]
[SUSE-SA:2009:031]
[[linux-kernel] 20090311 VFS, NFS security bug? Should CAP_MKNOD and CAP_LINUX_IMMUTABLE be added to CAP_FS_MASK?]
[DSA-1800]
[http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.9]
[[oss-security] 20090323 CVE request: kernel: nfsd did not drop CAP_MKNOD for non-root]
[RHSA-2009:1081]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[34205]
[USN-793-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-0802]
[ADV-2009-3316]
[linux-kernel-capmknod-security-bypass(49356)]
[oval:org.mitre.oval:def:10314]
[oval:org.mitre.oval:def:8382]
nss-ldapd before 0.6.8 uses world-readable permissions for the /etc/nss-ldapd.conf file, which allows local users to obtain a cleartext password for the LDAP server by reading the bindpw field.
[http://arthurenhella.demon.nl/viewvc/nss-ldapd/nss-ldapd/debian/libnss-ldapd.postinst?r1=795&r2=813]
[http://arthurenhella.demon.nl/viewvc/nss-ldapd/nss-ldapd/man/nss-ldapd.conf.5.xml?r1=805&r2=806]
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=520476]
[http://ch.tudelft.nl/~arthur/nss-ldapd/news.html#20090322]
[http://launchpad.net/bugs/cve/2009-1073]
[DSA-1758]
[[oss-security] 20090323 CVE request -- ucd-snmp / net-snmp, libnss-ldapd / nss_ldap]
[[oss-security] 20090324 Re: CVE request -- ucd-snmp / net-snmp, libnss-ldapd / nss_ldap]
[[oss-security] 20090324 Re: CVE request -- ucd-snmp / net-snmp, libnss-ldapd / nss_ldap]
[[oss-security] 20090324 Re: CVE request -- ucd-snmp / net-snmp, libnss-ldapd / nss_ldap]
[34211]
Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not use SSL in all expected circumstances, which makes it easier for remote attackers to obtain sensitive information by sniffing the network, related to "ssl termination devices" and lack of support for relative URLs.
[http://blogs.sun.com/security/entry/sun_alert_253267_sun_java]
[1021881]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1]
[253267]
[34191]
[ADV-2009-0797]
Sun Java System Identity Manager (IdM) 7.0 through 8.0 responds differently to failed use of the Forgot Password feature depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
[http://blogs.sun.com/security/entry/sun_alert_253267_sun_java]
[1021881]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-140936-01-1]
[253267]
[34191]
[ADV-2009-0797]
Sun Java System Identity Manager (IdM) 7.0 through 8.0 responds differently to failed use of the end-user question-based login feature depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
[http://blogs.sun.com/security/entry/sun_alert_253267_sun_java]
[1021881]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-137621-11-1]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-140936-01-1]
[253267]
[34191]
[ADV-2009-0797]
The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge property setting, which allows remote authenticated users to change the passwords of other users, as demonstrated by changing the administrator's password.
[http://blogs.sun.com/security/entry/sun_alert_253267_sun_java]
[1021881]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-137621-11-1]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-140936-01-1]
[253267]
[34191]
[ADV-2009-0797]
Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the expected privilege requirements for (1) deleting audit policies and (2) modifying workflows, which allows remote authenticated users to have an unspecified impact.
[http://blogs.sun.com/security/entry/sun_alert_253267_sun_java]
[1021881]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1]
[253267]
[34191]
[ADV-2009-0797]
Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager (IdM) 7.0 through 8.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug IDs 19659, 19660, and 19683.
[http://blogs.sun.com/security/entry/sun_alert_253267_sun_java]
[1021881]
[253267]
[34191]
[ADV-2009-0797]
Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager (IdM) 7.0 through 8.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID 19033.
[http://blogs.sun.com/security/entry/sun_alert_253267_sun_java]
[1021881]
[253267]
[34191]
[ADV-2009-0797]
Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager (IdM) 7.0 through 8.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug IDs 19595 and 19661.
[http://blogs.sun.com/security/entry/sun_alert_253267_sun_java]
[1021881]
[253267]
[34191]
[ADV-2009-0797]
Sun Java System Identity Manager (IdM) 7.0 through 8.0 allows remote authenticated users to gain privileges by submitting crafted commands to the Admin Console, as demonstrated by privileges for account creation and other administrative capabilities, related to the saveNoValidate action and saveNoValidateAllowedFormsAndWorkflows IDs.
[http://blogs.sun.com/security/entry/sun_alert_253267_sun_java]
[1021881]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-137621-11-1]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-140936-01-1]
[253267]
[34191]
[ADV-2009-0797]
Sun Java System Identity Manager (IdM) 7.0 through 8.0 on Linux, AIX, Solaris, and HP-UX permits "control characters" in the passwords of user accounts, which allows remote attackers to execute arbitrary commands via vectors involving "resource adapters."
[http://blogs.sun.com/security/entry/sun_alert_253267_sun_java]
[1021881]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1]
[253267]
[34191]
[ADV-2009-0797]
Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not properly restrict access to the System Configuration object, which allows remote authenticated administrators and possibly remote attackers to have an unspecified impact by modifying this object.
[http://blogs.sun.com/security/entry/sun_alert_253267_sun_java]
[1021881]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1]
[253267]
[34191]
[ADV-2009-0797]
[jsim-sco-unspecified(49607)]
Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the API key and other sensitive information via a direct request for misc/cron/archive.sh.
[http://dev.piwik.org/trac/ticket/599]
[http://marco-ziesing.de/archives/35-Schluesselloch-in-Piwik.html]
[[oss-security] 20090323 CVE request: API key disclosure in piwik]
Heap-based buffer overflow in the ldns_rr_new_frm_str_internal function in ldns 1.4.x allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a DNS resource record (RR) with a long (1) class field (clas variable) and possibly (2) TTL field.
[SUSE-SR:2009:010]
[DSA-1795]
[http://www.nlnetlabs.nl/bugs/show_bug.cgi?id=232]
[http://www.nlnetlabs.nl/svn/ldns/tags/release-1.5.0/Changelog]
[[oss-security] 20090324 CVE id request: ldns]
[34233]
Multiple argument injection vulnerabilities in PPLive.exe in PPLive 1.9.21 and earlier allow remote attackers to execute arbitrary code via a UNC share pathname in the LoadModule argument to the (1) synacast, (2) Play, (3) pplsv, or (4) ppvod URI handler. NOTE: some of these details are obtained from third party information.
[ADV-2009-0739]
[pplive-uri-code-execution(49263)]
[8215]
Hannon Hill Cascade Server 5.7 and other versions allows remote authenticated users to execute arbitrary programs or Java code via a crafted XSLT stylesheet with "extension elements and extension functions" that trigger code execution by Xalan-Java, as demonstrated using xalan://java.lang.Runtime.
[20090319 Command Execution in Hannon Hill Cascade Server]
[34186]
[cascadeserver-xlst-command-execution(49332)]
[8247]
Absolute path traversal vulnerability in upload.php in Rapidleech rev.36 and earlier allows remote attackers to read arbitrary files via a base64-encoded absolute path in the filename parameter.
[20090314 [Bkis-03-2009] Multiple Vulnerabilities found in Rapidleech rev.36]
[34119]
[rapidleech-filename-info-disclosure(49253)]
Directory traversal vulnerability in upload.php in Rapidleech rev.36 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the uploaded parameter.
[http://security.bkis.vn/?p=345]
[20090314 [Bkis-03-2009] Multiple Vulnerabilities found in Rapidleech rev.36]
[34119]
[rapidleech-uploaded-file-include(49256)]
Cross-site scripting (XSS) vulnerability in upload.php in Rapidleech rev.36 and earlier allows remote attackers to inject arbitrary web script or HTML via the uploaded parameter.
[20090314 [Bkis-03-2009] Multiple Vulnerabilities found in Rapidleech rev.36]
[34119]
[rapidleech-upload-xss(49257)]
Use-after-free vulnerability in the LIVEAUDIO.LiveAudioCtrl.1 ActiveX control in LIVEAU~1.OCX 7.0 for GeoVision DVR systems allows remote attackers to execute arbitrary code by calling the GetAudioPlayingTime method with certain arguments.
[http://retrogod.altervista.org/9sg_geovision_liveaudio_freedmem.html]
[20090313 GeoVision LiveAudio ActiveX Control GetAudioPlayingTime() remote freed-memory access exploit]
[34115]
[geovision-liveaudio-activex-dos(49238)]
[8206]
LdapCtx in the LDAP service in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.1_24 and earlier; and 1.4.2_19 and earlier does not close the connection when initialization fails, which allows remote attackers to cause a denial of service (LDAP service hang).
[SSRT090058]
[SUSE-SA:2009:016]
[SUSE-SA:2009:029]
[SUSE-SR:2009:011]
[SUSE-SA:2009:036]
[HPSBUX02429]
[GLSA-200911-02]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-118667-19-1]
[254569]
[http://support.avaya.com/elmodocs2/security/ASA-2009-108.htm]
[http://support.avaya.com/elmodocs2/security/ASA-2009-109.htm]
[DSA-1769]
[MDVSA-2009:137]
[MDVSA-2009:162]
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[RHSA-2009:0392]
[RHSA-2009:0394]
[RHSA-2009:1038]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[34240]
[1021893]
[USN-748-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-1426]
[ADV-2009-3316]
[oval:org.mitre.oval:def:11343]
[oval:org.mitre.oval:def:6676]
[RHSA-2009:0377]
[RHSA-2009:1198]
Unspecified vulnerability in the LDAP implementation in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.1_24 and earlier; and 1.4.2_19 and earlier allows remote LDAP servers to execute arbitrary code via unknown vectors related to serialized data.
[SSRT090058]
[SUSE-SA:2009:016]
[SUSE-SA:2009:029]
[SUSE-SR:2009:011]
[SUSE-SA:2009:036]
[HPSBUX02429]
[GLSA-200911-02]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-118667-19-1]
[254569]
[http://support.avaya.com/elmodocs2/security/ASA-2009-108.htm]
[http://support.avaya.com/elmodocs2/security/ASA-2009-109.htm]
[DSA-1769]
[MDVSA-2009:137]
[MDVSA-2009:162]
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[RHSA-2009:0392]
[RHSA-2009:0394]
[RHSA-2009:1038]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[34240]
[1021893]
[USN-748-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-1426]
[ADV-2009-1900]
[ADV-2009-3316]
[oval:org.mitre.oval:def:11064]
[oval:org.mitre.oval:def:6598]
[RHSA-2009:0377]
[RHSA-2009:1198]
Integer overflow in unpack200 in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code via a JAR file with crafted Pack200 headers.
[SSRT090058]
[20090326 Sun Java Runtime Environment (JRE) Pack200 Decompression Integer Overflow Vulnerability]
[SUSE-SA:2009:016]
[SUSE-SA:2009:029]
[SUSE-SR:2009:011]
[SUSE-SA:2009:036]
[HPSBUX02429]
[GLSA-200911-02]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-125137-14-1]
[254570]
[1020225]
[http://support.avaya.com/elmodocs2/security/ASA-2009-108.htm]
[http://support.avaya.com/elmodocs2/security/ASA-2009-109.htm]
[DSA-1769]
[MDVSA-2009:137]
[MDVSA-2009:162]
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[RHSA-2009:0392]
[RHSA-2009:0394]
[RHSA-2009:1038]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[34240]
[1021894]
[USN-748-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-1426]
[ADV-2009-3316]
[oval:org.mitre.oval:def:10124]
[oval:org.mitre.oval:def:6643]
[RHSA-2009:0377]
[RHSA-2009:1198]
Buffer overflow in unpack200 in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code via a JAR file with crafted Pack200 headers.
[SSRT090058]
[SUSE-SA:2009:016]
[SUSE-SA:2009:029]
[SUSE-SR:2009:011]
[SUSE-SA:2009:036]
[HPSBUX02429]
[GLSA-200911-02]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-125137-14-1]
[254570]
[1020225]
[http://support.avaya.com/elmodocs2/security/ASA-2009-108.htm]
[http://support.avaya.com/elmodocs2/security/ASA-2009-109.htm]
[DSA-1769]
[MDVSA-2009:137]
[MDVSA-2009:162]
[RHSA-2009:0392]
[RHSA-2009:0394]
[RHSA-2009:1038]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[34240]
[1021894]
[USN-748-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-1426]
[ADV-2009-3316]
[oval:org.mitre.oval:def:6659]
[oval:org.mitre.oval:def:8844]
[RHSA-2009:0377]
[RHSA-2009:1198]
Multiple buffer overflows in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allow remote attackers to access files or execute arbitrary code via (1) a crafted PNG image that triggers an integer overflow during memory allocation for display on the splash screen, aka CR 6804996; and (2) a crafted GIF image from which unspecified values are used in calculation of offsets, leading to object-pointer corruption, aka CR 6804997.
[SSRT090058]
[20090326 Sun Java Runtine Environment (JRE) GIF Decoding Heap Corruption Vulnerability]
[20090326 Sun Java Web Start (JWS ) PNG Decoding Integer Overflow Vulnerability]
[SUSE-SA:2009:016]
[SUSE-SA:2009:029]
[SUSE-SA:2009:036]
[HPSBUX02429]
[GLSA-200911-02]
[254571]
[http://support.avaya.com/elmodocs2/security/ASA-2009-108.htm]
[DSA-1769]
[MDVSA-2009:137]
[MDVSA-2009:162]
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[RHSA-2009:0392]
[RHSA-2009:1038]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[34240]
[1021913]
[USN-748-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-1426]
[ADV-2009-3316]
[jre-gif-file-bo(49475)]
[oval:org.mitre.oval:def:11241]
[oval:org.mitre.oval:def:6288]
[RHSA-2009:0377]
[RHSA-2009:1198]
Buffer overflow in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; 1.4.2_19 and earlier; and 1.3.1_24 and earlier allows remote attackers to access files or execute arbitrary code via a crafted GIF image, aka CR 6804998.
[SSRT090058]
[SUSE-SA:2009:016]
[SUSE-SA:2009:029]
[SUSE-SR:2009:011]
[SUSE-SA:2009:036]
[HPSBUX02429]
[GLSA-200911-02]
[254571]
[http://support.avaya.com/elmodocs2/security/ASA-2009-108.htm]
[http://support.avaya.com/elmodocs2/security/ASA-2009-109.htm]
[DSA-1769]
[MDVSA-2009:137]
[MDVSA-2009:162]
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[RHSA-2009:0392]
[RHSA-2009:0394]
[RHSA-2009:1038]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[34240]
[1021913]
[USN-748-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-1426]
[ADV-2009-3316]
[oval:org.mitre.oval:def:6008]
[oval:org.mitre.oval:def:9956]
[RHSA-2009:0377]
[RHSA-2009:1198]
Integer signedness error in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code via crafted glyph descriptions in a Type1 font, which bypasses a signed comparison and triggers a buffer overflow.
[SSRT090058]
[20090326 Sun Java Runtine Environment (JRE) Type1 Font Parsing Integer Signedness Vulnerability]
[SUSE-SA:2009:016]
[SUSE-SA:2009:029]
[SUSE-SR:2009:011]
[SUSE-SA:2009:036]
[HPSBUX02429]
[GLSA-200911-02]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-118669-19-1]
[254571]
[http://support.avaya.com/elmodocs2/security/ASA-2009-108.htm]
[http://support.avaya.com/elmodocs2/security/ASA-2009-109.htm]
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[RHSA-2009:0392]
[RHSA-2009:0394]
[RHSA-2009:1038]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[34240]
[1021913]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-1426]
[ADV-2009-3316]
[oval:org.mitre.oval:def:5726]
[RHSA-2009:1198]
Multiple unspecified vulnerabilities in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allow remote attackers to cause a denial of service (disk consumption) via vectors related to temporary font files and (1) "limits on Font creation," aka CR 6522586, and (2) another unspecified vector, aka CR 6632886.
[SSRT090058]
[SUSE-SA:2009:016]
[SUSE-SA:2009:029]
[SUSE-SR:2009:011]
[SUSE-SA:2009:036]
[HPSBUX02429]
[GLSA-200911-02]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-118667-19-1]
[254608]
[http://support.avaya.com/elmodocs2/security/ASA-2009-108.htm]
[http://support.avaya.com/elmodocs2/security/ASA-2009-109.htm]
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[RHSA-2009:0392]
[RHSA-2009:0394]
[RHSA-2009:1038]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[34240]
[1021917]
[USN-748-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-1426]
[ADV-2009-3316]
[oval:org.mitre.oval:def:6224]
[RHSA-2009:1198]
Unspecified vulnerability in the lightweight HTTP server implementation in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allows remote attackers to cause a denial of service (probably resource consumption) for a JAX-WS service endpoint via a connection without any data, which triggers a file descriptor "leak."
[SSRT090058]
[SUSE-SA:2009:016]
[SUSE-SA:2009:029]
[SUSE-SA:2009:036]
[HPSBUX02429]
[GLSA-200911-02]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-125137-14-1]
[254609]
[http://support.avaya.com/elmodocs2/security/ASA-2009-108.htm]
[DSA-1769]
[MDVSA-2009:137]
[MDVSA-2009:162]
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[RHSA-2009:0392]
[RHSA-2009:1038]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[34240]
[1021918]
[USN-748-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-1426]
[ADV-2009-3316]
[oval:org.mitre.oval:def:10152]
[oval:org.mitre.oval:def:6412]
[RHSA-2009:0377]
[RHSA-2009:1198]
Unspecified vulnerability in the Virtual Machine in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allows remote attackers to access files and execute arbitrary code via unknown vectors related to "code generation."
[SSRT090058]
[SUSE-SA:2009:016]
[SUSE-SA:2009:029]
[HPSBUX02429]
[GLSA-200911-02]
[254610]
[http://support.avaya.com/elmodocs2/security/ASA-2009-108.htm]
[MDVSA-2009:137]
[MDVSA-2009:162]
[RHSA-2009:0392]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[34240]
[1021919]
[USN-748-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-1426]
[ADV-2009-3316]
[oval:org.mitre.oval:def:10300]
[oval:org.mitre.oval:def:6722]
[RHSA-2009:0377]
Unspecified vulnerability in the Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; 1.4.2_19 and earlier; and 1.3.1_24 and earlier allows remote attackers to access files and execute arbitrary code via unknown vectors related to "deserializing applets," aka CR 6646860.
[SSRT090058]
[SUSE-SA:2009:016]
[SUSE-SR:2009:011]
[SUSE-SA:2009:036]
[HPSBUX02429]
[GLSA-200911-02]
[254611]
[http://support.avaya.com/elmodocs2/security/ASA-2009-108.htm]
[http://support.avaya.com/elmodocs2/security/ASA-2009-109.htm]
[RHSA-2009:0392]
[RHSA-2009:0394]
[RHSA-2009:1038]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[34240]
[1021920]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-1426]
[ADV-2009-3316]
[jre-javaplugin-privilege-escalation(49456)]
[oval:org.mitre.oval:def:6542]
[RHSA-2009:1198]
The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; and 1.4.2_19 and earlier does not prevent Javascript that is loaded from the localhost from connecting to other ports on the system, which allows user-assisted attackers to bypass intended access restrictions via LiveConnect, aka CR 6724331. NOTE: this vulnerability can be leveraged with separate cross-site scripting (XSS) vulnerabilities for remote attack vectors.
[SSRT090058]
[SUSE-SA:2009:016]
[SUSE-SR:2009:011]
[SUSE-SA:2009:036]
[HPSBUX02429]
[GLSA-200911-02]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-118669-19-1]
[254611]
[http://support.avaya.com/elmodocs2/security/ASA-2009-108.htm]
[http://support.avaya.com/elmodocs2/security/ASA-2009-109.htm]
[RHSA-2009:0392]
[RHSA-2009:0394]
[RHSA-2009:1038]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[34240]
[1021920]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-1426]
[ADV-2009-3316]
[jre-plugin-javascriptcode-unauthorized-access(49457)]
[oval:org.mitre.oval:def:6584]
[RHSA-2009:1198]
The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 allows user-assisted remote attackers to cause a trusted applet to run in an older JRE version, which can be used to exploit vulnerabilities in that older version, aka CR 6706490.
[SSRT090058]
[APPLE-SA-2010-05-18-1]
[SUSE-SA:2009:016]
[SUSE-SA:2009:036]
[HPSBUX02429]
[GLSA-200911-02]
[254611]
[http://support.apple.com/kb/HT4171]
[http://support.avaya.com/elmodocs2/security/ASA-2009-108.htm]
[RHSA-2009:0392]
[RHSA-2009:1038]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[34240]
[1021920]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-1426]
[ADV-2009-3316]
[ADV-2010-1191]
[jre-plugin-weak-security(49458)]
[oval:org.mitre.oval:def:6642]
[RHSA-2009:1198]
The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 does not properly parse crossdomain.xml files, which allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unknown vectors, aka CR 6798948.
[SSRT090058]
[SUSE-SA:2009:016]
[SUSE-SA:2009:036]
[HPSBUX02429]
[GLSA-200911-02]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-125137-14-1]
[254611]
[http://support.avaya.com/elmodocs2/security/ASA-2009-108.htm]
[RHSA-2009:0392]
[RHSA-2009:1038]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[34240]
[1021920]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-1426]
[ADV-2009-3316]
[jre-plugin-crossdomain-info-disclosure(49459)]
[oval:org.mitre.oval:def:6619]
[RHSA-2009:1198]
The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier, and 5.0 Update 17 and earlier, allows remote attackers to trick a user into trusting a signed applet via unknown vectors that misrepresent the security warning dialog, related to a "Swing JLabel HTML parsing vulnerability," aka CR 6782871.
[SSRT090058]
[SUSE-SA:2009:016]
[SUSE-SR:2009:011]
[SUSE-SA:2009:036]
[HPSBUX02429]
[GLSA-200911-02]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-125139-14-1]
[254611]
[http://support.avaya.com/elmodocs2/security/ASA-2009-108.htm]
[http://support.avaya.com/elmodocs2/security/ASA-2009-109.htm]
[RHSA-2009:0392]
[RHSA-2009:0394]
[RHSA-2009:1038]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[34240]
[1021920]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-1426]
[ADV-2009-3316]
[jre-plugin-signedapplet-unauth-access(49460)]
[oval:org.mitre.oval:def:6585]
[RHSA-2009:1198]
Multiple heap-based buffer overflows in EMC RepliStor 6.2 before SP5 and 6.3 before SP2 allow remote attackers to execute arbitrary code via a crafted message to (1) ctrlservice.exe or (2) rep_srv.exe, possibly related to an integer overflow.
[http://www.fortiguardcenter.com/advisory/FGA-2009-13.html]
[20090409 FGA-2009-003:EMC RepliStor Buffer Overflow Vulnerability]
[34449]
[1022026]
[ADV-2009-1018]
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS 5.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1535.
[20090616 IIS WebDav Vulnerability CVE ID]
[35232]
[1022358]
[TA09-160A]
[ADV-2009-1539]
[MS09-020]
[oval:org.mitre.oval:def:5861]
The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application, aka "Windows Kernel Desktop Vulnerability."
[1022359]
[TA09-160A]
[ADV-2009-1544]
[MS09-025]
[oval:org.mitre.oval:def:6206]
The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly validate user-mode pointers in unspecified error conditions, which allows local users to gain privileges via a crafted application, aka "Windows Kernel Pointer Validation Vulnerability."
[35238]
[1022359]
[TA09-160A]
[ADV-2009-1544]
[MS09-025]
[oval:org.mitre.oval:def:6231]
The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly validate an argument to an unspecified system call, which allows local users to gain privileges via a crafted application, aka "Windows Driver Class Registration Vulnerability."
[35240]
[1022359]
[TA09-160A]
[ADV-2009-1544]
[MS09-025]
[oval:org.mitre.oval:def:5912]
The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not properly validate the user-mode input associated with the editing of an unspecified desktop parameter, which allows local users to gain privileges via a crafted application, aka "Windows Desktop Parameter Edit Vulnerability."
[1022359]
[TA09-160A]
[ADV-2009-1544]
[MS09-025]
[oval:org.mitre.oval:def:6016]
win32k.sys in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 does not correctly validate an argument to an unspecified system call, which allows local users to gain privileges via a crafted application that triggers a NULL pointer dereference, aka "Win32k NULL Pointer Dereferencing Vulnerability."
[TA09-314A]
[MS09-065]
[oval:org.mitre.oval:def:5588]
Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allows remote attackers to execute arbitrary code via crafted sound data in a file that uses a PowerPoint 95 native file format, leading to memory corruption, aka "PP7 Memory Corruption Vulnerability," a different vulnerability than CVE-2009-1129.
[34837]
[1022205]
[TA09-132A]
[ADV-2009-1290]
[MS09-017]
[oval:org.mitre.oval:def:5416]
Multiple stack-based buffer overflows in the PowerPoint 95 importer (PP7X32.DLL) in Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allow remote attackers to execute arbitrary code via an inconsistent record length in sound data in a file that uses a PowerPoint 95 (PPT95) native file format, aka "PP7 Memory Corruption Vulnerability," a different vulnerability than CVE-2009-1128.
[20090512 Microsoft PowerPoint PPT95 Import Multiple Stack Buffer Overflow Vulnerabilities]
[34839]
[1022205]
[TA09-132A]
[ADV-2009-1290]
[MS09-017]
[oval:org.mitre.oval:def:6176]
Heap-based buffer overflow in Microsoft Office PowerPoint 2002 SP3 and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a crafted structure in a Notes container in a PowerPoint file that causes PowerPoint to read more data than was allocated when creating a C++ object, leading to an overwrite of a function pointer, aka "Heap Corruption Vulnerability."
[20090512 Microsoft PowerPoint Notes Container Heap Corruption Vulnerability]
[20090512 ZDI-09-020: Microsoft Office PowerPoint Notes Container Heap Overflow Vulnerability]
[34840]
[1022205]
[TA09-132A]
[ADV-2009-1290]
[http://www.zerodayinitiative.com/advisories/ZDI-09-020/]
[MS09-017]
[oval:org.mitre.oval:def:5961]
Multiple stack-based buffer overflows in Microsoft Office PowerPoint 2000 SP3 allow remote attackers to execute arbitrary code via a large amount of data associated with unspecified atoms in a PowerPoint file that triggers memory corruption, aka "Data Out of Bounds Vulnerability."
[20090512 Secunia Research: Microsoft PowerPoint Atom Parsing Buffer Overflows]
[34841]
[1022205]
[TA09-132A]
[ADV-2009-1290]
[MS09-017]
[oval:org.mitre.oval:def:5351]
Heap-based buffer overflow in the Wireless LAN AutoConfig Service (aka Wlansvc) in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a malformed wireless frame, aka "Wireless Frame Parsing Remote Code Execution Vulnerability."
[TA09-251A]
[MS09-049]
[oval:org.mitre.oval:def:6389]
Heap-based buffer overflow in Microsoft Remote Desktop Connection (formerly Terminal Services Client) running RDP 5.0 through 6.1 on Windows, and Remote Desktop Connection Client for Mac 2.0, allows remote attackers to execute arbitrary code via unspecified parameters, aka "Remote Desktop Connection Heap Overflow Vulnerability."
[1022709]
[TA09-223A]
[ADV-2009-2238]
[MS09-044]
[oval:org.mitre.oval:def:5693]
Excel in 2007 Microsoft Office System SP1 and SP2; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a BIFF file with a malformed Qsir (0x806) record object, aka "Record Pointer Corruption Vulnerability."
[20090610 ZDI-09-040: Microsoft Office Excel QSIR Record Pointer Corruption Vulnerability]
[35246]
[1022351]
[TA09-160A]
[ADV-2009-1540]
[http://www.zerodayinitiative.com/advisories/ZDI-09-040/]
[MS09-021]
[oval:org.mitre.oval:def:5922]
Microsoft Internet Security and Acceleration (ISA) Server 2006 Gold and SP1, when Radius OTP is enabled, uses the HTTP-Basic authentication method, which allows remote attackers to gain the privileges of an arbitrary account, and access published web pages, via vectors involving attempted access to a network resource behind the ISA Server, aka "Radius OTP Bypass Vulnerability."
[1022547]
[TA09-195A]
[ADV-2009-1889]
[MS09-031]
[oval:org.mitre.oval:def:5649]
The Microsoft Office Web Components Spreadsheet ActiveX control (aka OWC10 or OWC11), as distributed in Office XP SP3 and Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 Gold and SP1, and Office Small Business Accounting 2006, when used in Internet Explorer, allows remote attackers to execute arbitrary code via a crafted call to the msDataSourceObject method, as exploited in the wild in July and August 2009, aka "Office Web Components HTML Script Vulnerability."
[http://blogs.technet.com/msrc/archive/2009/07/13/microsoft-security-advisory-973472-released.aspx]
[http://blogs.technet.com/srd/archive/2009/07/13/more-information-about-the-office-web-components-activex-vulnerability.aspx]
[http://isc.sans.org/diary.html?storyid=6778]
[http://trac.metasploit.com/browser/framework3/trunk/modules/exploits/windows/browser/owc_spreadsheet_msdso.rb]
[http://www.microsoft.com/technet/security/advisory/973472.mspx]
[TA09-223A]
[http://xeye.us/blog/2009/07/one-0day/]
[MS09-043]
[oval:org.mitre.oval:def:5809]
Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allows remote attackers to execute arbitrary code via crafted sound data in a file that uses a PowerPoint 4.0 native file format, leading to memory corruption, aka "Legacy File Format Vulnerability," a different vulnerability than CVE-2009-0222, CVE-2009-0223, CVE-2009-0226, and CVE-2009-0227.
[34876]
[1022205]
[TA09-132A]
[ADV-2009-1290]
[MS09-017]
[powerpoint-sounddata-code-execution(50425)]
[oval:org.mitre.oval:def:5946]
The LDAP service in Active Directory on Microsoft Windows 2000 SP4 does not properly free memory for LDAP and LDAPS requests, which allows remote attackers to execute arbitrary code via a request that uses hexadecimal encoding, whose associated memory is not released, related to a "DN AttributeValue," aka "Active Directory Invalid Free Vulnerability." NOTE: this issue is probably a memory leak.
[20090611 Microsoft Active Directory Hexdecimal DN AttributeValue Invalid Free Vulnerability]
[http://support.avaya.com/elmodocs2/security/ASA-2009-214.htm]
[35226]
[1022349]
[TA09-160A]
[ADV-2009-1537]
[MS09-018]
[oval:org.mitre.oval:def:6180]
Memory leak in the LDAP service in Active Directory on Microsoft Windows 2000 SP4 and Server 2003 SP2, and Active Directory Application Mode (ADAM) on Windows XP SP2 and SP3 and Server 2003 SP2, allows remote attackers to cause a denial of service (memory consumption and service outage) via (1) LDAP or (2) LDAPS requests with unspecified OID filters, aka "Active Directory Memory Leak Vulnerability."
[http://support.avaya.com/elmodocs2/security/ASA-2009-214.htm]
[35225]
[1022349]
[TA09-160A]
[ADV-2009-1537]
[MS09-018]
[oval:org.mitre.oval:def:6253]
Microsoft Internet Explorer 5.01 SP4; 6 SP1; 6 and 7 for Windows XP SP2 and SP3; 6 and 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 does not prevent HTML rendering of cached content, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Cross-Domain Information Disclosure Vulnerability."
[1022350]
[TA09-160A]
[ADV-2009-1538]
[MS09-019]
[oval:org.mitre.oval:def:6278]
Microsoft Internet Explorer 6 for Windows XP SP2 and SP3 and Server 2003 SP2 allows remote attackers to execute arbitrary code via unspecified DHTML function calls related to a tr element and the "insertion, deletion and attributes of a table cell," which trigger memory corruption when the window is destroyed, aka "DHTML Object Memory Corruption Vulnerability."
[http://www.fortiguardcenter.com/advisory/FGA-2009-22.html]
[20090610 FortiGuard Advisory: Microsoft Internet Explorer DHTML Handling Remote Memory Corruption Vulnerability]
[1022350]
[TA09-160A]
[ADV-2009-1538]
[MS09-019]
[oval:org.mitre.oval:def:5554]
Untrusted search path vulnerability in the Gentoo package of Xpdf before 3.02-r2 allows local users to gain privileges via a Trojan horse xpdfrc file in the current working directory, related to an unset SYSTEM_XPDFRC macro in a Gentoo build process that uses the poppler library.
[http://bugs.gentoo.org/show_bug.cgi?id=200023]
[http://bugs.gentoo.org/show_bug.cgi?id=242930]
[GLSA-200904-07]
[34401]
Unspecified vulnerability in an ioctl in hcmon.sys in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, and VMware Server 1.0.x before 1.0.9 build 156507 and 2.0.x before 2.0.1 build 156745 allows local users to cause a denial of service via unknown vectors, a different vulnerability than CVE-2008-3761.
[[security-announce] 20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues]
[20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues]
[34373]
[1021977]
[http://www.vmware.com/security/advisories/VMSA-2009-0005.html]
[ADV-2009-0944]
[oval:org.mitre.oval:def:6310]
Unspecified vulnerability in vmci.sys in the Virtual Machine Communication Interface (VMCI) in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, and VMware Server 2.0.x before 2.0.1 build 156745 allows local users to gain privileges via unknown vectors.
[[security-announce] 20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues]
[20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues]
[34373]
[1021976]
[http://www.vmware.com/security/advisories/VMSA-2009-0005.html]
[ADV-2009-0944]
[oval:org.mitre.oval:def:5471]
Directory traversal vulnerability in bs_disp_as_mime_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to read arbitrary files via directory traversal sequences in the file_path parameter ($filename variable).
[SUSE-SR:2009:008]
[http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/bs_disp_as_mime_type.php?r1=12303&r2=12302&pathrev=12303]
[http://www.phpmyadmin.net/home_page/security/PMASA-2009-1.php]
CRLF injection vulnerability in bs_disp_as_mime_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the (1) c_type and possibly (2) file_type parameters.
[SUSE-SR:2009:008]
[http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/bs_disp_as_mime_type.php?r1=12303&r2=12302&pathrev=12303]
[http://www.phpmyadmin.net/home_page/security/PMASA-2009-1.php]
Multiple cross-site scripting (XSS) vulnerabilities in the export page (display_export.lib.php) in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allow remote attackers to inject arbitrary web script or HTML via the pma_db_filename_template cookie.
[SUSE-SR:2009:008]
[http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/trunk/phpMyAdmin/libraries/display_export.lib.php?r1=11986&r2=12302&pathrev=12302]
[GLSA-200906-03]
[DSA-1824]
[MDVSA-2009:115]
[http://www.phpmyadmin.net/home_page/security/PMASA-2009-2.php]
[34251]
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.
[http://labs.neohapsis.com/2009/04/06/about-cve-2009-1151/]
[SUSE-SR:2009:008]
[http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/scripts/setup.php?r1=11514&r2=12301&pathrev=12301]
[GLSA-200906-03]
[DSA-1824]
[http://www.gnucitizen.org/blog/cve-2009-1151-phpmyadmin-remote-code-execution-proof-of-concept/]
[MDVSA-2009:115]
[http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php]
[20090609 CVE-2009-1151: phpMyAdmin Remote Code Execution Proof of Concept]
[34236]
[8921]
Siemens Gigaset SE461 WiMAX router 1.5-BL024.9.6401, and possibly other versions, allows remote attackers to cause a denial of service (device restart and loss of configuration) by connecting to TCP port 53, then closing the connection.
[http://helith.net/txt/siemens_gigaset_se461_wimax_router_remote_dos.txt]
[34220]
[gigaset-se461-html-dos(49365)]
[8260]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2009. Notes: none.
Cisco IOS XR 3.8.1 and earlier allows remote attackers to cause a denial of service (process crash) via a long BGP UPDATE message, as demonstrated by a message with many AS numbers in the AS Path Attribute.
[1022756]
[20090818 Cisco IOS XR Software Border Gateway Protocol Vulnerability]
Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX Security Appliances 7.1(1) through 7.1(2)82, 7.2 before 7.2(4)27, 8.0 before 8.0(4)25, and 8.1 before 8.1(2)15, when AAA override-account-disable is entered in a general-attributes field, allow remote attackers to bypass authentication and establish a VPN session to an ASA device via unspecified vectors.
Per vendor advisory: http://www.cisco.com/en/US/products/products_security_advisory09186a0080a994f6.shtml
"VPN Authentication Bypass Vulnerability
Cisco ASA or Cisco PIX security appliances that are configured for IPsec or SSL-based remote access VPN and have the Override Account Disabled feature enabled are affected by this vulnerability.
Note: The Override Account Disabled feature was introduced in Cisco ASA software version 7.1(1). Cisco ASA and PIX software versions 7.1, 7.2, 8.0, and 8.1 are affected by this vulnerability. This feature is disabled by default. "
[20090408 Multiple Vulnerabilities in Cisco ASA Adaptive Security Appliance and Cisco PIX Security Appliances]
[34429]
[1022016]
[ADV-2009-0981]
Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5500 Series devices 8.0 before 8.0(4)25 and 8.1 before 8.1(2)15, when an SSL VPN or ASDM access is configured, allows remote attackers to cause a denial of service (device reload) via a crafted (1) SSL or (2) HTTP packet.
Per vendor advisory: http://www.cisco.com/en/US/products/products_security_advisory09186a0080a994f6.shtml
VPN Authentication Bypass Vulnerability
The Cisco ASA or Cisco PIX security appliance can be configured to override an account-disabled indication from a AAA server and allow the user to log on anyway. However, the user must provide the correct credentials in order to login to the VPN. A vulnerability exists in the Cisco ASA and Cisco PIX security appliances where VPN users can bypass authentication when the override account feature is enabled.
Note: The override account feature was introduced in Cisco ASA software version 7.1(1).
The override account feature is enabled with the override-account-disable command in tunnel-group general-attributes configuration mode, as shown in the following example. The following example allows overriding the "account-disabled" indicator from the AAA server for the WebVPN tunnel group "testgroup":
hostname(config)#tunnel-group testgroup type webvpn
hostname(config)#tunnel-group testgroup general-attributes
hostname(config-tunnel-general)#override-account-disable
Note: The override account feature is disabled by default.
[20090408 Multiple Vulnerabilities in Cisco ASA Adaptive Security Appliance and Cisco PIX Security Appliances]
[34429]
[1022015]
[ADV-2009-0981]
Memory leak on Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX Security Appliances 7.0 before 7.0(8)6, 7.1 before 7.1(2)82, 7.2 before 7.2(4)30, 8.0 before 8.0(4)28, and 8.1 before 8.1(2)19 allows remote attackers to cause a denial of service (memory consumption or device reload) via a crafted TCP packet.
Per vendor advisory: http://www.cisco.com/en/US/products/products_security_advisory09186a0080a994f6.shtml
Crafted TCP Packet DoS Vulnerability
Cisco ASA and Cisco PIX security appliances may experience a memory leak that can be triggered by a series of crafted TCP packets. Cisco ASA and Cisco PIX security appliances running versions 7.0, 7.1, 7.2, 8.0, and 8.1 are affected when configured for any of the following features:
* SSL VPNs
* ASDM Administrative Access
* Telnet Access
* SSH Access
* Cisco Tunneling Control Protocol (cTCP) for Remote Access VPNs
* Virtual Telnet
* Virtual HTTP
* Transport Layer Security (TLS) Proxy for Encrypted Voice Inspection
* Cut-Through Proxy for Network Access
* TCP Intercept
[20090408 Multiple Vulnerabilities in Cisco ASA Adaptive Security Appliance and Cisco PIX Security Appliances]
[34429]
[1022015]
[ADV-2009-0981]
Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5500 Series devices 7.0 before 7.0(8)6, 7.1 before 7.1(2)82, 7.2 before 7.2(4)26, 8.0 before 8.0(4)24, and 8.1 before 8.1(2)14, when H.323 inspection is enabled, allows remote attackers to cause a denial of service (device reload) via a crafted H.323 packet.
[20090408 Multiple Vulnerabilities in Cisco ASA Adaptive Security Appliance and Cisco PIX Security Appliances]
[34429]
[1022015]
[ADV-2009-0981]
Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX Security Appliances 7.2 before 7.2(4)26, 8.0 before 8.0(4)22, and 8.1 before 8.1(2)12, when SQL*Net inspection is enabled, allows remote attackers to cause a denial of service (traceback and device reload) via a series of SQL*Net packets.
[20090408 Multiple Vulnerabilities in Cisco ASA Adaptive Security Appliance and Cisco PIX Security Appliances]
[34429]
[1022015]
[ADV-2009-0981]
Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX Security Appliances 7.0 before 7.0(8)1, 7.1 before 7.1(2)74, 7.2 before 7.2(4)9, and 8.0 before 8.0(4)5 do not properly implement the implicit deny statement, which might allow remote attackers to successfully send packets that bypass intended access restrictions, aka Bug ID CSCsq91277.
[20090408 Multiple Vulnerabilities in Cisco ASA Adaptive Security Appliance and Cisco PIX Security Appliances]
[34429]
[1022017]
[ADV-2009-0981]
Directory traversal vulnerability in the TFTP service in Cisco CiscoWorks Common Services (CWCS) 3.0.x through 3.2.x on Windows, as used in Cisco Unified Service Monitor, Security Manager, TelePresence Readiness Assessment Manager, Unified Operations Manager, Unified Provisioning Manager, and other products, allows remote attackers to access arbitrary files via unspecified vectors.
[JVN#62527913]
[JVNDB-2009-000032]
[1022263]
[20090520 CiscoWorks TFTP Directory Traversal Vulnerability]
[35040]
[ADV-2009-1390]
Cross-site scripting (XSS) vulnerability in the Spam Quarantine login page in Cisco IronPort AsyncOS before 6.5.2 on Series C, M, and X appliances allows remote attackers to inject arbitrary web script or HTML via the referrer parameter.
[http://tools.cisco.com/security/center/viewAlert.x?alertId=18365]
[35203]
[1022335]
[ironport-asyncos-referrer-xss(50948)]
Memory leak on the Cisco Physical Access Gateway with software before 1.1 allows remote attackers to cause a denial of service (memory consumption) via unspecified TCP packets.
[http://www.cisco.com/en/US/products/products_applied_mitigation_bulletin09186a0080ad0fb2.html]
[20090624 Cisco Physical Access Gateway Denial of Service Vulnerability]
[35477]
[1022444]
The administrative web interface on the Cisco Wireless LAN Controller (WLC) platform 4.2 before 4.2.205.0 and 5.x before 5.2.178.0, as used in Cisco 1500 Series, 2000 Series, 2100 Series, 4100 Series, 4200 Series, and 4400 Series Wireless Services Modules (WiSM), WLC Modules for Integrated Services Routers, and Catalyst 3750G Integrated Wireless LAN Controllers, allows remote attackers to cause a denial of service (device reload) via a malformed response to a (1) HTTP or (2) HTTPS authentication request, aka Bug ID CSCsx03715.
[20090727 Multiple Vulnerabilities in Cisco Wireless LAN Controllers]
[ADV-2009-2021]
Memory leak on the Cisco Wireless LAN Controller (WLC) platform 4.x before 4.2.205.0, 5.1 before 5.1.163.0, and 5.0 and 5.2 before 5.2.178.0, as used in Cisco 1500 Series, 2000 Series, 2100 Series, 4100 Series, 4200 Series, and 4400 Series Wireless Services Modules (WiSM), WLC Modules for Integrated Services Routers, and Catalyst 3750G Integrated Wireless LAN Controllers, allows remote attackers to cause a denial of service (memory consumption and device reload) via SSH management connections, aka Bug ID CSCsw40789.
[20090727 Multiple Vulnerabilities in Cisco Wireless LAN Controllers]
[35817]
[1022605]
[ADV-2009-2021]
The administrative web interface on the Cisco Wireless LAN Controller (WLC) platform 4.x before 4.2.205.0 and 5.x before 5.2.191.0, as used in Cisco 1500 Series, 2000 Series, 2100 Series, 4100 Series, 4200 Series, and 4400 Series Wireless Services Modules (WiSM), WLC Modules for Integrated Services Routers, and Catalyst 3750G Integrated Wireless LAN Controllers, allows remote attackers to cause a denial of service (device reload) via a crafted (1) HTTP or (2) HTTPS request, aka Bug ID CSCsy27708.
[20090727 Multiple Vulnerabilities in Cisco Wireless LAN Controllers]
[1022605]
[ADV-2009-2021]
Unspecified vulnerability on the Cisco Wireless LAN Controller (WLC) platform 4.x before 4.2.205.0 and 5.x before 5.2.191.0, as used in Cisco 1500 Series, 2000 Series, 2100 Series, 4100 Series, 4200 Series, and 4400 Series Wireless Services Modules (WiSM), WLC Modules for Integrated Services Routers, and Catalyst 3750G Integrated Wireless LAN Controllers, allows remote attackers to modify the configuration via a crafted (1) HTTP or (2) HTTPS request, aka Bug ID CSCsy44672.
[20090727 Multiple Vulnerabilities in Cisco Wireless LAN Controllers]
[1022606]
[ADV-2009-2021]
Cisco IOS 12.0(32)S12 through 12.0(32)S13 and 12.0(33)S3 through 12.0(33)S4, 12.0(32)SY8 through 12.0(32)SY9, 12.2(33)SXI1, 12.2XNC before 12.2(33)XNC2, 12.2XND before 12.2(33)XND1, and 12.4(24)T1; and IOS XE 2.3 through 2.3.1t and 2.4 through 2.4.0; when RFC4893 BGP routing is enabled, allows remote attackers to cause a denial of service (memory corruption and device reload) by using an RFC4271 peer to send an update with a long series of AS numbers, aka Bug ID CSCsy86021.
[20090729 Cisco IOS Software Border Gateway Protocol 4-Byte Autonomous System Number Vulnerabilities]
[35862]
[1022619]
[ADV-2009-2082]
[oval:org.mitre.oval:def:6697]
The txMozillaXSLTProcessor::TransformToDoc function in Mozilla Firefox before 3.0.8 and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an XML file with a crafted XSLT transform.
Per: http://www.securityfocus.com/bid/34235/info
Mozilla Firefox is prone to a remote memory-corruption vulnerability.
An attacker can exploit this issue to execute arbitrary code within the context of the affected browser. Failed exploit attempt will result in a denial-of-service condition.
[http://blogs.zdnet.com/security/?p=3013]
[SUSE-SA:2009:022]
[SUSE-SA:2009:023]
[http://support.avaya.com/elmodocs2/security/ASA-2009-113.htm]
[DSA-1756]
[MDVSA-2009:084]
[http://www.mozilla.org/security/announce/2009/mfsa2009-12.html]
[RHSA-2009:0397]
[RHSA-2009:0398]
[34235]
[1021939]
[USN-745-1]
[ADV-2009-0853]
[https://bugzilla.mozilla.org/show_bug.cgi?id=460090]
[https://bugzilla.mozilla.org/show_bug.cgi?id=485217]
[https://bugzilla.mozilla.org/show_bug.cgi?id=485286]
[mozilla-xslt-code-execution(49439)]
[oval:org.mitre.oval:def:11372]
[8285]
[FEDORA-2009-3099]
[FEDORA-2009-3100]
[FEDORA-2009-3101]
Unspecified vulnerability in Sun OpenSolaris snv_100 through snv_101 allows local users, with privileges in a non-global zone, to execute arbitrary code in the global zone when a global-zone user is using mdb on a non-global zone process.
[255608]
[34272]
[1021944]
[ADV-2009-0877]
[opensolaris-mdb-code-execution(49468)]
The TeX filter in Moodle 1.6 before 1.6.9+, 1.7 before 1.7.7+, 1.8 before 1.8.9, and 1.9 before 1.9.5 allows user-assisted attackers to read arbitrary files via an input command in a "$$" sequence, which causes LaTeX to include the contents of the file.
[http://cvs.moodle.org/moodle/filter/tex/filter.php?r1=1.18.4.4&r2=1.18.4.5]
[SUSE-SR:2009:009]
[http://tracker.moodle.org/browse/MDL-18552]
[DSA-1761]
[20090327 Moodle: Sensitive File Disclosure]
[USN-791-2]
[8297]
[FEDORA-2009-3280]
[FEDORA-2009-3283]
The JAX-RPC WS-Security runtime in the Web Services Security component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 and 7.0 before 7.0.0.3, when APAR PK41002 is installed, does not properly validate UsernameToken objects, which has unknown impact and attack vectors.
[34502]
[http://www-01.ibm.com/support/docview.wss?uid=swg21367223]
[http://www-01.ibm.com/support/docview.wss?uid=swg27007951]
[http://www-01.ibm.com/support/docview.wss?uid=swg27014463]
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.3 uses weak permissions (777) for files associated with unspecified "interim fixes," which allows attackers to modify files that would not have been accessible if the intended 755 permissions were used.
[34259]
[ADV-2009-0854]
[PK82988]
[http://www-01.ibm.com/support/docview.wss?uid=swg27014463]
The Web Services Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35 and 7.0 before 7.0.0.3 has an unspecified "security problem" in the XML digital-signature specification, which has unknown impact and attack vectors.
[34506]
[ADV-2009-1464]
[PK80596]
[http://www-01.ibm.com/support/docview.wss?uid=swg21384925]
[http://www-01.ibm.com/support/docview.wss?uid=swg27006876]
[http://www-01.ibm.com/support/docview.wss?uid=swg27014463]
Cross-site scripting (XSS) vulnerability in apps/web/vs_diag.cgi in the DAAP extension in Banshee 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the server parameter, which is not properly handled in an error message.
[http://bugzilla.gnome.org/show_bug.cgi?id=577270]
[[oss-security] 20090330 [Fwd: Cross-Site Scripting in Banshee DAAP Extension]]
mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 does not ensure that the string holding the id parameter ends in a '\0' character, which allows remote attackers to conduct buffer-overflow attacks or have unspecified other impact via a long id parameter in a query action.
[[mapserver-users] 20090326 MapServer 5.2.2 and 4.10.4 released with security fixes]
[http://www.positronsecurity.com/advisories/2009-000.html]
[20090330 Positron Security Advisory #2009-000: Multiple Vulnerabilities in MapServer v5.2.1 and v4.10.3]
[34306]
[1021952]
[FEDORA-2009-3357]
[FEDORA-2009-3383]
Multiple stack-based buffer overflows in maptemplate.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 have unknown impact and remote attack vectors.
[[mapserver-users] 20090326 MapServer 5.2.2 and 4.10.4 released with security fixes]
[http://trac.osgeo.org/mapserver/ticket/2944]
[http://www.positronsecurity.com/advisories/2009-000.html]
[20090330 Positron Security Advisory #2009-000: Multiple Vulnerabilities in MapServer v5.2.1 and v4.10.3]
[34306]
[1021952]
[FEDORA-2009-3357]
[FEDORA-2009-3383]
Unspecified vulnerability in the server in IBM Tivoli Storage Manager (TSM) 5.3.x before 5.3.2 and 6.x before 6.1 has unknown impact and attack vectors related to the "admin command line."
[1021945]
[34285]
[ADV-2009-0881]
[http://www-01.ibm.com/support/docview.wss?uid=swg21246076]
[http://www-01.ibm.com/support/docview.wss?uid=swg21375360]
Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to execute arbitrary code via a crafted PDF file.
[APPLE-SA-2009-06-08-1]
[APPLE-SA-2009-06-17-1]
[SUSE-SA:2009:024]
[SUSE-SR:2009:010]
[SUSE-SR:2009:012]
[http://poppler.freedesktop.org/releases.html]
[RHSA-2009:0458]
[SSA:2009-129-01]
[http://support.apple.com/kb/HT3613]
[http://support.apple.com/kb/HT3639]
[DSA-1790]
[DSA-1793]
[VU#196617]
[MDVSA-2009:101]
[MDVSA-2010:087]
[MDVSA-2011:175]
[RHSA-2009:0429]
[RHSA-2009:0430]
[RHSA-2009:0431]
[RHSA-2009:0480]
[34568]
[1022073]
[ADV-2009-1065]
[ADV-2009-1066]
[ADV-2009-1076]
[ADV-2009-1077]
[ADV-2009-1522]
[ADV-2009-1621]
[ADV-2010-1040]
[https://bugzilla.redhat.com/show_bug.cgi?id=495889]
[oval:org.mitre.oval:def:11892]
[FEDORA-2009-6972]
[FEDORA-2009-6973]
[FEDORA-2009-6982]
The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to execute arbitrary code via a crafted PDF file that triggers a free of invalid data.
[SUSE-SA:2009:024]
[SUSE-SR:2009:010]
[SUSE-SR:2009:012]
[http://poppler.freedesktop.org/releases.html]
[RHSA-2009:0458]
[SSA:2009-129-01]
[DSA-1790]
[DSA-1793]
[VU#196617]
[MDVSA-2009:101]
[MDVSA-2010:087]
[MDVSA-2011:175]
[RHSA-2009:0429]
[RHSA-2009:0430]
[RHSA-2009:0431]
[RHSA-2009:0480]
[34568]
[1022073]
[ADV-2009-1065]
[ADV-2009-1066]
[ADV-2009-1076]
[ADV-2009-1077]
[ADV-2010-1040]
[https://bugzilla.redhat.com/show_bug.cgi?id=495892]
[oval:org.mitre.oval:def:9926]
[FEDORA-2009-6972]
[FEDORA-2009-6973]
[FEDORA-2009-6982]
The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers a NULL pointer dereference.
[SUSE-SA:2009:024]
[SUSE-SR:2009:010]
[SUSE-SR:2009:012]
[http://poppler.freedesktop.org/releases.html]
[RHSA-2009:0458]
[SSA:2009-129-01]
[DSA-1790]
[DSA-1793]
[VU#196617]
[MDVSA-2009:101]
[MDVSA-2010:087]
[MDVSA-2011:175]
[RHSA-2009:0429]
[RHSA-2009:0430]
[RHSA-2009:0431]
[RHSA-2009:0480]
[34568]
[1022072]
[ADV-2009-1065]
[ADV-2009-1066]
[ADV-2009-1076]
[ADV-2009-1077]
[ADV-2010-1040]
[https://bugzilla.redhat.com/show_bug.cgi?id=495894]
[oval:org.mitre.oval:def:9683]
[FEDORA-2009-6972]
[FEDORA-2009-6973]
[FEDORA-2009-6982]
Multiple buffer overflows in the JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF file.
[SUSE-SA:2009:024]
[SUSE-SR:2009:010]
[SUSE-SR:2009:012]
[http://poppler.freedesktop.org/releases.html]
[RHSA-2009:0458]
[SSA:2009-129-01]
[DSA-1790]
[DSA-1793]
[VU#196617]
[MDVSA-2009:101]
[MDVSA-2010:087]
[MDVSA-2011:175]
[RHSA-2009:0429]
[RHSA-2009:0430]
[RHSA-2009:0431]
[RHSA-2009:0480]
[34568]
[1022073]
[ADV-2009-1065]
[ADV-2009-1066]
[ADV-2009-1076]
[ADV-2009-1077]
[ADV-2010-1040]
[https://bugzilla.redhat.com/show_bug.cgi?id=495896]
[oval:org.mitre.oval:def:10735]
[FEDORA-2009-6972]
[FEDORA-2009-6973]
[FEDORA-2009-6982]
The JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted PDF file.
[SUSE-SA:2009:024]
[SUSE-SR:2009:010]
[SUSE-SR:2009:012]
[http://poppler.freedesktop.org/releases.html]
[RHSA-2009:0458]
[SSA:2009-129-01]
[DSA-1790]
[DSA-1793]
[VU#196617]
[MDVSA-2009:101]
[MDVSA-2010:087]
[MDVSA-2011:175]
[RHSA-2009:0429]
[RHSA-2009:0430]
[RHSA-2009:0431]
[RHSA-2009:0480]
[34568]
[1022072]
[ADV-2009-1065]
[ADV-2009-1066]
[ADV-2009-1076]
[ADV-2009-1077]
[ADV-2010-1040]
[https://bugzilla.redhat.com/show_bug.cgi?id=495899]
[oval:org.mitre.oval:def:10769]
[FEDORA-2009-6972]
[FEDORA-2009-6973]
[FEDORA-2009-6982]
The selinux_ip_postroute_iptables_compat function in security/selinux/hooks.c in the SELinux subsystem in the Linux kernel before 2.6.27.22, and 2.6.28.x before 2.6.28.10, when compat_net is enabled, omits calls to avc_has_perm for the (1) node and (2) port, which allows local users to bypass intended restrictions on network traffic. NOTE: this was incorrectly reported as an issue fixed in 2.6.27.21.
[http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.27.y.git;a=commit;h=910c9e41186762de3717baaf392ab5ff0c454496]
[[linux-kernel] 20090502 Linux 2.6.27.21]
[[linux-kernel] 20090502 Linux 2.6.28.10]
[http://patchwork.ozlabs.org/patch/25238/]
[DSA-1800]
[MDVSA-2009:118]
[MDVSA-2009:119]
[MDVSA-2009:135]
[[oss-security] 20090504 CVE-2009-1184 selinux: skipped node/port send checks in the compat_net=1 case]
[USN-793-1]
[https://launchpad.net/bugs/cve/2009-1184]
udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space.
[http://git.kernel.org/?p=linux/hotplug/udev.git;a=commitdiff;h=e2b362d9f23d4c63018709ab5f81a02f72b91e75]
[http://git.kernel.org/?p=linux/hotplug/udev.git;a=commitdiff;h=e86a923d508c2aed371cdd958ce82489cf2ab615]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10691]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705]
[SUSE-SA:2009:020]
[SUSE-SA:2009:025]
[[Security-announce] 20090710 VMSA-2009-0009 ESX Service Console updates for udev, sudo, and curl]
[SSA:2009-111-01]
[http://wiki.rpath.com/Advisories:rPSA-2009-0063]
[http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0063]
[DSA-1772]
[GLSA-200904-18]
[MDVSA-2009:103]
[MDVSA-2009:104]
[RHSA-2009:0427]
[20090417 rPSA-2009-0063-1 udev]
[20090711 VMSA-2009-0009 ESX Service Console updates for udev, sudo, and curl]
[34536]
[1022067]
[USN-758-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0009.html]
[ADV-2009-1053]
[ADV-2009-1865]
[https://bugzilla.redhat.com/show_bug.cgi?id=495051]
[https://launchpad.net/bugs/cve/2009-1185]
[oval:org.mitre.oval:def:10925]
[oval:org.mitre.oval:def:5975]
[8572]
[FEDORA-2009-3712]
[FEDORA-2009-3711]
Buffer overflow in the util_path_encode function in udev/lib/libudev-util.c in udev before 1.4.1 allows local users to cause a denial of service (service outage) via vectors that trigger a call with crafted arguments.
[http://git.kernel.org/?p=linux/hotplug/udev.git;a=commitdiff;h=662c3110803bd8c1aedacc36788e6fd028944314]
[SUSE-SA:2009:020]
[SSA:2009-111-01]
[http://wiki.rpath.com/Advisories:rPSA-2009-0063]
[http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0063]
[DSA-1772]
[GLSA-200904-18]
[MDVSA-2009:103]
[20090417 rPSA-2009-0063-1 udev]
[34539]
[1022068]
[USN-758-1]
[ADV-2009-1053]
[https://bugzilla.redhat.com/show_bug.cgi?id=495052]
[https://launchpad.net/bugs/cve/2009-1186]
[FEDORA-2009-3712]
[FEDORA-2009-3711]
Integer overflow in the JBIG2 decoding feature in Poppler before 0.10.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to CairoOutputDev (CairoOutputDev.cc).
[http://bugs.gentoo.org/show_bug.cgi?id=263028#c16]
[http://poppler.freedesktop.org/releases.html]
[http://wiki.rpath.com/Advisories:rPSA-2009-0059]
[VU#196617]
[MDVSA-2010:087]
[MDVSA-2011:175]
[RHSA-2009:0480]
[20090417 rPSA-2009-0059-1 poppler]
[34568]
[ADV-2009-1076]
[ADV-2010-1040]
[https://bugs.launchpad.net/ubuntu/+source/poppler/+bug/361875]
[poppler-jbig2-cairooutputdev-code-excution(50184)]
[oval:org.mitre.oval:def:10292]
[FEDORA-2009-6972]
[FEDORA-2009-6973]
[FEDORA-2009-6982]
Integer overflow in the JBIG2 decoding feature in the SplashBitmap::SplashBitmap function in SplashBitmap.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.10.6, as used in GPdf and kdegraphics KPDF, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document.
[http://bugs.gentoo.org/show_bug.cgi?id=263028#c16]
[FEDORA-2010-1805]
[FEDORA-2010-1842]
[FEDORA-2010-1377]
[http://poppler.freedesktop.org/releases.html]
[http://wiki.rpath.com/Advisories:rPSA-2009-0059]
[DSA-2028]
[DSA-2050]
[VU#196617]
[MDVSA-2010:087]
[MDVSA-2011:175]
[RHSA-2009:0480]
[20090417 rPSA-2009-0059-1 poppler]
[34568]
[ADV-2009-1076]
[ADV-2009-2928]
[ADV-2010-0802]
[ADV-2010-1040]
[ADV-2010-1220]
[https://bugs.launchpad.net/ubuntu/+source/poppler/+bug/361875]
[https://bugzilla.redhat.com/show_bug.cgi?id=495907]
[https://bugzilla.redhat.com/show_bug.cgi?id=526915]
[poppler-jbig2-splashbitmap-code-execution(50185)]
[oval:org.mitre.oval:def:9957]
[RHSA-2009:1501]
[RHSA-2009:1502]
[RHSA-2009:1503]
[RHSA-2009:1512]
[FEDORA-2009-6972]
[FEDORA-2009-6973]
[FEDORA-2009-6982]
The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before 1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834.
[http://bugs.freedesktop.org/show_bug.cgi?id=17803]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705]
[[security-announce] 20100303 VMSA-2010-0004 ESX Service Console and vMA third party updates]
[http://www.freedesktop.org/wiki/Software/dbus#head-dad0dab297a44f1d7a3b1259cfc06b583fd6a88a]
[[oss-security] 20090416 CVE-2009-1189: invalid fix for CVE-2008-3834 (dbus)]
[31602]
[ADV-2010-0528]
[dbus-dbusmarshalvalidate-spoofing(50385)]
[oval:org.mitre.oval:def:10308]
[RHSA-2010:0095]
[USN-799-1]
Algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method in Sun Java Development Kit (JDK) before 1.6, when used with spring.jar in SpringSource Spring Framework 1.1.0 through 2.5.6 and 3.0.0.M1 through 3.0.0.M2 and dm Server 1.0.0 through 1.0.2, allows remote attackers to cause a denial of service (CPU consumption) via serializable data with a long regex string containing multiple optional groups, a related issue to CVE-2004-2540.
[http://www.packetstormsecurity.org/hitb06/DAY_1_-_Marc_Schoenefeld_-_Pentesting_Java_J2EE.pdf]
[20090424 CVE-2009-1190: Spring Framework Remote Denial of Service Vulnerability]
[http://www.springsource.com/securityadvisory]
[https://bugzilla.redhat.com/show_bug.cgi?id=497161]
[springframework-data-dos(50083)]
mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request.
[APPLE-SA-2009-11-09-1]
[GLSA-200907-04]
[http://support.apple.com/kb/HT3937]
[http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?r1=766938&r2=767089]
[http://www.apache.org/dist/httpd/patches/apply_to_2.2.11/PR46949.diff]
[MDVSA-2009:102]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
[34663]
[1022264]
[USN-787-1]
[ADV-2009-1147]
[ADV-2009-3184]
[apache-modproxyajp-information-disclosure(50059)]
[https://issues.apache.org/bugzilla/show_bug.cgi?id=46949]
[[httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[[httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[oval:org.mitre.oval:def:8261]
The (1) agp_generic_alloc_page and (2) agp_generic_alloc_pages functions in drivers/char/agp/generic.c in the agp subsystem in the Linux kernel before 2.6.30-rc3 do not zero out pages that may later be available to a user-space process, which allows local users to obtain sensitive information by reading these pages.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=59de2bebabc5027f93df999d59cc65df591c3e6e]
[SUSE-SA:2009:032]
[SUSE-SA:2009:054]
[SUSE-SA:2009:056]
[[oss-security] 20090422 CVE-2009-1192 kernel: agp: zero pages before sending to userspace]
[http://wiki.rpath.com/Advisories:rPSA-2009-0084]
[DSA-1787]
[DSA-1794]
[DSA-1800]
[http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.30-rc3]
[MDVSA-2009:119]
[MDVSA-2009:135]
[RHSA-2009:1081]
[20090516 rPSA-2009-0084-1 kernel]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[34673]
[USN-793-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-3316]
[https://bugzilla.redhat.com/show_bug.cgi?id=497020]
[oval:org.mitre.oval:def:10567]
[oval:org.mitre.oval:def:8003]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Integer overflow in the pango_glyph_string_set_size function in pango/glyphstring.c in Pango before 1.24 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long glyph string that triggers a heap-based buffer overflow, as demonstrated by a long document.location value in Firefox.
[http://github.com/bratsche/pango/commit/4de30e5500eaeb49f4bf0b7a07f718e149a2ed5e]
[SUSE-SR:2009:012]
[SUSE-SA:2009:039]
[SUSE-SA:2009:042]
[264308]
[DSA-1798]
[http://www.mozilla.org/security/announce/2009/mfsa2009-36.html]
[http://www.ocert.org/advisories/ocert-2009-001.html]
[[oss-security] 20090507 [oCERT-2009-001] Pango integer overflow in heap allocation size calculations]
[RHSA-2009:0476]
[20090507 [oCERT-2009-001] Pango integer overflow in heap allocation size calculations]
[34870]
[35758]
[1022196]
[USN-773-1]
[ADV-2009-1269]
[ADV-2009-1972]
[https://bugzilla.mozilla.org/show_bug.cgi?id=480134]
[https://bugzilla.redhat.com/show_bug.cgi?id=496887]
[pango-pangoglyphstringsetsize-bo(50397)]
[https://launchpad.net/bugs/cve/2009-1194]
[oval:org.mitre.oval:def:10137]
The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.
[APPLE-SA-2009-11-09-1]
[SUSE-SA:2009:050]
[[apache-httpd-dev] 20090423 Includes vs IncludesNoExec security issue - help needed]
[HPSBUX02612]
[GLSA-200907-04]
[http://support.apple.com/kb/HT3937]
[http://svn.apache.org/viewvc?view=rev&revision=772997]
[http://wiki.rpath.com/Advisories:rPSA-2009-0142]
[DSA-1816]
[MDVSA-2009:124]
[RHSA-2009:1075]
[RHSA-2009:1156]
[20091112 rPSA-2009-0142-1 httpd mod_ssl]
[20091113 rPSA-2009-0142-2 httpd mod_ssl]
[35115]
[1022296]
[USN-787-1]
[ADV-2009-1444]
[ADV-2009-3184]
[https://bugzilla.redhat.com/show_bug.cgi?id=489436]
[apache-allowoverrides-security-bypass(50808)]
[[httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[[httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[oval:org.mitre.oval:def:11094]
[oval:org.mitre.oval:def:12377]
[oval:org.mitre.oval:def:8704]
[FEDORA-2009-8812]
The directory-services functionality in the scheduler in CUPS 1.1.17 and 1.1.22 allows remote attackers to cause a denial of service (cupsd daemon outage or crash) via manipulations of the timing of CUPS browse packets, related to a "pointer use-after-delete flaw."
[1022327]
[RHSA-2009:1083]
[35194]
[ADV-2009-1488]
[https://bugzilla.redhat.com/show_bug.cgi?id=497135]
[cups-directory-services-dos(50944)]
[oval:org.mitre.oval:def:11217]
Apache jUDDI before 2.0 allows attackers to spoof entries in log files via vectors related to error logging of keys from uddiget.jsp.
[http://issues.apache.org/jira/browse/JUDDI-220]
[[juddi-dev] 20090811 [ANNOUNCE] Release jUDDI v2.0 and v.2.0.1]
[101625]
Cross-site scripting (XSS) vulnerability in Apache jUDDI before 2.0 allows remote attackers to inject arbitrary web script or HTML via the dsname parameter to happyjuddi.jsp.
[http://issues.apache.org/jira/browse/JUDDI-221]
[[juddi-dev] 20090811 [ANNOUNCE] Release jUDDI v2.0 and v.2.0.1]
[101623]
Eval injection vulnerability in the csco_wrap_js function in /+CSCOL+/cte.js in WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 allows remote attackers to bypass a DOM wrapper and conduct cross-site scripting (XSS) attacks by setting CSCO_WebVPN['process'] to the name of a crafted function, aka Bug ID CSCsy80694.
[20090624 Trustwave's SpiderLabs Security Advisory TWSL2009-002]
[35476]
[1022457]
[ADV-2009-1713]
[https://www.trustwave.com/spiderlabs/advisories/TWSL2009-002.txt]
WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 allows remote attackers to bypass certain protection mechanisms involving URL rewriting and HTML rewriting, and conduct cross-site scripting (XSS) attacks, by modifying the first hex-encoded character in a /+CSCO+ URI, aka Bug ID CSCsy80705.
[20090624 Trustwave's SpiderLabs Security Advisory TWSL2009-002]
[35480]
[1022457]
[ADV-2009-1713]
WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 does not properly distinguish its own login screen from the login screens it produces for third-party (1) FTP and (2) CIFS servers, which makes it easier for remote attackers to trick a user into sending WebVPN credentials to an arbitrary server via a URL associated with that server, aka Bug ID CSCsy80709.
[20090624 Trustwave's SpiderLabs Security Advisory TWSL2009-002]
[35475]
[1022457]
[ADV-2009-1713]
Cross-site scripting (XSS) vulnerability in TikiWiki (Tiki) CMS/Groupware 2.2 allows remote attackers to inject arbitrary web script or HTML via the PHP_SELF portion of a URI to (1) tiki-galleries.php, (2) tiki-list_file_gallery.php, (3) tiki-listpages.php, and (4) tiki-orphan_pages.php.
[http://dev.tikiwiki.org/tiki-view_tracker_item.php?itemId=2359&trackerId=5&show=view&reloff=3&cant=1229&status=o&trackerId=5&sort_mode=created_desc]
[http://info.tikiwiki.org/tiki-read_article.php?articleId=51]
[http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki/branches/2.0/changelog.txt?view=markup]
[20090312 TikiWiki 2.2 XSS Vulnerability in URI]
[34105]
[34106]
[34107]
[34108]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2007-4475. Reason: This candidate is a duplicate of CVE-2007-4475. Notes: All CVE users should reference CVE-2007-4475 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Unspecified vulnerability in futomi's CGI Cafe Access Analyzer CGI Professional Version 4.11.5 and earlier allows remote attackers to gain administrative privileges via unknown vectors.
[JVN#63511247]
[JVNDB-2009-000016]
[http://www.futomi.com/library/info/2009/20090331.html]
[34315]
[ADV-2009-0888]
[cgicafe-unspecified-unauth-access(49525)]
Race condition in the dircmp script in Sun Solaris 8 through 10, and OpenSolaris snv_01 through snv_111, allows local users to overwrite arbitrary files, probably involving a symlink attack on temporary files.
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-138897-01-1]
[253468]
[http://support.avaya.com/elmodocs2/security/ASA-2009-140.htm]
[34316]
[ADV-2009-1105]
[solaris-dircmp-file-overwrite(49526)]
[oval:org.mitre.oval:def:6183]
SQL injection vulnerability in auth2db 0.2.5, and possibly other versions before 0.2.7, uses the addslashes function instead of the mysql_real_escape_string function, which allows remote attackers to conduct SQL injection attacks using multibyte character encodings.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521823]
[http://www.auth2db.com.ar/?title=CHANGELOG]
[DSA-1757]
[34287]
[auth2db-unspecified-sql-injection(49518)]
Stack-based buffer overflow in W3C Amaya Web Browser 11.1 allows remote attackers to execute arbitrary code via a script tag with a long defer attribute.
[34295]
[ADV-2009-0889]
[amaya-htmltag-bo(47399)]
[8314]
[8321]
Format string vulnerability in the PROFINET/DCP (PN-DCP) dissector in Wireshark 1.0.6 and earlier allows remote attackers to execute arbitrary code via a PN-DCP packet with format string specifiers in the station name. NOTE: some of these details are obtained from third party information.
[SUSE-SR:2009:011]
[http://wiki.rpath.com/Advisories:rPSA-2009-0062]
[DSA-1785]
[MDVSA-2009:088]
[RHSA-2009:1100]
[20090417 rPSA-2009-0062-1 tshark wireshark]
[34291]
[http://www.wireshark.org/security/wnpa-sec-2009-02.html]
[wireshark-pndcp-format-string(49512)]
[oval:org.mitre.oval:def:5976]
[oval:org.mitre.oval:def:9526]
[8308]
[FEDORA-2009-3599]
[FEDORA-2009-5339]
[FEDORA-2009-5382]
Blue Coat ProxySG, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web page that causes a client to send HTTP requests with a modified Host header.
[1021781]
[https://hypersonic.bluecoat.com/support/securityadvisories/ProxySG_in_transparent_deployments]
Multiple insecure method vulnerabilities in PRECIS~2.DLL in the PrecisionID Datamatrix ActiveX control (DMATRIXLib.Datamatrix) allow remote attackers to overwrite arbitrary files via the (1) SaveBarCode and (2) SaveEnhWMF methods.
[http://dsecrg.com/pages/vul/DSECRG-09-030.html]
[20090331 [DSECRG-09-030] PrecisionID Datamatrix ActiveX control - Arbitrary File overwriting]
[34322]
[8332]
Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 3.2 before 3.2.3, 3.3 before 3.3.4, and earlier versions allows remote attackers to hijack the authentication of arbitrary users for requests that use attachment editing.
[http://www.bugzilla.org/security/3.2.2/]
[34308]
[ADV-2009-0887]
[https://bugzilla.mozilla.org/show_bug.cgi?id=476603]
[bugzilla-attachment-csrf(49524)]
[FEDORA-2009-3405]
[FEDORA-2009-3410]
GNU screen 4.0.3 creates the /tmp/screen-exchange temporary file with world-readable permissions, which might allow local users to obtain sensitive session information.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521123]
[http://savannah.gnu.org/bugs/?25296]
[[oss-security] 20090325 CVE request -- zsh, XFree86-xfs/xorg-x11-xfs, screen]
[34521]
[https://bugs.launchpad.net/ubuntu/+source/screen/+bug/315993]
[https://bugzilla.redhat.com/show_bug.cgi?id=492104]
[screen-screenexchange-info-disclosure(49886)]
Race condition in GNU screen 4.0.3 allows local users to create or overwrite arbitrary files via a symlink attack on the /tmp/screen-exchange temporary file.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521123]
[http://savannah.gnu.org/bugs/?25296]
[[oss-security] 20090325 CVE request -- zsh, XFree86-xfs/xorg-x11-xfs, screen]
[34521]
[https://bugs.launchpad.net/ubuntu/+source/screen/+bug/315993]
[https://bugzilla.redhat.com/show_bug.cgi?id=492104]
[screen-screenexchange-symlink(49887)]
Multiple unspecified vulnerabilities in (1) unlzh.c and (2) unpack.c in the gzip libraries in Microsoft Windows Server 2008, Windows Services for UNIX 3.0 and 3.5, and the Subsystem for UNIX-based Applications (SUA); as used in gunzip, gzip, pack, pcat, and unpack 7.x before 7.0.1701.48, 8.x before 8.0.1969.62, and 9.x before 9.0.3790.2076; allow remote attackers to execute arbitrary code via unknown vectors.
[1021937]
[953602]
[34258]
[ADV-2009-0849]
[win-unlzh-unpack-code-execution(49435)]
Off-by-one error in the GpFont::SetData function in gdiplus.dll in Microsoft GDI+ on Windows XP allows remote attackers to cause a denial of service (stack corruption and application termination) via a crafted EMF file that triggers an integer overflow, as demonstrated by voltage-exploit.emf, aka the "Microsoft GdiPlus EMF GpFont.SetData integer overflow."
[http://bl4cksecurity.blogspot.com/2009/03/microsoft-gdiplus-emf-gpfontsetdata.html]
[http://blogs.technet.com/srd/archive/2009/03/26/new-emf-gdiplus-dll-crash-not-exploitable-for-code-execution.aspx]
[34250]
[ADV-2009-0832]
[win-gdi-emfplusfont-dos(49438)]
Multiple cross-site scripting (XSS) vulnerabilities in Sun Calendar Express Web Server in Sun ONE Calendar Server 6.0 and Sun Java System Calendar Server 6 2004Q2 through 6.3-7.01 allow remote attackers to inject arbitrary web script or HTML via (1) the fmt-out parameter to login.wcap or (2) the date parameter to command.shtml.
[256228]
[1020321]
[http://www.coresecurity.com/content/sun-calendar-express]
[20090331 CORE-2009-0108: Multiple vulnerabilities in Sun Calendar Express Web Server]
[34152]
[34153]
[ADV-2009-0905]
Sun Calendar Express Web Server in Sun ONE Calendar Server 6.0 and Sun Java System Calendar Server 6 2004Q2 through 6.3-7.01 allows remote attackers to cause a denial of service (daemon crash) via multiple requests to the default URI with alphabetic characters in the tzid parameter.
[256228]
[255008]
[http://www.coresecurity.com/content/sun-calendar-express]
[20090331 CORE-2009-0108: Multiple vulnerabilities in Sun Calendar Express Web Server]
[34150]
[ADV-2009-0905]
Cross-site scripting (XSS) vulnerability in +webvpn+/index.html in WebVPN on the Cisco Adaptive Security Appliances (ASA) 5520 with software 7.2(4)30 and earlier 7.2 versions including 7.2(2)22, and 8.0(4)28 and earlier 8.0 versions, when clientless mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the Host HTTP header.
[20090331 Cisco ASA5520 Web VPN Host Header XSS]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=17950]
[20090331 Cisco ASA5520 Web VPN Host Header XSS]
[20090424 RE: Cisco ASA5520 Web VPN Host Header XSS]
[34307]
[1022122]
[ADV-2009-1169]
[asa5520-webvpn-xss(49528)]
Directory traversal vulnerability in index.php in webEdition 6.0.0.4 and earlier, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the WE_LANGUAGE parameter.
[20090331 webEdition 6.0.0.4 Local File Inclusion]
[34323]
[webedition-index-file-include(49530)]
[8328]
aspWebCalendar Free Edition stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user credentials via a direct request for calendar/calendar.mdb.
[20090331 aspWebCalendar Free Edition bug]
[aspwebcalendar-calendar-info-disclosure(49885)]
SQL injection vulnerability in vsp-core/pub/themes/bismarck/gamestat.php in vsp stats processor 0.45 allows remote attackers to execute arbitrary SQL commands via the gameID parameter.
[8331]
Cross-site scripting (XSS) vulnerability in index.php in Turnkey Ebook Store 1.1 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a search action.
[http://packetstorm.linuxsecurity.com/0903-exploits/turnkeyebook-xss.txt]
core/admin/delete.php in Podcast Generator 1.1 and earlier does not properly restrict access to administrative functions, which allows remote attackers to delete arbitrary files via the file parameter.
[34317]
[8324]
** DISPUTED ** NOTE: this issue has been disputed by the vendor. Buffer overflow in the PKI Web Service in Check Point Firewall-1 PKI Web Service allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) Authorization or (2) Referer HTTP header to TCP port 18624. NOTE: the vendor has disputed this issue, stating "Check Point Security Alert Team has analyzed this report. We've tried to reproduce the attack on all VPN-1 versions from NG FP2 and above with and without HFAs. The issue was not reproduced. We have conducted a thorough analysis of the relevant code and verified that we are secure against this attack. We consider this attack to pose no risk to Check Point customers." In addition, the original researcher, whose reliability is unknown as of 20090407, also states that the issue "was discovered during a pen-test where the client would not allow further analysis."
[20090330 Check Point Firewall-1 PKI Web Service HTTP Header Remote Overflow]
[20090330 Check Point Firewall-1 PKI Web Service HTTP Header Remote Overflow]
[34286]
[1021948]
[8313]
Cross-site scripting (XSS) vulnerability in register.php in Arcadwy Arcade Script CMS allows remote attackers to inject arbitrary web script or HTML via the username field (user_name parameter).
[34275]
[arcadescript-register-xss(49472)]
[8296]
SQL injection vulnerability in Arcadwy Arcade Script allows remote attackers to execute arbitrary SQL commands via the user cookie parameter.
[34284]
[http://z0rlu.blogspot.com/2009/03/arcadwy-arcade-script-auth-bypass.html]
[arcadescript-user-sql-injection(49500)]
[8304]
Static code injection vulnerability in index.php in Podcast Generator 1.1 and earlier allows remote authenticated administrators to inject arbitrary PHP code into config.php via the recent parameter in a config change action.
[8324]
Unspecified vulnerability in the eClient in IBM DB2 Content Manager 8.4.1 before 8.4.1.1 has unknown impact and attack vectors.
[34326]
[ADV-2009-0910]
[http://www-01.ibm.com/support/docview.wss?uid=swg27015162]
Mozilla Firefox 3.0.8 and earlier 3.0.x versions allows remote attackers to cause a denial of service (memory corruption) via an XML document composed of a long series of start-tags with no corresponding end-tags. NOTE: it was later reported that 3.0.10 and earlier are also affected.
[http://milw0rm.com/sploits/2009-Firefox-XUL-0day-PoC.rar]
[http://websecurity.com.ua/3216/]
[34522]
[https://bugzilla.mozilla.org/show_bug.cgi?id=485941]
[firefox-xml-dos(49521)]
[8306]
Apple Safari 3.2.2 and 4 Beta on Windows allows remote attackers to cause a denial of service (application crash) via an XML document containing many nested A elements.
[34318]
[safari-xml-dos(49527)]
[oval:org.mitre.oval:def:5559]
[8325]
Opera 9.64 allows remote attackers to cause a denial of service (application crash) via an XML document containing a long series of start-tags with no corresponding end-tags. NOTE: it was later reported that 9.52 is also affected.
[SUSE-SR:2009:015]
[http://websecurity.com.ua/3216/]
[34298]
[opera-xml-dos(49522)]
[oval:org.mitre.oval:def:5432]
[8320]
XNU 1228.9.59 and earlier on Apple Mac OS X 10.5.6 and earlier does not properly restrict interaction between user space and the HFS IOCTL handler, which allows local users to overwrite kernel memory and gain privileges by attaching an HFS+ disk image and performing certain steps involving HFS_GET_BOOT_INFO fcntl calls.
[APPLE-SA-2009-08-05-1]
[http://support.apple.com/kb/HT3757]
[http://www.digit-labs.org/files/exploits/xnu-hfs-fcntl-v2.c]
[http://www.digit-labs.org/files/exploits/xnu-hfs-fcntl-v2.sh]
[http://www.informationweek.com/news/hardware/mac/showArticle.jhtml?articleID=216401181]
[34203]
[1022671]
[TA09-218A]
[ADV-2009-0822]
[ADV-2009-2172]
[8266]
Heap-based buffer overflow in the AppleTalk networking stack in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allows remote attackers to cause a denial of service (system crash) via a ZIP NOTIFY (aka ZIPOP_NOTIFY) packet that overwrites a certain ifPort structure member.
[http://www.digit-labs.org/files/exploits/xnu-appletalk-zip.c]
[http://www.informationweek.com/news/hardware/mac/showArticle.jhtml?articleID=216401181]
[34201]
[8262]
Multiple memory leaks in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allow local users to cause a denial of service (kernel memory consumption) via a crafted (1) SYS_add_profil or (2) SYS___mac_getfsstat system call.
[http://www.digit-labs.org/files/exploits/xnu-macfsstat-leak.c]
[http://www.digit-labs.org/files/exploits/xnu-profil-leak.c]
[http://www.informationweek.com/news/hardware/mac/showArticle.jhtml?articleID=216401181]
[34202]
[8263]
[8264]
Race condition in the HFS vfs sysctl interface in XNU 1228.8.20 and earlier on Apple Mac OS X 10.5.6 and earlier allows local users to cause a denial of service (kernel memory corruption) by simultaneously executing the same HFS_SET_PKG_EXTENSIONS code path in multiple threads, which is problematic because of lack of mutex locking for an unspecified global variable.
[http://www.digit-labs.org/files/exploits/xnu-vfssysctl-dos.c]
[http://www.informationweek.com/news/hardware/mac/showArticle.jhtml?articleID=216401181]
[34202]
[8265]
IBM DB2 9.1 before FP7 returns incorrect query results in certain situations related to the order of application of an INNER JOIN predicate and an OUTER JOIN predicate, which might allow attackers to obtain sensitive information via a crafted query.
[ADV-2009-0912]
[JR31886]
[http://www-01.ibm.com/support/docview.wss?uid=swg21381257]
[db2-predicate-information-disclosure(49864)]
Unspecified vulnerability in the IBM Proventia engine 4.9.0.0.44 20081231, as used in IBM Proventia Network Mail Security System, Network Mail Security System Virtual Appliance, Desktop Endpoint Security, Network Multi-Function Security (MFS), and possibly other products, allows remote attackers to bypass detection of malware via a modified RAR archive.
Per: http://iss.custhelp.com/cgi-bin/iss.cfg/php/enduser/std_adp.php?p_faqid=5417
Although the Virus Prevention System technology was, at one time, incorporated into the IBM Proventia Network MFS and the Proventia Network Mail appliances, this capability was removed in Jan 2008. For this reason, this vulnerability does not apply to these product lines.
The Virus Prevention System technology is currently incorporated into Proventia Desktop. However, the Proventia Desktop product is not affected by this evasion.
No other IBM ISS products currently incorporate the Virus Prevention System technology.
[http://blog.zoller.lu/2009/04/ibm-proventia-evasion-limited-details.html]
[http://iss.custhelp.com/cgi-bin/iss.cfg/php/enduser/std_adp.php?p_faqid=5417]
[20090402 [TZO-06-2009] IBM Proventia - Generic bypass (Limited disclosure - see details)]
[20090715 Update: [TZO-06-2009] IBM Proventia - Generic bypass (Limited disclosure - see details)]
[20090716 Re[2]: Update: [TZO-06-2009] IBM Proventia - Generic bypass (Limited disclosure - see details)]
[20090716 Re: Update: [TZO-06-2009] IBM Proventia - Generic bypass (Limited disclosure - see details)]
[34345]
Unspecified vulnerability in ClamAV before 0.95 allows remote attackers to bypass detection of malware via a modified RAR archive.
[http://blog.zoller.lu/2009/04/clamav-094-and-below-evasion-and-bypass.html]
[APPLE-SA-2009-09-10-2]
[SUSE-SR:2009:009]
[http://support.apple.com/kb/HT3865]
[MDVSA-2009:097]
[[oss-security] 20090407 Re: CVE request: clamav clamd and clamscan DoS and bypass by malformated archive]
[20090402 [TZO-05-2009] Clamav 0.94 and below - Evasion /bypass]
[34344]
[ADV-2009-0934]
The vmx_set_msr function in arch/x86/kvm/vmx.c in the VMX implementation in the KVM subsystem in the Linux kernel before 2.6.29.1 on the i386 platform allows guest OS users to cause a denial of service (OOPS) by setting the EFER_LME (aka "Long mode enable") bit in the Extended Feature Enable Register (EFER) model-specific register, which is specific to the x86_64 platform.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=16175a796d061833aacfbd9672235f2d2725df65]
[SUSE-SA:2009:031]
[SUSE-SA:2009:032]
[[oss-security] 20090401 CVE request: kernel: KVM: VMX: Dont allow uninhibited access to EFER on i386]
[http://patchwork.kernel.org/patch/15549/]
[http://vigilance.fr/vulnerability/Linux-kernel-denial-of-service-via-EFER-8585]
[http://wiki.rpath.com/Advisories:rPSA-2009-0084]
[DSA-1787]
[DSA-1800]
[http://www.globalsecuritymag.com/Vigil-nce-Linux-kernel-denial-of,20090402,8311]
[http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.29.1]
[http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.29-git1.log]
[20090516 rPSA-2009-0084-1 kernel]
[34331]
[USN-793-1]
[ADV-2009-0924]
[https://bugzilla.redhat.com/show_bug.cgi?id=502109]
[linux-kernel-eferlme-dos(49594)]
[FEDORA-2009-5356]
net/ipv4/udp.c in the Linux kernel before 2.6.29.1 performs an unlocking step in certain incorrect circumstances, which allows local users to cause a denial of service (panic) by reading zero bytes from the /proc/net/udp file and unspecified other files, related to the "udp seq_file infrastructure."
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=30842f2989aacfaba3ccb39829b3417be9313dbe]
[[oss-security] 20090401 CVE request: kernel: udp: Wrong locking code in udp seq_file infrastructure]
[http://vigilance.fr/vulnerability/Linux-kernel-denial-of-service-via-proc-net-udp-8586]
[http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.29.1]
[34329]
[ADV-2009-0924]
[linux-kernel-procnetudp-dos(49595)]
Unspecified vulnerability in the virtual machine display function in VMware Workstation 6.5.1 and earlier; VMware Player 2.5.1 and earlier; VMware ACE 2.5.1 and earlier; VMware Server 1.x before 1.0.9 build 156507 and 2.x before 2.0.1 build 156745; VMware Fusion before 2.0.4 build 159196; VMware ESXi 3.5; and VMware ESX 3.0.2, 3.0.3, and 3.5 allows guest OS users to execute arbitrary code on the host OS via unknown vectors, a different vulnerability than CVE-2008-4916.
[[security-announce] 20090410 VMSA-2009-0006 VMware Hosted products and patches for ESX and ESXi resolve a critical security vulnerability]
[GLSA-201209-25]
[20090410 VMSA-2009-0006 VMware Hosted products and patches for ESX and ESXi resolve a critical security vulnerability]
[34471]
[1022031]
[http://www.vmware.com/security/advisories/VMSA-2009-0006.html]
[ADV-2009-0944]
[vmware-virtualmachine-code-execution(49834)]
[oval:org.mitre.oval:def:6065]
Multiple SQL injection vulnerabilities in the insert_to_pastebin function in php/cccp-admin/inc/functions.php in CCCP Community Clan Portal Pastebin before 2.80 allow remote attackers to execute arbitrary SQL commands via the (1) subject, (2) language, and (3) nickname parameters to php/cccp-pages/submit.php. NOTE: some of these details are obtained from third party information.
[http://jcsfog.cvs.sourceforge.net/viewvc/jcsfog/CCCP-Pastebin/php/cccp-admin/inc/functions.php?r1=1.10&r2=1.11]
[http://sourceforge.net/project/shownotes.php?release_id=670960]
[34264]
[communitycode-submit-sql-injection(49426)]
Multiple directory traversal vulnerabilities in Blogplus 1.0 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) row_mysql_blocks_center_down[file] parameter to includes/block_center_down.php; (2) row_mysql_blocks_center_top[file] includes/parameter to block_center_top.php; (3) row_mysql_blocks_left[file] parameter to includes/block_left.php; (4) row_mysql_blocks_right[file] parameter to includes/block_right.php; and row_mysql_bloginfo[theme] parameter to (5) includes/window_down.php and (6) includes/window_top.php.
[34261]
[blogplus-file-theme-file-include(49446)]
[8290]
SQL injection vulnerability in login.php in Acute Control Panel 1.0.0 allows remote attackers to execute arbitrary SQL commands via the username parameter.
[34265]
[acutecontrol-login-sql-injection(49444)]
[8291]
Multiple PHP remote file inclusion vulnerabilities in Acute Control Panel 1.0.0 allow remote attackers to execute arbitrary PHP code via a URL in the theme_directory parameter to (1) container.php and (2) header.php in themes/.
[34265]
[acutecontrol-themedirectory-file-include(49443)]
[8291]
Cross-site scripting (XSS) vulnerability in Feed element mapper 5.x before 5.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the content title in admin/content/node-type/nodetype/map.
[http://drupal.org/node/414644]
[http://drupal.org/node/414702]
[34266]
The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remote attackers to cause a denial of service (system crash) via an RX response with a large error-code value that is interpreted as a pointer and dereferenced, related to use of the ERR_PTR macro.
[GLSA-201101-05]
[DSA-1768]
[MDVSA-2009:099]
[http://www.openafs.org/security/openafs-sa-2009-002.patch]
[http://www.openafs.org/security/OPENAFS-SA-2009-002.txt]
[34404]
[ADV-2009-0984]
[ADV-2011-0117]
[http://www-01.ibm.com/support/docview.wss?uid=swg21396389]
[ID71123]
Heap-based buffer overflow in the cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58 on Unix platforms allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via an RX response containing more data than specified in a request, related to use of XDR arrays.
[GLSA-201101-05]
[DSA-1768]
[MDVSA-2009:099]
[http://www.openafs.org/security/openafs-sa-2009-001.patch]
[http://www.openafs.org/security/OPENAFS-SA-2009-001.txt]
[34407]
[ADV-2009-0984]
[ADV-2011-0117]
Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.
[NetBSD-SA2009-006]
[SUSE-SR:2009:011]
[RHSA-2009:1039]
[RHSA-2009:1040]
[FreeBSD-SA-09:11]
[SSA:2009-154-01]
[http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0092]
[DSA-1801]
[GLSA-200905-08]
[VU#853097]
[MDVSA-2009:117]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[35017]
[1022243]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-1361]
[ADV-2009-3316]
[https://bugzilla.redhat.com/show_bug.cgi?id=499694]
[https://launchpad.net/bugs/cve/2009-1252]
[oval:org.mitre.oval:def:11231]
[oval:org.mitre.oval:def:6307]
[https://support.ntp.org/bugs/show_bug.cgi?id=1151]
[USN-777-1]
[FEDORA-2009-5674]
[FEDORA-2009-5273]
[FEDORA-2009-5275]
James Stone Tunapie 2.1 allows local users to overwrite arbitrary files via a symlink attack on an unspecified temporary file.
[DSA-1764]
[34417]
[ADV-2009-0972]
[https://launchpad.net/bugs/314591]
[https://launchpad.net/bugs/cve/2009-1253]
James Stone Tunapie 2.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a stream URL.
[DSA-1764]
[34418]
[ADV-2009-0972]
[https://launchpad.net/bugs/314591]
[https://launchpad.net/bugs/cve/2009-1254]
The process_stat function in (1) Memcached before 1.2.8 and (2) MemcacheDB 1.2.0 discloses (a) the contents of /proc/self/maps in response to a stats maps command and (b) memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain sensitive information such as the locations of memory regions, and defeat ASLR protection, by sending a command to the daemon's TCP port.
[20090428 Positron Security Advisory #2009-001: Memcached and MemcacheDB ASLR Bypass Weakness]
[http://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98&r=98]
[http://code.google.com/p/memcachedb/source/detail?r=98]
[http://code.google.com/p/memcachedb/source/diff?spec=svn98&r=98&format=side&path=/trunk/memcachedb.c]
[http://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40e]
[MDVSA-2009:105]
[http://www.positronsecurity.com/advisories/2009-001.html]
[20090428 Positron Security Advisory #2009-001: Memcached and MemcacheDB ASLR Bypass Weakness]
[34756]
[1022140]
[ADV-2009-1196]
[ADV-2009-1197]
[memcachedb-procselfmaps-info-disclosure(50221)]
[FEDORA-2009-4199]
[FEDORA-2009-4542]
SQL injection vulnerability in FlexCMS 2.5 allows remote attackers to execute arbitrary SQL commands via the ItemId parameter. NOTE: some of these details are obtained from third party information.
[34394]
[flexcms-itemid-sql-injection(49680)]
[8355]
Heap-based buffer overflow in Magic ISO Maker 5.5 build 0274 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted CCD file.
[34574]
[ADV-2009-0940]
[magiciso-ccd-bo(49673)]
[8343]
SQL injection vulnerability in the RD-Autos (com_rdautos) component 1.5.7 for Joomla! allows remote attackers to execute arbitrary SQL commands via the makeid parameter in index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[34364]
[rdautos-makeid-sql-injection(49671)]
SQL injection vulnerability in inc/bb/topic.php in Insane Visions AdaptBB 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the topic_id parameter in a topic action to index.php.
[34371]
[adaptbb-topic-sql-injection(49681)]
[8351]
Multiple stack-based buffer overflows in UltraISO 9.3.3.2685 and earlier allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted (1) CCD or (2) IMG file.
[34363]
[ADV-2009-0935]
[ultraiso-ccd-img-bo(49672)]
[8343]
Multiple cross-site scripting (XSS) vulnerabilities in Web Help Desk 9.1.22 (evaluation version) allow remote attackers to inject arbitrary web script or HTML via the (1) Report Name, (2) Asset No., and (3) Full Name fields in a Models action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[34391]
[webhelpdesk-multiple-form-xss(49683)]
Format string vulnerability in Fortinet FortiClient 3.0.614, and possibly earlier, allows local users to execute arbitrary code via format string specifiers in the VPN connection name.
[20090402 Layered Defense Research Advisory: Format String Vulnerability: FortiClient Version 3]
[http://www.layereddefense.com/FortiClient02Apr.html]
[20090402 Layered Defense Research Advisory: Format String Vulnerability: FortiClient Version 3]
[20090410 Re: Layered Defense Research Advisory: Format String Vulnerability: FortiClient Version 3]
[34343]
[1021966]
[ADV-2009-0941]
[forticlient-vpn-format-string(49633)]
SQL injection vulnerability in sub_commententry.php in the BookJoomlas (com_bookjoomlas) component 0.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the gbid parameter in a comment action to index.php.
[34392]
[ADV-2009-0952]
[bookjoomlas-index-sql-injection(49682)]
[8353]
Frontend User Registration (sr_feuser_register) extension 2.5.20 and earlier for TYPO3 does not properly verify access rights, which allows remote authenticated users to obtain sensitive information such as passwords via unknown attack vectors.
[http://typo3.org/extensions/repository/view/sr_feuser_register/2.5.21/]
[http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-004/]
[34374]
[ADV-2009-0938]
Integer overflow in rose_sendmsg (sys/net/af_rose.c) in the Linux kernel 2.6.24.4, and other versions before 2.6.30-rc1, might allow remote attackers to obtain sensitive information via a large length value, which causes "garbage" memory to be sent.
[http://bugzilla.kernel.org/show_bug.cgi?id=10423]
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=83e0bbcbe2145f160fbaa109b0439dae7f4a38a9]
[SUSE-SA:2009:028]
[SUSE-SA:2009:030]
[SUSE-SA:2009:031]
[SUSE-SA:2009:032]
[DSA-1787]
[DSA-1794]
[DSA-1800]
[MDVSA-2009:119]
[MDVSA-2009:135]
[[oss-security] 20090408 CVE-2009-1265 kernel: af_rose/x25: Sanity check the maximum user frame size]
[34654]
[USN-793-1]
Unspecified vulnerability in Wireshark before 1.0.7 has unknown impact and attack vectors.
[SUSE-SR:2009:011]
[http://wiki.rpath.com/Advisories:rPSA-2009-0062]
[20090417 rPSA-2009-0062-1 tshark wireshark]
[wireshark-unspecified(50334)]
Unspecified vulnerability in the LDAP dissector in Wireshark 0.99.2 through 1.0.6, when running on Windows, allows remote attackers to cause a denial of service (crash) via unknown attack vectors.
[SUSE-SR:2009:011]
[http://wiki.rpath.com/Advisories:rPSA-2009-0062]
[20090417 rPSA-2009-0062-1 tshark wireshark]
[34457]
[1022027]
[http://www.wireshark.org/security/wnpa-sec-2009-02.html]
[wireshark-ldap-home-dos(49814)]
[oval:org.mitre.oval:def:6099]
The Check Point High-Availability Protocol (CPHAP) dissector in Wireshark 0.9.6 through 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted FWHA_MY_STATE packet.
[SUSE-SR:2009:011]
[http://wiki.rpath.com/Advisories:rPSA-2009-0062]
[DSA-1785]
[DSA-1942]
[MDVSA-2009:088]
[RHSA-2009:1100]
[20090417 rPSA-2009-0062-1 tshark wireshark]
[34457]
[1022027]
[http://www.wireshark.org/security/wnpa-sec-2009-02.html]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3269]
[wireshark-cphap-dos(49815)]
[oval:org.mitre.oval:def:10876]
[oval:org.mitre.oval:def:5335]
[FEDORA-2009-3599]
[FEDORA-2009-5339]
[FEDORA-2009-5382]
Unspecified vulnerability in Wireshark 0.99.6 through 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted Tektronix .rf5 file.
[SUSE-SR:2009:011]
[http://wiki.rpath.com/Advisories:rPSA-2009-0062]
[DSA-1785]
[MDVSA-2009:088]
[RHSA-2009:1100]
[20090417 rPSA-2009-0062-1 tshark wireshark]
[34457]
[1022027]
[http://www.wireshark.org/security/wnpa-sec-2009-02.html]
[wireshark-rf5file-dos(49816)]
[oval:org.mitre.oval:def:10642]
[oval:org.mitre.oval:def:5748]
[FEDORA-2009-3599]
[FEDORA-2009-5339]
[FEDORA-2009-5382]
libclamav/untar.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (infinite loop) via a crafted TAR file that causes (1) clamd and (2) clamscan to hang.
[APPLE-SA-2009-09-10-2]
[http://support.apple.com/kb/HT3865]
[DSA-1771]
[MDVSA-2009:097]
[[oss-security] 20090407 Re: CVE request: clamav clamd and clamscan DoS and bypass by malformated archive]
[34357]
[USN-754-1]
[ADV-2009-0934]
[clamav-untar-dos(49846)]
[https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1462]
The JSON_parser function (ext/json/JSON_parser.c) in PHP 5.2.x before 5.2.9 allows remote attackers to cause a denial of service (segmentation fault) via a malformed string to the json_decode API function.
[http://cvs.php.net/viewvc.cgi/php-src/ext/json/JSON_parser.c?r1=1.1.2.14&r2=1.1.2.15]
[APPLE-SA-2009-09-10-2]
[SUSE-SR:2009:012]
[http://support.apple.com/kb/HT3865]
[DSA-1775]
[DSA-1789]
[MDVSA-2009:090]
[[oss-security] 20090401 CVE request: PHP 5.2.9]
[http://www.php.net/releases/5_2_9.php]
[RHSA-2009:0350]
[USN-761-2]
[USN-761-1]
[FEDORA-2009-3768]
[FEDORA-2009-3848]
The php_zip_make_relative_path function in php_zip.c in PHP 5.2.x before 5.2.9 allows context-dependent attackers to cause a denial of service (crash) via a ZIP file that contains filenames with relative paths, which is not properly handled during extraction.
[http://cvs.php.net/viewvc.cgi/php-src/ext/zip/php_zip.c?r1=1.1.2.48&r2=1.1.2.49]
[APPLE-SA-2009-09-10-2]
[SUSE-SR:2009:012]
[HPSBMA02447]
[http://support.apple.com/kb/HT3865]
[[oss-security] 20090401 CVE request: PHP 5.2.9]
[[oss-security] 20090409 Re: CVE request: PHP 5.2.9]
[http://www.php.net/releases/5_2_9.php]
pam_ssh 1.92 and possibly other versions, as used when PAM is compiled with USE=ssh, generates different error messages depending on whether the username is valid or invalid, which makes it easier for remote attackers to enumerate usernames.
[http://bugs.gentoo.org/show_bug.cgi?id=263579]
[FEDORA-2009-3500]
[FEDORA-2009-3627]
Integer overflow in the qt_error parse_trak_atom function in demuxers/demux_qt.c in xine-lib 1.1.16.2 and earlier allows remote attackers to execute arbitrary code via a Quicktime movie file with a large count value in an STTS atom, which triggers a heap-based buffer overflow.
[http://bugs.xine-project.org/show_bug.cgi?id=224]
[SUSE-SR:2009:011]
[http://sourceforge.net/project/shownotes.php?group_id=9655&release_id=673233]
[MDVSA-2009:298]
[MDVSA-2009:299]
[20090404 [TKADV2009-005] xine-lib Quicktime STTS Atom Integer Overflow]
[34384]
[1021989]
[http://www.trapkit.de/advisories/TKADV2009-005.txt]
[ADV-2009-0937]
[xinelib-demuxqt-bo(49714)]
[FEDORA-2009-3428]
[FEDORA-2009-3433]
Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain circumstances, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via unspecified vectors, related to the (1) tiles:putAttribute and (2) tiles:insertTemplate JSP tags.
[http://svn.apache.org/viewvc/tiles/framework/trunk/src/site/apt/security/security-bulletin-1.apt?revision=741913]
[34657]
[https://issues.apache.org/struts/browse/TILES-351]
XScreenSaver in Sun Solaris 10 and OpenSolaris before snv_109, and Solaris 8 and 9 with GNOME 2.0 or 2.0.2, allows physically proximate attackers to obtain sensitive information by reading popup windows, which are displayed even when the screen is locked, as demonstrated by Thunderbird new-mail notifications.
[1022009]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-120094-22-1]
[255308]
[34421]
[ADV-2009-0978]
SQL injection vulnerability in index.php in Gravity Board X (GBX) 2.0 BETA allows remote attackers to execute arbitrary SQL commands via the member_id parameter in a viewprofile action. NOTE: the board_id issue is already covered by CVE-2008-2996.2.
[34370]
[gravityboardx-index-sql-injection(49678)]
[8350]
Static code injection vulnerability in forms/ajax/configure.php in Gravity Board X (GBX) 2.0 BETA allows remote attackers to inject arbitrary PHP code into config.php via the configure action to index.php.
[34370]
[gravityboardx-index-code-execution(49679)]
[8350]
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.5 through 1.5.9 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the (1) com_admin component, (2) com_search component when "Gather Search Statistics" is enabled, and (3) the category view in the com_content component.
[http://developer.joomla.org/security/news/293-20090301-core-multiple-xsscsrf.html]
[http://developer.joomla.org/security/news/294-20090302-core-comcontent-xss.html]
[34360]
[content-categoryview-xss(49654)]
[admin-search-unspecified-xss(49655)]
Multiple cross-site request forgery (CSRF) vulnerabilities in the com_media component for Joomla! 1.5.x through 1.5.9 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
[http://developer.joomla.org/security/news/293-20090301-core-multiple-xsscsrf.html]
[media-unspecified-csrf(49656)]
Cross-site scripting (XSS) vulnerability in glFusion before 1.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://www.glfusion.org/article.php/glfusion113]
[34377]
SQL injection vulnerability in private/system/lib-session.php in glFusion 1.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the glf_session cookie parameter.
[20090403 glFusion <= 1.1.2 COM_applyFilter()/cookies remote blind sql]
[http://retrogod.altervista.org/9sg_glfuso_sql_cookies.html]
[http://www.glfusion.org/wiki/doku.php?id=glfusion:whatsnew]
[34361]
[glfusion-libsession-sql-injection(49652)]
[8347]
glFusion before 1.1.3 performs authentication with a user-provided password hash instead of a password, which allows remote attackers to gain privileges by obtaining the hash and using it in the glf_password cookie, aka "User Masquerading." NOTE: this can be leveraged with a separate SQL injection vulnerability to steal hashes.
[20090403 glFusion <= 1.1.2 COM_applyFilter()/cookies remote blind sql]
[http://retrogod.altervista.org/9sg_glfuso_sql_cookies.html]
[http://www.glfusion.org/article.php/glfusion113]
[http://www.glfusion.org/wiki/doku.php?id=glfusion:whatsnew]
[8347]
Buffer overflow in BibTeX 0.99 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a long .bib bibliography file.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=520920]
[GLSA-201206-28]
[[oss-security] 20090401 CVE request -- bibtex, pam_ssh]
[USN-937-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=492136]
[FEDORA-2009-10730]
[FEDORA-2009-10857]
Static code injection vulnerability in the getConfigFile function in setup/lib/ConfigFile.class.php in phpMyAdmin 3.x before 3.1.3.2 allows remote attackers to inject arbitrary PHP code into configuration files.
[http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/setup/lib/ConfigFile.class.php?r1=12248&r2=12301&pathrev=12342]
[http://www.phpmyadmin.net/home_page/security/PMASA-2009-4.php]
[34526]
[ADV-2009-1045]
[FEDORA-2009-3692]
[FEDORA-2009-3700]
The IMAP task in the server in IBM Lotus Domino 8.0.2 before FP1 IF1 and 8.5 before IF3 allows remote attackers to cause a denial of service (daemon crash) via a MIME e-mail message with RFC822 attachments (aka blobs) containing malformed root entities.
[1022024]
[34441]
[ADV-2009-0986]
[http://www-01.ibm.com/support/docview.wss?uid=swg21379894]
[http://www-01.ibm.com/support/docview.wss?uid=swg21379915]
[http://www-01.ibm.com/support/docview.wss?uid=swg21381562]
[http://www-01.ibm.com/support/docview.wss?uid=swg21381566]
Cross-site scripting (XSS) vulnerability in Cisco Subscriber Edge Services Manager (SESM) allows remote attackers to inject arbitrary web script or HTML via the URI. NOTE: some of these details are obtained from third party information.
[1022030]
[34454]
[http://www.xc0re.net/index.php?p=1_17_Cisco-Subscriber-Edge-Services-Manager-Multiple-Vulnerabilities]
[sesm-unspecified-xss(50349)]
Multiple cross-site scripting (XSS) vulnerabilities in the Advanced Management Module (AMM) on the IBM BladeCenter, including the BladeCenter H with BPET36H 54, allow remote attackers to inject arbitrary web script or HTML via (1) the username in a login action or (2) the PATH parameter to private/file_management.ssi in the File manager.
[1022025]
[http://www.louhinetworks.fi/advisory/ibm_090409.txt]
[20090409 IBM BladeCenter Advanced Management Module Multiple vulnerabilities]
[34447]
private/login.ssi in the Advanced Management Module (AMM) on the IBM BladeCenter, including the BladeCenter H with BPET36H 54, allows remote attackers to discover the access roles and scopes of arbitrary user accounts via a modified WEBINDEX parameter.
[1022025]
[http://www.louhinetworks.fi/advisory/ibm_090409.txt]
[20090409 IBM BladeCenter Advanced Management Module Multiple vulnerabilities]
[34447]
Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration interface in the Advanced Management Module (AMM) on the IBM BladeCenter, including the BladeCenter H with BPET36H 54, allow remote attackers to hijack the authentication of administrators, as demonstrated by a power-off request to the private/blade_power_action script.
[1022025]
[http://www.louhinetworks.fi/advisory/ibm_090409.txt]
[20090409 IBM BladeCenter Advanced Management Module Multiple vulnerabilities]
[34447]
Stack-based buffer overflow in TIBCO SmartSockets before 6.8.2, SmartSockets Product Family (aka RTworks) before 4.0.5, and Enterprise Message Service (EMS) 4.0.0 through 5.1.1, as used in SmartSockets Server and RTworks Server (aka RTserver), SmartSockets client libraries and add-on products, RTworks libraries and components, EMS Server (aka tibemsd), SmartMQ, iProcess Engine, ActiveMatrix products, and CA Enterprise Communicator, allows remote attackers to execute arbitrary code via "inbound data," as demonstrated by requests to the UDP interface of the RTserver component, and data injection into the TCP stream to tibemsd.
[20090428 TIBCO SmartSockets Stack Buffer Overflow Vulnerability]
[1022129]
[http://www.harmonysecurity.com/blog/2009/04/tibco-smartsockets-stack-buffer.html]
[34754]
[http://www.tibco.com/multimedia/security_advisory_ems_tcm8-7558.txt]
[http://www.tibco.com/multimedia/security_advisory_rtworks_tcm8-7559.txt]
[http://www.tibco.com/multimedia/security_advisory_smartsockets_tcm8-7560.txt]
[http://www.tibco.com/services/support/advisories/default.jsp]
[http://www.tibco.com/services/support/advisories/smartsockets-sspfm-ems_advisory_20090428.jsp]
[ADV-2009-1198]
[smartsockets-udp-bo(50214)]
UCM-CQ in IBM Rational ClearCase 7.0.0.x before 7.0.0.5, 7.0.1.x before 7.0.1.4, and 7.1.x before 7.1.0.1 on Linux and AIX places a username and password on the command line, which allows local users to obtain credentials by listing the process.
[34483]
[1022035]
[ADV-2009-1017]
[PK75832]
[clearcase-ucmcq-information-disclosure(49836)]
The web login functionality (c/portal/login) in Novell Teaming 1.0 through SP3 (1.0.3) generates different error messages depending on whether the username is valid or invalid, which makes it easier for remote attackers to enumerate usernames.
[http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=7002997&sliceId=1&docTypeID=DT_TID_1_1&dialogID=33090060&stateId=1%200%2033084737]
[20090415 SEC Consult SA-20090415-0 :: Multiple Vulnerabilities in Novell Teaming]
[34531]
[1022063]
[ADV-2009-1048]
[https://www.sec-consult.com/files/20090415-0-novell-teaming.txt]
Multiple cross-site scripting (XSS) vulnerabilities in web/guest/home in the Liferay 4.3.0 portal in Novell Teaming 1.0 through SP3 (1.0.3) allow remote attackers to inject arbitrary web script or HTML via the (1) p_p_state or (2) p_p_mode parameters.
[http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=7002999&sliceId=1&docTypeID=DT_TID_1_1&dialogID=33090060&stateId=1%200%2033084737]
[20090415 SEC Consult SA-20090415-0 :: Multiple Vulnerabilities in Novell Teaming]
[34531]
[1022063]
[ADV-2009-1048]
[https://www.sec-consult.com/files/20090415-0-novell-teaming.txt]
Apport before 0.108.4 on Ubuntu 8.04 LTS, before 0.119.2 on Ubuntu 8.10, and before 1.0-0ubuntu5.2 on Ubuntu 9.04 does not properly remove files from the application's crash-report directory, which allows local users to delete arbitrary files via unspecified vectors.
[SUSE-SR:2009:010]
[34776]
[USN-768-1]
[https://bugs.launchpad.net/bugs/357024]
[https://launchpad.net/bugs/cve/2009-1295]
The eCryptfs support utilities (ecryptfs-utils) 73-0ubuntu6.1 on Ubuntu 9.04 stores the mount passphrase in installation logs, which might allow local users to obtain access to the filesystem by reading the log files from disk. NOTE: the log files are only readable by root.
[1022347]
[USN-783-1]
[ecryptfs-passphrase-info-disclosure(51191)]
iscsi_discovery in open-iscsi in SUSE openSUSE 10.3 through 11.1 and SUSE Linux Enterprise (SLE) 10 SP2 and 11, and other operating systems, allows local users to overwrite arbitrary files via a symlink attack on an unspecified temporary file that has a predictable name.
[SUSE-SR:2009:016]
[MDVSA-2013:109]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0241]
The ip_frag_reasm function in net/ipv4/ip_fragment.c in the Linux kernel 2.6.32-rc8, and 2.6.29 and later versions before 2.6.32, calls IP_INC_STATS_BH with an incorrect argument, which allows remote attackers to cause a denial of service (NULL pointer dereference and hang) via long IP packets, possibly related to the ip_defrag function.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=bbf31bf18d34caa87dd01f08bf713635593697f2]
[SUSE-SA:2010:001]
[http://twitter.com/spendergrsec/statuses/6339560349]
[http://wiki.rpath.com/Advisories:rPSA-2009-0161]
[http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.32]
[MDVSA-2009:329]
[20091216 rPSA-2009-0161-1 hwdata kernel]
[http://www.theregister.co.uk/2009/12/11/linux_kernel_bugs_patched/]
[USN-869-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=544144]
[FEDORA-2009-12786]
[FEDORA-2009-12825]
The pa_make_secure_dir function in core-util.c in PulseAudio 0.9.10 and 0.9.19 allows local users to change the ownership and permissions of arbitrary files via a symlink attack on a /tmp/.esd-##### temporary file.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=573615]
[http://git.0pointer.de/?p=pulseaudio.git;a=patch;h=d3efa43d85ac132c6a5a416a2b6f2115f5d577ee]
[DSA-2017]
[MDVSA-2010:124]
[ADV-2010-1570]
[https://bugs.edge.launchpad.net/ubuntu/+source/pulseaudio/+bug/509008]
apt 0.7.20 does not check when the date command returns an "invalid date" error, which can prevent apt from loading security updates in time zones for which DST occurs at midnight.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=523213]
[DSA-1779]
[[oss-security] 20090408 CVE request: apt]
[https://bugs.launchpad.net/ubuntu/+source/coreutils/+bug/354793]
[USN-762-1]
Integer signedness error in the store_id3_text function in the ID3v2 code in mpg123 before 1.7.2 allows remote attackers to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via an ID3 tag with a negative encoding value. NOTE: some of these details are obtained from third party information.
[http://bugs.gentoo.org/show_bug.cgi?id=265342]
[[mpg123-devel] 20090405 mpg123 1.7.2 is out -- important security fix!]
[http://sourceforge.net/project/shownotes.php?release_id=673696]
[GLSA-200904-15]
[MDVSA-2009:093]
[34381]
[ADV-2009-0936]
The browser engine in Mozilla Firefox 3.x before 3.0.9, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (application crash) and possibly trigger memory corruption via vectors related to (1) nsAsyncInstantiateEvent::Run, (2) nsStyleContext::Destroy, (3) nsComputedDOMStyle::GetWidth, (4) the xslt_attributeset_ImportSameName.html test case for the XSLT stylesheet compiler, (5) nsXULDocument::SynchronizeBroadcastListener, (6) IsBindingAncestor, (7) PL_DHashTableOperate and nsEditor::EndUpdateViewBatch, and (8) gfxSkipCharsIterator::SetOffsets, and other vectors.
[SUSE-SR:2009:010]
[264308]
[DSA-1797]
[DSA-1830]
[MDVSA-2009:111]
[MDVSA-2009:141]
[http://www.mozilla.org/security/announce/2009/mfsa2009-14.html]
[RHSA-2009:0436]
[34656]
[1022090]
[SSA:2009-178-01]
[ADV-2009-1125]
[https://bugzilla.mozilla.org/show_bug.cgi?id=428113]
[https://bugzilla.mozilla.org/show_bug.cgi?id=431260]
[https://bugzilla.mozilla.org/show_bug.cgi?id=432114]
[https://bugzilla.mozilla.org/show_bug.cgi?id=454276]
[https://bugzilla.mozilla.org/show_bug.cgi?id=461053]
[https://bugzilla.mozilla.org/show_bug.cgi?id=462517]
[https://bugzilla.mozilla.org/show_bug.cgi?id=467881]
[https://bugzilla.mozilla.org/show_bug.cgi?id=477775]
[https://bugzilla.mozilla.org/show_bug.cgi?id=483444]
[oval:org.mitre.oval:def:10106]
[oval:org.mitre.oval:def:5527]
[oval:org.mitre.oval:def:6070]
[oval:org.mitre.oval:def:6170]
[oval:org.mitre.oval:def:7030]
[USN-764-1]
[FEDORA-2009-3875]
The browser engine in Mozilla Firefox before 3.0.9, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (application crash) and possibly trigger memory corruption via vectors related to nsSVGElement::BindToTree.
[SUSE-SR:2009:010]
[RHSA-2009:0437]
[264308]
[DSA-1797]
[DSA-1830]
[MDVSA-2009:111]
[MDVSA-2009:141]
[http://www.mozilla.org/security/announce/2009/mfsa2009-14.html]
[RHSA-2009:0436]
[RHSA-2009:1125]
[RHSA-2009:1126]
[34656]
[1022090]
[SSA:2009-178-01]
[USN-782-1]
[ADV-2009-1125]
[https://bugzilla.mozilla.org/show_bug.cgi?id=453736]
[oval:org.mitre.oval:def:5810]
[oval:org.mitre.oval:def:5992]
[oval:org.mitre.oval:def:6151]
[oval:org.mitre.oval:def:6646]
[oval:org.mitre.oval:def:9455]
[USN-764-1]
[FEDORA-2009-3875]
The JavaScript engine in Mozilla Firefox 3.x before 3.0.9, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (application crash) and possibly trigger memory corruption via vectors involving (1) js_FindPropertyHelper, related to the definitions of Math and Date; and (2) js_CheckRedeclaration.
[SUSE-SR:2009:010]
[264308]
[DSA-1797]
[MDVSA-2009:111]
[MDVSA-2009:141]
[http://www.mozilla.org/security/announce/2009/mfsa2009-14.html]
[RHSA-2009:0436]
[34656]
[1022090]
[SSA:2009-178-01]
[ADV-2009-1125]
[https://bugzilla.mozilla.org/show_bug.cgi?id=461158]
[https://bugzilla.mozilla.org/show_bug.cgi?id=475971]
[oval:org.mitre.oval:def:5319]
[oval:org.mitre.oval:def:5480]
[oval:org.mitre.oval:def:6015]
[oval:org.mitre.oval:def:7516]
[oval:org.mitre.oval:def:9535]
[USN-764-1]
[FEDORA-2009-3875]
The JavaScript engine in Mozilla Firefox before 3.0.9, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (application crash) and possibly trigger memory corruption via vectors involving JSOP_DEFVAR and properties that lack the JSPROP_PERMANENT attribute.
[SUSE-SR:2009:010]
[RHSA-2009:0437]
[264308]
[DSA-1797]
[MDVSA-2009:111]
[MDVSA-2009:141]
[http://www.mozilla.org/security/announce/2009/mfsa2009-14.html]
[RHSA-2009:0436]
[RHSA-2009:1125]
[RHSA-2009:1126]
[34656]
[1022090]
[SSA:2009-178-01]
[USN-782-1]
[ADV-2009-1125]
[https://bugzilla.mozilla.org/show_bug.cgi?id=476049]
[oval:org.mitre.oval:def:10110]
[oval:org.mitre.oval:def:6090]
[oval:org.mitre.oval:def:6232]
[oval:org.mitre.oval:def:6248]
[oval:org.mitre.oval:def:6921]
[USN-764-1]
[FEDORA-2009-3875]
The jar: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not follow the Content-Disposition header of the inner URI, which allows remote attackers to conduct cross-site scripting (XSS) attacks and possibly other attacks via an uploaded .jar file with a "Content-Disposition: attachment" designation.
[SUSE-SR:2009:010]
[RHSA-2009:0437]
[264308]
[DSA-1797]
[MDVSA-2009:111]
[MDVSA-2009:141]
[http://www.mozilla.org/security/announce/2009/mfsa2009-16.html]
[RHSA-2009:0436]
[RHSA-2009:1125]
[RHSA-2009:1126]
[34656]
[1022095]
[USN-782-1]
[ADV-2009-1125]
[https://bugzilla.mozilla.org/show_bug.cgi?id=474536]
[oval:org.mitre.oval:def:10150]
[oval:org.mitre.oval:def:6021]
[oval:org.mitre.oval:def:6194]
[oval:org.mitre.oval:def:6312]
[oval:org.mitre.oval:def:6710]
[USN-764-1]
[FEDORA-2009-3875]
The view-source: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not properly implement the Same Origin Policy, which allows remote attackers to (1) bypass crossdomain.xml restrictions and connect to arbitrary web sites via a Flash file; (2) read, create, or modify Local Shared Objects via a Flash file; or (3) bypass unspecified restrictions and render content via vectors involving a jar: URI.
[SUSE-SR:2009:010]
[RHSA-2009:0437]
[SSA:2009-176-01]
[264308]
[DSA-1797]
[DSA-1830]
[MDVSA-2009:111]
[MDVSA-2009:141]
[http://www.mozilla.org/security/announce/2009/mfsa2009-17.html]
[RHSA-2009:0436]
[RHSA-2009:1125]
[RHSA-2009:1126]
[34656]
[1022093]
[SSA:2009-178-01]
[USN-782-1]
[ADV-2009-1125]
[https://bugzilla.mozilla.org/show_bug.cgi?id=481342]
[oval:org.mitre.oval:def:10972]
[oval:org.mitre.oval:def:5933]
[oval:org.mitre.oval:def:6154]
[oval:org.mitre.oval:def:6266]
[oval:org.mitre.oval:def:7008]
[USN-764-1]
[FEDORA-2009-3875]
[FEDORA-2009-7567]
[FEDORA-2009-7614]
Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey allows remote attackers to inject arbitrary web script or HTML via vectors involving XBL JavaScript bindings and remote stylesheets, as exploited in the wild by a March 2009 eBay listing.
[SUSE-SR:2009:010]
[264308]
[DSA-1797]
[MDVSA-2009:111]
[MDVSA-2009:141]
[http://www.mozilla.org/security/announce/2009/mfsa2009-18.html]
[RHSA-2009:0436]
[RHSA-2009:1126]
[34656]
[1022097]
[http://www.theregister.co.uk/2009/03/08/ebay_scam_wizardy/]
[USN-782-1]
[ADV-2009-1125]
[https://bugzilla.mozilla.org/show_bug.cgi?id=481558]
[oval:org.mitre.oval:def:10428]
[oval:org.mitre.oval:def:6173]
[oval:org.mitre.oval:def:6185]
[oval:org.mitre.oval:def:6296]
[oval:org.mitre.oval:def:7285]
[USN-764-1]
[FEDORA-2009-3875]
Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey do not properly implement the Same Origin Policy for (1) XMLHttpRequest, involving a mismatch for a document's principal, and (2) XPCNativeWrapper.toString, involving an incorrect __proto__ scope, which allows remote attackers to conduct cross-site scripting (XSS) attacks and possibly other attacks via a crafted document.
[SUSE-SR:2009:010]
[RHSA-2009:0437]
[264308]
[DSA-1797]
[MDVSA-2009:111]
[MDVSA-2009:141]
[http://www.mozilla.org/security/announce/2009/mfsa2009-19.html]
[RHSA-2009:0436]
[RHSA-2009:1125]
[RHSA-2009:1126]
[34656]
[1022094]
[USN-782-1]
[ADV-2009-1125]
[https://bugzilla.mozilla.org/show_bug.cgi?id=478433]
[https://bugzilla.mozilla.org/show_bug.cgi?id=482206]
[oval:org.mitre.oval:def:5265]
[oval:org.mitre.oval:def:5591]
[oval:org.mitre.oval:def:6139]
[oval:org.mitre.oval:def:6831]
[oval:org.mitre.oval:def:9494]
[USN-764-1]
[FEDORA-2009-3875]
Cross-site scripting (XSS) vulnerability in the MozSearch plugin implementation in Mozilla Firefox before 3.0.9 allows user-assisted remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SearchForm element.
[SUSE-SR:2009:010]
[264308]
[DSA-1886]
[MDVSA-2009:111]
[http://www.mozilla.org/security/announce/2009/mfsa2009-20.html]
[RHSA-2009:0436]
[34656]
[1022097]
[ADV-2009-1125]
[https://bugzilla.mozilla.org/show_bug.cgi?id=483086]
[oval:org.mitre.oval:def:11520]
[oval:org.mitre.oval:def:6242]
[USN-764-1]
[FEDORA-2009-3875]
Mozilla Firefox before 3.0.9 and SeaMonkey before 1.1.17 allow user-assisted remote attackers to obtain sensitive information via a web page with an embedded frame, which causes POST data from an outer page to be sent to the inner frame's URL during a SAVEMODE_FILEONLY save of the inner frame.
[SUSE-SR:2009:010]
[RHSA-2009:0437]
[SSA:2009-176-01]
[264308]
[DSA-1797]
[MDVSA-2009:111]
[http://www.mozilla.org/security/announce/2009/mfsa2009-21.html]
[RHSA-2009:0436]
[34656]
[1022097]
[ADV-2009-1125]
[https://bugzilla.mozilla.org/show_bug.cgi?id=471962]
[oval:org.mitre.oval:def:10939]
[oval:org.mitre.oval:def:6200]
[oval:org.mitre.oval:def:6222]
[oval:org.mitre.oval:def:7235]
[USN-764-1]
[FEDORA-2009-3875]
[FEDORA-2009-7567]
[FEDORA-2009-7614]
Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header. NOTE: it was later reported that Firefox 3.6 a1 pre and Mozilla 1.7.x and earlier are also affected.
[http://ha.ckers.org/blog/20070309/firefox-header-redirection-javascript-execution/]
[SUSE-SR:2009:010]
[RHSA-2009:0437]
[264308]
[http://websecurity.com.ua/3275/]
[http://websecurity.com.ua/3386/]
[MDVSA-2009:111]
[http://www.mozilla.org/security/announce/2009/mfsa2009-22.html]
[RHSA-2009:0436]
[20090702 Cross-Site Scripting vulnerabilities in Mozilla, Internet Explorer, Opera and Chrome]
[20090703 Re: Cross-Site Scripting vulnerabilities in Mozilla, Internet Explorer, Opera and Chrome]
[34656]
[1022096]
[ADV-2009-1125]
[https://bugzilla.mozilla.org/show_bug.cgi?id=475636]
[oval:org.mitre.oval:def:6064]
[oval:org.mitre.oval:def:6131]
[oval:org.mitre.oval:def:6731]
[oval:org.mitre.oval:def:9818]
[USN-764-1]
[FEDORA-2009-3875]
The nsTextFrame::ClearTextRun function in layout/generic/nsTextFrameThebes.cpp in Mozilla Firefox 3.0.9 allows remote attackers to cause a denial of service (memory corruption) and probably execute arbitrary code via unspecified vectors. NOTE: this vulnerability reportedly exists because of an incorrect fix for CVE-2009-1302.
[1022126]
[1022127]
[SSA:2009-118-01]
[MDVSA-2009:111]
[http://www.mozilla.org/security/announce/2009/mfsa2009-23.html]
[34743]
[USN-765-1]
[ADV-2009-1180]
[https://bugzilla.mozilla.org/show_bug.cgi?id=489647]
[https://bugzilla.mozilla.org/show_bug.cgi?id=489676]
[https://bugzilla.mozilla.org/show_bug.cgi?id=490233]
[https://bugzilla.redhat.com/show_bug.cgi?id=497447]
[oval:org.mitre.oval:def:10446]
[RHSA-2009:0449]
body.asp in Web File Explorer 3.1 allows remote attackers to create arbitrary files and execute arbitrary code via the savefile action with a file parameter containing a filename that has an executable extension.
[webfileexplorer-body-code-execution(50389)]
[8382]
Multiple cross-site scripting (XSS) vulnerabilities in AbleSpace 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) gid parameter to groups_profile.php, (2) cat_id and (3) razd_id parameters to adv_cat.php, and the (4) URL to blogs_full.php.
[http://dsecrg.com/pages/vul/show.php?id=137]
[20090414 [DSECRG-09-037] abk-soft AbleSpace CMS 1.0 - Multiple security vulnerabilities]
[34512]
[ablespace-advcat-xss(44847)]
[8424]
Multiple SQL injection vulnerabilities in AbleSpace 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) eid parameter to events_view.php and the (2) id parameter to events_clndr_view.php.
[http://dsecrg.com/pages/vul/show.php?id=137]
[20090414 [DSECRG-09-037] abk-soft AbleSpace CMS 1.0 - Multiple security vulnerabilities]
[34512]
[8424]
Multiple SQL injection vulnerabilities in Aqua CMS 1.1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) userSID cookie parameter to droplets/functions/base.php and the (2) username parameter to admin/index.php.
[34516]
[8432]
Directory traversal vulnerability in index.php in Jamroom 3.1.2, 3.2.3 through 3.2.6, 4.0.2, and possibly other versions before 3.4.0 allows remote attackers to include arbitrary files via directory traversal sequences in the t parameter.
[http://www.jamroom.net/index.php?m=td_tracker&o=view&id=1470]
[34511]
[jamroom-index-file-include(49869)]
[8423]
Directory traversal vulnerability in includes/ini.inc.php in GuestCal 2.1 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the lang parameter to index.php.
[34519]
[8431]
Multiple cross-site scripting (XSS) vulnerabilities in include/zstore.php in Zazzle Store Builder 1.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) gridPage and (2) gridSort parameters. NOTE: some of these details are obtained from third party information.
[http://holisticinfosec.org/content/view/102/45/]
[34525]
Cross-site scripting (XSS) vulnerability in search.asp in ASP Product Catalog 1.0 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter.
[34504]
[aspproduct-search-xss(49858)]
[8418]
ASP Product Catalog 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user credentials via a direct request for database/aspProductCatalog.mdb.
[aspproduct-aspproductcatalog-info-disc(49859)]
[8418]
SQL injection vulnerability in body.asp in Web File Explorer 3.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
[34462]
[webfileexplorer-body-sql-injection(49801)]
[8382]
Stack-based buffer overflow in Mini-stream ASX to MP3 Converter 3.0.0.7 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file.
[34494]
[asxmp3-m3u-bo(49840)]
[8407]
[8412]
Stack-based buffer overflow in Mini-stream Ripper 3.0.1.1 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file.
[34494]
[ripper-m3u-bo(49844)]
[8402]
[8416]
Stack-based buffer overflow in Mini-stream RM Downloader 3.0.0.9 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file.
[34494]
[rmdownloader-m3u-bo(49843)]
[8404]
[8410]
Stack-based buffer overflow in Mini-stream WM Downloader 3.0.0.9 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file.
[34494]
[wmdownloader-m3u-bo(49842)]
[8403]
[8411]
Stack-based buffer overflow in Mini-stream RM-MP3 Converter 3.0.0.7 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file.
[34494]
[rmmp3-m3u-bo(49841)]
[8405]
[8413]
Stack-based buffer overflow in Mini-stream Shadow Stream Recorder 3.0.1.7 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file.
[34494]
[8405]
[8426]
Stack-based buffer overflow in Easy RM to MP3 Converter allows remote attackers to execute arbitrary code via a long filename in a playlist (.pls) file.
[34514]
[easyrmmp3-pls-bo(50326)]
[39933]
[8427]
Integer overflow in Microsoft Windows Media Player (WMP) 11.0.5721.5260 allows remote attackers to cause a denial of service (application crash) via a crafted .mid file, as demonstrated by crash.mid.
[34534]
[8445]
The Online Help feature in Sun Java System Directory Server 5.2 and Enterprise Edition 5 allows remote attackers to determine the existence of files and directories, and possibly obtain partial contents of files, via unspecified vectors.
[255848]
[34548]
[ADV-2009-1059]
Cross-site scripting (XSS) vulnerability in refresh_rate.htm in the web interface on the HP Deskjet 6840 printer with firmware XF1M131A allows remote attackers to inject arbitrary web script or HTML via the POST request body.
[20090411 HP Deskjet 6800 XSS in Web Interface]
[34480]
[deskjet-refreshrate-xss(49850)]
Cross-site scripting (XSS) vulnerability in login/FilepathLogin.html in IBM Tivoli Continuous Data Protection (CDP) for Files 3.1.4.0 allows remote attackers to inject arbitrary web script or HTML via the reason parameter.
[1022060]
[http://www.insight-tech.org/index.php?p=IBM-Tivoli-Continuous-Data-Protection-for-Files-version-3-1-4-0---XSS]
[34513]
[ADV-2009-1021]
[tivoli-cdpf-reason-xss(49872)]
Microsoft Internet Explorer 7 and 8 on Windows XP and Vista allows remote attackers to cause a denial of service (application hang) via a large document composed of unprintable characters, aka MSRC 9011jr.
[20090411 [BMSA 2009-04] Remote DoS in Internet Explorer]
[20090411 [BMSA 2009-04] Remote DoS in Internet Explorer]
[34478]
[ie-unprintable-dos(50350)]
fs/nfs/client.c in the Linux kernel before 2.6.23 does not properly initialize a certain structure member that stores the maximum NFS filename length, which allows local users to cause a denial of service (OOPS) via a long filename, related to the encode_lookup function.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=54af3bb543c071769141387a42deaaab5074da55]
[RHSA-2009:0473]
[DSA-1794]
[http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.23]
[[oss-security] 20090406 CVE request: kernel: NFS: Fix an Oops in encode_lookup()]
[[oss-security] 20090417 Re: CVE request: kernel: NFS: Fix an Oops in encode_lookup()]
[RHSA-2009:1024]
[RHSA-2009:1077]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[34390]
[1022176]
[USN-793-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-3316]
[https://bugzilla.redhat.com/show_bug.cgi?id=494074]
[oval:org.mitre.oval:def:10859]
[oval:org.mitre.oval:def:8495]
The exit_notify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAP_KILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exit_signal field and then uses an exec system call to launch a setuid application.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=432870dab85a2f69dc417022646cb9a70acf7f94]
[SUSE-SA:2009:028]
[SUSE-SA:2009:030]
[SUSE-SA:2009:031]
[SUSE-SA:2009:032]
[[linux-kernel] 20090225 Re: [PATCH 2/2] exit_notify: kill the wrong capable(CAP_KILL) check]
[http://patchwork.kernel.org/patch/16544/]
[RHSA-2009:0473]
[http://wiki.rpath.com/Advisories:rPSA-2009-0084]
[DSA-1787]
[DSA-1794]
[DSA-1800]
[http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.30-rc1]
[MDVSA-2009:119]
[MDVSA-2009:135]
[[oss-security] 20090407 CVE request: kernel: exit_notify: kill the wrong capable(CAP_KILL) check]
[[oss-security] 20090417 Re: CVE request: kernel: exit_notify: kill the wrong capable(CAP_KILL) check]
[RHSA-2009:0451]
[RHSA-2009:1024]
[RHSA-2009:1077]
[20090516 rPSA-2009-0084-1 kernel]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[20100625 VMSA-2010-0010 ESX 3.5 third party update for Service Console kernel]
[34405]
[1022141]
[USN-793-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-3316]
[https://bugzilla.redhat.com/show_bug.cgi?id=493771]
[oval:org.mitre.oval:def:10919]
[oval:org.mitre.oval:def:11206]
[oval:org.mitre.oval:def:8295]
[RHSA-2009:1550]
[FEDORA-2009-5356]
The kill_something_info function in kernel/signal.c in the Linux kernel before 2.6.28 does not consider PID namespaces when processing signals directed to PID -1, which allows local users to bypass the intended namespace isolation, and send arbitrary signals to all processes in all namespaces, via a kill command.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d25141a818383b3c3b09f065698c544a7a0ec6e7]
[[linux-kernel] 20080723 Re: [PATCH 1/2] signals: kill(-1) should only signal processes in the same namespace]
[http://wiki.rpath.com/Advisories:rPSA-2009-0084]
[DSA-1787]
[DSA-1800]
[http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28]
[[oss-security] 20090416 CVE request: kernel: 'kill sig -1' must only apply to caller's PID namespace]
[[oss-security] 20090417 Re: CVE request: kernel: 'kill sig -1' must only apply to caller's PID namespace]
[[oss-security] 20090421 Re: CVE request: kernel: 'kill sig -1' must only apply to caller's PID namespace]
[RHSA-2009:1081]
[20090516 rPSA-2009-0084-1 kernel]
[USN-793-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=496031]
[kernel-killsomethinginfo-security-bypass(50386)]
Cross-site request forgery (CSRF) vulnerability in TWiki before 4.3.1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that update pages, as demonstrated by a URL for a save script in the SRC attribute of an IMG element, a related issue to CVE-2009-1434.
[http://bugs.debian.org/526258]
[1022146]
[[twiki-announce] 20090430 Announcement: TWiki 4.3.1 Production Release]
[http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2009-1339]
[http://twiki.org/p/pub/Codev/SecurityAlert-CVE-2009-1339/TWiki-4.3.0-c-diff-cve-2009-1339.txt]
[[debian-bugs-rc] 20090430 Bug#526258: CVE-2009-1339: CSRF Vulnerability with Image Tag]
[ADV-2009-1217]
[twiki-unspecified-csrf(50254)]
[https://launchpad.net/bugs/cve/2009-1339]
Memory leak in the dequote_bytea function in quote.c in the DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module before 2.0.0 for Perl allows context-dependent attackers to cause a denial of service (memory consumption) by fetching data with BYTEA columns.
[http://cpansearch.perl.org/src/TURNSTEP/DBD-Pg-2.13.1/Changes]
[SUSE-SR:2009:012]
[http://rt.cpan.org/Public/Bug/Display.html?id=21392]
[http://security.debian.org/pool/updates/main/libd/libdbd-pg-perl/libdbd-pg-perl_1.49-2+etch1.diff.gz]
[DSA-1780]
[RHSA-2009:0479]
[RHSA-2009:1067]
[34757]
[libdbdpgperl-dequotebytea-dos(50387)]
[https://launchpad.net/bugs/cve/2009-1341]
[oval:org.mitre.oval:def:9680]
Cross-site scripting (XSS) vulnerability in the CCK comment reference module 6.x before 6.x-1.2, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via certain comment titles associated with a node edit form.
[http://drupal.org/node/434836]
[34547]
[ADV-2009-1060]
Cross-site scripting (XSS) vulnerability in the Print (aka Printer, e-mail and PDF versions) module 5.x before 5.x-4.5 and 6.x before 6.x-1.5, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via content titles.
[http://drupal.org/node/434748]
[34545]
[ADV-2009-1060]
Cross-site scripting (XSS) vulnerability in the Localization client module 5.x before 5.x-1.2 and 6.x before 6.x-1.7, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via input to the translation functionality.
[http://drupal.org/node/434682]
[34546]
[ADV-2009-1060]
SQL injection vulnerability in document.php in cpCommerce 1.2.8 allows remote attackers to execute arbitrary SQL commands via the id_document parameter.
[34556]
[1022082]
[cpcommerce-document-sql-injection(49901)]
[8455]
SQL injection vulnerability in publico/ficha.php in NetHoteles 3.0 allows remote attackers to execute arbitrary SQL commands via the id_establecimiento parameter.
[34561]
[nethoteles-ficha-sql-injection(49897)]
[8457]
Multiple SQL injection vulnerabilities in stats/index.php in chCounter 3.1.3 allow remote attackers to execute arbitrary SQL commands via (1) the login_name parameter (aka the username field) or (2) the login_pw parameter (aka the password field).
[34572]
[8461]
The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security, SecurityShield for Microsoft ISA Server, Security for Microsoft Sharepoint, Security for Email Servers, Email Gateway, and Active Virus Defense allows remote attackers to bypass virus detection via (1) an invalid Headflags field in a malformed RAR archive, (2) an invalid Packsize field in a malformed RAR archive, or (3) an invalid Filelength field in a malformed ZIP archive.
[http://blog.zoller.lu/2009/04/mcafee-multiple-bypassesevasions-ziprar.html]
[20090501 [TZO-18-2009] Mcafee multiple evasions/bypasses (RAR, ZIP)]
[34780]
[https://kc.mcafee.com/corporate/index?page=content&id=SB10001&actp=LIST_RECENT]
Cross-site scripting (XSS) vulnerability in C2Net Stronghold 2.3 allows remote attackers to inject arbitrary web script or HTML via the URI.
[20090418 Cross-site Scripting vulnerability in Stronghold/2.3 Apache/1.2.6 C2NetUS/2007]
[34606]
Unspecified vulnerability in xtagent.exe in Novell NetIdentity Client before 1.2.4 allows remote attackers to execute arbitrary code by establishing an IPC$ connection to the XTIERRPCPIPE named pipe, and sending RPC messages that trigger a dereference of an arbitrary pointer.
[http://download.novell.com/Download?buildid=6ERQGPjRZ8o~]
[20090406 ZDI-09-016: Novell Client/NetIdentity Agent Remote Arbitrary Pointer Dereference Code Execution Vulnerability]
[34400]
[1021990]
[ADV-2009-0954]
[http://www.zerodayinitiative.com/advisories/ZDI-09-016/]
[https://bugzilla.novell.com/show_bug.cgi?id=437511]
Heap-based buffer overflow in Apollo 37zz allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long URI in a playlist (.m3u) file.
[34554]
[8451]
Stack-based buffer overflow in Dawningsoft PowerCHM 5.7 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an HTML file with a link to a long URL, as demonstrated by a .rar URL.
[34517]
[powerchm-url-bo(49882)]
[8434]
Buffer overflow in the http_parse_hex function in libz/misc.c in Zervit Webserver 0.02 allows remote attackers to cause a denial of service (daemon crash) via a long URI, related to http.c.
[20090414 Zervit Webserver Buffer Overflow]
[34530]
[http://zervit.svn.sourceforge.net/viewvc/zervit/trunk/src/libz/misc.c?r1=17&r2=19]
[http://zervit.svn.sourceforge.net/viewvc/zervit/trunk/src/libz/misc.c?view=log]
[8447]
Directory traversal vulnerability in Mongoose 2.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
[20090413 MonGoose 2.4 Directory Traversal Vulnerability]
[34510]
[mongoose-directory-traversal(49878)]
[8428]
Stack-based buffer overflow in muxatmd in IBM AIX 5.2, 5.3, and 6.1 allows local users to gain privileges via a long filename.
[http://aix.software.ibm.com/aix/efixes/security/muxatmd_advisory.asc]
[20090415 IBM AIX muxatmd Buffer Overflow Vulnerability]
[IZ48495]
[IZ48496]
[IZ48499]
[IZ48500]
[IZ48501]
[IZ48502]
[IZ48561]
[IZ48562]
[34543]
[1022065]
[ADV-2009-1056]
[oval:org.mitre.oval:def:6402]
Stack-based buffer overflow in Elecard AVC HD Player allows remote attackers to execute arbitrary code via a long MP3 filename in a playlist (.xpl) file.
[34560]
[8452]
CRLF injection vulnerability in da/DA/Login in Sun Java System Delegated Administrator 6.2 through 6.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the HELP_PAGE parameter.
[1022108]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-121581-20-1]
[255928]
[1020305]
[http://www.coresecurity.com/content/sun-delegated-administrator]
[20090421 CORE-2009-0114 - HTTP Response Splitting vulnerability in Sun Delegated Administrator]
[34643]
[ADV-2009-1122]
[sjs-delegated-login-response-splitting(50004)]
apt-get in apt before 0.7.21 does not check for the correct error code from gpgv, which causes apt to treat a repository as valid even when it has been signed with a key that has been revoked or expired, which might allow remote attackers to trick apt into installing malicious repositories.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=433091]
[DSA-1779]
[34630]
[https://bugs.launchpad.net/ubuntu/+source/apt/+bug/356012]
[apt-aptget-gpgv-security-bypass(50086)]
[USN-762-1]
Unspecified vulnerability in the SCTP sockets implementation in Sun OpenSolaris snv_106 through snv_107 allows local users to cause a denial of service (panic) via unknown vectors.
[257331]
[34628]
[ADV-2009-1120]
The __inet6_check_established function in net/ipv6/inet6_hashtables.c in the Linux kernel before 2.6.29, when Network Namespace Support (aka NET_NS) is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via vectors involving IPv6 packets.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3f53a38131a4e7a053c0aa060aba0411242fb6b9]
[SUSE-SA:2009:032]
[http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.29]
[MDVSA-2009:135]
[34602]
[USN-793-1]
[http://xorl.wordpress.com/2009/04/21/linux-kernel-net_ns-ipv6-null-pointer-dereference/]
dig.php in GScripts.net DNS Tools allows remote attackers to execute arbitrary commands via shell metacharacters in the host parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
SQL injection vulnerability in administration/index.php in chCounter 3.1.3 allows remote attackers to execute arbitrary SQL commands via the login_name parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[chcounter-administration-sql-injection(50353)]
Use-after-free vulnerability in the embedded GD library in libwmf 0.2.8.4 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WMF file.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[SUSE-SR:2009:011]
[openSUSE-SU-2015:1132]
[openSUSE-SU-2015:1134]
[RHSA-2009:0457]
[GLSA-200907-01]
[http://wvware.cvs.sourceforge.net/viewvc/wvware/libwmf2/src/extra/Makefile.am?hideattic=0&view=log]
[DSA-1796]
[MDVSA-2009:106]
[34792]
[1022154]
[USN-769-1]
[ADV-2009-1228]
[https://bugzilla.redhat.com/show_bug.cgi?id=496864]
[libwmf-gdlibrary-code-execution(50290)]
[https://launchpad.net/bugs/cve/2009-1364]
[oval:org.mitre.oval:def:10959]
[FEDORA-2009-5518]
[FEDORA-2009-5524]
[FEDORA-2009-5517]
Unspecified vulnerability in Adobe Flash Media Server (FMS) before 3.0.4 and 3.5.x before 3.5.2, as used in Flash Media Interactive Server and Flash Media Streaming Server, allows remote attackers to execute arbitrary remote procedures within an ActionScript file on the server via RPC requests.
[http://www.adobe.com/support/security/bulletins/apsb09-05.html]
[34790]
[1022148]
[ADV-2009-1234]
Cross-site scripting (XSS) vulnerability in Website\admin\Sales\paypalipn.aspx in DotNetNuke (DNN) before 4.9.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "name/value pairs" and "paypal IPN functionality."
[http://www.dotnetnuke.com/News/SecurityPolicy/Securitybulletinno25/tabid/1260/Default.aspx]
[34484]
Cross-site scripting (XSS) vulnerability in index.php in moziloCMS 1.11 allows remote attackers to inject arbitrary web script or HTML via the query parameter in search action, a different issue than CVE-2008-6127.2a.
[http://cms.mozilo.de/index.php?cat=10_moziloCMS&page=60_Changelog]
[34474]
[mozilocms-indexphp-xss(49812)]
[8394]
Directory traversal vulnerability in index.php in moziloCMS 1.11 allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter. NOTE: this might be the same issue as CVE-2008-6126.2, which may have been fixed in 1.10.3.
[http://cms.mozilo.de/index.php?cat=10_moziloCMS&page=60_Changelog]
[34474]
[mozilocms-index-file-include(49813)]
[8394]
moziloCMS 1.11 allows remote attackers to obtain sensitive information via the (1) gal[] parameter to gallery.php, (2) page[] and (3) cat[] parameter to index.php, or (4) file[] parameter to download.php, which reveals the installation path in an error message.
[mozilocms-index-path-disclosure(49811)]
[8394]
Stack-based buffer overflow in ape_plugin.plg in Xilisoft Video Converter 3.1.53.0704n and 5.1.23.0402 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a .cue file.
[34472]
[vcw-cue-bo(49807)]
[8390]
The CLI_ISCONTAINED macro in libclamav/others.h in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) via a malformed file with UPack encoding.
[APPLE-SA-2009-09-10-2]
[http://support.apple.com/kb/HT3865]
[http://svn.clamav.net/websvn/filedetails.php?repname=clamav-devel&path=%2Ftrunk%2FChangeLog&rev=5032]
[DSA-1771]
[MDVSA-2009:097]
[34446]
[1022028]
[USN-756-1]
[ADV-2009-0985]
[https://launchpad.net/bugs/360502]
[https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1552]
Stack-based buffer overflow in the cli_url_canon function in libclamav/phishcheck.c in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted URL.
[APPLE-SA-2009-09-10-2]
[http://support.apple.com/kb/HT3865]
[http://svn.clamav.net/websvn/filedetails.php?repname=clamav-devel&path=%2Ftrunk%2FChangeLog&rev=5032]
[MDVSA-2009:097]
[34446]
[1022028]
[ADV-2009-0985]
[https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1553]
Buffer overflow in the XMPP SOCKS5 bytestream server in Pidgin (formerly Gaim) before 2.5.6 allows remote authenticated users to execute arbitrary code via vectors involving an outbound XMPP file transfer. NOTE: some of these details are obtained from third party information.
[DSA-1805]
[GLSA-200905-07]
[MDVSA-2009:140]
[MDVSA-2009:173]
[http://www.pidgin.im/news/security/?id=29]
[RHSA-2009:1059]
[RHSA-2009:1060]
[35067]
[USN-781-1]
[USN-781-2]
[ADV-2009-1396]
[https://bugzilla.redhat.com/show_bug.cgi?id=500488]
[pidgin-xmppsocks5-bo(50682)]
[oval:org.mitre.oval:def:17722]
[oval:org.mitre.oval:def:9005]
[FEDORA-2009-5552]
[FEDORA-2009-5583]
[FEDORA-2009-5597]
Buffer overflow in the decrypt_out function in Pidgin (formerly Gaim) before 2.5.6 allows remote attackers to cause a denial of service (application crash) via a QQ packet.
[GLSA-200905-07]
[MDVSA-2009:173]
[http://www.pidgin.im/news/security/?id=30]
[RHSA-2009:1060]
[35067]
[USN-781-1]
[ADV-2009-1396]
[https://bugzilla.redhat.com/show_bug.cgi?id=500490]
[pidgin-decryptout-bo(50684)]
[oval:org.mitre.oval:def:11654]
[oval:org.mitre.oval:def:18201]
[FEDORA-2009-5552]
[FEDORA-2009-5583]
[FEDORA-2009-5597]
The PurpleCircBuffer implementation in Pidgin (formerly Gaim) before 2.5.6 does not properly maintain a certain buffer, which allows remote attackers to cause a denial of service (memory corruption and application crash) via vectors involving the (1) XMPP or (2) Sametime protocol.
[DSA-1805]
[GLSA-200905-07]
[MDVSA-2009:173]
[http://www.pidgin.im/news/security/?id=31]
[RHSA-2009:1060]
[35067]
[USN-781-1]
[ADV-2009-1396]
[https://bugzilla.redhat.com/show_bug.cgi?id=500491]
[pidgin-purplecircbuffer-dos(50683)]
[oval:org.mitre.oval:def:10829]
[FEDORA-2009-5552]
[FEDORA-2009-5583]
[FEDORA-2009-5597]
Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin (formerly Gaim) before 2.5.6 on 32-bit platforms allow remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value, leading to buffer overflows. NOTE: this issue exists because of an incomplete fix for CVE-2008-2927.
[DSA-1805]
[GLSA-200905-07]
[MDVSA-2009:140]
[MDVSA-2009:173]
[http://www.pidgin.im/news/security/?id=32]
[RHSA-2009:1059]
[RHSA-2009:1060]
[35067]
[USN-781-1]
[USN-781-2]
[ADV-2009-1396]
[https://bugzilla.redhat.com/show_bug.cgi?id=500493]
[pidgin-msn-slp-bo(50680)]
[oval:org.mitre.oval:def:10476]
[oval:org.mitre.oval:def:18432]
[FEDORA-2009-5552]
[FEDORA-2009-5583]
[FEDORA-2009-5597]
The dtls1_buffer_record function in ssl/d1_pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service (memory consumption) via a large series of "future epoch" DTLS records that are buffered in a queue, aka "DTLS record buffer limitation bug."
[NetBSD-SA2009-009]
[http://cvs.openssl.org/chngview?cn=18187]
[HPSBMA02492]
[SUSE-SR:2009:011]
[[security-announce] 20100303 VMSA-2010-0004 ESX Service Console and vMA third party updates]
[[openssl-dev] 20090516 [openssl.org #1930] [PATCH] DTLS record buffer limitation bug]
[http://rt.openssl.org/Ticket/Display.html?id=1930&user=guest&pass=guest]
[GLSA-200912-01]
[SSA:2010-060-02]
[http://sourceforge.net/mailarchive/message.php?msg_name=4AD43807.7080105%40users.sourceforge.net]
[http://voodoo-circle.sourceforge.net/sa/sa-20091012-01.html]
[MDVSA-2009:120]
[[oss-security] 20090518 Two OpenSSL DTLS remote DoS]
[RHSA-2009:1335]
[35001]
[1022241]
[USN-792-1]
[ADV-2009-1377]
[ADV-2010-0528]
[https://kb.bluecoat.com/index?page=content&id=SA50]
[https://launchpad.net/bugs/cve/2009-1377]
[oval:org.mitre.oval:def:6683]
[oval:org.mitre.oval:def:9663]
Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."
[NetBSD-SA2009-009]
[http://cvs.openssl.org/chngview?cn=18188]
[SSRT100079]
[SUSE-SR:2009:011]
[[security-announce] 20100303 VMSA-2010-0004 ESX Service Console and vMA third party updates]
[[openssl-dev] 20090516 [openssl.org #1931] [PATCH] DTLS fragment handling memory leak]
[[openssl-dev] 20090518 Re: [openssl.org #1931] [PATCH] DTLS fragment handling memory leak]
[http://rt.openssl.org/Ticket/Display.html?id=1931&user=guest&pass=guest]
[GLSA-200912-01]
[SSA:2010-060-02]
[http://sourceforge.net/mailarchive/message.php?msg_name=4AD43807.7080105%40users.sourceforge.net]
[http://voodoo-circle.sourceforge.net/sa/sa-20091012-01.html]
[MDVSA-2009:120]
[[oss-security] 20090518 Two OpenSSL DTLS remote DoS]
[RHSA-2009:1335]
[35001]
[1022241]
[USN-792-1]
[ADV-2009-1377]
[ADV-2010-0528]
[https://kb.bluecoat.com/index?page=content&id=SA50]
[https://launchpad.net/bugs/cve/2009-1378]
[oval:org.mitre.oval:def:11309]
[oval:org.mitre.oval:def:7229]
[8720]
Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service (openssl s_client crash) and possibly have unspecified other impact via a DTLS packet, as demonstrated by a packet from a server that uses a crafted server certificate.
[NetBSD-SA2009-009]
[HPSBMA02492]
[SUSE-SR:2009:011]
[[security-announce] 20100303 VMSA-2010-0004 ESX Service Console and vMA third party updates]
[http://rt.openssl.org/Ticket/Display.html?id=1923&user=guest&pass=guest]
[GLSA-200912-01]
[SSA:2010-060-02]
[http://sourceforge.net/mailarchive/message.php?msg_name=4AD43807.7080105%40users.sourceforge.net]
[http://voodoo-circle.sourceforge.net/sa/sa-20091012-01.html]
[[oss-security] 20090518 Re: Two OpenSSL DTLS remote DoS]
[RHSA-2009:1335]
[35138]
[1022241]
[USN-792-1]
[ADV-2009-1377]
[ADV-2010-0528]
[openssl-dtls1retrievebufferedfragment-dos(50661)]
[https://kb.bluecoat.com/index?page=content&id=SA50]
[https://launchpad.net/bugs/cve/2009-1379]
[oval:org.mitre.oval:def:6848]
[oval:org.mitre.oval:def:9744]
Cross-site scripting (XSS) vulnerability in JMX-Console in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 allows remote attackers to inject arbitrary web script or HTML via the filter parameter, related to the key property and the position of quote and colon characters.
[1023315]
[37276]
[https://bugzilla.redhat.com/show_bug.cgi?id=511224]
[jboss-enterprise-jmxconsole-xss(54698)]
[https://jira.jboss.org/jira/browse/JBPAPP-1983]
[RHSA-2009:1636]
[RHSA-2009:1637]
[RHSA-2009:1649]
[RHSA-2009:1650]
The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian GNU/Linux, and possibly other operating systems and versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program. NOTE: this issue exists because of an incomplete fix for CVE-2009-1579.
[http://release.debian.org/proposed-updates/stable_diffs/squirrelmail_1.4.15-4+lenny2.debdiff]
[DSA-1802]
[MDVSA-2009:122]
[20090521 [SECURITY] [DSA 1802-2] New squirrelmail packages correct incomplete fix]
[FEDORA-2009-5471]
[FEDORA-2009-5350]
Multiple stack-based buffer overflows in mimetex.cgi in mimeTeX, when downloaded before 20090713, allow remote attackers to execute arbitrary code via a TeX file with long (1) picture, (2) circle, or (3) input tags.
[http://groups.google.com/group/comp.text.tex/browse_thread/thread/5d56d3d744351578]
[FEDORA-2010-6546]
[http://scary.beasts.org/security/CESA-2009-009.html]
[http://www.ocert.org/advisories/ocert-2009-010.html]
[20090713 [oCERT-2009-010] mimeTeX and mathTeX buffer overflows and commandinjection]
[ADV-2009-1875]
[ADV-2010-0877]
[mimetex-mimetex-bo(51794)]
The getdirective function in mathtex.cgi in mathTeX, when downloaded before 20090713, allows remote attackers to execute arbitrary commands via shell metacharacters in the dpi tag.
[http://groups.google.com/group/comp.text.tex/browse_thread/thread/5d56d3d744351578]
[http://www.ocert.org/advisories/ocert-2009-010.html]
[20090713 [oCERT-2009-010] mimeTeX and mathTeX buffer overflows and commandinjection]
[ADV-2009-1875]
[mathtex-getdirective-command-execution(51795)]
pam_krb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise Linux (RHEL) 5, generates different password prompts depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
[MDVSA-2010:054]
[[oss-security] 20090527 CVE assignment notification (pam_krb5 CVE-2009-1384)]
[20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX]
[35112]
[http://www.vmware.com/security/advisories/VMSA-2011-0003.html]
[ADV-2009-1448]
[https://bugzilla.redhat.com/show_bug.cgi?id=502602]
[oval:org.mitre.oval:def:7081]
[oval:org.mitre.oval:def:9652]
Integer underflow in the e1000_clean_rx_irq function in drivers/net/e1000/e1000_main.c in the e1000 driver in the Linux kernel before 2.6.30-rc8, the e1000e driver in the Linux kernel, and Intel Wired Ethernet (aka e1000) before 7.5.5 allows remote attackers to cause a denial of service (panic) via a crafted frame size.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ea30e11970a96cfe5e32c03a29332554573b4a10]
[SUSE-SA:2009:038]
[http://sourceforge.net/project/shownotes.php?release_id=504022&group_id=42302]
[http://wiki.rpath.com/Advisories:rPSA-2009-0111]
[DSA-1844]
[DSA-1865]
[http://www.intel.com/support/network/sb/CS-030543.htm]
[http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.30-rc8]
[MDVSA-2009:135]
[MDVSA-2009:148]
[[oss-security] 20090603 CVE-2009-1385 kernel: e1000_clean_rx_irq() denial of service]
[RHSA-2009:1157]
[RHSA-2009:1193]
[20090724 rPSA-2009-0111-1 kernel]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[20100625 VMSA-2010-0010 ESX 3.5 third party update for Service Console kernel]
[35185]
[USN-793-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-3316]
[https://bugzilla.redhat.com/show_bug.cgi?id=502981]
[oval:org.mitre.oval:def:11598]
[oval:org.mitre.oval:def:11681]
[oval:org.mitre.oval:def:8340]
[RHSA-2009:1550]
[FEDORA-2009-6883]
[FEDORA-2009-6768]
[FEDORA-2009-6846]
ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a DTLS ChangeCipherSpec packet that occurs before ClientHello.
[NetBSD-SA2009-009]
[http://cvs.openssl.org/chngview?cn=17369]
[HPSBMA02492]
[SUSE-SR:2009:012]
[[security-announce] 20100303 VMSA-2010-0004 ESX Service Console and vMA third party updates]
[http://rt.openssl.org/Ticket/Display.html?id=1679&user=guest&pass=guest]
[[oss-security] 20090602 Re: Two OpenSSL DTLS remote DoS]
[RHSA-2009:1335]
[35174]
[USN-792-1]
[ADV-2010-0528]
[openssl-changecipherspec-dos(50963)]
[oval:org.mitre.oval:def:11179]
[oval:org.mitre.oval:def:7469]
[8873]
The dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL before 1.0.0 Beta 2 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence DTLS handshake message, related to a "fragment bug."
[NetBSD-SA2009-009]
[http://cvs.openssl.org/chngview?cn=17958]
[HPSBMA02492]
[SUSE-SR:2009:012]
[[security-announce] 20100303 VMSA-2010-0004 ESX Service Console and vMA third party updates]
[http://rt.openssl.org/Ticket/Display.html?id=1838&user=guest&pass=guest]
[GLSA-200912-01]
[http://sourceforge.net/mailarchive/message.php?msg_name=4AD43807.7080105%40users.sourceforge.net]
[http://voodoo-circle.sourceforge.net/sa/sa-20091012-01.html]
[[oss-security] 20090602 Re: Two OpenSSL DTLS remote DoS]
[RHSA-2009:1335]
[USN-792-1]
[ADV-2010-0528]
[oval:org.mitre.oval:def:10740]
[oval:org.mitre.oval:def:7592]
The ptrace_start function in kernel/ptrace.c in the Linux kernel 2.6.18 does not properly handle simultaneous execution of the do_coredump function, which allows local users to cause a denial of service (deadlock) via vectors involving the ptrace system call and a coredumping thread.
[[oss-security] 20090702 CVE-2009-1388 kernel: do_coredump() vs ptrace_start() deadlock]
[RHSA-2009:1193]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[35559]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-3316]
[https://bugzilla.redhat.com/attachment.cgi?id=346615]
[https://bugzilla.redhat.com/attachment.cgi?id=346742]
[https://bugzilla.redhat.com/show_bug.cgi?id=504263]
[oval:org.mitre.oval:def:8625]
[oval:org.mitre.oval:def:8680]
Buffer overflow in the RTL8169 NIC driver (drivers/net/r8169.c) in the Linux kernel before 2.6.30 allows remote attackers to cause a denial of service (kernel memory corruption and crash) via a long packet.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=fdd7b4c3302c93f6833e338903ea77245eb510b4]
[SUSE-SA:2009:038]
[SUSE-SA:2010:031]
[[linux-kernel] 20090608 [Security, resend] Instant crash with rtl8169 and large packets]
[[linux-netdev] 20090214 r8169: instant crash if receiving packet larger than MTU]
[http://support.avaya.com/css/P8/documents/100067254]
[http://support.citrix.com/article/CTX123453]
[http://wiki.rpath.com/Advisories:rPSA-2009-0111]
[DSA-1844]
[DSA-1865]
[MDVSA-2009:148]
[[oss-security] 20090610 CVE-2009-1389 kernel: r8169: fix crash when large packets are received]
[RHSA-2009:1157]
[RHSA-2009:1193]
[20090724 rPSA-2009-0111-1 kernel]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[35281]
[1023507]
[USN-807-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-3316]
[ADV-2010-0219]
[ADV-2010-1857]
[https://bugzilla.redhat.com/show_bug.cgi?id=504726]
[linux-kernel-rtl8169nic-dos(51051)]
[oval:org.mitre.oval:def:10415]
[oval:org.mitre.oval:def:8108]
[FEDORA-2009-6883]
[FEDORA-2009-6768]
[FEDORA-2009-6846]
Mutt 1.5.19, when linked against (1) OpenSSL (mutt_ssl.c) or (2) GnuTLS (mutt_ssl_gnutls.c), allows connections when only one TLS certificate in the chain is accepted instead of verifying the entire chain, which allows remote attackers to spoof trusted servers via a man-in-the-middle attack.
[http://dev.mutt.org/hg/mutt/rev/64bf199c8d8a]
[http://dev.mutt.org/hg/mutt/rev/8f11dd00c770]
[[oss-security] 20090610 Mutt 1.5.19 SSL chain verification flaw]
[35288]
[mutt-x509-security-bypass(51068)]
[FEDORA-2009-6465]
Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow, as exploited in the wild by Trojan.Downloader-71014 in June 2009.
[http://article.gmane.org/gmane.mail.virus.amavis.user/33635]
[http://article.gmane.org/gmane.mail.virus.amavis.user/33638]
[SUSE-SR:2009:012]
[GLSA-200908-07]
[http://thread.gmane.org/gmane.mail.virus.amavis.user/33635]
[MDVSA-2009:157]
[35307]
[ADV-2009-1571]
[https://bugs.gentoo.org/show_bug.cgi?id=273141]
[https://bugzilla.redhat.com/show_bug.cgi?id=504386]
[perl-compressrawzlib-inflate-bo(51062)]
[USN-794-1]
[FEDORA-2009-7680]
The browser engine in Mozilla Firefox 3 before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) nsEventStateManager::GetContentState and nsNativeTheme::CheckBooleanAttr; (2) UnhookTextRunFromFrames and ClearAllTextRunReferences; (3) nsTextFrame::ClearTextRun; (4) IsPercentageAware; (5) PL_DHashTableFinish; (6) nsListBoxBodyFrame::GetNextItemBox; (7) AtomTableClearEntry, related to the atom table, DOM mutation events, and Unicode surrogates; (8) nsHTMLEditor::HideResizers; and (9) nsWindow::SetCursor, related to changing the cursor; and other vectors.
[RHSA-2009:1096]
[1022376]
[SSA:2009-167-01]
[SSA:2009-176-01]
[265068]
[1020800]
[DSA-1820]
[DSA-1830]
[MDVSA-2009:141]
[http://www.mozilla.org/security/announce/2009/mfsa2009-24.html]
[RHSA-2009:1125]
[RHSA-2009:1126]
[35326]
[35370]
[1022397]
[SSA:2009-178-01]
[USN-782-1]
[ADV-2009-1572]
[ADV-2009-2152]
[https://bugzilla.mozilla.org/show_bug.cgi?id=380359]
[https://bugzilla.mozilla.org/show_bug.cgi?id=429969]
[https://bugzilla.mozilla.org/show_bug.cgi?id=431086]
[https://bugzilla.mozilla.org/show_bug.cgi?id=432068]
[https://bugzilla.mozilla.org/show_bug.cgi?id=451341]
[https://bugzilla.mozilla.org/show_bug.cgi?id=472776]
[https://bugzilla.mozilla.org/show_bug.cgi?id=486398]
[https://bugzilla.mozilla.org/show_bug.cgi?id=489041]
[https://bugzilla.mozilla.org/show_bug.cgi?id=490410]
[https://bugzilla.mozilla.org/show_bug.cgi?id=490425]
[https://bugzilla.mozilla.org/show_bug.cgi?id=490513]
[https://bugzilla.redhat.com/show_bug.cgi?id=503568]
[oval:org.mitre.oval:def:9501]
[RHSA-2009:1095]
[FEDORA-2009-6366]
[FEDORA-2009-6411]
Stack-based buffer overflow in Motorola Timbuktu Pro 8.6.5 on Windows allows remote attackers to execute arbitrary code by sending a long malformed string over the PlughNTCommand named pipe.
[20090625 Motorola Timbuktu Pro PlughNTCommand Stack Based Buffer Overflow Vulnerability]
[http://www.netopia.com/software/products/tb2/]
[20090625 iDefense Security Advisory 06.25.09: Motorola Timbuktu Pro PlughNTCommand Stack Based Buffer Overflow Vulnerability]
[35496]
[1022455]
SQL injection vulnerability in product_info.php in CRE Loaded 6.2 allows remote attackers to execute arbitrary SQL commands via the products_id parameter.
[34640]
[creloaded-productinfo-sql-injection(49987)]
[8501]
SQL injection vulnerability in admin.php in PastelCMS 0.8.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the user (Username) parameter.
[34635]
[pastelcms-admin-sql-injection(49985)]
[8502]
Directory traversal vulnerability in index.php in PastelCMS 0.8.0, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the set_lng parameter.
[34635]
[pastelcms-setlng-file-include(49986)]
[8502]
Directory traversal vulnerability in cms_detect.php in TotalCalendar 2.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the include parameter.
[34634]
[totalcalendar-cmsdetect-file-include(49980)]
[8503]
Directory traversal vulnerability in config.php in NotFTP 1.3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in a certain languages[][file] parameter.
[34636]
[notftp-config-file-include(49988)]
[8504]
Cross-site scripting (XSS) vulnerability in webSPELL 4.2.0c allows remote attackers to inject arbitrary web script or HTML allows remote attackers to inject arbitrary web script or HTML via Javascript events such as onmouseover in nested BBcode tags, as demonstrated using (1) email, (2) img, and (3) url tags.
[20090416 webSPELL 4.2.0c XSS (BYPASS BBCODE) COOKIES STEALING VULNERABILITY]
[34595]
[http://www.webspell.org/index.php?site=files&file=25]
[http://www.webspell.org/index.php?site=news_comments&newsID=126&lang=uk]
[webspell-bbcode-xss(49937)]
[8453]
SQL injection vulnerability in usersettings.php in e107 0.7.15 and earlier, when "Extended User Fields" is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the hide parameter, a different vector than CVE-2005-4224 and CVE-2008-5320.
[34614]
[e107-hide-sql-injection(49981)]
[8495]
SQL injection vulnerability in index.php in Quick.Cms.Lite 0.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
[34647]
[quickcmslite-index-sql-injection(49989)]
[8505]
SQL injection vulnerability in events/inc/events.inc.php in the Events plugin for Seditio CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the c parameter to plug.php.
[34608]
[ADV-2009-1112]
[seditio-events-eventsinc-sql-injection(49975)]
[8482]
Argument injection vulnerability in the chromehtml: protocol handler in Google Chrome before 1.0.154.59, when invoked by Internet Explorer, allows remote attackers to determine the existence of files, and open tabs for URLs that do not satisfy the IsWebSafeScheme restriction, via a web page that sets document.location to a chromehtml: value, as demonstrated by use of a (1) javascript: or (2) data: URL. NOTE: this can be leveraged for Universal XSS by exploiting certain behavior involving persistence across page transitions.
[http://chromium.googlecode.com/issues/attachment?aid=5579180911289877192&name=Google+Chrome+Advisory.doc]
[http://code.google.com/p/chromium/issues/detail?id=9860]
[http://googlechromereleases.blogspot.com/2009/04/stable-update-security-fix.html]
[googlechrome-chromehtml-command-execution(50449)]
Google Chrome 1.0.x does not cancel timeouts upon a page transition, which makes it easier for attackers to conduct Universal XSS attacks by calling setTimeout to trigger future execution of JavaScript code, and then modifying document.location to arrange for JavaScript execution in the context of an arbitrary web site. NOTE: this can be leveraged for a remote attack by exploiting a chromehtml: argument-injection vulnerability.
[http://chromium.googlecode.com/issues/attachment?aid=5579180911289877192&name=Google+Chrome+Advisory.doc]
[http://code.google.com/p/chromium/issues/detail?id=9860]
[googlechrome-settimeout-xss(50447)]
Google Chrome 2.0.x lets modifications to the global object persist across a page transition, which makes it easier for attackers to conduct Universal XSS attacks via unspecified vectors.
[http://code.google.com/p/chromium/issues/detail?id=9860]
[googlechrome-globalobject-xss(50446)]
lib/pk-libgcrypt.c in libgnutls in GnuTLS before 2.6.6 does not properly handle invalid DSA signatures, which allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a malformed DSA key that triggers a (1) free of an uninitialized pointer or (2) double free.
[[gnutls-devel] 20090430 Double free and free of invalid pointer on certain errors [GNUTLS-SA-2009-1] [CVE-2009-1415]]
[[gnutls-devel] 20090423 Re: some crashes on using DSA keys]
[GLSA-200905-04]
[http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3488]
[MDVSA-2009:116]
[34783]
[1022157]
[ADV-2009-1218]
[gnutls-dsa-code-execution(50257)]
[gnutls-dsa-dos(50260)]
[gnutls-libgnutls-dos(50445)]
lib/gnutls_pk.c in libgnutls in GnuTLS 2.5.0 through 2.6.5 generates RSA keys stored in DSA structures, instead of the intended DSA keys, which might allow remote attackers to spoof signatures on certificates or have unspecified other impact by leveraging an invalid DSA key.
[[gnutls-devel] 20090430 All DSA keys generated using GnuTLS 2.6.x are corrupt [GNUTLS-SA-2009-2] [CVE-2009-1416]]
[[help-gnutls] 20090420 Encryption using DSA keys]
[GLSA-200905-04]
[MDVSA-2009:116]
[34783]
[1022158]
[ADV-2009-1218]
gnutls-cli in GnuTLS before 2.6.6 does not verify the activation and expiration times of X.509 certificates, which allows remote attackers to successfully present a certificate that is (1) not yet valid or (2) no longer valid, related to lack of time checks in the _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls_x509, as used by (a) Exim, (b) OpenLDAP, and (c) libsoup.
[[gnutls-devel] 20090430 Certificate expiration not checked by gnutls-cli [GNUTLS-SA-2009-3] [CVE-2009-1417]]
[GLSA-200905-04]
[MDVSA-2009:116]
[34783]
[1022159]
[ADV-2009-1218]
[gnutls-gnutlscli-spoofing(50261)]
Cross-site scripting (XSS) vulnerability in HP System Management Homepage (SMH) before 3.0.1.73 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Per: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01745065
"SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP System Management Homepage (SMH) before v3.0.1.73 running on Linux and Windows Server 2003, 2008."
[SSRT090048]
[JVN#02331156]
[JVNDB-2009-000029]
[1022242]
[35031]
[smh-win-unspecified-xss(50633)]
Unspecified vulnerability in HP Discovery & Dependency Mapping Inventory (DDMI) 2.0.0 through 2.52, 7.50, and 7.51 on Windows allows remote attackers to access DDMI agents via unknown vectors.
[HPSBMA02433]
[35250]
[1022339]
[ADV-2009-1514]
Stack-based buffer overflow in rping in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53, when used with SNMP (aka HPOvNNM.HPOVSNMP) before 1.30.009 and MIB (aka HPOvNNM.HPOVMIB) before 1.30.009, allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors.
[20090626 HP Network Node Manager rping Stack Buffer Overflow Vulnerability]
[HPSBMA02430]
[1022360]
[35267]
[ADV-2009-1549]
Unspecified vulnerability in NFS / ONCplus B.11.31_06 and B.11.31_07 on HP HP-UX B.11.31 allows local users to cause a denial of service via unknown attack vectors.
Per: http://www.vupen.com/english/advisories/2009/1755
"Affected Products
HP-UX B.11.31 running NFS / ONCplus version B.11.31_07 and B.11.31_06 "
[SSRT090106]
[1022493]
[35547]
[ADV-2009-1755]
Unspecified vulnerability in HP ProCurve Threat Management Services zl Module (J9155A) ST.1.0.090213 and earlier allows remote attackers to gain privileges via unknown vectors, aka PR_41209.
[SSRT090111]
[1022536]
[ADV-2009-1869]
Unspecified vulnerability in HP ProCurve Threat Management Services zl Module (J9155A) ST.1.0.090213 and earlier allows remote attackers to cause a denial of service via unknown vectors, aka PR_39898, a different vulnerability than CVE-2009-1424 and CVE-2009-1425.
[SSRT090111]
[1022536]
[ADV-2009-1869]
[procurve-vpn-dos(51689)]
Unspecified vulnerability in HP ProCurve Threat Management Services zl Module (J9155A) ST.1.0.090213 and earlier allows remote attackers to cause a denial of service via unknown vectors, aka PR_39412, a different vulnerability than CVE-2009-1423 and CVE-2009-1425.
[SSRT090111]
[1022536]
[ADV-2009-1869]
Unspecified vulnerability in HP ProCurve Threat Management Services zl Module (J9155A) ST.1.0.090213 and earlier allows remote attackers to cause a denial of service by triggering a stop or crash in httpd, aka PR_18770, a different vulnerability than CVE-2009-1423 and CVE-2009-1424.
[http://cdn.procurve.com/training/Manuals/TMSzlModule-RelNotes-90603-59900224.pdf]
[SSRT090111]
[35653]
[1022536]
[ADV-2009-1869]
[procurve-httpd-dos(51691)]
Unspecified vulnerability on HP ProLiant DL and ML 100 Series G5, G5p, and G6 servers with ProLiant Onboard Administrator Powered by LO100i (formerly Lights Out 100) 3.07 and earlier allows remote attackers to cause a denial of service via unknown vectors.
[HPSBMA02438]
[1022617]
Unspecified vulnerability in HP-UX B.11.31 allows local users to cause a denial of service (system crash) via unknown vectors related to the ttrace system call.
[HPSBUX02450]
[36017]
[1022706]
[ADV-2009-2230]
[oval:org.mitre.oval:def:19004]
[oval:org.mitre.oval:def:6215]
Multiple cross-site scripting (XSS) vulnerabilities in ccLgView.exe in the Symantec Log Viewer, as used in Symantec AntiVirus (SAV) before 10.1 MR8, Symantec Endpoint Protection (SEP) 11.0 before 11.0 MR1, Norton 360 1.0, and Norton Internet Security 2005 through 2008, allow remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, related to "two parsing errors."
[34669]
[1022133]
[1022134]
[1022135]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090428_01]
[ADV-2009-1203]
[multiple-symantec-log-xss(50170)]
The Intel LANDesk Common Base Agent (CBA) in Symantec Alert Management System 2 (AMS2), as used in Symantec System Center (SSS); Symantec AntiVirus Server; Symantec AntiVirus Central Quarantine Server; Symantec AntiVirus (SAV) Corporate Edition 9 before 9.0 MR7, 10.0 and 10.1 before 10.1 MR8, and 10.2 before 10.2 MR2; Symantec Client Security (SCS) 2 before 2.0 MR7 and 3 before 3.1 MR8; and Symantec Endpoint Protection (SEP) before 11.0 MR3, allows remote attackers to execute arbitrary commands via a crafted packet whose contents are interpreted as a command to be launched in a new process by the CreateProcessA function.
[8346]
[34671]
[1022130]
[1022131]
[1022132]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090428_02]
[ADV-2009-1204]
[symantec-cba-command-execution(50176)]
Multiple stack-based buffer overflows in IAO.EXE in the Intel Alert Originator Service in Symantec Alert Management System 2 (AMS2), as used in Symantec System Center (SSS); Symantec AntiVirus Server; Symantec AntiVirus Central Quarantine Server; Symantec AntiVirus (SAV) Corporate Edition 9 before 9.0 MR7, 10.0 and 10.1 before 10.1 MR8, and 10.2 before 10.2 MR2; Symantec Client Security (SCS) 2 before 2.0 MR7 and 3 before 3.1 MR8; and Symantec Endpoint Protection (SEP) before 11.0 MR3, allow remote attackers to execute arbitrary code via (1) a crafted packet or (2) data that ostensibly arrives from the MsgSys.exe process.
[20090428 ZDI-09-018: Symantec Client Security Alert Originator Service Stack Overflow Vulnerability]
[34672]
[34674]
[1022130]
[1022131]
[1022132]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090428_02]
[ADV-2009-1204]
[http://www.zerodayinitiative.com/advisories/ZDI-09-018/]
[symantec-iao-bo(50177)]
[symantec-msgsys-bo(50178)]
XFR.EXE in the Intel File Transfer service in the console in Symantec Alert Management System 2 (AMS2), as used in Symantec System Center (SSS); Symantec AntiVirus Server; Symantec AntiVirus Central Quarantine Server; Symantec AntiVirus (SAV) Corporate Edition 9 before 9.0 MR7, 10.0 and 10.1 before 10.1 MR8, and 10.2 before 10.2 MR2; Symantec Client Security (SCS) 2 before 2.0 MR7 and 3 before 3.1 MR8; and Symantec Endpoint Protection (SEP) before 11.0 MR3, allows remote attackers to execute arbitrary code by placing the code on a (1) share or (2) WebDAV server, and then sending the UNC share pathname to this service.
Per vendor: http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090428_02
"Symantec System Center Impact
Symantec System Center (SSS) is a Microsoft Management Console (MMC) plug-in which allows an administrator to manage all Symantec AntiVirus platforms from a single, centralized location. Alert Management System 2 (AMS2) is an alerting feature of System Center that listens for specific events and sends notifications as specified by the administrator.
AMS2 is installed by default with Symantec System Center 9.0. AMS2 is an optional component in Symantec System Center 10.0 or 10.1. These vulnerabilities will only impact systems if AMS has been installed.
Symantec AntiVirus Server Impact
AMS2 is installed by default with Symantec AntiVirus Server 9.0. AMS2 is an optional component in Symantec AntiVirus Server 10.0 or 10.1. These vulnerabilities will only impact systems if AMS has been installed.
Symantec AntiVirus and Symantec Endpoint Protection Central Quarantine Server Impact
AMS2 is installed by default by Central Quarantine Server. These vulnerabilities will only impact systems if Quarantine Server has been installed.
Symantec is not aware of any customers impacted by these issues, or of any attempts to exploit them. However, we recommend that any affected customers update their product immediately to protect against potential attempts to exploit these issues.
Certain localized language versions of SCS 2.0/SAV 9.x were not patched due to compatibility issues on the localized platforms. As a result, customers who are running the following versions are strongly recommended to update to a non-vulnerable SCS 2.0/SAV 9 International English version or upgrade to a non-vulnerable version of SEP 11.x:
Symantec Client Security 2.0/Symantec AntiVirus Corporate Edition 9.x (Chinese Simplified and Chinese Traditional)
Symantec Client Security 2.0/Symantec AntiVirus Business Pack 9.x (Chinese Simplified and Chinese Traditional)
Symantec Client Security 2.0/Symantec AntiVirus Business Pack 9.x (Korean)
Symantec Client Security 2.0/Symantec AntiVirus Business Pack 9.x (Japanese licensed)"
[20090429 Symantec System Center Alert Management System Console Arbitrary Program Execution Design Error Vulnerability]
[34675]
[1022130]
[1022131]
[1022132]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090428_02]
[ADV-2009-1204]
[symantec-xfr-code-execution(50179)]
Symantec Reporting Server, as used in Symantec AntiVirus (SAV) Corporate Edition 10.1 before 10.1 MR8 and 10.2 before 10.2 MR2, Symantec Client Security (SCS) before 3.1 MR8, and the Symantec Endpoint Protection Manager (SEPM) component in Symantec Endpoint Protection (SEP) before 11.0 MR2, allows remote attackers to inject arbitrary text into the login screen, and possibly conduct phishing attacks, via vectors involving a URL that is not properly handled.
[1022136]
[1022137]
[1022138]
[34668]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090428_00]
[ADV-2009-1202]
[ADV-2009-1204]
[multiple-symantec-login-spoofing(50172)]
SQL injection vulnerability in File::find (filesystem/File.php) in SilverStripe before 2.3.1 allows remote attackers to execute arbitrary SQL commands via the filename parameter.
[http://open.silverstripe.com/ticket/3721]
[http://open.silverstripe.com/wiki/ChangeLog/2.3.1]
[34485]
Cross-site request forgery (CSRF) vulnerability in Foswiki before 1.0.5 allows remote attackers to hijack the authentication of arbitrary users for requests that modify pages, change permissions, or change group memberships, as demonstrated by a URL for a (1) save or (2) view script in the SRC attribute of an IMG element, a related issue to CVE-2009-1339.
[http://foswiki.org/Support/SecurityAlert-CVE-2009-1434]
[[foswiki-announce] 20090427 Security Alert CVE-2009-1434: Foswiki Page View Cross-Site Request Forgery (CSRF)]
[foswiki-unspecified-csrf(50256)]
[https://launchpad.net/bugs/cve/2009-1434]
NTRtScan.exe in Trend Micro OfficeScan Client 8.0 SP1 and 8.0 SP1 Patch 1 allows local users to cause a denial of service (application crash) via directories with long pathnames. NOTE: some of these details are obtained from third party information.
[http://es.geocities.com/jplopezy/officescan.zip]
[20090421 Trend Micro OfficeScan Client - DOS]
[20090421 Re: Trend Micro OfficeScan Client - DOS]
[34642]
[1022109]
[ADV-2009-1146]
The db interface in libc in FreeBSD 6.3, 6.4, 7.0, 7.1, and 7.2-PRERELEASE does not properly initialize memory for Berkeley DB 1.85 database structures, which allows local users to obtain sensitive information by reading a database file.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10756]
[FreeBSD-SA-09:07]
[34666]
[1022113]
Stack-based buffer overflow in PortableApps CoolPlayer Portable (aka CoolPlayer+ Portable) 2.19.6 and earlier allows remote attackers to execute arbitrary code via a long string in a malformed playlist (.m3u) file. NOTE: this may overlap CVE-2008-3408.
[coolplayerportable-m3u-bo(49984)]
[https://hansesecure.de/vulnerability-in-coolplayer/]
[8489]
[8519]
[8520]
Integer overflow in the CSoundFile::ReadMed function (src/load_med.cpp) in libmodplug before 0.8.6, as used in gstreamer-plugins, TTPlayer, and other products, allows context-dependent attackers to execute arbitrary code via a MED file with a crafted (1) song comment or (2) song name, which triggers a heap-based buffer overflow, as exploited in the wild in August 2008.
[http://bugs.gentoo.org/show_bug.cgi?id=266913]
[SUSE-SR:2009:012]
[http://modplug-xmms.cvs.sourceforge.net/viewvc/modplug-xmms/libmodplug/src/load_med.cpp?r1=1.1&r2=1.2]
[GLSA-200907-07]
[http://sourceforge.net/project/shownotes.php?release_id=677065&group_id=1275]
[DSA-1850]
[DSA-1851]
[MDVSA-2009:128]
[[oss-security] 20090421 CVE Request -- libmodplug]
[FEDORA-2009-4064]
[FEDORA-2009-4068]
[30801]
[USN-771-1]
[ADV-2009-1104]
[https://bugzilla.redhat.com/show_bug.cgi?id=496834]
[libmodplug-csoundfilereadmed-bo(50388)]
Buffer overflow in fs/cifs/connect.c in CIFS in the Linux kernel 2.6.29 and earlier allows remote attackers to cause a denial of service (crash) via a long nativeFileSystem field in a Tree Connect response to an SMB mount request.
[http://blog.fefe.de/?ts=b72905a8]
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b363b3304bcf68c4541683b2eff70b29f0446a5b]
[SUSE-SA:2009:028]
[SUSE-SA:2009:030]
[SUSE-SA:2009:031]
[SUSE-SA:2009:032]
[[linux-cifs-client] 20090406 [PATCH] cifs: Fix insufficient memory allocation for nativeFileSystem field]
[http://wiki.rpath.com/Advisories:rPSA-2009-0084]
[DSA-1787]
[DSA-1794]
[DSA-1800]
[[oss-security] 20090405 CVE request? buffer overflow in CIFS in 2.6.*]
[[oss-security] 20090407 Re: CVE request? buffer overflow in CIFS in 2.6.*]
[[oss-security] 20090407 Re: CVE request? buffer overflow in CIFS in 2.6.*]
[RHSA-2009:1081]
[20090516 rPSA-2009-0084-1 kernel]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[34453]
[USN-793-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-3316]
[http://xorl.wordpress.com/2009/04/07/linux-kernel-tree-connect-cifs-remote-buffer-overflow/]
[https://bugzilla.novell.com/show_bug.cgi?id=492282]
[https://bugzilla.redhat.com/show_bug.cgi?id=494275]
[oval:org.mitre.oval:def:10321]
[oval:org.mitre.oval:def:8265]
[FEDORA-2009-5356]
[FEDORA-2009-5383]
Incomplete blacklist vulnerability in DownloadListCtrl.cpp in amule 2.2.4 allows remote attackers to conduct argument injection attacks into a command for mplayer via a crafted filename.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=525078]
[DSA-1821]
[[oss-security] 20090422 CVE id request: amule]
[34683]
[amule-downloadlistctrl-command-execution(50205)]
Heap-based buffer overflow in the ParamTraits<SkBitmap>::Read function in Google Chrome before 1.0.154.64 allows attackers to leverage renderer access to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to a large bitmap that arrives over the IPC channel.
[http://code.google.com/p/chromium/issues/detail?id=10869]
[http://googlechromereleases.blogspot.com/2009/05/stable-update-security-fix.html]
[34859]
[1022174]
[ADV-2009-1266]
[chrome-paramtraitsskbitmapread-bo(50362)]
Multiple integer overflows in Skia, as used in Google Chrome 1.x before 1.0.154.64 and 2.x, and possibly Android, might allow remote attackers to execute arbitrary code in the renderer process via a crafted (1) image or (2) canvas.
[http://code.google.com/p/chromium/issues/detail?id=10736]
[http://code.google.com/p/skia/source/detail?r=159]
[http://googlechromereleases.blogspot.com/2009/05/stable-update-security-fix.html]
[34859]
[1022175]
[ADV-2009-1266]
Multiple unspecified vulnerabilities in the Server component in OCS Inventory NG before 1.02 have unknown impact and attack vectors.
[http://www.ocsinventory-ng.org/index.php?mact=News,cntnt01,detail,0&cntnt01articleid=133&cntnt01returnid=51]
[34694]
[ADV-2009-1152]
PHP remote file inclusion vulnerability in indexk.php in WebPortal CMS 0.8-beta allows remote attackers to execute arbitrary PHP code via a URL in the lib_path parameter.
[34687]
[8516]
Multiple directory traversal vulnerabilities in WebPortal CMS 0.8-beta allow remote attackers to (1) read arbitrary files via directory traversal sequences in the lang parameter to libraries/helpdocs/help.php and (2) include and execute arbitrary local files via directory traversal sequences in the error parameter to index.php.
[34687]
[8516]
Unrestricted file upload vulnerability in upload.php in Elkagroup Image Gallery 1.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in gallery/pictures/. NOTE: some of these details are obtained from third party information.
[34679]
[ADV-2009-1149]
[8514]
Unrestricted file upload vulnerability in admin/editor/image.php in e-cart.biz Free Shopping Cart allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images/.
[34590]
[ecart-image-file-upload(49956)]
[8474]
Cross-site scripting (XSS) vulnerability in apricot.php in LovPop.net APRICOT, probably 1.20, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
[JVN#82744714]
[JVNDB-2009-000019]
[apricot-apricot-xss(49948)]
Stack-based buffer overflow in PortableApps CoolPlayer Portable (aka CoolPlayer+ Portable) 2.19.1 allows remote attackers to execute arbitrary code via a skin file (skin.ini) with a large PlaylistSkin parameter. NOTE: this may overlap CVE-2008-5735.
[coolplayerportable-skin-bo(50448)]
[8527]
PHP remote file inclusion vulnerability in format.php in SMA-DB 0.3.12 allows remote attackers to execute arbitrary PHP code via a URL in the _page_content parameter.
[7936]
Cross-site scripting (XSS) vulnerability in startpage.php in SMA-DB 0.3.12 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
[7936]
Multiple PHP remote file inclusion vulnerabilities in theme/format.php in SMA-DB 0.3.13 allow remote attackers to execute arbitrary PHP code via a URL in the (1) _page_css and (2) _page_javascript parameters. NOTE: the _page_content vector is already is covered by CVE-2009-1450.
[34569]
[smadb-formatphp-file-include(49928)]
[8460]
SQL injection vulnerability in class.eport.php in Tiny Blogr 1.0.0 rc4, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the txtUsername parameter (aka the Username field). NOTE: some of these details are obtained from third party information.
[20090417 Tiny Blogr 1.0.0 rc4 Authentication Bypass]
[34581]
[8464]
Cross-site scripting (XSS) vulnerability in tasks.php in WebCollab before 2.50 (aka Billy Goat) allows remote attackers to inject arbitrary web script or HTML via the selection parameter in a todo action.
[http://holisticinfosec.org/content/view/108/45/]
[http://sourceforge.net/project/shownotes.php?release_id=676245&group_id=75945]
[34576]
[webcollab-tasks-xss(49939)]
Multiple cross-site request forgery (CSRF) vulnerabilities in WebCollab before 2.50 (aka Billy Goat) allow remote attackers to hijack the authentication of administrators for requests that change an arbitrary password or have other unspecified impact.
[http://holisticinfosec.org/content/view/108/45/]
[http://sourceforge.net/project/shownotes.php?release_id=676245&group_id=75945]
[webcollab-unspecifed-csrf(49940)]
Directory traversal vulnerability in admin.php in Malleo 1.2.3 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the module parameter.
[20090417 Malleo 1.2.3 Local File Inclusion Vulnerability]
[34588]
Cross-site scripting (XSS) vulnerability in player.php in Nuke Evolution Xtreme 2.x allows remote attackers to inject arbitrary web script or HTML via the defaultVisualExt parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[34594]
[nex-player-xss(49944)]
Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in razorCMS before 0.4 allow remote attackers to inject arbitrary web script or HTML via (1) the slab parameter in an edit action, (2) the catname parameter in a showcats action, and (3) the cat parameter in a reordercat action.
[20090416 razorCMS - Multiple Vulnerabilities]
[20090416 [follow-up] razorCMS - Multiple Vulnerabilities]
[http://razorcms.co.uk/support/viewtopic.php?f=13&t=325]
[34566]
[razorcms-index-xss(49945)]
Cross-site request forgery (CSRF) vulnerability in razorCMS before 0.4 allows remote attackers to hijack the authentication of administrators for requests that create a web page containing PHP code.
[20090416 razorCMS - Multiple Vulnerabilities]
[20090416 [follow-up] razorCMS - Multiple Vulnerabilities]
[http://razorcms.co.uk/support/viewtopic.php?f=13&t=325]
[34566]
[razorcms-unspecified-csrf(49947)]
razorCMS before 0.4 uses weak permissions for (1) admin/core/admin_config.php, which allows local users to obtain the administrator's password hash and FTP user credentials; and (2) the root directory, (3) datastore/, and (4) admin/core/, which allows local users to have an unspecified impact.
[20090416 razorCMS - Multiple Vulnerabilities]
[20090416 [follow-up] razorCMS - Multiple Vulnerabilities]
[http://razorcms.co.uk/support/viewtopic.php?f=13&t=325]
[34566]
[razorcms-adminconfig-info-disclosure(49946)]
Cross-site scripting (XSS) vulnerability in the Create New Page form in razorCMS 0.3 RC2 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the Page Title field.
[20090416 [follow-up] razorCMS - Multiple Vulnerabilities]
[http://razorcms.co.uk/support/viewtopic.php?f=13&t=325]
[34854]
[razorcms-createnewpage-xss(50357)]
The Security Manager in razorCMS before 0.4 does not verify the permissions of every file owned by the apache user account, which is inconsistent with the documentation and allows local users to have an unspecified impact.
[20090416 razorCMS - Multiple Vulnerabilities]
[20090416 [follow-up] razorCMS - Multiple Vulnerabilities]
[http://razorcms.co.uk/support/viewtopic.php?f=13&t=325]
[34566]
[razorcms-security-manager-unspecified(50358)]
Static code injection vulnerability in razorCMS before 0.4 allows remote attackers to inject arbitrary PHP code into any page by saving content as a .php file.
[20090416 razorCMS - Multiple Vulnerabilities]
[20090416 [follow-up] razorCMS - Multiple Vulnerabilities]
[http://razorcms.co.uk/support/viewtopic.php?f=13&t=325]
[34566]
[razorcms-phpfile-code-execution(50359)]
Multiple cross-site request forgery (CSRF) vulnerabilities in index.aas in Application Access Server (A-A-S) 2.0.48 allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary programs via a command job, (2) stop services via a setservice job, or (3) terminate processes via a killprocess job.
[1022204]
[20090512 Syhunt: A-A-S (Application Access Server) Multiple Security Vulnerabilities]
[34911]
[http://www.syhunt.com/advisories/?id=aas-multiple]
[http://www.syhunt.com/advisories/aashack.txt]
Application Access Server (A-A-S) 2.0.48 has "wildbat" as its default password for the admin account, which makes it easier for remote attackers to obtain access.
[1022204]
[20090512 Syhunt: A-A-S (Application Access Server) Multiple Security Vulnerabilities]
[34911]
[http://www.syhunt.com/advisories/?id=aas-multiple]
[aas-default-password(50589)]
Application Access Server (A-A-S) 2.0.48 stores (1) passwords and (2) the port keyword in cleartext in aas.ini, which allows local users to obtain sensitive information by reading this file.
[1022204]
[20090512 Syhunt: A-A-S (Application Access Server) Multiple Security Vulnerabilities]
[34911]
[http://www.syhunt.com/advisories/?id=aas-multiple]
[aas-aas-info-disclosure(50590)]
Multiple cross-site scripting (XSS) vulnerabilities in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote attackers to inject arbitrary web script or HTML via (1) the body of a message, related to the email view and incorrect HTML filtering in the cleanHTML function in server/inc/tools.php; or the (2) title, (3) link, or (4) description element in an RSS feed, related to the getHTML function in server/inc/rss/item.php.
[http://www.redteam-pentesting.de/advisories/rt-sa-2009-001]
[http://www.redteam-pentesting.de/advisories/rt-sa-2009-002]
[20090505 [RT-SA-2009-001] IceWarp WebMail Server: Cross Site Scripting in Email View]
[20090505 [RT-SA-2009-002] IceWarp WebMail Server: User-assisted Cross Site Scripting in RSS Feed Reader]
[34825]
[1022167]
[1022168]
[ADV-2009-1253]
[merak-webmail-xss(50331)]
Multiple SQL injection vulnerabilities in the search form in server/webmail.php in the Groupware component in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) sql and (2) order_by elements in an XML search query.
[http://www.redteam-pentesting.de/advisories/rt-sa-2009-003]
[20090505 [RT-SA-2009-003] IceWarp WebMail Server: SQL Injection in Groupware Component]
[34820]
[1022169]
[ADV-2009-1253]
CRLF injection vulnerability in the Forgot Password implementation in server/webmail.php in IceWarp eMail Server and WebMail Server before 9.4.2 makes it easier for remote attackers to trick a user into disclosing credentials via CRLF sequences preceding a Reply-To header in the subject element of an XML document, as demonstrated by triggering an e-mail message from the server that contains a user's correct credentials, and requests that the user compose a reply that includes this message.
[http://www.redteam-pentesting.de/advisories/rt-sa-2009-004]
[20090505 [RT-SA-2009-004] IceWarp WebMail Server: Client-Side Specification of "Forgot Password" eMail Content]
[34827]
[1022166]
[ADV-2009-1253]
[merak-forgot-password-header-injection(50332)]
The Java client program for the ATEN KH1516i IP KVM switch with firmware 1.0.063 and the KN9116 IP KVM switch with firmware 1.1.104 has a hardcoded AES encryption key, which makes it easier for man-in-the-middle attackers to (1) execute arbitrary Java code, or (2) gain access to machines connected to the switch, by hijacking a session.
[20090526 Multiple vulnerabilities in several ATEN IP KVM Switches]
[35108]
The (1) Windows and (2) Java client programs for the ATEN KH1516i IP KVM switch with firmware 1.0.063 and the KN9116 IP KVM switch with firmware 1.1.104 do not properly use RSA cryptography for a symmetric session-key negotiation, which makes it easier for remote attackers to (a) decrypt network traffic, or (b) conduct man-in-the-middle attacks, by repeating unspecified "client-side calculations."
[20090526 Multiple vulnerabilities in several ATEN IP KVM Switches]
[35108]
[aten-kvm-client-weak-security(50849)]
The ATEN KH1516i IP KVM switch with firmware 1.0.063 and the KN9116 IP KVM switch with firmware 1.1.104 do not (1) encrypt mouse events, which makes it easier for man-in-the-middle attackers to perform mouse operations on machines connected to the switch by injecting network traffic; and do not (2) set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
[20090526 Multiple vulnerabilities in several ATEN IP KVM Switches]
[35108]
[aten-kvm-mouse-weak-security(50850)]
Buffer overflow in lib/load_http.c in ippool in Darren Reed IPFilter (aka IP Filter) 4.1.31 allows local users to gain privileges via vectors involving a long hostname in a URL.
[http://cvsweb.netbsd.org/bsdweb.cgi/src/dist/ipf/lib/load_http.c]
[http://cvsweb.netbsd.org/bsdweb.cgi/src/dist/ipf/lib/load_http.c.diff?r1=1.1&r2=1.2&f=h]
[20090522 IPFilter (ippool) 4.1.31 lib/load_http.c buffer overflow]
[35076]
[1022272]
[ipfilter-loadhttp-bo(50716)]
The https web interfaces on the ATEN KH1516i IP KVM switch with firmware 1.0.063, the KN9116 IP KVM switch with firmware 1.1.104, and the PN9108 power-control unit have a hardcoded SSL private key, which makes it easier for remote attackers to decrypt https sessions by extracting this key from their own switch and then sniffing network traffic to a switch owned by a different customer.
[20090526 Multiple vulnerabilities in several ATEN IP KVM Switches]
[35108]
[aten-kvm-ssl-weak-security(50851)]
Multiple unspecified vulnerabilities in the DTrace ioctl handlers in Sun Solaris 10, and OpenSolaris before snv_114, allow local users to cause a denial of service (panic) via unknown vectors.
[257708]
[http://support.avaya.com/elmodocs2/security/ASA-2009-171.htm]
[34753]
[1022143]
[ADV-2009-1199]
[ADV-2009-1378]
[solaris-dtrace-ioctl-dos(50220)]
Directory traversal vulnerability in client/desktop/default.htm in Boxalino before 09.05.25-0421 allows remote attackers to read arbitrary files via a .. (dot dot) in the url parameter.
[http://www.csnc.ch/misc/files/advisories/CVE-2009-1479-Boxalino-Directory_Traversal.txt]
[20091020 [CVE-2009-1479] Boxalino - Directory Traversal Vulnerability]
[boxalino-default-directory-traversal(53932)]
SQL injection vulnerability in index.php Pragyan CMS 2.6.4 allows remote attackers to execute arbitrary SQL commands via the fileget parameter in a view action and other unspecified vectors.
[20090424 Pragyan CMS 2.6.4 Multiple SQL Injection Vulnerabilities]
[34707]
[8533]
SQL injection vulnerability in action.asp in PuterJam's Blog (PJBlog3) 3.0.6.170 allows remote attackers to execute arbitrary SQL commands via the cname parameter in a checkAlias action, as exploited in the wild in April 2009. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[http://downloads.securityfocus.com/vulnerabilities/exploits/34701.vbs]
[34701]
[pjblog3-action-sql-injection(50082)]
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin 1.8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) an AttachFile sub-action in the error_msg function or (2) multiple vectors related to package file errors in the upload_form function, different vectors than CVE-2009-0260.
[http://hg.moinmo.in/moin/1.8/rev/5f51246a4df1]
[http://moinmo.in/SecurityFixes]
[DSA-1791]
[34631]
[USN-774-1]
[ADV-2009-1119]
[moinmoin-errormsg-xss(50356)]
Unrestricted file upload vulnerability in upload-file.php in Adam Patterson Studio Lounge Address Book 2.5, as reachable from index2.php, allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in profiles/.
[34652]
[ADV-2009-1111]
[addressbook-uploadfile-file-upload(49972)]
[8481]
Cross-site scripting (XSS) vulnerability in the web mail interface feature in AXIGEN Mail Server 6.2.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving e-mail messages. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[34716]
The logging feature in eMule Plus before 1.2e allows remote attackers to cause a denial of service (infinite loop) via unspecified attack vectors.
[http://sourceforge.net/project/shownotes.php?release_id=676726]
[emuleplus-logging-dos(50081)]
Directory traversal vulnerability in pmscript.php in Flatchat 3.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the with parameter.
[8549]
SQL injection vulnerability in pages/login.php in FunGamez RC1 allows remote attackers to execute arbitrary SQL commands via the login_user (aka username) parameter. NOTE: some of these details are obtained from third party information.
[20090420 Multiple Remote Vulnerabilities--SQLi-(INSECURE-COOKIE-HANDLING)-LFI-->]
[34610]
[ADV-2009-1117]
[fungamez-login-sql-injection(50090)]
[8493]
Directory traversal vulnerability in admin/load.php in FunGamez RC1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module parameter to index.php.
[20090420 Multiple Remote Vulnerabilities--SQLi-(INSECURE-COOKIE-HANDLING)-LFI-->]
[34610]
[ADV-2009-1117]
[fungamez-index-file-include(50091)]
[8493]
includes/user.php in Fungamez RC1 allows remote attackers to bypass authentication and gain administrative access by setting the user cookie parameter.
[20090420 Multiple Remote Vulnerabilities--SQLi-(INSECURE-COOKIE-HANDLING)-LFI-->]
[ADV-2009-1117]
[fungamez-user-auth-bypass(50424)]
[8493]
Heap-based buffer overflow in Sendmail before 8.13.2 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a long X- header, as demonstrated by an X-Testing header.
[http://www.nmrc.org/~thegnome/blog/apr09/]
[http://www.sendmail.org/releases/8.13.2]
[sendmail-xheader-bo(50355)]
McAfee GroupShield for Microsoft Exchange on Exchange Server 2000, and possibly other anti-virus or anti-spam products from McAfee or other vendors, does not scan X- headers for malicious content, which allows remote attackers to bypass virus detection via a crafted message, as demonstrated by a message with an X-Testing header and no message body.
[http://www.nmrc.org/~thegnome/blog/apr09/]
[groupshield-xheaders-security-bypass(50354)]
The getAnnots Doc method in the JavaScript API in Adobe Reader and Acrobat 9.1, 8.1.4, 7.1.1, and earlier allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a PDF file that contains an annotation, and has an OpenAction entry with JavaScript code that calls this method with crafted integer arguments.
[http://blogs.adobe.com/psirt/2009/04/potential_adobe_reader_issue.html]
[http://blogs.adobe.com/psirt/2009/04/update_on_adobe_reader_issue.html]
[http://blogs.adobe.com/psirt/2009/05/adobe_reader_issue_update.html]
[SUSE-SA:2009:027]
[SUSE-SR:2009:011]
[http://packetstorm.linuxsecurity.com/0904-exploits/getannots.txt]
[GLSA-200907-06]
[259028]
[http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=926953]
[http://www.adobe.com/support/security/bulletins/apsb09-06.html]
[VU#970180]
[RHSA-2009:0478]
[34736]
[1022139]
[TA09-133B]
[ADV-2009-1189]
[ADV-2009-1317]
[reader-getannots-code-execution(50145)]
[8569]
The customDictionaryOpen spell method in the JavaScript API in Adobe Reader 9.1, 8.1.4, 7.1.1, and earlier on Linux and UNIX allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a PDF file that triggers a call to this method with a long string in the second argument.
[http://blogs.adobe.com/psirt/2009/04/update_on_adobe_reader_issue.html]
[http://blogs.adobe.com/psirt/2009/05/adobe_reader_issue_update.html]
[SUSE-SA:2009:027]
[SUSE-SR:2009:011]
[http://packetstorm.linuxsecurity.com/0904-exploits/spell.txt]
[GLSA-200907-06]
[259028]
[http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=926953]
[http://www.adobe.com/support/security/bulletins/apsb09-06.html]
[VU#970180]
[RHSA-2009:0478]
[34740]
[1022139]
[TA09-133B]
[ADV-2009-1189]
[ADV-2009-1317]
[reader-spellcustom-code-execution(50146)]
[8570]
The process_stat function in Memcached 1.2.8 discloses memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain potentially sensitive information by sending this command to the daemon's TCP port.
[http://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98&r=98]
[http://code.google.com/p/memcachedb/source/detail?r=98]
[http://code.google.com/p/memcachedb/source/diff?spec=svn98&r=98&format=side&path=/trunk/memcachedb.c]
[http://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40e]
[http://memcached.googlecode.com/files/memcached-1.2.8.tar.gz]
[memcached-processstat-info-disclosure(50444)]
Web File Explorer 3.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for data/db.mdb.
[8374]
Directory traversal vulnerability in the Cmi Marketplace (com_cmimarketplace) component 0.1 for Joomla! allows remote attackers to list arbitrary directories via a .. (dot dot) in the viewit parameter to index.php.
[34431]
[8367]
Stack-based buffer overflow in srt2smi.exe in Gretech Online Movie Player (GOM Player) 2.1.16.4635 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long string in an SRT file.
[http://security.bkis.vn/?p=501]
[20090408 [Bkis-06-2009] GOM Player Subtitle Buffer Overflow Vulnerability]
[34427]
[8370]
Directory traversal vulnerability in inc/profilemain.php in Game Maker 2k Internet Discussion Boards (iDB) 0.2.5 Pre-Alpha SVN 243 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the skin parameter in a settings action to profile.php.
[34397]
[idb-profilemain-file-include(49697)]
[8357]
SQL injection vulnerability in the MailTo (aka com_mailto) component in Joomla! allows remote attackers to execute arbitrary SQL commands via the article parameter in index.php. NOTE: SecurityFocus states that this issue has been disputed by the vendor.
[34433]
[8366]
SQL injection vulnerability in index.php in ProjectCMS 1.0 Beta allows remote attackers to execute arbitrary SQL commands via the sn parameter.
[20090429 SQL INJECTION (SQLi) VULNERABILITY--ProjectCMS v1.0 Beta Final-->]
[34767]
[8565]
Cross-site scripting (XSS) vulnerability in the Exif module 5.x-1.x before 5.x-1.2 and 6.x-1.x-dev before April 13, 2009, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via EXIF tags in an image.
[http://drupal.org/node/448958]
[34774]
[ADV-2009-1213]
Directory traversal vulnerability in plugin.php in S-Cms 1.1 Stable and 1.5.2 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the page parameter.
[34771]
[8566]
Multiple SQL injection vulnerabilities in login.php in Tiger Document Management System (DMS) allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
[34775]
[8571]
Absolute Form Processor XE 1.5 allows remote attackers to bypass authentication and gain administrative access by setting the xlaAFPadmin cookie to "lvl=1&userid=1."
[8529]
SQL injection vulnerability in the News Page module 5.x before 5.x-1.2 for Drupal allows remote authenticated users, with News Page nodes create and edit privileges, to execute arbitrary SQL commands via the Include Words (aka keywords) field.
[http://drupal.org/node/449014]
[34777]
[ADV-2009-1214]
[newspage-keywords-sql-injection(50248)]
SQL injection vulnerability in classes/Xp.php in eLitius 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to banner-details.php.
[34769]
[8563]
The Node Access User Reference module 5.x before 5.x-2.0-beta4 and 6.x before 6.x-2.0-beta6, a module for Drupal, interprets an empty CCK user reference as a reference to the anonymous user, which might allow remote attackers to bypass intended access restrictions to read or modify a node.
[http://drupal.org/node/449030]
[34778]
[ADV-2009-1212]
SQL injection vulnerability in the xforum_validateUser function in Common.php in X-Forum 0.6.2 allows remote attackers to execute arbitrary SQL commands, as demonstrated via the cookie_username parameter to Configure.php.
[34302]
[xforum-cookieusername-sql-injection(49537)]
[8317]
SQL injection vulnerability in ajaxp_backend.php in MyioSoft AjaxPortal 3.0 allows remote attackers to execute arbitrary SQL commands via the page parameter.
[34338]
[8341]
Multiple directory traversal vulnerabilities in KoschtIT Image Gallery 1.82 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the file parameter to (1) ki_makepic.php and (2) ki_nojsdisplayimage.php in ki_base/.
[34335]
[8334]
GDI+ in Microsoft Windows XP SP3 allows remote attackers to cause a denial of service (infinite loop) via a PNG file that contains a certain large btChunkLen value.
[34586]
[8466]
Static code injection vulnerability in X-Forum 0.6.2 allows remote authenticated administrators to inject arbitrary PHP code into Config.php via the adminEMail parameter to SaveConfig.php.
[xforum-config-code-execution(50390)]
[8317]
Buffer overflow in the PATinst function in src/load_pat.cpp in libmodplug before 0.8.7 allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a long instrument name.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526084]
[http://modplug-xmms.cvs.sourceforge.net/viewvc/modplug-xmms/libmodplug/src/load_pat.cpp?r1=1.3&r2=1.4]
[http://modplug-xmms.git.sourceforge.net/git/gitweb.cgi?p=modplug-xmms;a=commitdiff;h=c4ebb701be6ee9a296a44fdac5a20b7739ff0595]
[GLSA-200907-07]
[http://sourceforge.net/project/shownotes.php?release_id=678622&group_id=1275]
[http://sourceforge.net/tracker/?func=detail&aid=2777467&group_id=1275&atid=301275]
[DSA-1850]
[MDVSA-2009:128]
[[oss-security] 20090429 Re: CVE Request -- libmodplug]
[34747]
[USN-771-1]
[ADV-2009-1200]
Google Chrome 1.0.154.53 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a throw statement with a long exception value.
[34786]
[8573]
Heap-based buffer overflow in the cdf_read_sat function in src/cdf.c in Christos Zoulas file 5.00 allows user-assisted remote attackers to execute arbitrary code via a crafted compound document file, as demonstrated by a .msi, .doc, or .mpp file. NOTE: some of these details are obtained from third party information.
[ftp://ftp.astron.com/pub/file/file-5.01.tar.gz]
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=515603]
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=525820]
[[file] 20090501 file 5.01 is now available]
[MDVSA-2009:129]
[34745]
Stack-based buffer overflow in the IceWarpServer.APIObject ActiveX control in api.dll in IceWarp Merak Mail Server 9.4.1 might allow context-dependent attackers to execute arbitrary code via a large value in the second argument to the Base64FileEncode method, as possibly demonstrated by a web application that accepts untrusted input for this method.
[34739]
[8542]
Multiple insecure method vulnerabilities in the Symantec.EasySetup.1 ActiveX control in EasySetupInt.dll 14.0.4.30167 in the EasySetup wizard in Symantec Norton Ghost 14.0 allow remote attackers to cause a denial of service (browser crash) and possibly execute arbitrary code via unspecified input to the (1) GetBackupLocationPath, (2) CallUninstall, (3) SetupDeleteVolume, (4) CanUseEasySetup, (5) CallAddInitialProtection, and (6) CallTour methods.
[34696]
[1022120]
[http://www.shinnai.net/xplits/TXT_Gl6RHStS23c9DANArcJE.html]
[nortonghost-easysetupint-dos(50098)]
[8523]
Cross-site request forgery (CSRF) vulnerability in Beltane before 2.3.11 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Directory traversal vulnerability in index.php in Pecio CMS 1.1.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the language parameter.
[34802]
[8593]
Buffer overflow in the Web GUI in the IBM Tivoli Storage Manager (TSM) client 5.1.0.0 through 5.1.8.2, 5.2.0.0 through 5.2.5.3, 5.3.0.0 through 5.3.6.4, 5.4.0.0 through 5.4.2.6, and 5.5.0.0 through 5.5.1.17 allows attackers to cause a denial of service (application crash) or execute arbitrary code via unspecified vectors.
[ADV-2009-1235]
[http://www-01.ibm.com/support/docview.wss?uid=swg21384389]
[IC59994]
[ibm-tsm-webgui-bo(50328)]
Unspecified vulnerability in the Java GUI in the IBM Tivoli Storage Manager (TSM) client 5.2.0.0 through 5.2.5.3, 5.3.0.0 through 5.3.6.5, 5.4.0.0 through 5.4.2.6, and 5.5.0.0 through 5.5.1.17, and the TSM Express client 5.3.3.0 through 5.3.6.5, allows attackers to read or modify arbitrary files via unknown vectors.
[ADV-2009-1235]
[http://www-01.ibm.com/support/docview.wss?uid=swg21384389]
[IC59779]
[ibm-tsm-javagui-security-bypass(50329)]
The IBM Tivoli Storage Manager (TSM) client 5.5.0.0 through 5.5.1.17 on AIX and Windows, when SSL is used, allows remote attackers to conduct unspecified man-in-the-middle attacks and read arbitrary files via unknown vectors.
[ADV-2009-1235]
[http://www-01.ibm.com/support/docview.wss?uid=swg21384389]
[IC59781]
[ibm-tsm-ssl-mitm(50330)]
Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.
[SSRT100184]
[http://jira.codehaus.org/browse/JETTY-1004]
[VU#402580]
[http://www.kb.cert.org/vuls/id/CRDY-7RKQCY]
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[34800]
[35675]
[1022563]
[ADV-2009-1900]
[ADV-2010-1792]
[https://bugzilla.redhat.com/show_bug.cgi?id=499867]
[FEDORA-2009-5500]
[FEDORA-2009-5509]
[FEDORA-2009-5513]
Cross-site scripting (XSS) vulnerability in Mort Bay Jetty before 6.1.17 allows remote attackers to inject arbitrary web script or HTML via a directory listing request containing a ; (semicolon) character.
[SSRT100184]
[http://jira.codehaus.org/browse/JETTY-980]
[34800]
[ADV-2010-1792]
[https://bugzilla.redhat.com/show_bug.cgi?id=499867]
CMD_DB in JBMC Software DirectAdmin before 1.334 allows remote authenticated users to gain privileges via shell metacharacters in the name parameter during a restore action.
[20090422 DirectAdmin < 1.33.4 Local file overwrite & Local root escalation]
[http://www.directadmin.com/features.php?id=968]
[directadmin-cmddb-command-execution(50167)]
JBMC Software DirectAdmin before 1.334 allows local users to create or overwrite any file via a symlink attack on an arbitrary file in a certain temporary directory, related to a request for this temporary file in the PATH_INFO to the CMD_DB script during a backup action.
[20090422 DirectAdmin < 1.33.4 Local file overwrite & Local root escalation]
[http://www.directadmin.com/features.php?id=968]
Race condition in the ptrace_attach function in kernel/ptrace.c in the Linux kernel before 2.6.30-rc4 allows local users to gain privileges via a PTRACE_ATTACH ptrace call during an exec system call that is launching a setuid application, related to locking an incorrect cred_exec_mutex object.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=cad81bc2529ab8c62b6fdc83a1c0c7f4a87209eb]
[http://wiki.rpath.com/Advisories:rPSA-2009-0084]
[http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.30-rc4]
[[oss-security] 20090504 CVE request: kernel: ptrace_attach: fix the usage of ->cred_exec_mutex]
[20090516 rPSA-2009-0084-1 kernel]
[34799]
[ADV-2009-1236]
[linux-kernel-ptraceattach-code-execution(50293)]
Microsoft Internet Explorer 6 and 7 for Windows XP SP2 and SP3; 6 and 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 does not properly synchronize AJAX requests, which allows allows remote attackers to execute arbitrary code via a large number of concurrent, asynchronous XMLHttpRequest calls, aka "HTML Object Memory Corruption Vulnerability."
[20090610 ZDI-09-037: Microsoft Internet Explorer Concurrent Ajax Request Memory Corruption Vulnerability]
[35222]
[1022350]
[TA09-160A]
[ADV-2009-1538]
[http://www.zerodayinitiative.com/advisories/ZDI-09-037]
[MS09-019]
[oval:org.mitre.oval:def:6260]
Microsoft Internet Explorer 7 for Windows XP SP2 and SP3; 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by calling the setCapture method on a collection of crafted objects, aka "Uninitialized Memory Corruption Vulnerability."
[20090610 ZDI-09-036: Microsoft Internet Explorer setCapture Memory Corruption Vulnerability]
[35223]
[1022350]
[TA09-160A]
[ADV-2009-1538]
[http://www.zerodayinitiative.com/advisories/ZDI-09-036]
[MS09-019]
[oval:org.mitre.oval:def:6295]
Use-after-free vulnerability in Microsoft Internet Explorer 7 for Windows XP SP2 and SP3; 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 allows remote attackers to execute arbitrary code by repeatedly adding HTML document nodes and calling event handlers, which triggers an access of an object that (1) was not properly initialized or (2) is deleted, aka "HTML Objects Memory Corruption Vulnerability."
[20090610 ZDI-09-038: Microsoft Internet Explorer Event Handler Memory Corruption Vulnerability]
[1022350]
[TA09-160A]
[ADV-2009-1538]
[http://www.zerodayinitiative.com/advisories/ZDI-09-038]
[MS09-019]
[oval:org.mitre.oval:def:6294]
Microsoft Internet Explorer 7 for Windows XP SP2 and SP3; 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 allows remote attackers to execute arbitrary code via frequent calls to the getElementsByTagName function combined with the creation of an object during reordering of elements, followed by an onreadystatechange event, which triggers an access of an object that (1) was not properly initialized or (2) is deleted, aka "HTML Object Memory Corruption Vulnerability."
[20090610 ZDI-09-039: Microsoft Internet Explorer onreadystatechange Memory Corruption Vulnerability]
[35234]
[1022350]
[TA09-160A]
[ADV-2009-1538]
[http://www.zerodayinitiative.com/advisories/ZDI-09-039]
[MS09-019]
[oval:org.mitre.oval:def:6308]
Microsoft Internet Explorer 8 for Windows XP SP2 and SP3; 8 for Server 2003 SP2; 8 for Vista Gold, SP1, and SP2; and 8 for Server 2008 SP2 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code via "malformed row property references" that trigger an access of an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "HTML Objects Memory Corruption Vulnerability" or "HTML Object Memory Corruption Vulnerability."
[20090610 ZDI-09-041: Microsoft Internet Explorer 8 Rows Property Dangling Pointer Code Execution Vulnerability]
[1022350]
[TA09-160A]
[ADV-2009-1538]
[http://www.zerodayinitiative.com/advisories/ZDI-09-041]
[MS09-019]
[oval:org.mitre.oval:def:6244]
Buffer overflow in the Works for Windows document converters in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, Office 2007 SP1, and Works 8.5 and 9 allows remote attackers to execute arbitrary code via a crafted Works .wps file that triggers memory corruption, aka "File Converter Buffer Overflow Vulnerability."
[http://blogs.technet.com/srd/archive/2009/06/09/ms09-024.aspx]
[JVN#70858401]
[35184]
[1022354]
[1022355]
[TA09-160A]
[ADV-2009-1543]
[MS09-024]
[oval:org.mitre.oval:def:6292]
Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Components SP3, BizTalk Server 2002, and Visual Studio .NET 2003 SP1 allows remote attackers to execute arbitrary code via crafted property values, aka "Office Web Components Buffer Overflow Vulnerability."
[35992]
[1022708]
[TA09-223A]
[MS09-043]
[oval:org.mitre.oval:def:6326]
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files, via a %c0%af (Unicode / character) at an arbitrary position in the URI, as demonstrated by inserting %c0%af into a "/protected/" initial pathname component to bypass the password protection on the protected\ folder, aka "IIS 5.1 and 6.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1122.
[20090515 IIS6 + webdav and unicode rides again in 2009]
[20090515 Re: IIS6 + webdav and unicode rides again in 2009]
[20090515 Re: IIS6 + webdav and unicode rides again in 2009]
[http://archives.neohapsis.com/archives/fulldisclosure/2009-05/att-0135/IIS_Advisory.pdf]
[http://blog.zoller.lu/2009/05/iis-6-webdac-auth-bypass-and-data.html]
[http://isc.sans.org/diary.html?n&storyid=6397]
[http://view.samurajdata.se/psview.php?id=023287d6&page=1]
[20090616 IIS WebDav Vulnerability CVE ID]
[TA09-160A]
[MS09-020]
[oval:org.mitre.oval:def:6029]
ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request scheduling, which allows remote attackers to cause a denial of service (daemon outage) via a series of crafted HTTP requests, aka "Remote Unauthenticated Denial of Service in ASP.NET Vulnerability."
[http://blogs.technet.com/srd/archive/2009/08/11/ms09-035-asp-net-denial-of-service-vulnerability.aspx]
[35985]
[1022715]
[TA09-223A]
[ADV-2009-2231]
[MS09-036]
[oval:org.mitre.oval:def:6393]
Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted QuickTime media file, as exploited in the wild in May 2009, aka "DirectX NULL Byte Overwrite Vulnerability."
Per: http://www.microsoft.com/technet/security/advisory/971778.mspx
"Microsoft is aware of limited, active attacks that use this exploit code. While our investigation is ongoing, our investigation so far has shown that Windows 2000 Service Pack 4, Windows XP, and Windows Server 2003 are vulnerable; all versions of Windows Vista and Windows Server 2008 are not vulnerable."
[http://blogs.technet.com/msrc/archive/2009/05/28/microsoft-security-advisory-971778-vulnerability-in-microsoft-directshow-released.aspx]
[http://blogs.technet.com/srd/archive/2009/05/28/new-vulnerability-in-quicktime-parsing.aspx]
[http://isc.sans.org/diary.html?storyid=6481]
[http://www.microsoft.com/technet/security/advisory/971778.mspx]
[35139]
[1022299]
[TA09-195A]
[ADV-2009-1445]
[ADV-2009-1886]
[MS09-028]
[oval:org.mitre.oval:def:6237]
The QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 performs updates to pointers without properly validating unspecified data values, which allows remote attackers to execute arbitrary code via a crafted QuickTime media file, aka "DirectX Pointer Validation Vulnerability."
[35600]
[TA09-195A]
[ADV-2009-1886]
[MS09-028]
[oval:org.mitre.oval:def:5963]
The QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 does not properly validate unspecified size fields in QuickTime media files, which allows remote attackers to execute arbitrary code via a crafted file, aka "DirectX Size Validation Vulnerability."
[TA09-195A]
[ADV-2009-1886]
[MS09-028]
[oval:org.mitre.oval:def:6341]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2009. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2009. Notes: none.
The Virtual Machine Monitor (VMM) in Microsoft Virtual PC 2004 SP1, 2007, and 2007 SP1, and Microsoft Virtual Server 2005 R2 SP1, does not enforce CPU privilege-level requirements for all machine instructions, which allows guest OS users to execute arbitrary kernel-mode code and gain privileges within the guest OS via a crafted application, aka "Virtual PC and Virtual Server Privileged Instruction Decoding Vulnerability."
[1022544]
[TA09-195A]
[ADV-2009-1890]
[MS09-033]
[oval:org.mitre.oval:def:6166]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2009. Notes: none.
Double free vulnerability in the Workstation service in Microsoft Windows allows remote authenticated users to gain privileges via a crafted RPC message to a Windows XP SP2 or SP3 or Server 2003 SP2 system, or cause a denial of service via a crafted RPC message to a Vista Gold, SP1, or SP2 or Server 2008 Gold or SP2 system, aka "Workstation Service Memory Corruption Vulnerability."
[TA09-223A]
[MS09-041]
[oval:org.mitre.oval:def:6286]
Unspecified vulnerability in Avifil32.dll in the Windows Media file handling functionality in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a malformed header in a crafted AVI file, aka "Malformed AVI Header Vulnerability."
[35967]
[1022711]
[TA09-223A]
[ADV-2009-2233]
[MS09-038]
[oval:org.mitre.oval:def:5412]
Integer overflow in Avifil32.dll in the Windows Media file handling functionality in Microsoft Windows allows remote attackers to execute arbitrary code on a Windows 2000 SP4 system via a crafted AVI file, or cause a denial of service on a Windows XP SP2 or SP3, Server 2003 SP2, Vista Gold, SP1, or SP2, or Server 2008 Gold or SP2 system via a crafted AVI file, aka "AVI Integer Overflow Vulnerability."
[35970]
[1022711]
[TA09-223A]
[ADV-2009-2233]
[MS09-038]
[oval:org.mitre.oval:def:5930]
Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via a crafted data stream header that triggers memory corruption, aka "Data Stream Header Corruption Vulnerability."
[TA09-286A]
[MS09-054]
[oval:org.mitre.oval:def:6454]
SQL injection vulnerability in index.php in BluSky CMS allows remote attackers to execute arbitrary SQL commands via the news_id parameter in a read action.
[34811]
[ADV-2009-1246]
[8600]
AGTC MyShop 3.2b allows remote attackers to bypass authentication and obtain administrative access setting the log_accept cookie to "correcto."
[34808]
[ADV-2009-1245]
[8599]
Zakkis Technology ABC Advertise 1.0 does not properly restrict access to admin.inc.php, which allows remote attackers to obtain the administrator login name and password via a direct request.
[abcadvertise-admininc-info-disclosure(50183)]
[8555]
Multiple PHP remote file inclusion vulnerabilities in Qt quickteam 2 allow remote attackers to execute arbitrary PHP code via a URL in the (1) qte_web_path parameter to qte_web.php and the (2) qte_root parameter to bin/qte_init.php.
[ADV-2009-1247]
[8602]
Unspecified vulnerability in the IGMP driver in SCO Unixware Release 7.1.4 Maintenance Pack 4 allows attackers to cause a denial of service (system panic) via unspecified vectors.
[ftp://ftp.sco.com/pub/unixware7/714/security/p535283/p535283.txt]
[34781]
[unixware-igmp-unspecified-dos(50255)]
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, or (6) webService/webServicesGeneral.jsf; or the name parameter to (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf.
[http://dsecrg.com/pages/vul/show.php?id=134]
[JVN#73653977]
[JVNDB-2009-000027]
[258528]
[[dev] 20090319 [DSECRG] Sun Glassfish Multiple Security Vulnerabilities]
[[dev] 20090411 Re: [DSECRG] Sun Glassfish Multiple Security Vulnerabilities]
[20090505 [DSECRG-09-034] Sun Glassfish Enterprise Server - Multiple Linked XSS vulnerabilies]
[34824]
[34914]
[ADV-2009-1255]
[glassfish-jsa-admininterface-xss(50453)]
[[cvs] 20090320 CVS update [SJSAS91_FCS_BRANCH]: /glassfish/admin-gui/src/java/com/sun/enterprise/tools/admingui/handlers/CommonHandlers.java]
[[cvs] 20090320 CVS update [SJSAS91_FCS_BRANCH]: /glassfish/admin-gui/src/docroot/]
[[cvs] 20090322 CVS update [SJSAS91_FCS_BRANCH]: /glassfish/admin-gui/src/docroot/configuration/]
Cross-site scripting (XSS) vulnerability in ThemeServlet.java in Sun Woodstock 4.2, as used in Sun GlassFish Enterprise Server and other products, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 string in the PATH_INFO, which is displayed on the 404 error page, as demonstrated by the PATH_INFO to theme/META-INF.
[http://dsecrg.com/pages/vul/show.php?id=138]
[[dev] 20090319 [DSECRG] Sun Glassfish Multiple Security Vulnerabilities]
[[dev] 20090411 Re: [DSECRG] Sun Glassfish Multiple Security Vulnerabilities]
[20090505 [DSECRG-09-038] Sun Glassfish Woodstock Project - Linked XSS Vulnerability]
[34829]
[woodstock-404page-xss(50336)]
[[cvs] 20090321 CVS update: /woodstock/webui/src/runtime/com/sun/webui/theme/ThemeServlet.java]
The Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R22 and 1.00R24 sends configuration data in response to a Setup Wizard remote-management command, which allows remote attackers to obtain sensitive information such as passwords by reading the SetupWizard.exe process memory, a related issue to CVE-2008-4390.
[http://www.gnucitizen.org/blog/hacking-linksys-ip-cameras-pt-1/]
[34596]
[ADV-2009-1173]
img/main.cgi on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R22 and 1.00R24 allows remote authenticated users to read arbitrary files in img/ via a filename in the next_file parameter, as demonstrated by reading .htpasswd to obtain the admin password, a different vulnerability than CVE-2004-2507.
[http://www.gnucitizen.org/blog/hacking-linksys-ip-cameras-pt-2/]
[34629]
[ADV-2009-1173]
Multiple cross-site scripting (XSS) vulnerabilities on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R22 and 1.00R24 allow remote attackers to inject arbitrary web script or HTML via the next_file parameter to (1) main.cgi, (2) img/main.cgi, or (3) adm/file.cgi; or (4) the this_file parameter to adm/file.cgi.
[http://www.gnucitizen.org/blog/hacking-linksys-ip-cameras-pt-4/]
[34714]
[ADV-2009-1173]
[wvc54gca-nextfile-xss(50224)]
Directory traversal vulnerability in adm/file.cgi on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R22 and 1.00R24 allows remote attackers to read arbitrary files via a %2e. (encoded dot dot) or an absolute pathname in the next_file parameter.
[http://www.gnucitizen.org/blog/hacking-linksys-ip-cameras-pt-3/]
[34713]
[ADV-2009-1173]
[wvc54gca-admfile-dir-traversal(50231)]
Absolute path traversal vulnerability in adm/file.cgi on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R24 and possibly 1.00R22 allows remote attackers to read arbitrary files via an absolute pathname in the this_file parameter. NOTE: traversal via a .. (dot dot) is probably also possible.
[http://www.gnucitizen.org/blog/hacking-linksys-ip-cameras-pt-3/]
[34713]
[ADV-2009-1173]
[wvc54gca-admfile-dir-traversal(50231)]
The Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R22 and 1.00R24 stores passwords and wireless-network keys in cleartext in (1) pass_wd.htm and (2) Wsecurity.htm, which allows remote attackers to obtain sensitive information by reading the HTML source code.
[http://www.gnucitizen.org/blog/hacking-linksys-ip-cameras-pt-4/]
[ADV-2009-1173]
[wvc54gca-pass-wsecurity-info-disclosure(50410)]
Cross-site request forgery (CSRF) vulnerability in administration.cgi on the Cisco Linksys WRT54GC router with firmware 1.05.7 allows remote attackers to hijack the intranet connectivity of arbitrary users for requests that change the administrator password via the sysPasswd and sysConfirmPasswd parameters.
[20090418 Linksys WRT54GC - Admin Password Change (POC)]
[http://packetstormsecurity.org/0904-exploits/linksysadmin-passwd.txt]
[http://www.falandodeseguranca.com/?p=17]
[34616]
[ADV-2009-1172]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2009-0689. Reason: This candidate is a duplicate of CVE-2009-0689. Certain codebase relationships were not originally clear. Notes: All CVE users should reference CVE-2009-0689 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Heap-based buffer overflow in vmnc.dll in the VMnc media codec in VMware Movie Decoder before 6.5.4 Build 246459 on Windows, and the movie decoder in VMware Workstation 6.5.x before 6.5.4 build 246459, VMware Player 2.5.x before 2.5.4 build 246459, and VMware Server 2.x on Windows, allows remote attackers to execute arbitrary code via an AVI file with crafted video chunks that use HexTile encoding.
[20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues]
[20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues]
[20100409 VMware VMnc Codec Heap Overflow Vulnerability]
[[security-announce] 20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues]
[39363]
[1023838]
[http://www.vmware.com/security/advisories/VMSA-2010-0007.html]
vmnc.dll in the VMnc media codec in VMware Movie Decoder before 6.5.4 Build 246459 on Windows, and the movie decoder in VMware Workstation 6.5.x before 6.5.4 build 246459, VMware Player 2.5.x before 2.5.4 build 246459, and VMware Server 2.x on Windows, allows remote attackers to execute arbitrary code via an AVI file with crafted HexTile-encoded video chunks that trigger heap-based buffer overflows, related to "integer truncation errors."
[20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues]
[20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues]
[[security-announce] 20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues]
[39364]
[1023838]
[http://www.vmware.com/security/advisories/VMSA-2010-0007.html]
Integer overflow in Roxio Easy Media Creator 9.0.136, and Roxio Creator 2010 before SP1, might allow remote attackers to execute arbitrary code via an image with crafted dimensions.
[20091202 Secunia Research: Roxio Creator Image Rendering Integer Overflow Vulnerability]
[37183]
[ADV-2009-3375]
[roxio-image-code-execution(54496)]
Multiple stack-based buffer overflows in the Lateral Arts Photobox uploader ActiveX control 1.x before 1.3, and 2.2.0.6, allow remote attackers to execute arbitrary code via a long URL string for the (1) LogURL, (2) ConnectURL, (3) SkinURL, (4) AlbumCreateURL, (5) ErrorURL, or (6) httpsinglehost property value.
[20091202 Secunia Research: Lateral Arts Photobox uploader ActiveX Control Buffer Overflow]
[37187]
[ADV-2009-3376]
[ADV-2009-3377]
Stack-based buffer overflow in ienipp.ocx in Novell iPrint Client 5.30, and possibly other versions before 5.32, allows remote attackers to execute arbitrary code via a long target-frame parameter.
[http://download.novell.com/Download?buildid=29T3EFRky18~]
[20091208 Secunia Research: Novell iPrint Client "target-frame" Parameter Buffer Overflow]
[37242]
[ADV-2009-3429]
Multiple stack-based buffer overflows in Novell iPrint Client 4.38, 5.30, and possibly other versions before 5.32 allow remote attackers to execute arbitrary code via vectors related to (1) Date and (2) Time.
[http://download.novell.com/Download?buildid=29T3EFRky18~]
[20091208 Secunia Research: Novell iPrint Client Date/Time Parsing Buffer Overflow]
[37242]
[ADV-2009-3429]
Integer overflow in the ReadImage function in plug-ins/file-bmp/bmp-read.c in GIMP 2.6.7 might allow remote attackers to execute arbitrary code via a BMP file with crafted width and height values that trigger a heap-based buffer overflow.
[http://git.gnome.org/cgit/gimp/commit/?h=gimp-2-6&id=df2b0aca2e7cdb95ebfd3454c65aaba0a83e9bbe]
[SUSE-SR:2010:009]
[GLSA-201209-23]
[RHSA-2011:0837]
[RHSA-2011:0838]
[20091112 Secunia Research: Gimp BMP Image Parsing Integer Overflow Vulnerability]
[37006]
[ADV-2009-3228]
[ADV-2009-3564]
[ADV-2010-1021]
[https://bugzilla.gnome.org/show_bug.cgi?id=600484]
[gimp-readimage-bo(54254)]
[oval:org.mitre.oval:def:8290]
Use-after-free vulnerability in the HTML parser in Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, Thunderbird before 3.0.2, and SeaMonkey before 2.0.3 allows remote attackers to execute arbitrary code via unspecified method calls that attempt to access freed objects in low-memory situations.
[FEDORA-2010-1932]
[FEDORA-2010-1936]
[FEDORA-2010-1727]
[FEDORA-2010-3230]
[FEDORA-2010-3267]
[SUSE-SA:2010:015]
[DSA-1999]
[MDVSA-2010:042]
[MDVSA-2010:051]
[http://www.mozilla.org/security/announce/2010/mfsa2010-03.html]
[RHSA-2010:0112]
[RHSA-2010:0113]
[RHSA-2010:0153]
[RHSA-2010:0154]
[20100218 Secunia Research: Mozilla Firefox Memory Corruption Vulnerability]
[USN-895-1]
[USN-896-1]
[ADV-2010-0405]
[ADV-2010-0650]
[https://bugzilla.mozilla.org/show_bug.cgi?id=526500]
[mozilla-htmlparser-code-exec(56361)]
[oval:org.mitre.oval:def:11227]
[oval:org.mitre.oval:def:8615]
The BGP daemon (bgpd) in Quagga 0.99.11 and earlier allows remote attackers to cause a denial of service (crash) via an AS path containing ASN elements whose string representation is longer than expected, which triggers an assert error.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526311]
[SUSE-SR:2009:012]
[[quagga-dev] 20090203 [quagga-dev 6391] [PATCH] BGP 4-byte ASN bug fixes]
[http://thread.gmane.org/gmane.network.quagga.devel/6513]
[DSA-1788]
[MDVSA-2009:109]
[[oss-security] 20090501 CVE request (sort of): Quagga BGP crasher]
[[oss-security] 20090501 Re: CVE request (sort of): Quagga BGP crasher]
[34817]
[1022164]
[USN-775-1]
[quagga-systemnumber-dos(50317)]
[FEDORA-2009-5284]
[FEDORA-2009-5324]
xvfb-run 1.6.1 in Debian GNU/Linux, Ubuntu, Fedora 10, and possibly other operating systems place the magic cookie (MCOOKIE) on the command line, which allows local users to gain privileges by listing the process and its arguments.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526678]
[[oss-security] 20090505 CVE id request: Debian/Ubuntu specific issue in xvfb-run (xorg)]
[[oss-security] 20090505 Re: CVE id request: Debian/Ubuntu specific issue in xvfb-run (xorg)]
[34828]
[USN-939-1]
[ADV-2010-1185]
[xvfbrun-magiccookie-info-disclosure(50348)]
racoon/isakmp_frag.c in ipsec-tools before 0.7.2 allows remote attackers to cause a denial of service (crash) via crafted fragmented packets without a payload, which triggers a NULL pointer dereference.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705]
[APPLE-SA-2009-11-09-1]
[APPLE-SA-2010-12-16-1]
[SUSE-SR:2009:012]
[GLSA-200905-03]
[http://sourceforge.net/project/shownotes.php?group_id=74601&release_id=677611]
[http://support.apple.com/kb/HT3937]
[http://support.apple.com/kb/HT4298]
[DSA-1804]
[MDVSA-2009:112]
[[oss-security] 20090429 ipsec-tools 0.7.2]
[[oss-security] 20090504 Re: ipsec-tools 0.7.2]
[RHSA-2009:1036]
[34765]
[USN-785-1]
[ADV-2009-3184]
[https://bugzilla.redhat.com/show_bug.cgi?id=497990]
[ipsectools-isakmpfrag-dos(50412)]
[oval:org.mitre.oval:def:9624]
[FEDORA-2009-4291]
[FEDORA-2009-4298]
[FEDORA-2009-4394]
Cross-site scripting (XSS) vulnerability in Drupal 5.x before 5.17 and 6.x before 6.11, as used in vbDrupal before 5.17.0, allows remote attackers to inject arbitrary web script or HTML via crafted UTF-8 byte sequences before the Content-Type meta tag, which are treated as UTF-7 by Internet Explorer 6 and 7.
[http://drupal.org/node/449078]
[DSA-1792]
[http://www.vbdrupal.org/forum/showthread.php?p=9953#post9953]
[ADV-2009-1216]
[drupal-utf7-xss(50250)]
[FEDORA-2009-4175]
[FEDORA-2009-4203]
Unspecified vulnerability in Drupal 5.x before 5.17 and 6.x before 6.11, as used in vbDrupal before 5.17.0, allows user-assisted remote attackers to obtain sensitive information by tricking victims into visiting the front page of the site with a crafted URL and causing form data to be sent to an attacker-controlled site, possibly related to multiple / (slash) characters that are not properly handled by includes/bootstrap.inc, as demonstrated using the search box. NOTE: this vulnerability can be leveraged to conduct cross-site request forgery (CSRF) attacks.
[http://drupal.org/files/sa-core-2009-005/SA-CORE-2009-005-5.16.patch]
[http://drupal.org/node/449078]
[DSA-1792]
[http://www.vbdrupal.org/forum/showthread.php?p=9953#post9953]
[ADV-2009-1216]
[FEDORA-2009-4175]
[FEDORA-2009-4203]
Multiple stack-based buffer overflows in the putstring function in find.c in Cscope before 15.6 allow user-assisted remote attackers to execute arbitrary code via a long (1) function name or (2) symbol in a source-code file.
[http://cscope.cvs.sourceforge.net/viewvc/cscope/cscope/src/find.c?r1=1.18&r2=1.19]
[http://cscope.cvs.sourceforge.net/viewvc/cscope/cscope/src/find.c?view=log#rev1.19]
[http://cvs.fedoraproject.org/viewvc/rpms/cscope/devel/cscope-15.5-putstring-overflow.patch]
[GLSA-200905-02]
[[oss-security] 20090505 Old cscope buffer overflow]
[[oss-security] 20090506 Re: Old cscope buffer overflow]
[[oss-security] 20090506 Re: Old cscope buffer overflow]
[RHSA-2009:1101]
[https://bugzilla.redhat.com/show_bug.cgi?id=189666]
[https://bugzilla.redhat.com/show_bug.cgi?id=499174]
[cscope-findc-bo(50366)]
[oval:org.mitre.oval:def:9837]
Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail before 1.4.18 and NaSMail before 1.7 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) certain encrypted strings in e-mail headers, related to contrib/decrypt_headers.php; (2) PHP_SELF; and (3) the query string (aka QUERY_STRING).
[http://download.gna.org/nasmail/nasmail-1.7.zip]
[APPLE-SA-2010-06-15-1]
[http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/contrib/decrypt_headers.php?r1=13672&r2=13671&pathrev=13672]
[http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/doc/ChangeLog]
[http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/functions/global.php?r1=13670&r2=13669&pathrev=13670]
[http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13670]
[http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13672]
[http://support.apple.com/kb/HT4188]
[DSA-1802]
[MDVSA-2009:110]
[RHSA-2009:1066]
[34916]
[http://www.squirrelmail.org/security/issue/2009-05-08]
[http://www.squirrelmail.org/security/issue/2009-05-09]
[ADV-2009-1296]
[ADV-2009-3315]
[ADV-2010-1481]
[https://bugzilla.redhat.com/show_bug.cgi?id=500363]
[squirrelmail-phpself-xss(50459)]
[squirrelmail-decryptheaders-xss(50460)]
[https://gna.org/forum/forum.php?forum_id=2146]
[oval:org.mitre.oval:def:11624]
[FEDORA-2009-4870]
[FEDORA-2009-4875]
[FEDORA-2009-4880]
The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.18 and NaSMail before 1.7 allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program.
[http://download.gna.org/nasmail/nasmail-1.7.zip]
[APPLE-SA-2010-06-15-1]
[http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/doc/ChangeLog]
[http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/functions/imap_general.php?r1=13674&r2=13673&pathrev=13674]
[http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13674]
[http://support.apple.com/kb/HT4188]
[DSA-1802]
[MDVSA-2009:110]
[RHSA-2009:1066]
[34916]
[http://www.squirrelmail.org/security/issue/2009-05-10]
[ADV-2009-1296]
[ADV-2009-3315]
[ADV-2010-1481]
[https://bugzilla.redhat.com/show_bug.cgi?id=500360]
[squirrelmail-mapypalias-code-execution(50461)]
[https://gna.org/forum/forum.php?forum_id=2146]
[oval:org.mitre.oval:def:10986]
[FEDORA-2009-4870]
[FEDORA-2009-4875]
[FEDORA-2009-4880]
Session fixation vulnerability in SquirrelMail before 1.4.18 allows remote attackers to hijack web sessions via a crafted cookie.
[APPLE-SA-2010-06-15-1]
[http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/doc/ChangeLog]
[http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13676]
[http://support.apple.com/kb/HT4188]
[DSA-1802]
[MDVSA-2009:110]
[34916]
[http://www.squirrelmail.org/security/issue/2009-05-11]
[ADV-2009-1296]
[ADV-2010-1481]
[https://bugzilla.redhat.com/show_bug.cgi?id=500358]
[squirrelmail-baseuri-session-hijacking(50462)]
[oval:org.mitre.oval:def:10107]
[FEDORA-2009-4870]
[FEDORA-2009-4875]
[FEDORA-2009-4880]
functions/mime.php in SquirrelMail before 1.4.18 does not protect the application's content from Cascading Style Sheets (CSS) positioning in HTML e-mail messages, which allows remote attackers to spoof the user interface, and conduct cross-site scripting (XSS) and phishing attacks, via a crafted message.
[APPLE-SA-2010-06-15-1]
[http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/doc/ChangeLog]
[http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/functions/mime.php?r1=13667&r2=13666&pathrev=13667]
[http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13667]
[http://support.apple.com/kb/HT4188]
[DSA-1802]
[MDVSA-2009:110]
[RHSA-2009:1066]
[34916]
[http://www.squirrelmail.org/security/issue/2009-05-12]
[ADV-2009-1296]
[ADV-2010-1481]
[https://bugzilla.redhat.com/show_bug.cgi?id=500356]
[squirrelmail-css-xss(50463)]
[oval:org.mitre.oval:def:10441]
[FEDORA-2009-4870]
[FEDORA-2009-4875]
[FEDORA-2009-4880]
Million Dollar Text Links 1.0 does not properly restrict administrator access to admin.home.php, which allows remote attackers to bypass intended restrictions and gain privileges via a direct request to admin.home.php after visiting admin.php.
[34809]
[milliondollar-adminhome-auth-bypass(50306)]
[8605]
Multiple cross-site scripting (XSS) vulnerabilities in TemaTres 1.0.3 and 1.031 allow remote attackers to inject arbitrary web script or HTML via the (1) search form; (2) _expresion_de_busqueda, (3) letra, (4) estado_id, and (5) tema parameters to index.php; the (6) PATH_INFO to index.php; (7) unspecified parameters when editing a term as specified by the edit_id and tema parameters to index.php; and the (7) y, (8) ord, and (9) m parameters to sobre.php.
[20090505 MULTIPLE REMOTE VULNERABILITIES--TemaTres 1.0.3-->]
[34830]
[tematres-term-xss(50343)]
[8615]
Multiple SQL injection vulnerabilities in TemaTres 1.0.3 and 1.031, when magic_quotes_gpc is disabled, allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the (1) mail, (2) password, and (3) letra parameters to index.php; (4) y and (5) m parameters to sobre.php; and the (6) dcTema, (7) madsTema, (8) zthesTema, (9) skosTema, and (10) xtmTema parameters to xml.php.
[20090505 MULTIPLE REMOTE VULNERABILITIES--TemaTres 1.0.3-->]
[20090505 BLIND SQL INJECTION EXPLOIT--TemaTres 1.0.3-->]
[34830]
[8615]
[8616]
Multiple SQL injection vulnerabilities in TemaTres 1.031, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) id_correo_electronico and (2) id_password parameters to login.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Stack-based buffer overflow in the NZB importer feature in GrabIt 1.7.2 Beta 3 and earlier allows remote attackers to execute arbitrary code via a crafted DTD reference in a DOCTYPE element in an NZB file.
[http://blog.teusink.net/2009/05/grabit-172-beta-3-nzb-file-parsing.html]
[20090503 Grabit <= 1.7.2 beta 3 NZB file parsing stack overflow]
[34807]
[1022161]
[http://www.shemes.com/index.php?p=whatsnew]
[ADV-2009-1243]
[grabit-nzb-bo(50310)]
[8612]
index.php in PHP Site Lock 2.0 allows remote attackers to bypass authentication and obtain administrative access by setting the login_id, group_id, login_name, user_id, and user_type cookies to certain values.
[ADV-2009-1249]
[phpsitelock-index-security-bypass(50304)]
[8604]
Cross-site scripting (XSS) vulnerability in CGI RESCUE MiniBBS 8t before 8.95t, 8 before 8.95, 9 before 9.08, and 10 before 10.32 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[JVN#11396739]
[JVNDB-2009-000022]
[http://www.rescue.ne.jp/whatsnew/blog.cgi/permalink/20081213132937]
[34718]
[minibbs-unspecified-xss(50219)]
Unspecified vulnerability in CGI RESCUE MiniBBS22 before 1.01 allows remote attackers to send email to arbitrary recipients via unknown vectors.
[JVN#36982346]
[JVNDB-2009-000021]
[http://www.rescue.ne.jp/whatsnew/blog.cgi/permalink/20081213132937]
Unspecified vulnerability in CGI RESCUE FORM2MAIL before 1.42 allows remote attackers to send email to arbitrary recipients via a web form.
[JVN#76370393]
[JVNDB-2009-000023]
[http://www.rescue.ne.jp/whatsnew/blog.cgi/permalink/20081213132937]
CRLF injection vulnerability in CGI RESCUE Web Mailer before 1.04 allows remote attackers to inject arbitrary HTTP headers, and conduct cross-site scripting (XSS) or HTTP response splitting attacks, via CRLF sequences in an unspecified web form.
[JVN#28020230]
[JVNDB-2009-000024]
[http://www.rescue.ne.jp/whatsnew/blog.cgi/permalink/20090209180123]
[35047]
Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a long banner. NOTE: this might overlap CVE-2003-1368.
[34822]
[ADV-2009-1263]
[32bit-cwd-banner-bo(50337)]
[8611]
[8614]
Armorlogic Profense Web Application Firewall before 2.2.22, and 2.4.x before 2.4.4, does not properly implement the "negative model," which allows remote attackers to conduct cross-site scripting (XSS) attacks via a modified end tag of a SCRIPT element.
[20090520 Armorlogic Profense Web Application Firewall 2.4 multiple vulnerabilities.]
[35053]
[[websecurity] 20090519 [WEB SECURITY] Trustwave's SpiderLabs Security Advisory TWSL2009-001 and EnableSecurity Advisory ES-20090500]
[profense-blacklist-security-bypass(50663)]
Armorlogic Profense Web Application Firewall before 2.2.22, and 2.4.x before 2.4.4, does not properly implement the "positive model," which allows remote attackers to bypass certain protection mechanisms via a %0A (encoded newline), as demonstrated by a %0A in a cross-site scripting (XSS) attack URL.
[http://resources.enablesecurity.com/advisories/ES-20090500-profense.txt]
[20090520 Armorlogic Profense Web Application Firewall 2.4 multiple vulnerabilities.]
[35053]
[[websecurity] 20090519 [WEB SECURITY] Trustwave's SpiderLabs Security Advisory TWSL2009-001 and EnableSecurity Advisory ES-20090500]
[profense-whitelist-security-bypass(50662)]
The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts via a modified username element in a passwd_change action.
[http://www.igniterealtime.org/builds/openfire/docs/latest/changelog.html]
[http://www.igniterealtime.org/community/message/190280]
[http://www.igniterealtime.org/issues/browse/JM-1531]
[34804]
[ADV-2009-1237]
[openfire-jabberiqauth-security-bypass(50292)]
Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password (aka canChangePassword) console configuration setting, which allows remote authenticated users to bypass intended policy and change their own passwords via a passwd_change IQ packet.
[http://www.igniterealtime.org/community/message/190280]
[http://www.igniterealtime.org/issues/browse/JM-1532]
[34804]
[openfire-nopassword-security-bypass(50291)]
Mozilla Firefox executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an inline PDF file, which might allow remote attackers to bypass intended Adobe Acrobat JavaScript restrictions on accessing the document object, as demonstrated by a web site that permits PDF uploads by untrusted users, and therefore has a shared document.domain between the web site and this javascript: URI. NOTE: the researcher reports that Adobe's position is "a PDF file is active content."
[http://secniche.org/papers/SNS_09_03_PDF_Silent_Form_Re_Purp_Attack.pdf]
[20090503 [SecNiche WhitePaper ] - PDF Silent HTTP Form Repurposing Attacks]
Google Chrome executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an inline PDF file, which might allow remote attackers to bypass intended Adobe Acrobat JavaScript restrictions on accessing the document object, as demonstrated by a web site that permits PDF uploads by untrusted users, and therefore has a shared document.domain between the web site and this javascript: URI. NOTE: the researcher reports that Adobe's position is "a PDF file is active content."
[http://secniche.org/papers/SNS_09_03_PDF_Silent_Form_Re_Purp_Attack.pdf]
[20090503 [SecNiche WhitePaper ] - PDF Silent HTTP Form Repurposing Attacks]
Opera executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an inline PDF file, which might allow remote attackers to bypass intended Adobe Acrobat JavaScript restrictions on accessing the document object, as demonstrated by a web site that permits PDF uploads by untrusted users, and therefore has a shared document.domain between the web site and this javascript: URI. NOTE: the researcher reports that Adobe's position is "a PDF file is active content."
[http://secniche.org/papers/SNS_09_03_PDF_Silent_Form_Re_Purp_Attack.pdf]
[20090503 [SecNiche WhitePaper ] - PDF Silent HTTP Form Repurposing Attacks]
Apple Safari executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an inline PDF file, which might allow remote attackers to bypass intended Adobe Acrobat JavaScript restrictions on accessing the document object, as demonstrated by a web site that permits PDF uploads by untrusted users, and therefore has a shared document.domain between the web site and this javascript: URI. NOTE: the researcher reports that Adobe's position is "a PDF file is active content."
[http://secniche.org/papers/SNS_09_03_PDF_Silent_Form_Re_Purp_Attack.pdf]
[20090503 [SecNiche WhitePaper ] - PDF Silent HTTP Form Repurposing Attacks]
The Ubuntu clamav-milter.init script in clamav-milter before 0.95.1+dfsg-1ubuntu1.2 in Ubuntu 9.04 sets the ownership of the current working directory to the clamav account, which might allow local users to bypass intended access restrictions via read or write operations involving this directory.
Per https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/365823
A clean install of clamav-milter (0.95.1+dfsg-1ubuntu1.1) causes the root directory to become owned by the clamav user.
This was witnessed breaking ssh chroot environment.
TEST CASE:
- purge any existing clamav-milter installation, make sure you don't have any old /etc/init.d/clamav-milter init script around
- check root directory's owner (should be root:root)
- sudo apt-get install clamav-milter (the last one in Jaunty is 0.95.1+dfsg-1ubuntu1.1)
- after installing the package, clamav-milter will start automatically (at least 'init.d/clamav-milter start' will execute)
- check the root directory's owner:
[34818]
[USN-770-1]
[clamav-clamavmilter-security-bypass(50311)]
[https://launchpad.net/bugs/365823]
Pablo Software Solutions Quick 'n Easy Mail Server 3.3 allows remote attackers to cause a denial of service (daemon outage or CPU consumption) via multiple long SMTP commands, as demonstrated by HELO commands.
[34814]
[quickneasymailserver-helo-dos(50299)]
[8606]
src/tools/pkcs11-tool.c in pkcs11-tool in OpenSC 0.11.7, when used with unspecified third-party PKCS#11 modules, generates RSA keys with incorrect public exponents, which allows attackers to read the cleartext form of messages that were intended to be encrypted.
[GLSA-200908-01]
[MDVSA-2009:123]
[[opensc-announce] 20090508 OpenSC 0.11.8 released with security update]
[[oss-security] 20090508 OpenSC 0.11.8 released with security update]
[ADV-2009-1295]
[FEDORA-2009-4928]
[FEDORA-2009-4967]
[FEDORA-2009-4919]
[FEDORA-2009-4883]
Unspecified vulnerability in LimeSurvey before 1.82 allows remote attackers to execute commands and obtain sensitive data via unknown attack vectors related to /admin/remotecontrol/.
[http://www.limesurvey.org/content/view/169/1/lang,en/]
[34785]
[ADV-2009-1219]
Heap-based buffer overflow in the loadexponentialfunc function in mupdf/pdf_function.c in MuPDF in the mupdf-20090223-win32 package, as used in SumatraPDF 0.9.3 and earlier, allows remote attackers to execute arbitrary code via a crafted PDF file. NOTE: some of these details are obtained from third party information.
[20090424 SumatraPDF <= 0.9.3 Heap Overflow PoC]
[ADV-2009-1185]
[ADV-2009-1186]
Multiple stack-based and heap-based buffer overflows in Dafolo DafoloControl ActiveX control (DafoloFFControl.dll) 1.108.6.195 allow remote attackers to execute arbitrary code via long (1) baseurl, (2) kommune, (3) felter, (4) afdeling, (5) Flags, (6) HelpURL, (7) caburl, or (8) filename properties; or (9) a long argument to the Open method. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[34900]
[dafolo-baseurl-bo(50420)]
[dafolo-stringparsing-bo(50421)]
[dafolo-helpurl-caburl-bo(50422)]
[dafolo-filenames-bo(50423)]
Cross-site scripting (XSS) vulnerability in the administrator panel in phpForm.net LinkBase 2.0 allows remote attackers to inject arbitrary web script or HTML via the username in a registration, which is not properly handled when the administrator accesses the Users menu.
[34844]
[linkbase-usersmenu-xss(50338)]
[8618]
Multiple buffer overflows in Microchip MPLAB IDE 8.30 and possibly earlier versions allow user-assisted remote attackers to execute arbitrary code via a .MCP project file with long (1) FILE_INFO, (2) CAT_FILTERS, and possibly other fields.
[http://security.bkis.vn/?p=654]
[20090511 [Bkis-08-2009] Microchip MPLAB IDE Buffer Overflow Vulnerability]
[34897]
[mplabide-fileinfo-bo(50418)]
[mplabide-catfilters-bo(50419)]
Unrestricted file upload vulnerability in admin/uploadform.asp in Battle Blog 1.25 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file.
[34887]
[ADV-2009-1280]
[battleblog-uploadform-file-upload(50400)]
[8647]
admin/changepassword.php in Job Script Job Board Software 2.0 allows remote attackers to change the administrator password and gain administrator privileges via a direct request.
[34874]
[jobscript-changepassword-security-bypass(50380)]
[8639]
Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a long 257 reply to a CWD command.
[34822]
[34838]
[ADV-2009-1263]
[8613]
[8621]
Stack-based buffer overflow in the MPS.StormPlayer.1 ActiveX control in mps.dll 3.9.4.27 in Baofeng Storm allows remote attackers to execute arbitrary code via a long argument to the OnBeforeVideoDownload method, as exploited in the wild in April and May 2009. NOTE: some of these details are obtained from third party information. NOTE: it was later reported that 3.09.04.17 and earlier are also affected.
[http://www.cisrt.org/enblog/read.php?245]
[34789]
[8579]
Multiple SQL injection vulnerabilities in leap.php in Leap CMS 0.1.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) searchterm or (2) email parameter.
[8576]
[8577]
Multiple cross-site scripting (XSS) vulnerabilities in Leap CMS 0.1.4 allow remote attackers to inject arbitrary web script or HTML via (1) the msg parameter (aka the message in an article comment) or (2) the searchterm parameter (aka the search post form). NOTE: some of these details are obtained from third party information.
[8577]
Unrestricted file upload vulnerability in Leap CMS 0.1.4 allows remote attackers to execute arbitrary code by uploading a file with an executable extension via an admin.system.files (aka Manage Files) request to the default URI, then accessing the file via a direct request.
[8577]
Cross-site scripting (XSS) vulnerability in docs/showdoc.php in Coppermine Photo Gallery (CPG) before 1.4.22 allows remote attackers to inject arbitrary web script or HTML via the css parameter, a different vector than CVE-2008-0505.
[http://forum.coppermine-gallery.net/index.php/topic,59237.0.html]
[http://forum.coppermine-gallery.net/index.php/topic,59247.0.html]
[34782]
Teraway LinkTracker 1.0 allows remote attackers to bypass authentication and gain administrative access via a userid=1&lvl=1 value for the twLTadmin cookie.
[34735]
[8550]
Teraway LiveHelp 2.0 allows remote attackers to bypass authentication and gain administrative access via a pwd=&lvl=1&usr=&alias=admin&userid=1 value for the TWLHadmin cookie.
[34735]
[8552]
Teraway FileStream 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the twFSadmin cookie to 1.
[34735]
[8551]
Multiple cross-site scripting (XSS) vulnerabilities in input.php in MataChat allow remote attackers to inject arbitrary web script or HTML via the (1) nickname and (2) color parameters.
[20090425 MataChat Cross-Site Scripting Vulnerabilities]
[34722]
Directory traversal vulnerability in index.php in OpenCart 1.1.8 allows remote attackers to read arbitrary files via a .. (dot dot) in the route parameter.
[20140529 OpenCart 1.5.6.4 Directory Traversal Vulnerability]
[34724]
[8539]
SQL injection vulnerability in user.php in EcShop 2.5.0 allows remote attackers to execute arbitrary SQL commands via the order_sn parameter in an order_query action.
[34733]
[8548]
Cross-site scripting (XSS) vulnerability in index.php in Dew-NewPHPLinks 2.0 allows remote attackers to inject arbitrary web script or HTML via the PID parameter.
[34732]
[8545]
Directory traversal vulnerability in index.php in Dew-NewPHPLinks 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the show parameter.
[34732]
[8545]
Directory traversal vulnerability in index.php in Thickbox Gallery 2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ln parameter.
[34741]
[8546]
SQL injection vulnerability in public/specific.php in EZ-Blog before Beta 2 20090427, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the category parameter.
[http://sourceforge.net/project/shownotes.php?release_id=678562&group_id=243152]
[34729]
[8547]
Stack-based buffer overflow in Streaming Download Project (SDP) Downloader 2.3.0 allows remote attackers to execute arbitrary code via a long .asf URL in the HREF attribute of a REF element in a .asx file.
[34712]
[ADV-2009-1171]
[8531]
[8536]
Stack-based buffer overflow in mnet.exe in Unisys Business Information Server (BIS) 10 and 10.1 on Windows allows remote attackers to execute arbitrary code via a crafted TCP packet.
[ftp://ftp.support.unisys.com/pub/mapper/NT/BIS10.1/Readme.txt]
[20090625 Unisys Business Information Server Stack Buffer Overflow]
ajaxterm.js in AjaxTerm 0.10 and earlier generates session IDs with predictable random numbers based on certain JavaScript functions, which makes it easier for remote attackers to (1) hijack a session or (2) cause a denial of service (session ID exhaustion) via a brute-force attack.
[FEDORA-2010-18867]
[http://www.ocert.org/advisories/ocert-2009-004.html]
[[oss-security] 20090511 [oCERT-2009-004] AjaxTerm session id collision]
[20090511 [oCERT-2009-004] AjaxTerm session id collision]
[34903]
[ajaxterm-ajaxterm-session-hijacking(50464)]
The nfs_permission function in fs/nfs/dir.c in the NFS client implementation in the Linux kernel 2.6.29.3 and earlier, when atomic_open is available, does not check execute (aka EXEC or MAY_EXEC) permission bits, which allows local users to bypass permissions and execute files, as demonstrated by files on an NFSv4 fileserver.
[[linux-nfs] 20090509 [NFS] [PATCH] nfs: Fix NFS v4 client handling of MAY_EXEC in nfs_permission.]
[http://bugzilla.linux-nfs.org/show_bug.cgi?id=131]
[[nfsv4] 20061116 Status of execute permissions in NFSv4 ACLs ?]
[[nfsv4] 20061117 [Patch] Re: Status of execute permissions in NFSv4 ACLs ?]
[SUSE-SA:2009:031]
[SUSE-SA:2009:038]
[http://wiki.rpath.com/Advisories:rPSA-2009-0111]
[DSA-1809]
[DSA-1844]
[DSA-1865]
[MDVSA-2009:135]
[MDVSA-2009:148]
[[oss-security] 20090513 CVE request: kernel: problem with NFS v4 client handling of MAY_EXEC in nfs_permission]
[RHSA-2009:1157]
[20090724 rPSA-2009-0111-1 kernel]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[34934]
[USN-793-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-1331]
[ADV-2009-3316]
[https://bugzilla.redhat.com/show_bug.cgi?id=500297]
[oval:org.mitre.oval:def:8543]
[oval:org.mitre.oval:def:9990]
The Mailer component in Evolution 2.26.1 and earlier uses world-readable permissions for the .evolution directory, and certain directories and files under .evolution/ related to local mail, which allows local users to obtain sensitive information by reading these files.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526409]
[http://bugzilla.gnome.org/show_bug.cgi?id=581604]
[[oss-security] 20090512 CVE Request (evolution)]
[34921]
[https://bugzilla.redhat.com/show_bug.cgi?id=498648]
Multiple memory leaks in Ipsec-tools before 0.7.2 allow remote attackers to cause a denial of service (memory consumption) via vectors involving (1) signature verification during user authentication with X.509 certificates, related to the eay_check_x509sign function in src/racoon/crypto_openssl.c; and (2) the NAT-Traversal (aka NAT-T) keepalive implementation, related to src/racoon/nattraversal.c.
[http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/crypto_openssl.c]
[http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/crypto_openssl.c.diff?r1=1.11.6.4&r2=1.11.6.5&f=h]
[http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/nattraversal.c]
[http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/nattraversal.c.diff?r1=1.6&r2=1.6.6.1&f=h]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705]
[APPLE-SA-2009-11-09-1]
[SUSE-SR:2009:012]
[[oss-security] 20090429 ipsec-tools 0.7.2]
[GLSA-200905-03]
[[ipsec-tools-announce] 20090422 Ipsec-tools 0.7.2 released]
[http://sourceforge.net/project/shownotes.php?group_id=74601&release_id=677611]
[http://support.apple.com/kb/HT3937]
[DSA-1804]
[MDVSA-2009:114]
[[oss-security] 20090512 Re: ipsec-tools 0.7.2]
[RHSA-2009:1036]
[34765]
[USN-785-1]
[ADV-2009-3184]
[oval:org.mitre.oval:def:10581]
[https://trac.ipsec-tools.net/ticket/303]
Multiple buffer overflows in the cifs subsystem in the Linux kernel before 2.6.29.4 allow remote CIFS servers to cause a denial of service (memory corruption) and possibly have unspecified other impact via (1) a malformed Unicode string, related to Unicode string area alignment in fs/cifs/sess.c; or (2) long Unicode characters, related to fs/cifs/cifssmb.c and the cifs_readdir function in fs/cifs/readdir.c.
[http://git.kernel.org/?p=linux/kernel/git/sfrench/cifs-2.6.git;a=commit;h=7b0c8fcff47a885743125dd843db64af41af5a61]
[http://git.kernel.org/?p=linux/kernel/git/sfrench/cifs-2.6.git;a=commit;h=968460ebd8006d55661dec0fb86712b40d71c413]
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=27b87fe52baba0a55e9723030e76fce94fabcea4]
[SUSE-SA:2009:054]
[SUSE-SA:2009:056]
[SUSE-SA:2010:012]
[[oss-security] 20090429 Re: CVE request? buffer overflow in CIFS in 2.6.*]
[[oss-security] 20090429 Re: CVE request? buffer overflow in CIFS in 2.6.*]
[http://wiki.rpath.com/Advisories:rPSA-2009-0111]
[DSA-1809]
[DSA-1844]
[DSA-1865]
[http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.29.4]
[MDVSA-2009:148]
[[oss-security] 20090514 Update - Re: CVE request? buffer overflow in CIFS in 2.6.*]
[[oss-security] 20090514 Re: Update - Re: CVE request? buffer overflow in CIFS in 2.6.*]
[[oss-security] 20090515 Re: Re: Update - Re: CVE request? buffer overflow in CIFS in 2.6.*]
[RHSA-2009:1157]
[20090724 rPSA-2009-0111-1 kernel]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[34612]
[USN-793-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-3316]
[https://bugzilla.redhat.com/show_bug.cgi?id=496572]
[oval:org.mitre.oval:def:8588]
[oval:org.mitre.oval:def:9525]
[FEDORA-2009-5356]
[FEDORA-2009-5383]
The WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 does not properly implement session management mechanisms, which allows remote attackers to gain access to user accounts via unspecified vectors.
[http://www.novell.com/support/viewContent.do?externalId=7003266&sliceId=1]
[35066]
[ADV-2009-1393]
[https://bugzilla.novell.com/show_bug.cgi?id=472979]
[groupwise-session-unauth-access(50688)]
Multiple cross-site scripting (XSS) vulnerabilities in the WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote attackers to inject arbitrary web script or HTML via (1) the User.lang parameter to the login page (aka gw/webacc), (2) style expressions in a message that contains an HTML file, or (3) vectors associated with incorrect protection mechanisms against scripting, as demonstrated using whitespace between JavaScript event names and values.
[http://packetstorm.linuxsecurity.com/0905-exploits/groupwise-xss.txt]
[1022267]
[http://www.novell.com/support/search.do?cmd=displayKC&externalId=7003271]
[http://www.novell.com/support/viewContent.do?externalId=7003267&sliceId=1]
[http://www.novell.com/support/viewContent.do?externalId=7003268&sliceId=1]
[20090521 Novell GroupWise Web Access Multiple XSS]
[20090528 Novell Groupwise fails to properly sanitize emails.]
[35061]
[35066]
[ADV-2009-1393]
[https://bugzilla.novell.com/show_bug.cgi?id=472987]
[https://bugzilla.novell.com/show_bug.cgi?id=474500]
[https://bugzilla.novell.com/show_bug.cgi?id=484942]
[groupwise-webaccess-loginpage-xss(50672)]
[groupwise-styleexpressions-xss(50689)]
[groupwise-unspecified-xss(50691)]
Multiple buffer overflows in the Internet Agent (aka GWIA) component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote attackers to execute arbitrary code via (1) a crafted e-mail address in an SMTP session or (2) an SMTP command.
[http://www.novell.com/support/viewContent.do?externalId=7003272&sliceId=1]
[http://www.novell.com/support/viewContent.do?externalId=7003273&sliceId=1]
[20090522 Novell GroupWise Internet Agent Remote Buffer Overflow Vulnerabilities]
[35064]
[35065]
[1022276]
[ADV-2009-1393]
[http://www.vupen.com/exploits/Novell_GroupWise_GWIA_Email_Address_Remote_Buffer_Overflow_Exploit_1393141.php]
[http://www.vupen.com/exploits/Novell_GroupWise_GWIA_SMTP_Command_Remote_Buffer_Overflow_PoC_Exploit_1393140.php]
[https://bugzilla.novell.com/show_bug.cgi?id=478892]
[https://bugzilla.novell.com/show_bug.cgi?id=482914]
[gia-smtp-code-execution(50692)]
[gia-email-code-execution(50693)]
profile.php in Simple Customer 1.3 does not require administrative authentication, which allows remote attackers to change the admin e-mail address and password via the email and password parameters.
[34872]
[simplecustomer-profile-security-bypass(50379)]
[8638]
Techno Dreams Job Career Package 3.0 allows remote attackers to bypass authentication and obtain administrative access by setting the JobCareerAdmin cookie to Login.
[34865]
[jcp-jobcareeradmin-sec-bypass(50370)]
[8627]
Stack-based buffer overflow in Nucleus Data Recovery Kernel Recovery for Novell 4.03 allows user-assisted attackers to execute arbitrary code via a crafted .NKNT file.
[http://www.insight-tech.org/index.php?p=Kernel-recovery-for-Novell-Traditional-volumes-v-4-03-Code-Execution-and-DoS]
[http://www.insight-tech.org/xploits/KernelrecoveryforNovell(Traditionalvolumes)v.4.03CodeExecutionandDoS.py]
[34846]
Stack-based buffer overflow in Nucleus Data Recovery Kernel Recovery for Macintosh 4.04 allows user-assisted attackers to execute arbitrary code via a crafted .AMHH file.
[http://www.insight-tech.org/index.php?p=Kernel-recovery-for-Macintosh-v-4-04-Buffer-Overflow]
[http://www.insight-tech.org/xploits/KernelrecoveryforMacintoshv.4.04BufferOverflow.py]
[34846]
[nucleus-amhh-bo(50345)]
Multiple stack-based buffer overflows in Mini-stream Ripper 3.0.1.1 allow remote attackers to execute arbitrary code via (1) a long rtsp URL in a .ram file and (2) a long string in the HREF attribute of a REF element in a .asx file.
[34860]
[34864]
[ripper-ram-asx-bo(50375)]
[8631]
[8632]
Multiple stack-based buffer overflows in Mini-stream ASX to MP3 Converter 3.0.0.7 allow remote attackers to execute arbitrary code via (1) a long rtsp URL in a .ram file and (2) a long string in the HREF attribute of a REF element in a .asx file. NOTE: the latter was also subsequently reported in "prior to 3.1.3.7."
[34860]
[34864]
[asxmp3-ram-asxf-bo(50374)]
[https://packetstormsecurity.com/files/144558/ASX-To-MP3-Converter-Stack-Overflow.html]
[8629]
[8630]
Stack-based buffer overflow in Sorinara Soritong MP3 Player 1.0 allows remote attackers to execute arbitrary code via a crafted .m3u file.
[34863]
[soritong-m3u-bo(50398)]
[8624]
Stack-based buffer overflow in Sorinara Streaming Audio Player 0.9 allows remote attackers to execute arbitrary code via a crafted .pla file.
[34861]
[sorinara-pla-bo(50369)]
[8625]
[8640]
Multiple stack-based buffer overflows in Mini-stream Easy RM-MP3 Converter 3.0.0.7 allow remote attackers to execute arbitrary code via (1) a long rtsp URL in a .ram file and (2) a long string in the HREF attribute of a REF element in a .asx file.
[34860]
[34864]
[easyrmmp3-ram-asx-bo(50376)]
[8633]
[8634]
Stack-based buffer overflow in Mini-stream RM Downloader 3.0.0.9 allows remote attackers to execute arbitrary code via a long rtsp URL in a .ram file.
[34860]
[8628]
Heap-based buffer overflow in popcorn.exe in Ultrafunk Popcorn 1.87 allows remote POP3 servers to cause a denial of service (application crash) via a long string in a +OK response. NOTE: some of these details are obtained from third party information.
[34699]
[ADV-2009-1170]
[8526]
The YaST2 LDAP module in yast2-ldap-server on SUSE Linux Enterprise Server 11 (aka SLE11) does not enable the firewall in certain circumstances involving reboots during online updates, which makes it easier for remote attackers to access network services.
[SUSE-SR:2009:012]
Directory traversal vulnerability in arch.php in beLive 0.2.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the arch parameter.
[34968]
[8680]
Multiple SQL injection vulnerabilities in photos.php in Shutter 0.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) albumID, (2) tagID, and (3) photoID parameters to index.html.
[20090514 MULTIPLE SQL INJECTION VULNERABILITIES --Shutter v-0.1.1-->]
[34967]
[8679]
SQL injection vulnerability in admin/member_details.php in 2daybiz Business Community Script allows remote attackers to execute arbitrary SQL commands via the mid parameter.
[34976]
[8689]
admin/adminaddeditdetails.php in Business Community Script does not properly restrict access, which allows remote attackers to gain privileges and add administrators via a direct request.
[34976]
[8689]
Directory traversal vulnerability in examples/tbs_us_examples_0view.php in TinyButStrong 3.4.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the script parameter.
[ADV-2009-1304]
[tinybutstrong-script-file-include(50506)]
[8667]
Cross-site scripting (XSS) vulnerability in questiondetail.php in Easy Scripts Answer and Question Script allows remote attackers to inject arbitrary web script or HTML via the questionid parameter.
[34975]
[8690]
Multiple SQL injection vulnerabilities in myaccount.php in Easy Scripts Answer and Question Script allow remote authenticated users to execute arbitrary SQL commands via the (1) user name (userid parameter) and (2) password.
[34975]
[8690]
Xerox WorkCentre and WorkCentre Pro 232, 238, 245, 255, 265, 275; and WorkCentre 5632, 5638, 5645, 5655, 5665, 5675, 5687, 7655, 7656, and 7675 allows remote attackers to execute arbitrary commands via unknown attack vectors, aka "command injection vulnerability."
[34984]
[1022238]
[ADV-2009-1328]
[http://www.xerox.com/downloads/usa/en/c/cert_XRX09-02_v1.0.pdf]
[workcentre-unspecified-cmd-execution(50558)]
Multiple SQL injection vulnerabilities in the Starrating plugin before 0.7.7 for b2evolution allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
[http://sourceforge.net/project/shownotes.php?release_id=681352&group_id=160495]
[34899]
[starrating-unspecified-sql-injection(50417)]
Multiple SQL injection vulnerabilities in admin/admin.php in Realty Webware Technologies Realty Web-Base 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) user (username) and (2) password parameters. NOTE: some of these details are obtained from third party information.
[34886]
[webbase-admin-sql-injection(50399)]
[8643]
Unrestricted file upload vulnerability in admin/uploadimage.php in eLitius 1.0 allows remote attackers to bypass intended access restrictions and upload and execute arbitrary files via an avatar file with an accepted Content-Type such as image/gif, then requesting the file in admin/banners/.
[34813]
[ADV-2009-1248]
[elitius-uploadimage-file-upload(50305)]
[8603]
Stack-based buffer overflow in URUWorks ViPlay3 3.0 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long file entry in a .vpl file.
[34877]
[viplay3-vpl-bo(50403)]
[8644]
SQL injection vulnerability in admin/utopic.php in uTopic 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the rating parameter to index.php.
[http://sourceforge.net/project/shownotes.php?group_id=261386&release_id=680474]
[20090511 (POST var 'rating') BLIND SQL INJECTION--microTopic v1 Initial Release-->]
[34907]
[ADV-2009-1288]
[microtopic-rating-sql-injection(50428)]
[8655]
Multiple SQL injection vulnerabilities in admin/login.php in Wright Way Services Recipe Script 5 allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) Password fields, as reachable from admin/index.php.
[34885]
[recipescript-login-sql-injection(50407)]
[8642]
Unrestricted file upload vulnerability in myaccount.php in Easy Scripts Answer and Question Script allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the uploads/[username] directory.
[8690]
myaccount.php in Easy Scripts Answer and Question Script does not verify the original password before changing passwords, which allows remote attackers to change the password of other users and gain privileges via modified userid, txtpassword, and txtRpassword parameters.
[8690]
myaccount.php in Easy Scripts Answer and Question Script allows remote attackers to remove arbitrary user accounts via a modified userid parameter without specifying any additional fields.
[answerquestion-userid-security-bypass(50627)]
[8690]
Multiple unspecified vulnerabilities in CycloMedia CycloScopeLite 2.50.3.0 allow remote attackers to execute arbitrary code via the ReturnConnection method in (1) CM_ADOConnection.dll, (2) CM_AddressInfoDBC.dll, and (3) CM_RecordingLocationDBC.dll, related to improper dereferencing. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[34912]
Stack-based buffer overflow in Mini-stream CastRipper 2.50.70 allows remote attackers to execute arbitrary code via a long entry in a .m3u file, a different vector than CVE-2009-5137.
[8660]
[8661]
[8662]
TYPSoft FTP Server 1.11 allows remote attackers to cause a denial of service (CPU consumption) by sending an ABOR (abort) command without an active file transfer.
[34901]
[1022202]
[8650]
The smarty_function_math function in libs/plugins/function.math.php in Smarty 2.6.22 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the equation attribute of the math function. NOTE: some of these details are obtained from third party information.
Per http://secunia.com/advisories/35072
"The vulnerability is confirmed in version 2.6.22 on Windows. Other versions may also be affected."
[34918]
[USN-791-3]
[smarty-smartyfunctionmath-cmd-execution(50457)]
[8659]
[FEDORA-2009-5525]
[FEDORA-2009-5516]
[FEDORA-2009-5520]
user/index.php in TCPDB 3.8 does not require administrative authentication, which allows remote attackers to add admin accounts via unspecified vectors. NOTE: some of these details are obtained from third party information.
[34866]
[tcpdb-userpage-security-bypass(50371)]
[8626]
Multiple buffer overflows in the Deployment Toolkit ActiveX control in deploytk.dll 6.0.130.3 in Sun Java SE Runtime Environment (aka JRE) 6 Update 13 allow remote attackers to execute arbitrary code via a long string argument to the (1) setInstallerType, (2) setAdditionalPackages, (3) compareVersion, (4) getStaticCLSID, or (5) launch method.
[34931]
[http://www.shinnai.net/xplits/TXT_mhxRKrtrPLyAHRFNm7QR.html]
[8665]
The Deployment Toolkit ActiveX control in deploytk.dll 6.0.130.3 in Sun Java SE Runtime Environment (aka JRE) 6 Update 13 allows remote attackers to (1) execute arbitrary code via a .jnlp URL in the argument to the launch method, and might allow remote attackers to launch JRE installation processes via the (2) installLatestJRE or (3) installJRE method.
[34931]
[http://www.shinnai.net/xplits/TXT_mhxRKrtrPLyAHRFNm7QR.html]
[sun-jre-activex-code-execution(50629)]
[8665]
The kernel in Sun Solaris 9 allows local users to cause a denial of service (panic) by calling fstat with a first argument of AT_FDCWD.
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-122300-40-1]
[257988]
[http://support.avaya.com/elmodocs2/security/ASA-2009-188.htm]
[34979]
[1022232]
[ADV-2009-1315]
[ADV-2009-1388]
[solaris-fstat-dos(50557)]
[oval:org.mitre.oval:def:6256]
Stack-based buffer overflow in Microchip MPLAB IDE 8.30 allows user-assisted remote attackers to execute arbitrary code via a long .cof pathname in a [TOOL_SETTINGS] section in a .mcp file, possibly a related issue to CVE-2009-1608.
[8656]
Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a long 227 reply to a PASV command.
[34838]
[32bit-cwd-banner-bo(50337)]
[32bit-pasv-bo(50644)]
[8623]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2009-1535. Reason: This candidate is a duplicate of CVE-2009-1535. Notes: All CVE users should reference CVE-2009-1535 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Per http://www.microsoft.com/technet/security/advisory/971492.mspx
Affected Software
Microsoft Internet Information Services 5.0
Microsoft Internet Information Services 5.1
Microsoft Internet Information Services 6.0
Multiple static code injection vulnerabilities in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allow (1) remote authenticated users to inject arbitrary PHP code into files by placing PHP sequences into the account's "display name" setting and then invoking boards/boards_rss.php, and might allow (2) remote attackers to inject arbitrary PHP code into files via the HTTP Host header in a request to boards/boards_rss.php.
[20090512 Bitweaver <= 2.6 /boards/boards_rss.php / saveFeed() remote code execution exploit]
[34910]
[bitweaver-savefeed-code-execution(50631)]
[8659]
Directory traversal vulnerability in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the version parameter to boards/boards_rss.php.
[20090512 Bitweaver <= 2.6 /boards/boards_rss.php / saveFeed() remote code execution exploit]
[34910]
[8659]
The Profiles component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1, when installing a configuration profile, can replace the password policy from Exchange ActiveSync with a weaker password policy, which allows physically proximate attackers to bypass the intended policy.
[APPLE-SA-2009-06-17-1]
[http://support.apple.com/kb/HT3639]
[35414]
[35436]
[ADV-2009-1621]
[ipod-iphone-profile-security-bypass(51212)]
Safari in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly clear the search history when it is cleared from the Settings application, which allows physically proximate attackers to obtain the search history.
[APPLE-SA-2009-06-17-1]
[http://support.apple.com/kb/HT3639]
[35414]
[35448]
[ADV-2009-1621]
WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not prevent web sites from loading third-party content into a subframe, which allows remote attackers to bypass the Same Origin Policy and conduct "clickjacking" attacks via a crafted HTML document.
[APPLE-SA-2009-06-08-1]
[APPLE-SA-2009-06-17-1]
[SUSE-SR:2011:002]
[http://support.apple.com/kb/HT3613]
[http://support.apple.com/kb/HT3639]
[DSA-1950]
[35260]
[35317]
[ADV-2009-1522]
[ADV-2009-1621]
[ADV-2011-0212]
Apple Safari before 4.0 does not properly check for revoked Extended Validation (EV) certificates, which makes it easier for remote attackers to trick a user into accepting an invalid certificate.
[APPLE-SA-2009-06-08-1]
[http://support.apple.com/kb/HT3613]
[35260]
[35353]
[1022346]
[ADV-2009-1522]
The Telephony component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to cause a denial of service (device reset) via a crafted ICMP echo request, which triggers an assertion error related to a "logic issue."
[JVN#87239696]
[JVNDB-2009-000040]
[APPLE-SA-2009-06-17-1]
[http://support.apple.com/kb/HT3639]
[35414]
[ADV-2009-1621]
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via an event handler that triggers script execution in the context of the next loaded document.
[APPLE-SA-2009-06-08-1]
[APPLE-SA-2009-06-17-1]
[SUSE-SR:2011:002]
[1022344]
[http://support.apple.com/kb/HT3613]
[http://support.apple.com/kb/HT3639]
[DSA-1950]
[35260]
[ADV-2009-1522]
[ADV-2009-1621]
[ADV-2011-0212]
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML by overwriting the document.implementation property of (1) an embedded document or (2) a parent document.
[APPLE-SA-2009-06-08-1]
[APPLE-SA-2009-06-17-1]
[SUSE-SR:2011:002]
[1022344]
[http://support.apple.com/kb/HT3613]
[http://support.apple.com/kb/HT3639]
[35260]
[35319]
[ADV-2009-1522]
[ADV-2009-1621]
[ADV-2011-0212]
WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle constant (aka const) declarations in a type-conversion operation during JavaScript exception handling, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.
[APPLE-SA-2009-06-08-1]
[APPLE-SA-2009-06-17-1]
[SUSE-SR:2011:002]
[1022345]
[http://support.apple.com/kb/HT3613]
[http://support.apple.com/kb/HT3639]
[35260]
[35311]
[ADV-2009-1522]
[ADV-2009-1621]
[ADV-2011-0212]
The JavaScript garbage collector in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle allocation failures, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document that triggers write access to an "offset of a NULL pointer."
[APPLE-SA-2009-06-08-1]
[APPLE-SA-2009-06-17-1]
[SUSE-SR:2011:002]
[1022345]
[http://support.apple.com/kb/HT3613]
[http://support.apple.com/kb/HT3639]
[DSA-1950]
[MDVSA-2009:330]
[35260]
[35309]
[USN-822-1]
[USN-836-1]
[USN-857-1]
[ADV-2009-1522]
[ADV-2009-1621]
[ADV-2011-0212]
[oval:org.mitre.oval:def:10260]
[FEDORA-2009-8039]
[FEDORA-2009-8049]
[FEDORA-2009-8046]
[FEDORA-2009-8020]
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to determining a security context through an approach that is not the "HTML 5 standard method."
[APPLE-SA-2009-06-08-1]
[APPLE-SA-2009-06-17-1]
[SUSE-SR:2011:002]
[1022344]
[http://support.apple.com/kb/HT3613]
[http://support.apple.com/kb/HT3639]
[35260]
[35320]
[ADV-2009-1522]
[ADV-2009-1621]
[ADV-2011-0212]
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving submission of a form to the about:blank URL, leading to security-context replacement.
[APPLE-SA-2009-06-08-1]
[APPLE-SA-2009-06-17-1]
[SUSE-SR:2011:002]
[1022344]
[http://support.apple.com/kb/HT3613]
[http://support.apple.com/kb/HT3639]
[35260]
[35332]
[ADV-2009-1522]
[ADV-2009-1621]
[ADV-2011-0212]
Use-after-free vulnerability in WebKit, as used in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Google Chrome 1.0.154.53, and possibly other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by setting an unspecified property of an HTML tag that causes child elements to be freed and later accessed when an HTML error occurs, related to "recursion in certain DOM event handlers."
[20090608 Multiple Vendor WebKit Error Handling Use After Free Vulnerability]
[APPLE-SA-2009-06-08-1]
[APPLE-SA-2009-06-17-1]
[SUSE-SR:2011:002]
[1022345]
[http://support.apple.com/kb/HT3613]
[http://support.apple.com/kb/HT3639]
[DSA-1950]
[MDVSA-2009:330]
[35260]
[USN-822-1]
[USN-836-1]
[USN-857-1]
[ADV-2009-1522]
[ADV-2009-1621]
[ADV-2011-0212]
[oval:org.mitre.oval:def:11009]
[FEDORA-2009-8039]
[FEDORA-2009-8049]
[FEDORA-2009-8046]
[FEDORA-2009-8020]
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to insufficient access control for standard JavaScript prototypes in other domains.
[APPLE-SA-2009-06-08-1]
[APPLE-SA-2009-06-17-1]
[SUSE-SR:2011:002]
[1022344]
[http://support.apple.com/kb/HT3613]
[http://support.apple.com/kb/HT3639]
[35260]
[35330]
[ADV-2009-1522]
[ADV-2009-1621]
[ADV-2011-0212]
WebKit before r41741, as used in Apple iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Safari, and other software, allows remote attackers to cause a denial of service (memory consumption or device reset) via a web page containing an HTMLSelectElement object with a large length attribute, related to the length property of a Select object.
[http://kb.palm.com/wps/portal/kb/na/pre/p100eww/sprint/solutions/article/50607_en.html#121]
[APPLE-SA-2009-06-17-1]
[SUSE-SR:2011:002]
[http://support.apple.com/kb/HT3639]
[DSA-1950]
[http://www.g-sec.lu/one-bug-to-rule-them-all.html]
[20090715 [GSEC-TZO-44-2009] One bug to rule them all - Firefox, IE, Safari,Opera, Chrome,Seamonkey,iPhone,iPod,Wii,PS3....]
[20090715 Re:[GSEC-TZO-44-2009] One bug to rule them all - Firefox, IE, Safari,Opera, Chrome,Seamonkey,iPhone,iPod,Wii,PS3....]
[20090715 Re: [GSEC-TZO-44-2009] One bug to rule them all - Firefox, IE, Safari,Opera, Chrome,Seamonkey,iPhone,iPod,Wii,PS3....]
[20090716 Re[2]: [GSEC-TZO-44-2009] One bug to rule them all - Firefox, IE, Safari,Opera, Chrome,Seamonkey,iPhone,iPod,Wii,PS3....]
[35414]
[35446]
[ADV-2009-1621]
[ADV-2011-0212]
[https://bugs.webkit.org/show_bug.cgi?id=23319]
[9160]
WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to read images from arbitrary web sites via a CANVAS element with an SVG image, related to a "cross-site image capture issue."
[APPLE-SA-2009-06-08-1]
[APPLE-SA-2009-06-17-1]
[SUSE-SR:2011:002]
[http://support.apple.com/kb/HT3613]
[http://support.apple.com/kb/HT3639]
[DSA-1950]
[35260]
[35331]
[ADV-2009-1522]
[ADV-2009-1621]
[ADV-2011-0212]
WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle redirects, which allows remote attackers to read images from arbitrary web sites via vectors involving a CANVAS element and redirection, related to a "cross-site image capture issue."
[APPLE-SA-2009-06-08-1]
[APPLE-SA-2009-06-17-1]
[SUSE-SR:2011:002]
[http://support.apple.com/kb/HT3613]
[http://support.apple.com/kb/HT3639]
[DSA-1950]
[35260]
[35322]
[ADV-2009-1522]
[ADV-2009-1621]
[ADV-2011-0212]
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving access to frame contents after completion of a page transition.
[APPLE-SA-2009-06-08-1]
[APPLE-SA-2009-06-17-1]
[SUSE-SR:2011:002]
[1022344]
[http://support.apple.com/kb/HT3613]
[http://support.apple.com/kb/HT3639]
[DSA-1950]
[35260]
[35328]
[ADV-2009-1522]
[ADV-2009-1621]
[ADV-2011-0212]
WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 uses predictable random numbers in JavaScript applications, which makes it easier for remote web servers to track the behavior of a Safari user during a session.
[APPLE-SA-2009-06-08-1]
[APPLE-SA-2009-06-17-1]
[SUSE-SR:2011:002]
[http://support.apple.com/kb/HT3613]
[http://support.apple.com/kb/HT3639]
[35260]
[ADV-2009-1522]
[ADV-2009-1621]
[ADV-2011-0212]
CRLF injection vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject HTTP headers and bypass the Same Origin Policy via a crafted HTML document, related to cross-site scripting (XSS) attacks that depend on communication with arbitrary web sites on the same server through use of XMLHttpRequest without a Host header.
[APPLE-SA-2009-06-08-1]
[APPLE-SA-2009-06-17-1]
[SUSE-SR:2011:002]
[1022344]
[http://support.apple.com/kb/HT3613]
[http://support.apple.com/kb/HT3639]
[DSA-1950]
[35260]
[ADV-2009-1522]
[ADV-2009-1621]
[ADV-2011-0212]
WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not initialize a pointer during handling of a Cascading Style Sheets (CSS) attr function call with a large numerical argument, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.
[http://blog.zoller.lu/2009/05/advisory-apple-safari-remote-code.html]
[APPLE-SA-2009-06-08-1]
[APPLE-SA-2009-06-17-1]
[SUSE-SR:2011:002]
[1022345]
[http://support.apple.com/kb/HT3613]
[http://support.apple.com/kb/HT3639]
[DSA-1950]
[MDVSA-2009:330]
[RHSA-2009:1128]
[20090608 ZDI-09-032: Apple WebKit attr() Invalid Attribute Memory Corruption Vulnerability]
[20090614 [TZO-37-2009] Apple Safari <v4 Remote code execution]
[35260]
[35318]
[USN-822-1]
[USN-836-1]
[USN-857-1]
[ADV-2009-1522]
[ADV-2009-1621]
[ADV-2011-0212]
[http://www.zerodayinitiative.com/advisories/ZDI-09-032/]
[oval:org.mitre.oval:def:9484]
[FEDORA-2009-8039]
[FEDORA-2009-8049]
[FEDORA-2009-8046]
[FEDORA-2009-8020]
The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as demonstrated by a file:///etc/passwd URL in an entity declaration, related to an "XXE attack."
[APPLE-SA-2009-06-08-1]
[APPLE-SA-2009-06-17-1]
[SUSE-SR:2011:002]
[http://scary.beasts.org/security/CESA-2009-006.html]
[http://scarybeastsecurity.blogspot.com/2009/06/apples-safari-4-fixes-local-file-theft.html]
[http://support.apple.com/kb/HT3613]
[http://support.apple.com/kb/HT3639]
[35260]
[35321]
[USN-857-1]
[ADV-2009-1522]
[ADV-2009-1621]
[ADV-2011-0212]
[8907]
The XSLT implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle redirects, which allows remote attackers to read XML content from arbitrary web pages via a crafted document.
[APPLE-SA-2009-06-08-1]
[APPLE-SA-2009-06-17-1]
[SUSE-SR:2011:002]
[http://support.apple.com/kb/HT3613]
[http://support.apple.com/kb/HT3639]
[35260]
[ADV-2009-1522]
[ADV-2009-1621]
[ADV-2011-0212]
Use-after-free vulnerability in the JavaScript DOM implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by destroying a document.body element that has an unspecified XML container with elements that support the dir attribute.
[APPLE-SA-2009-06-08-1]
[APPLE-SA-2009-06-17-1]
[SUSE-SR:2011:002]
[1022345]
[http://support.apple.com/kb/HT3613]
[http://support.apple.com/kb/HT3639]
[20090608 ZDI-09-033: Apple WebKit dir Attribute Freeing Dangling Object Pointer Vulnerability]
[35260]
[35325]
[ADV-2009-1522]
[ADV-2009-1621]
[ADV-2011-0212]
[http://www.zerodayinitiative.com/advisories/ZDI-09-033/]
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to improper handling of Location and History objects.
[APPLE-SA-2009-06-08-1]
[APPLE-SA-2009-06-17-1]
[SUSE-SR:2011:002]
[1022344]
[http://support.apple.com/kb/HT3613]
[http://support.apple.com/kb/HT3639]
[35260]
[35327]
[ADV-2009-1522]
[ADV-2009-1621]
[ADV-2011-0212]
WebKit in Apple Safari before 4.0 does not prevent references to file: URLs within (1) audio and (2) video elements, which allows remote attackers to determine the existence of arbitrary files via a crafted HTML document.
[APPLE-SA-2009-06-08-1]
[SUSE-SR:2011:002]
[http://support.apple.com/kb/HT3613]
[35260]
[35333]
[ADV-2009-1522]
[ADV-2011-0212]
CFNetwork in Apple Safari before 4.0 misinterprets downloaded image files as local HTML documents in unspecified circumstances, which allows remote attackers to execute arbitrary JavaScript code by placing it in an image file.
[APPLE-SA-2009-06-08-1]
[1022343]
[http://support.apple.com/kb/HT3613]
[35260]
[35344]
[ADV-2009-1522]
CoreGraphics in Apple Safari before 4.0 on Windows does not properly use arithmetic during automatic hinting of TrueType fonts, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted font data.
[APPLE-SA-2009-06-08-1]
[http://support.apple.com/kb/HT3613]
[35260]
[35308]
[ADV-2009-1522]
The Private Browsing feature in Apple Safari before 4.0 on Windows does not remove cookies from the alternate cookie store in unspecified circumstances upon (1) disabling of the feature or (2) exit of the application, which makes it easier for remote web servers to track users via a cookie.
[APPLE-SA-2009-06-08-1]
[http://support.apple.com/kb/HT3613]
[35260]
[35346]
[ADV-2009-1522]
Race condition in the Reset Safari implementation in Apple Safari before 4.0 on Windows might allow local users to read stored web-site passwords via unspecified vectors.
[APPLE-SA-2009-06-08-1]
[APPLE-SA-2010-11-22-1]
[http://support.apple.com/kb/HT3613]
[http://support.apple.com/kb/HT4456]
[35260]
[35352]
[ADV-2009-1522]
[ADV-2010-3046]
Apple Safari before 4.0 does not prevent calls to the open-help-anchor URL handler by web sites, which allows remote attackers to open arbitrary local help files, and execute arbitrary code or obtain sensitive information, via a crafted call.
[APPLE-SA-2009-06-08-1]
[1022345]
[http://support.apple.com/kb/HT3613]
[35260]
[35351]
[ADV-2009-1522]
Use-after-free vulnerability in the garbage-collection implementation in WebCore in WebKit in Apple Safari before 4.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via an SVG animation element, related to SVG set objects, SVG marker elements, the targetElement attribute, and unspecified "caches."
[APPLE-SA-2009-06-08-1]
[SUSE-SR:2011:002]
[1022345]
[http://support.apple.com/kb/HT3613]
[MDVSA-2010:182]
[RHSA-2009:1130]
[35260]
[35334]
[ADV-2009-1522]
[ADV-2011-0212]
[http://www.zerodayinitiative.com/advisories/ZDI-09-034/]
[oval:org.mitre.oval:def:10162]
[USN-823-1]
WebKit in Apple Safari before 4.0 allows remote attackers to spoof the browser's display of (1) the host name, (2) security indicators, and unspecified other UI elements via a custom cursor in conjunction with a modified CSS3 hotspot property.
[APPLE-SA-2009-06-08-1]
[SUSE-SR:2011:002]
[http://support.apple.com/kb/HT3613]
[DSA-1950]
[35260]
[35340]
[ADV-2009-1522]
[ADV-2011-0212]
[safari-uielements-spoofing(51263)]
WebKit in Apple Safari before 4.0 does not properly initialize memory for Attr DOM objects, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document.
[APPLE-SA-2009-06-08-1]
[SUSE-SR:2011:002]
[1022345]
[http://support.apple.com/kb/HT3613]
[DSA-1950]
[35260]
[35310]
[USN-836-1]
[USN-857-1]
[ADV-2009-1522]
[ADV-2011-0212]
[safari-attrdom-code-execution(51265)]
WebKit in Apple Safari before 4.0 does not prevent remote loading of local Java applets, which allows remote attackers to execute arbitrary code, gain privileges, or obtain sensitive information via an APPLET or OBJECT element.
[APPLE-SA-2009-06-08-1]
[SUSE-SR:2011:002]
[1022345]
[http://support.apple.com/kb/HT3613]
[DSA-1950]
[35260]
[35350]
[USN-836-1]
[USN-857-1]
[ADV-2009-1522]
[ADV-2011-0212]
[safari-applets-code-execution(51266)]
The XSLT functionality in WebKit in Apple Safari before 4.0 does not properly implement the document function, which allows remote attackers to read (1) arbitrary local files and (2) files from different security zones via unspecified vectors.
[APPLE-SA-2009-06-08-1]
[SUSE-SR:2011:002]
[http://support.apple.com/kb/HT3613]
[35260]
[USN-857-1]
[ADV-2009-1522]
[ADV-2011-0212]
[safari-document-information-disclosure(51267)]
Cross-site scripting (XSS) vulnerability in Web Inspector in WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to inject arbitrary web script or HTML, and read local files, via vectors related to the improper escaping of HTML attributes.
[APPLE-SA-2009-06-08-1]
[SUSE-SR:2011:002]
[1022344]
[http://support.apple.com/kb/HT3613]
[DSA-1950]
[35260]
[35348]
[ADV-2009-1522]
[ADV-2011-0212]
[safari-webinspector-xss(51268)]
Cross-site scripting (XSS) vulnerability in Web Inspector in WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to inject arbitrary web script or HTML, and read local files, via vectors related to script execution with incorrect privileges.
[APPLE-SA-2009-06-08-1]
[SUSE-SR:2011:002]
[1022344]
[http://support.apple.com/kb/HT3613]
[35260]
[35349]
[ADV-2009-1522]
[ADV-2011-0212]
CFNetwork in Apple Safari before 4.0 on Windows does not properly protect the temporary files created for downloads, which allows local users to obtain sensitive information by reading these files.
[APPLE-SA-2009-06-08-1]
[1022342]
[http://support.apple.com/kb/HT3613]
[35260]
[35347]
[ADV-2009-1522]
Integer overflow in Terminal in Apple Mac OS X 10.5 before 10.5.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted size value in a CSI[4 xterm resize escape sequence that triggers a heap-based buffer overflow.
[http://dvlabs.tippingpoint.com/advisory/TPTI-09-04]
[1022322]
[http://support.apple.com/kb/HT3549]
[20090602 TPTI-09-04: Apple Terminal xterm Resize Escape Sequence Memory Corruption Vulnerability]
[35182]
[macos-terminal-bo(50982)]
WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to obtain sensitive information via vectors involving drag events and the dragging of content over a crafted web page.
[APPLE-SA-2009-06-08-1]
[SUSE-SR:2011:002]
[http://support.apple.com/kb/HT3613]
[35260]
[ADV-2009-1522]
[ADV-2011-0212]
The Aqua Look and Feel for Java implementation in Java 1.5 on Mac OS X 10.5 allows remote attackers to execute arbitrary code via a call to the undocumented apple.laf.CColourUIResource constructor with a crafted value in the first argument, which is dereferenced as a pointer.
[APPLE-SA-2009-06-15-1]
[http://support.apple.com/kb/HT3632]
[20090616 ZDI-09-043: Apple Java CColorUIResource Pointer Derference Code Execution Vulnerability]
[35381]
[35401]
[http://www.zerodayinitiative.com/advisories/ZDI-09-043]
[hotspot-ccolouruiresource-code-execution(51185)]
Multiple integer overflows in OpenEXR 1.2.2 and 1.6.1 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors that trigger heap-based buffer overflows, related to (1) the Imf::PreviewImage::PreviewImage function and (2) compressor constructors. NOTE: some of these details are obtained from third party information.
[APPLE-SA-2009-08-05-1]
[SUSE-SR:2009:014]
[http://release.debian.org/proposed-updates/stable_diffs/openexr_1.6.1-3%2Blenny3.debdiff]
[http://security.debian.org/pool/updates/main/o/openexr/openexr_1.2.2-4.3+etch2.diff.gz]
[http://security.debian.org/pool/updates/main/o/openexr/openexr_1.6.1-3+lenny3.diff.gz]
[http://support.apple.com/kb/HT3757]
[DSA-1842]
[MDVSA-2009:190]
[MDVSA-2009:191]
[35838]
[1022674]
[USN-831-1]
[TA09-218A]
[ADV-2009-2035]
[ADV-2009-2172]
[https://github.com/openexr/openexr/blob/master/CHANGES.md#version-170-july-23-2010]
[FEDORA-2009-8132]
[FEDORA-2009-8136]
The decompression implementation in the Imf::hufUncompress function in OpenEXR 1.2.2 and 1.6.1 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger a free of an uninitialized pointer.
[APPLE-SA-2009-08-05-1]
[SUSE-SR:2009:014]
[http://release.debian.org/proposed-updates/stable_diffs/openexr_1.6.1-3%2Blenny3.debdiff]
[http://security.debian.org/pool/updates/main/o/openexr/openexr_1.2.2-4.3+etch2.diff.gz]
[http://security.debian.org/pool/updates/main/o/openexr/openexr_1.6.1-3+lenny3.diff.gz]
[http://support.apple.com/kb/HT3757]
[DSA-1842]
[MDVSA-2009:190]
[MDVSA-2009:191]
[35838]
[1022674]
[USN-831-1]
[TA09-218A]
[ADV-2009-2035]
[ADV-2009-2172]
[FEDORA-2009-8132]
[FEDORA-2009-8136]
Heap-based buffer overflow in the compression implementation in OpenEXR 1.2.2 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors.
[APPLE-SA-2009-08-05-1]
[http://security.debian.org/pool/updates/main/o/openexr/openexr_1.2.2-4.3+etch2.diff.gz]
[http://support.apple.com/kb/HT3757]
[DSA-1842]
[MDVSA-2009:191]
[35838]
[1022674]
[USN-831-1]
[TA09-218A]
[ADV-2009-2035]
[ADV-2009-2172]
[https://github.com/openexr/openexr/blob/master/CHANGES.md#version-170-july-23-2010]
CFNetwork in Apple Mac OS X 10.5 before 10.5.8 places an incorrect URL in a certificate warning in certain 302 redirection scenarios, which makes it easier for remote attackers to trick a user into visiting an arbitrary https web site by leveraging an open redirect vulnerability, a different issue than CVE-2009-2062.
[APPLE-SA-2009-08-05-1]
[APPLE-SA-2010-06-21-1]
[http://support.apple.com/kb/HT3757]
[http://support.apple.com/kb/HT4225]
[35954]
[TA09-218A]
[ADV-2009-2172]
[macosx-cfnetwork-weak-security(52418)]
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms, allows remote attackers to inject arbitrary web script or HTML via vectors related to parent and top objects.
[APPLE-SA-2009-07-08-1]
[APPLE-SA-2009-09-09-1]
[SUSE-SR:2011:002]
[http://support.apple.com/kb/HT3666]
[http://support.apple.com/kb/HT3860]
[35441]
[1022525]
[ADV-2009-1827]
[ADV-2011-0212]
[oval:org.mitre.oval:def:6208]
WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms; KHTML in kdelibs in KDE; QtWebKit (aka Qt toolkit); and possibly other products do not properly handle numeric character references, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.
[APPLE-SA-2009-07-08-1]
[APPLE-SA-2009-09-09-1]
[SUSE-SR:2011:002]
[http://support.apple.com/kb/HT3666]
[http://support.apple.com/kb/HT3860]
[http://websvn.kde.org/?view=rev&revision=1002162]
[http://websvn.kde.org/?view=rev&revision=1002163]
[http://websvn.kde.org/?view=rev&revision=1002164]
[DSA-1950]
[MDVSA-2009:330]
[35607]
[1022526]
[USN-836-1]
[USN-857-1]
[ADV-2009-1827]
[ADV-2011-0212]
[https://bugzilla.redhat.com/show_bug.cgi?id=513813]
[oval:org.mitre.oval:def:5777]
[FEDORA-2009-8800]
[FEDORA-2009-8802]
[FEDORA-2009-8039]
[FEDORA-2009-8049]
[FEDORA-2009-8046]
[FEDORA-2009-8020]
Heap-based buffer overflow in ColorSync in Apple Mac OS X 10.4.11 and 10.5 before 10.5.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted image containing an embedded ColorSync profile.
[APPLE-SA-2009-08-05-1]
[APPLE-SA-2010-06-16-1]
[APPLE-SA-2010-06-07-1]
[http://support.apple.com/kb/HT3757]
[http://support.apple.com/kb/HT4196]
[http://support.apple.com/kb/HT4220]
[35954]
[1022674]
[TA09-218A]
[ADV-2009-2172]
[ADV-2010-1373]
[ADV-2010-1512]
[macosx-colorsync-profile-bo(52419)]
[safari-colorsync-profile-bo(59162)]
[oval:org.mitre.oval:def:7499]
Incomplete blacklist vulnerability in CoreTypes in Apple Mac OS X 10.5 before 10.5.8 makes it easier for user-assisted remote attackers to execute arbitrary JavaScript via a web page that offers a download with a Content-Type value that is not on the list of possibly unsafe content types for Safari.
[APPLE-SA-2009-08-05-1]
[http://support.apple.com/kb/HT3757]
[35954]
[TA09-218A]
[ADV-2009-2172]
[macosx-coretype-code-execution(52420)]
Stack-based buffer overflow in Image RAW in Apple Mac OS X 10.5 before 10.5.8, and 10.4 before Digital Camera RAW Compatibility Update 2.6, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Canon RAW image.
[APPLE-SA-2009-08-05-1]
[http://support.apple.com/kb/HT3757]
[35954]
[1022674]
[TA09-218A]
[ADV-2009-2172]
[macosx-imageraw-bo(52423)]
Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Communications Express 6 2005Q4 (aka 6.2) and 6.3 allow remote attackers to inject arbitrary web script or HTML via (1) the abperson_displayName parameter to uwc/abs/search.xml in the Add Contact implementation in the Personal Address Book component or (2) the temporaryCalendars parameter to uwc/base/UWCMain.
[20090520 CORE-2009-0109 - Multiple XSS in Sun Communications Express]
[1022266]
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-122793-26-1]
[258068]
[http://www.coresecurity.com/content/sun-communications-express]
[20090520 CORE-2009-0109 - Multiple XSS in Sun Communications Express]
[34154]
[34155]
[ADV-2009-1389]
[communications-express-search-xss(50658)]
Multiple directory traversal vulnerabilities in NetMechanica NetDecision TFTP Server 4.2 allow remote attackers to read or modify arbitrary files via directory traversal sequences in the (1) GET or (2) PUT command.
[http://www.princeofnigeria.org/blogs/index.php/2009/05/17/netdecision-tftp-server-4-2-tftp-directo?blog=1]
[35002]
[netdecision-tftp-dir-traversal(50574)]
SQL injection vulnerability in panel/index.php in MLFFAT 2.1 allows remote attackers to execute arbitrary SQL commands via a base64-encoded supervisor cookie.
[http://securityreason.com/exploitalert/6198]
[http://www.sebug.net/exploit/11292/]
[34982]
[ADV-2009-1308]
[mlffat-index-sql-injection(50526)]
Cross-site scripting (XSS) vulnerability in admin/usermanager in IPplan 4.91a allows remote attackers to inject arbitrary web script or HTML via the grp parameter.
[http://holisticinfosec.org/content/view/113/45/]
[DSA-1827]
[35037]
Cross-site request forgery (CSRF) vulnerability in IPplan 4.91a allows remote attackers to hijack the authentication of administrators for requests that (1) change the password, (2) add users, or (3) delete users via unknown vectors.
[http://holisticinfosec.org/content/view/113/45/]
[ipplan-unspecified-csrf(50632)]
SQL injection vulnerability in listing_video.php in VidSharePro allows remote attackers to execute arbitrary SQL commands via the catid parameter.
[35033]
[8737]
Cross-site scripting (XSS) vulnerability in search.php in VidSharePro allows remote attackers to inject arbitrary web script or HTML via the searchtxt parameter. NOTE: some of these details are obtained from third party information.
[35033]
[vidshare-listingvideo-sql-injection(50635)]
[8737]
SQL injection vulnerability in the GridSupport (GS) Ticket System (com_gsticketsystem) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a viewCategory action to index.php.
[35025]
[gsticketsystem-index-sql-injection(50624)]
[8731]
Directory traversal vulnerability in bom.php in MyPic 2.1 allows remote attackers to list files in arbitrary directories via a .. (dot dot) in the dir parameter.
[http://hi.baidu.com/hirfire/blog/item/c3c0f6dda3ca47d18d10291a.html]
[35030]
[mypic-dir-directory-traversal(50621)]
Cross-site scripting (XSS) vulnerability in Feed Block 6.x-1.x before 6.x-1.1, a module for Drupal, allows remote authenticated users with administrator feed permissions to inject arbitrary web script or HTML via unspecified vectors in "aggregator items."
[http://drupal.org/node/453098]
[http://drupal.org/node/461706]
[34953]
[ADV-2009-1319]
[feedblock-unspecified-xss(50521)]
PAD Site Scripts 3.6 allows remote attackers to bypass authentication and gain privileges as other users, including administrative privileges, by setting the authuser cookie parameter to a valid username.
[35027]
[padsite-cookie-security-bypass(50622)]
[8735]
Multiple heap-based buffer overflows in the D-Link MPEG4 Viewer ActiveX Control (csviewer.ocx) 2.11.918.2006 allow remote attackers to execute arbitrary code via a long argument to the (1) SetFilePath and (2) SetClientCookie methods. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[34990]
[mpeg4viewer-csviewer-bo(50556)]
Multiple SQL injection vulnerabilities in login.php in DM FileManager 3.9.2, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields.
[35035]
[8741]
code.php in PC4Arb Pc4 Uploader 9.0 and earlier makes it easier for remote attackers to conduct SQL injection attacks via crafted keyword sequences that are removed from a filter in the id parameter in a banner action, as demonstrated via the "UNIunionON" string, which is collapsed into "UNION" by the filter_sql function.
[35004]
[ADV-2009-1364]
[pc4uploader-code-sql-injection(50586)]
[8709]
Directory traversal vulnerability in InstallHFZ.exe 6.5.201.0 in Pinnacle Hollywood Effects 6, a module in Pinnacle Systems Pinnacle Studio 12, allows remote attackers to create and overwrite arbitrary files via a filename containing a ..\ (dot dot backslash) sequence in a Hollywood FX Compressed Archive (.hfz) file. NOTE: this can be leveraged for code execution by decompressing a file to a Startup folder. NOTE: some of these details are obtained from third party information.
[http://retrogod.altervista.org/9sg_pinnacle_studio_12_hfz.htm]
[20090513 Pinnacle Studio 12 "Hollywood FX Compressed Archive" (.hfz) directory traversal vulnerability poc]
[34936]
[pinnaclestudio-hfz-directory-traversal(50510)]
[8670]
InstallHFZ.exe 6.5.201.0 in Pinnacle Hollywood Effects 6, a module in Pinnacle Systems Pinnacle Studio 12, allows remote attackers to cause a denial of service (application crash) via a crafted Hollywood FX Compressed Archive (.hfz) file.
[35137]
[pinnaclestudio-hfz-dos(50856)]
[8670]
Armorlogic Profense Web Application Firewall before 2.2.22, and 2.4.x before 2.4.4, has a default root password hash, and permits password-based root logins over SSH, which makes it easier for remote attackers to obtain access.
[20090520 Armorlogic Profense Web Application Firewall 2.4 multiple vulnerabilities.]
[profense-default-password(50852)]
SQL injection vulnerability in berita.php in Dian Gemilang DGNews 3.0 Beta allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action.
[35016]
[8727]
SQL injection vulnerability in index.php in 26th Avenue bSpeak 1.10 allows remote attackers to execute arbitrary SQL commands via the forumid parameter in a post action.
[35049]
[8751]
Multiple directory traversal vulnerabilities in index.php in Catviz 0.4.0 Beta 1 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) webpages_form or (2) userman_form parameter.
[35042]
[8745]
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Catviz 0.4.0 beta 1 allow remote attackers to inject arbitrary web script or HTML via the (1) userman_form and (2) webpages_form parameters.
[35042]
[8745]
Unrestricted file upload vulnerability in VidSharePro allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via unspecified vectors.
[35024]
[vidshare-unspecified-file-upload(50625)]
[8730]
SQL injection vulnerability in list_list.php in Realty Webware Technologies Web-Base 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
[35043]
[realtywebbase-listlist-sql-injection(50646)]
[8748]
exJune Office Message System 1 does not properly restrict access to (1) configure.asp and (2) addmessage2.asp, which allows remote attackers to gain privileges a direct request. NOTE: some of these details are obtained from third party information.
[oms-configure-addmessage2-security-bypass(50647)]
[8744]
Coccinelle 0.1.7 allows local users to overwrite arbitrary files via a symlink attack on an unspecified "result file."
[http://packages.debian.org/changelogs/pool/main/c/coccinelle/coccinelle_0.1.7.deb-3/changelog]
[[oss-security] 20090506 CVE id request: coccinelle]
[34848]
[FEDORA-2009-5368]
The PackageManagerService class in services/java/com/android/server/PackageManagerService.java in Android 1.5 through 1.5 CRB42 does not properly check developer certificates during processing of sharedUserId requests at an application's installation time, which allows remote user-assisted attackers to access application data by creating a package that specifies a shared user ID with an arbitrary application.
[http://android.git.kernel.org/?p=platform/frameworks/base.git;a=commit;h=5d6d773fab559fdc12e553d60d789f3991ac552c]
[http://www.ocert.org/advisories/ocert-2009-006.html]
[[oss-security] 20090522 [oCERT-2009-006] Android improper package verification when using shared uids]
[20090522 [oCERT-2009-006] Android improper package verification when using shared uids]
[35090]
Off-by-one error in the packet_read_query_section function in packet.c in nsd 3.2.1, and process_query_section in query.c in nsd 2.3.7, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors that trigger a buffer overflow.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=529418]
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=529420]
[http://www.nlnetlabs.nl/publications/NSD_vulnerability_announcement.html]
[[oss-security] 20090519 CVE id request: nsd]
SLiM Simple Login Manager 1.3.0 places the X authority magic cookie (mcookie) on the command line when invoking xauth from (1) app.cpp and (2) switchuser.cpp, which allows local users to access the X session by listing the process and its arguments.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=529306]
[[oss-security] 20090518 CVE id request: slim]
[35015]
[slim-xauthority-info-disclosure(50611)]
[FEDORA-2009-13551]
[FEDORA-2009-13552]
Cross-site request forgery (CSRF) vulnerability in Transmission 1.5 before 1.53 and 1.6 before 1.61 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
[[oss-security] 20090521 CVE request: transmission <1.61 CSRF]
[http://www.transmissionbt.com/index.php]
The hypervisor_callback function in Xen, possibly before 3.4.0, as applied to the Linux kernel 2.6.30-rc4, 2.6.18, and probably other versions allows guest user applications to cause a denial of service (kernel oops) of the guest OS by triggering a segmentation fault in "certain address ranges."
[[Xen-devel] 20090513 [PATCH] linux/i386: hypervisor_callback adjustments]
[DSA-1809]
[[oss-security] 20090514 CVE Request: XEN local denial of service]
[34957]
[oval:org.mitre.oval:def:10313]
Stack-based buffer overflow in the btFiles::BuildFromMI function (trunk/btfiles.cpp) in Enhanced CTorrent (aka dTorrent) 3.3.2 and probably earlier, and CTorrent 1.3.4, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Torrent file containing a long path.
[http://dtorrent.svn.sourceforge.net/viewvc/dtorrent/dtorrent/trunk/btfiles.cpp?r1=296&r2=301&view=patch]
[http://sourceforge.net/tracker/?func=detail&aid=2782875&group_id=202532&atid=981959]
[DSA-1817]
[[oss-security] 20090520 CVE request: ctorrent]
[34584]
[ADV-2009-1092]
[https://bugzilla.redhat.com/show_bug.cgi?id=501813]
[ctorrent-btfiles-bo(49959)]
[8470]
[FEDORA-2009-8897]
[FEDORA-2009-8969]
Directory traversal vulnerability in src/torrent_info.cpp in Rasterbar libtorrent before 0.14.4, as used in firetorrent, qBittorrent, deluge Torrent, and other applications, allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) and partial relative pathname in a Multiple File Mode list element in a .torrent file.
[http://census-labs.com/news/2009/06/08/libtorrent-rasterbar/]
[GLSA-200907-14]
[http://sourceforge.net/project/shownotes.php?group_id=79942&release_id=686456]
[DSA-1815]
[MDVSA-2009:139]
[20090608 Rasterbar libtorrent arbitrary file overwrite vulnerability]
[35262]
[ADV-2009-1534]
[libtorrent-path-element-dir-traversal(51008)]
The message engine in CA ARCserve Backup r12.0 and r12.0 SP1 for Windows allows remote attackers to cause a denial of service (crash) via (1) an invalid 0x13 message, which is not properly handled in the ASCORE module, or (2) a 0x3B message with invalid stub data that triggers an RPC marshalling error.
[http://community.ca.com/blogs/casecurityresponseblog/archive/2009/06/15/ca20090615-01-ca-arcserve-backup-message-engine-denial-of-service-vulnerabilities.aspx]
[http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=209502]
[http://www.ivizsecurity.com/security-advisory-iviz-sr-09003.html]
[http://www.ivizsecurity.com/security-advisory-iviz-sr-09004.html]
[20090616 CA20090615-01: CA ARCserve Backup Message Engine Denial of Service Vulnerabilities]
[20090616 CA20090615-01: CA ARCserve Backup Message Engine Denial of Service Vulnerabilities (Updated)]
[35396]
[1022405]
[ADV-2009-1608]
[ca-arcserve-ascore-dos(51169)]
Multiple cross-site scripting (XSS) vulnerabilities in the WebAccess login page (aka gw/webacc) in Novell GroupWise 7.x before 7.03 HP2 allow remote attackers to inject arbitrary web script or HTML via the (1) GWAP.version or (2) User.Theme (aka User.Theme.index) parameter.
[http://packetstorm.linuxsecurity.com/0905-exploits/groupwise-xss.txt]
[1022267]
[http://www.novell.com/support/search.do?cmd=displayKC&externalId=7003271]
[20090521 Novell GroupWise Web Access Multiple XSS]
[35061]
[ADV-2009-1393]
[https://bugzilla.novell.com/show_bug.cgi?id=484942]
Unspecified vulnerability in the Solaris Secure Digital slot driver (aka sdhost) in Sun OpenSolaris snv_105 through snv_108 on the x86 platform allows local users to gain privileges or cause a denial of service (filesystem or memory corruption) via unknown vectors.
[259408]
[35069]
[1022271]
[ADV-2009-1410]
[solaris-slotdriver-code-execution(50687)]
SQL injection vulnerability in inc/ajax.asp in MaxCMS 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a digg action.
[34981]
[maxcms-ajax-sql-injection(50553)]
[8726]
Multiple directory traversal vulnerabilities in pluck 4.6.2, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the langpref parameter to (1) data/modules/contactform/module_info.php, (2) data/modules/blog/module_info.php, and (3) data/modules/albums/module_info.php, different vectors than CVE-2008-3194.
[35007]
[8715]
SQL injection vulnerability in index.php in LightOpenCMS 0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
[20090604 SQL INJECTION VULNERABILITY--LightOpen CMS Devel 0.1-->]
[8724]
admin/edituser.php in 2daybiz Template Monster Clone does not require administrative authentication, which allows remote attackers to modify arbitrary accounts via the (1) loginname, (2) password, (3) email, (4) firstname, or (5) lastname parameter.
[34977]
[tmc-edituser-security-bypass(50561)]
[8691]
Directory traversal vulnerability in download.php in Rama Zaiten CMS 0.9.8 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
[34995]
[ADV-2009-1343]
[ramacms-download-file-include(50572)]
[8700]
The web interface in Open Computer and Software Inventory Next Generation (OCS Inventory NG) 1.01 generates different error messages depending on whether a username is valid, which allows remote attackers to enumerate valid usernames.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=529344]
[http://www.ocsinventory-ng.org/index.php?mact=News,cntnt01,detail,0&cntnt01articleid=133&cntnt01returnid=69]
[35023]
[FEDORA-2009-5764]
[FEDORA-2009-5769]
[FEDORA-2009-5773]
Directory traversal vulnerability in includes/database/examples/addressbook.php in Flyspeck CMS 6.8 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.
[35011]
[ADV-2009-1367]
[8714]
index.php in Flyspeck CMS 6.8 does not require administrative authentication for the updateExistingContent action, which allows remote attackers to create or modify admin accounts via the (1) users[fullname], (2) users[email], (3) users[role_id], (4) users[username], and (5) users[password] parameters.
[35011]
[ADV-2009-1367]
[8714]
Cross-site scripting (XSS) vulnerability in activeCollab 2.1 Corporate allows remote attackers to inject arbitrary web script or HTML via the re_route parameter to the login script.
[http://pridels-team.blogspot.com/2009/05/activecollab-xss-and-full-path.html]
[35022]
activeCollab 2.1 Corporate allows remote attackers to obtain sensitive information via an invalid re_route parameter to the login script, which reveals the installation path in an error message.
[http://pridels-team.blogspot.com/2009/05/activecollab-xss-and-full-path.html]
[35022]
Directory traversal vulnerability in plugins/ddb/foot.php in Strawberry 1.1.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the file parameter to example/index.php. NOTE: this was originally reported as an issue affecting the do parameter, but traversal with that parameter might depend on a modified example/index.php. NOTE: some of these details are obtained from third party information.
[34971]
[strawberry-index-file-include(50562)]
[8681]
Multiple cross-site scripting (XSS) vulnerabilities in Ulteo Open Virtual Desktop 1.0 allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) admin/applications.php, (2) admin/appsgroup.php, (3) admin/users.php, (4) admin/usersgroup.php, and (5) admin/tasks.php; (6) show parameter to admin/logs.php; and (7) mode parameter to admin/configuration-partial.php. NOTE: some of these details are obtained from third party information.
[http://www.insight-tech.org/index.php?p=Ulteo-Open-Virtual-Desktop-v1-0-multiple-XSS]
[34927]
[http://www.ulteo.com/home/en/ovdi/openvirtualdesktop/downloadnow?autolang=en]
Multiple cross-site scripting (XSS) vulnerabilities in FormMail.pl in Matt Wright FormMail 1.92, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via javascript: URIs in the (1) request and (2) return_link_url parameters.
[20090512 FormMail 1.92 Multiple Vulnerabilities]
[34929]
[http://www.ush.it/team/ush/hack-formmail_192/adv.txt]
CRLF injection vulnerability in FormMail.pl in Matt Wright FormMail 1.92, and possibly earlier, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the redirect parameter.
[20090512 FormMail 1.92 Multiple Vulnerabilities]
[34929]
[http://www.ush.it/team/ush/hack-formmail_192/adv.txt]
SQL injection vulnerability in the new user registration feature in BigACE CMS 2.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.
[http://www.bigace.de/BIGACE-2.6.html]
[http://www.bigace.de/Security-Fix-for-2.5.html]
[20090512 User options changer (SQLi) EXPLOIT --Bigace CMS -stable release- 2.5-->]
[34920]
[8664]
PHP remote file inclusion vulnerability in admin.php in Frax.dk Php Recommend 1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the form_include_template parameter.
[34909]
[ADV-2009-1287]
[8658]
admin.php in Frax.dk Php Recommend 1.3 and earlier does not require authentication when the user password is changed, which allows remote attackers to gain administrative privileges via modified form_admin_user and form_admin_pass parameters.
[34909]
[ADV-2009-1287]
[8658]
Static code injection vulnerability in admin.php in Frax.dk Php Recommend 1.3 and earlier allows remote attackers to inject arbitrary PHP code into phpre_config.php via the form_aula parameter.
[34909]
[ADV-2009-1287]
[8658]
Multiple F-Secure anti-virus products, including Anti-Virus for Microsoft Exchange 7.10 and earlier; Internet Gatekeeper for Windows 6.61 and earlier, Windows 6.61 and earlier, and Linux 2.16 and earlier; Internet Security 2009 and earlier, Anti-Virus 2009 and earlier, Client Security 8.0 and earlier, and others; allow remote attackers to bypass malware detection via a crafted (1) ZIP and (2) RAR archive.
[http://www.f-secure.com/en_EMEA/support/security-advisory/fsc-2009-1.html]
[34849]
[1022170]
[1022171]
[1022172]
[ADV-2009-1262]
[fsecure-rar-zip-security-bypass(50346)]
Multiple FRISK Software F-Prot anti-virus products, including Antivirus for Exchange, Linux on IBM zSeries, Linux x86 File Servers, Linux x86 Mail Servers, Linux x86 Workstations, Solaris Mail Servers, Antivirus for Windows, and others, allow remote attackers to bypass malware detection via a crafted CAB archive.
[http://blog.zoller.lu/2009/04/advisory-f-prot-frisk-cab-bypass.html]
[20090509 [TZO-21-2009] Fprot CAB bypass / evasion]
[34896]
[fprot-cab-security-bypass(50427)]
The AVG parsing engine 8.5 323, as used in multiple AVG anti-virus products including Anti-Virus Network Edition, Internet Security Netzwerk Edition, Server Edition f?r Linux/FreeBSD, Anti-Virus SBS Edition, and others allows remote attackers to bypass malware detection via a crafted (1) RAR and (2) ZIP archive.
[http://blog.zoller.lu/2009/04/avg-zip-evasion-bypass.html]
[20090509 [TZO-20-2009] AVG ZIP evasion / bypass]
[34895]
[avg-zip-security-bypass(50426)]
Cross-site scripting (XSS) vulnerability in Ulteo Open Virtual Desktop 1.0 allows remote attackers to inject arbitrary web script or HTML via the error parameter to header.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[http://www.ulteo.com/home/en/ovdi/openvirtualdesktop/downloadnow?autolang=en]
The malloc subsystem in libc in IBM AIX 5.3 and 6.1 allows local users to create or overwrite arbitrary files via a symlink attack on the log file associated with the MALLOCDEBUG environment variable.
[http://aix.software.ibm.com/aix/efixes/security/libc_advisory.asc]
[20090520 IBM AIX libc MALLOCDEBUG File Overwrite Vulnerability]
[1022261]
[IZ50121]
[IZ50129]
[IZ50139]
[IZ50445]
[IZ50447]
[IZ50500]
[IZ50517]
[35034]
[ADV-2009-1380]
[aix-mallocdebug-privilege-escalation(50636)]
[oval:org.mitre.oval:def:6276]
[9306]
Multiple SQL injection vulnerabilities in PHP Dir Submit (aka WebsiteSubmitter and Submitter Script) allow remote attackers to bypass authentication and gain administrative access via the (1) username and (2) password parameters.
[35003]
[ADV-2009-1365]
[8710]
Heap-based buffer overflow in voc_read_header in libsndfile 1.0.15 through 1.0.19, as used in Winamp 5.552 and possibly other media programs, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a VOC file with an invalid header value.
[GLSA-200905-09]
[http://trapkit.de/advisories/TKADV2009-006.txt]
[DSA-1814]
[MDVSA-2009:132]
[http://www.mega-nerd.com/erikd/Blog/CodeHacking/libsndfile/]
[http://www.mega-nerd.com/libsndfile/]
[34978]
[ADV-2009-1324]
[ADV-2009-1348]
[libsndfile-aiff-voc-bo(50541)]
[libsndfile-voc-bo(50827)]
mod/server.mod/servmsg.c in Eggheads Eggdrop and Windrop 1.6.19 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PRIVMSG that causes an empty string to trigger a negative string length copy. NOTE: this issue exists because of an incorrect fix for CVE-2007-2807.
[20090514 eggdrop/windrop remote crash vulnerability]
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=528778]
[http://cvs.eggheads.org/viewvc/viewvc.cgi/eggdrop1.6/doc/Changes1.6?revision=1.20&view=markup]
[DSA-1826]
[MDVSA-2009:126]
[20090515 eggdrop/windrop remote crash vulnerability]
[34985]
[ADV-2009-1340]
[eggdrop-servmsg-dos(50547)]
[8695]
[FEDORA-2009-5568]
[FEDORA-2009-5572]
Cross-site scripting (XSS) vulnerability in CGI RESCUE Trees before 2.11 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
[JVN#28521500]
[JVNDB-2009-000028]
[http://www.rescue.ne.jp/whatsnew/blog.cgi/permalink/20090512155247]
[34999]
[rescuetrees-unspecified-xss(50579)]
Heap-based buffer overflow in aiff_read_header in libsndfile 1.0.15 through 1.0.19, as used in Winamp 5.552 and possibly other media programs, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an AIFF file with an invalid header value.
[GLSA-200905-09]
[DSA-1814]
[MDVSA-2009:132]
[http://www.mega-nerd.com/erikd/Blog/CodeHacking/libsndfile/]
[http://www.mega-nerd.com/libsndfile/]
[34978]
[ADV-2009-1324]
[libsndfile-aiff-voc-bo(50541)]
The system.openURL function in StoneTrip Ston3D StandalonePlayer (aka S3DPlayer StandAlone) 1.6.2.4 and 1.7.0.1 and WebPlayer (aka S3DPlayer Web) 1.6.0.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the first argument (the sURL argument).
[http://www.coresecurity.com/content/StoneTrip-S3DPlayers]
[20090528 CORE-2009-0401 - StoneTrip S3DPlayers remote command injection]
[35105]
Cross-site scripting (XSS) vulnerability in Sun Java System Portal Server 6.3.1, 7.1, and 7.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to an error page.
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-118950-38-1]
[256588]
[35082]
[1022273]
[ADV-2009-1411]
[javasystem-portalserver-xss(50704)]
Multiple cross-site request forgery (CSRF) vulnerabilities on the Network Management Card (NMC) on American Power Conversion (APC) Switched Rack PDU (aka Rack Mount Power Distribution) devices and other devices allow remote attackers to hijack the authentication of (1) administrator or (2) device users for requests that create new administrative users or have unspecified other impact.
[http://holisticinfosec.org/content/view/111/45/]
[http://nam-en.apc.com/cgi-bin/nam_en.cfg/php/enduser/std_adp.php?p_faqid=10887]
[VU#166739]
Multiple cross-site scripting (XSS) vulnerabilities on the Network Management Card (NMC) on American Power Conversion (APC) Switched Rack PDU (aka Rack Mount Power Distribution) devices and other devices allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the login_username vector for Forms/login1 is already covered by CVE-2009-4406.
[http://holisticinfosec.org/content/view/111/45/]
[http://nam-en.apc.com/cgi-bin/nam_en.cfg/php/enduser/std_adp.php?p_faqid=10887]
[VU#166739]
Multiple SQL injection vulnerabilities in the getGalleryImage function in st_admin/gallery_output.php in ST-Gallery 0.1 alpha, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) gallery_category or (2) gallery_show parameter to example.php.
[20090507 SQL INJECTION VULNERABILITIES--ST-Gallery version 0.1 alpha]
[34875]
[stgallery-example-sql-injection(50378)]
[8636]
Stack-based buffer overflow in the Chinagames CGAgent ActiveX control 1.x in CGAgent.dll, as distributed in Chinagames iGame 2009, allows remote attackers to execute arbitrary code via a long argument to the CreateChinagames method, as exploited in the wild in April and May 2009. NOTE: some of these details are obtained from third party information.
[http://bbs.pediy.com/showthread.php?t=87615]
[http://downloads.securityfocus.com/vulnerabilities/exploits/34871.html]
[http://hi.baidu.com/wi4r/blog/item/8b1c06fb2e3de8819f514671.html]
[http://www.cisrt.org/enblog/read.php?245]
[34871]
Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to inject arbitrary web script or HTML via the (1) display parameter to reports.php, the (2) order and (3) extdisplay parameters to config.php, and the (4) sort parameter to recordings/index.php. NOTE: some of these details are obtained from third party information.
[http://freepbx.org/trac/ticket/3660]
[34857]
[freepbx-reports-xss(50361)]
Multiple cross-site request forgery (CSRF) vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to hijack the authentication of admins for requests that create a new admin account or have unspecified other impact.
[http://freepbx.org/trac/ticket/3660]
[34857]
FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, generates different error messages for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
[http://freepbx.org/trac/ticket/3660]
[34857]
Multiple SQL injection vulnerabilities in admin/index.php in VideoScript.us YouTube Video Script allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
[34868]
[videoscript-index-sql-injection(50373)]
[8635]
Unspecified vulnerability in the VMware Descheduled Time Accounting driver in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, VMware Server 1.x before 1.0.9 build 156507 and 2.x before 2.0.1 build 156745, VMware Fusion 2.x before 2.0.2 build 147997, VMware ESXi 3.5, and VMware ESX 3.0.2, 3.0.3, and 3.5, when the Descheduled Time Accounting Service is not running, allows guest OS users on Windows to cause a denial of service via unknown vectors.
[20090529 VMSA-2009-0007 VMware Hosted products and ESX and ESXi patches resolve security issues]
[35141]
[1022300]
[http://www.vmware.com/security/advisories/VMSA-2009-0007.html]
[ADV-2009-1452]
[oval:org.mitre.oval:def:6130]
Unspecified vulnerability in IBM Hardware Management Console (HMC) 7 release 3.4.0 SP2, when Active Memory Sharing is used, has unknown impact and attack vectors, related to a shared memory partition and a shared memory pool with redundant paging Virtual I/O Server (VIOS) partitions. NOTE: some of these details are obtained from third party information.
[35113]
[http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=4671]
[http://www-933.ibm.com/support/fixcentral/firmware/readme?fixid=MH01181]
[hmc-ams-unspecified(50910)]
Unspecified vulnerability in Config.dll in Baofeng products 3.09.04.17 and earlier allows remote attackers to execute arbitrary code by calling the SetAttributeValue method, as exploited in the wild in April and May 2009.
[http://www.cisrt.org/enblog/read.php?245]
[ADV-2009-1392]
Microsoft Windows XP SP3 allows local users to cause a denial of service (system crash) by making an SPI_SETDESKWALLPAPER SystemParametersInfo call with an improperly terminated pvParam argument, followed by an SPI_GETDESKWALLPAPER SystemParametersInfo call.
[http://www.ragestorm.net/blogs/?p=78]
[35120]
[1022330]
[win-spisetdeskwallpaper-dos(50903)]
Multiple cross-site scripting (XSS) vulnerabilities in myColex 1.4.2 allow remote attackers to inject arbitrary web script or HTML via (1) the year parameter to modules/kalender.php, (2) the Page parameter in a List action to modules/ereignis.php, (3) the Kontext parameter in a Search action to modules/kategorie.php, or (4) the image parameter to modules/image.php.
[34997]
[ADV-2009-1344]
[8707]
Multiple SQL injection vulnerabilities in myColex 1.4.2 allow remote attackers to execute arbitrary SQL commands via (1) the formUser parameter (aka the Name field) to common/login.php, and allow remote authenticated users to execute arbitrary SQL commands via the ID parameter in a Detail action to (2) kategorie.php, (3) medium.php, (4) person.php, or (5) schlagwort.php in modules/, related to classes/class.perform.php.
[http://www.collector.ch/drupal5/?q=node/39]
[34997]
[ADV-2009-1344]
[8707]
Multiple cross-site scripting (XSS) vulnerabilities in myGesuad 0.9.14 (aka 0.9) allow remote attackers to inject arbitrary web script or HTML via (1) the Page parameter in a List action to modules/ereignis.php, (2) the Kontext parameter in a Search action to modules/kategorie.php, (3) the image parameter to modules/image.php, or (4) the ID parameter in a Detail action to modules/sitzung.php.
[34998]
[ADV-2009-1345]
[8708]
Multiple SQL injection vulnerabilities in myGesuad 0.9.14 (aka 0.9) allow remote attackers to execute arbitrary SQL commands via (1) the formUser parameter (aka the Name field) to common/login.php, and allow remote authenticated users to execute arbitrary SQL commands via the ID parameter in a Detail action to (2) kategorie.php, (3) budget.php, (4) zahlung.php, or (5) adresse.php in modules/, related to classes/class.perform.php.
[http://www.collector.ch/drupal5/?q=node/39]
[34998]
[ADV-2009-1345]
[8708]
Multiple SQL injection vulnerabilities in admin/index.php in Submitter Script 2 allow remote attackers to execute arbitrary SQL commands via (1) the uNev parameter (aka the username field) or (2) the uJelszo parameter (aka the Password field).
[34970]
[ADV-2009-1327]
[submitterscript-index-sql-injection(50552)]
[8683]
SQL injection vulnerability in mail.php in PHPenpals 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter. NOTE: the profile.php vector is already covered by CVE-2006-0074.
[34996]
[ADV-2009-1342]
[8706]
Stack-based buffer overflow in Sonic Spot Audioactive Player 1.93b allows remote attackers to execute arbitrary code via a long string in a playlist file, as demonstrated by a long .mp3 URL in a .m3u file.
[34987]
[ADV-2009-1339]
[8698]
[8701]
SQL injection vulnerability in admin.php in My Game Script 2.0 allows remote attackers to execute arbitrary SQL commands via the user parameter (aka the username field). NOTE: some of these details are obtained from third party information.
[34963]
[mygamescript-admin-sql-injection(50528)]
[8676]
Multiple buffer overflows in DigiMode Maya 1.0.2 allow remote attackers to execute arbitrary code via a long string in a malformed (1) .m3u or (2) .m3l playlist file.
[34960]
[digimode-m3u-m3l-bo(50533)]
[8677]
SQL injection vulnerability in admin/admin_manager.asp in MaxCMS 2.0 allows remote attackers to execute arbitrary SQL commands via an m_username cookie in an add action.
[ADV-2009-1307]
[maxcms-musername-sql-injection(50513)]
[8672]
SQL injection vulnerability in product.php in 2daybiz Custom T-shirt Design Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
[34992]
[ADV-2009-1341]
[8702]
Cross-site scripting (XSS) vulnerability in product.php in 2daybiz Custom T-shirt Design Script allows remote attackers to inject arbitrary web script or HTML via the id parameter.
[34992]
[ADV-2009-1341]
[8702]
DMXReady Registration Manager 1.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for databases/webblogmanager.mdb.
[ADV-2009-1347]
[registrationmgr-webblogmgr-info-disclosure(50915)]
[8705]
Multiple PHP remote file inclusion vulnerabilities in the InterJoomla ArtForms (com_artforms) component 2.1b7 for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) imgcaptcha.php or (2) mp3captcha.php in assets/captcha/includes/captchaform/, or (3) assets/captcha/includes/captchatalk/swfmovie.php.
[34986]
[8697]
Cross-site scripting (XSS) vulnerability in the Print (aka Printer, e-mail and PDF versions) module 5.x before 5.x-4.7 and 6.x before 6.x-1.7, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML by modifying a document head, before the Content-Type META element, to contain crafted UTF-8 byte sequences that are treated as UTF-7 by Internet Explorer 6 and 7, a related issue to CVE-2009-1575.
[http://drupal.org/node/461674]
[34954]
[ADV-2009-1320]
[printeremailpdf-utf7-xss(50523)]
The ps_drv.sys kernel driver in ArcaBit ArcaVir 2009 Antivirus Protection 9.4.3201.9 and earlier, ArcaVir 2009 Internet Security 9.4.3202.9 and earlier, ArcaVir 2009 System Protection 9.4.3203.9 and earlier, and ArcaBit 2009 Home Protection 9.4.3204.9 and earlier, allows local users to gain privileges via crafted METHOD_NEITHER IOCTL requests to \Device\ps_drv containing arbitrary kernel addresses, as demonstrated using the (1) 0x2A7B802B and possibly (2) 0x2A7B8004 and (3) 0x2A7B802F IOCTLs.
[http://ntinternals.org/ntiadv0814/ntiadv0814.html]
[http://ntinternals.org/ntiadv0814/PsDrv_Exp.zip]
[35100]
[ADV-2009-1428]
[8782]
modules/admuser.php in myColex 1.4.2 does not require administrative authentication, which allows remote authenticated users to list user accounts via a Find action.
[http://www.collector.ch/drupal5/?q=node/39]
[ADV-2009-1344]
[8707]
modules/admuser.php in myGesuad 0.9.14 (aka 0.9) does not require administrative authentication, which allows remote authenticated users to list user accounts via a Find action.
[http://www.collector.ch/download/mygesuad-0.9.zip]
[http://www.collector.ch/drupal5/?q=node/39]
[ADV-2009-1345]
[8708]
The SVG component in Mozilla Firefox 3.0.4 allows remote attackers to cause a denial of service (application hang) via a large value in the r (aka Radius) attribute of a circle element, related to an "unclamped loop."
[20090527 Re: [Full-disclosure] [TZO-26-2009] Firefox (all?) Denial of Service through unclamped loop (SVG)]
[20090527 Re[2]: Addendum : [TZO-26-2009] Firefox (all?) Denial of Service through unclamped loop (SVG)]
[20090527 Re[2]: [Full-disclosure] [TZO-26-2009] Firefox (all?) Denial of Service through unclamped loop (SVG)]
[http://blog.zoller.lu/2009/04/advisory-firefox-dos-condition.html]
[20090526 [TZO-26-2009] Firefox (all?) Denial of Service through unclamped loop (SVG)]
[https://bugzilla.mozilla.org/show_bug.cgi?id=393832]
[https://bugzilla.mozilla.org/show_bug.cgi?id=465615]
[firefox-loop-dos(50721)]
[8794]
Mozilla Firefox 3.0.10 allows remote attackers to cause a denial of service (infinite loop, application hang, and memory consumption) via a KEYGEN element in conjunction with (1) a META element specifying automatic page refresh or (2) a JavaScript onLoad event handler for a BODY element. NOTE: it was later reported that earlier versions are also affected.
[20090527 [TZO-27-2009] Firefox Denial of Service (Keygen)]
[20090528 Re: [TZO-27-2009] Firefox Denial of Service (Keygen)]
[http://blog.zoller.lu/2009/04/advisory-firefox-denial-of-service.html]
[http://websecurity.com.ua/3194/]
[20090528 [TZO-27-2009] Firefox Denial of Service (Keygen)]
[20090908 Re: DoS vulnerability in Google Chrome]
[35132]
[https://bugzilla.mozilla.org/show_bug.cgi?id=469565]
[firefox-keygen-dos(50838)]
[oval:org.mitre.oval:def:5928]
[8822]
Unspecified vulnerability in the PCNFSD dissector in Wireshark 0.8.20 through 1.0.7 allows remote attackers to cause a denial of service (crash) via crafted PCNFSD packets.
[http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0095]
[DSA-1942]
[MDVSA-2009:125]
[RHSA-2009:1100]
[35081]
[1022274]
[ADV-2009-1408]
[http://www.wireshark.org/security/wnpa-sec-2009-03.html]
[wireshark-pcnfsd-dos(50686)]
[oval:org.mitre.oval:def:9270]
[FEDORA-2009-5339]
[FEDORA-2009-5382]
Stack-based buffer overflow in Soulseek 156 and 157 NS allows remote attackers to execute arbitrary code via a long search query.
[20090525 Soulseek * P2P Remote Distributed Search Code Execution]
[35091]
[ADV-2009-1427]
[8777]
[8804]
The Nullsoft Modern Skins Support module (gen_ff.dll) in Nullsoft Winamp before 5.552 allows remote attackers to execute arbitrary code via a crafted MAKI file, which triggers an incorrect sign extension, an integer overflow, and a stack-based buffer overflow.
[http://vrt-sourcefire.blogspot.com/2009/05/winamp-maki-parsing-vulnerability.html]
[35052]
[winamp-maki-overflow(50664)]
[oval:org.mitre.oval:def:15683]
[8767]
[8770]
[8772]
[8783]
Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors involving "double frame construction."
[1022376]
[SSA:2009-167-01]
[SSA:2009-176-01]
[265068]
[1020800]
[DSA-1820]
[DSA-1830]
[MDVSA-2009:141]
[http://www.mozilla.org/security/announce/2009/mfsa2009-24.html]
[35326]
[35371]
[1022397]
[SSA:2009-178-01]
[ADV-2009-1572]
[ADV-2009-2152]
[https://bugzilla.mozilla.org/show_bug.cgi?id=484031]
[https://bugzilla.redhat.com/show_bug.cgi?id=503569]
[oval:org.mitre.oval:def:10237]
[RHSA-2009:1095]
[FEDORA-2009-7567]
[FEDORA-2009-7614]
[FEDORA-2009-6366]
[FEDORA-2009-6411]
The JavaScript engine in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) js_LeaveSharpObject, (2) ParseXMLSource, and (3) a certain assertion in jsinterp.c; and other vectors.
[RHSA-2009:1096]
[1022376]
[SSA:2009-167-01]
[SSA:2009-176-01]
[265068]
[1020800]
[DSA-1820]
[MDVSA-2009:141]
[http://www.mozilla.org/security/announce/2009/mfsa2009-24.html]
[RHSA-2009:1125]
[RHSA-2009:1126]
[35326]
[35372]
[1022397]
[SSA:2009-178-01]
[USN-782-1]
[ADV-2009-1572]
[ADV-2009-2152]
[https://bugzilla.mozilla.org/show_bug.cgi?id=369696]
[https://bugzilla.mozilla.org/show_bug.cgi?id=426520]
[https://bugzilla.mozilla.org/show_bug.cgi?id=427196]
[https://bugzilla.mozilla.org/show_bug.cgi?id=487204]
[https://bugzilla.redhat.com/show_bug.cgi?id=503570]
[oval:org.mitre.oval:def:11487]
[RHSA-2009:1095]
[FEDORA-2009-6366]
[FEDORA-2009-6411]
Visual truncation vulnerability in netwerk/dns/src/nsIDNService.cpp in Mozilla Firefox before 3.0.11 and SeaMonkey before 1.1.17 allows remote attackers to spoof the location bar via an IDN with invalid Unicode characters that are displayed as whitespace, as demonstrated by the \u115A through \u115E characters.
[SSA:2009-167-01]
[264308]
[DSA-1820]
[http://www.mozilla.org/security/announce/2009/mfsa2009-25.html]
[35326]
[35388]
[ADV-2009-1572]
[https://bugzilla.mozilla.org/show_bug.cgi?id=479413]
[https://bugzilla.redhat.com/show_bug.cgi?id=503573]
[oval:org.mitre.oval:def:10436]
[RHSA-2009:1095]
[FEDORA-2009-6366]
[FEDORA-2009-6411]
Mozilla Firefox before 3.0.11 and SeaMonkey before 1.1.17 associate local documents with external domain names located after the file:// substring in a URL, which allows user-assisted remote attackers to read arbitrary cookies via a crafted HTML document, as demonstrated by a URL with file://example.com/C:/ at the beginning.
[RHSA-2009:1096]
[SSA:2009-167-01]
[SSA:2009-176-01]
[265068]
[1020800]
[DSA-1820]
[http://www.mozilla.org/security/announce/2009/mfsa2009-26.html]
[35326]
[35391]
[ADV-2009-1572]
[ADV-2009-2152]
[https://bugzilla.mozilla.org/show_bug.cgi?id=491801]
[https://bugzilla.redhat.com/show_bug.cgi?id=503576]
[oval:org.mitre.oval:def:9803]
[RHSA-2009:1095]
[FEDORA-2009-7567]
[FEDORA-2009-7614]
[FEDORA-2009-6366]
[FEDORA-2009-6411]
Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 use the HTTP Host header to determine the context of a document provided in a non-200 CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.
[http://research.microsoft.com/apps/pubs/default.aspx?id=79323]
[http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf]
[SSA:2009-167-01]
[SSA:2009-176-01]
[264308]
[DSA-1820]
[DSA-1830]
[MDVSA-2009:141]
[http://www.mozilla.org/security/announce/2009/mfsa2009-27.html]
[RHSA-2009:1126]
[35326]
[35380]
[1022396]
[SSA:2009-178-01]
[USN-782-1]
[ADV-2009-1572]
[https://bugzilla.mozilla.org/show_bug.cgi?id=479880]
[https://bugzilla.redhat.com/show_bug.cgi?id=503578]
[oval:org.mitre.oval:def:11764]
[RHSA-2009:1095]
[FEDORA-2009-7567]
[FEDORA-2009-7614]
[FEDORA-2009-6366]
[FEDORA-2009-6411]
Race condition in the NPObjWrapper_NewResolve function in modules/plugin/base/src/nsJSNPRuntime.cpp in xul.dll in Mozilla Firefox 3 before 3.0.11 might allow remote attackers to execute arbitrary code via a page transition during Java applet loading, related to a use-after-free vulnerability for memory associated with a destroyed Java object.
[SSA:2009-167-01]
[264308]
[DSA-1820]
[http://www.mozilla.org/security/announce/2009/mfsa2009-28.html]
[20090612 Secunia Research: Mozilla Firefox Java Applet Loading Vulnerability]
[35326]
[35360]
[1022386]
[ADV-2009-1572]
[https://bugzilla.mozilla.org/show_bug.cgi?id=486269]
[https://bugzilla.redhat.com/show_bug.cgi?id=503579]
[oval:org.mitre.oval:def:10628]
[RHSA-2009:1095]
[FEDORA-2009-6366]
[FEDORA-2009-6411]
The garbage-collection implementation in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 sets an element's owner document to null in unspecified circumstances, which allows remote attackers to execute arbitrary JavaScript with chrome privileges via a crafted event handler, related to an incorrect context for this event handler.
[RHSA-2009:1096]
[SSA:2009-167-01]
[SSA:2009-176-01]
[264308]
[DSA-1820]
[DSA-1830]
[MDVSA-2009:141]
[http://www.mozilla.org/security/announce/2009/mfsa2009-29.html]
[RHSA-2009:1125]
[RHSA-2009:1126]
[35326]
[35383]
[1022397]
[SSA:2009-178-01]
[USN-782-1]
[ADV-2009-1572]
[https://bugzilla.mozilla.org/show_bug.cgi?id=489131]
[https://bugzilla.redhat.com/show_bug.cgi?id=503580]
[oval:org.mitre.oval:def:11080]
[RHSA-2009:1095]
[FEDORA-2009-7567]
[FEDORA-2009-7614]
[FEDORA-2009-6366]
[FEDORA-2009-6411]
Mozilla Firefox 3 before 3.0.11 associates an incorrect principal with a file: URL loaded through the location bar, which allows user-assisted remote attackers to bypass intended access restrictions and read files via a crafted HTML document, aka a "file-URL-to-file-URL scripting" attack.
[SSA:2009-167-01]
[264308]
[DSA-1820]
[http://www.mozilla.org/security/announce/2009/mfsa2009-30.html]
[35326]
[35386]
[ADV-2009-1572]
[https://bugzilla.mozilla.org/show_bug.cgi?id=479943]
[https://bugzilla.redhat.com/show_bug.cgi?id=503581]
[oval:org.mitre.oval:def:9256]
[RHSA-2009:1095]
[FEDORA-2009-6366]
[FEDORA-2009-6411]
Mozilla Firefox before 3.0.11, Thunderbird, and SeaMonkey do not check content policy before loading a script file into a XUL document, which allows remote attackers to bypass intended access restrictions via a crafted HTML document, as demonstrated by a "web bug" in an e-mail message, or web script or an advertisement in a web page.
[SSA:2009-167-01]
[264308]
[DSA-1820]
[MDVSA-2009:141]
[http://www.mozilla.org/security/announce/2009/mfsa2009-31.html]
[35326]
[1022379]
[ADV-2009-1572]
[https://bugzilla.mozilla.org/show_bug.cgi?id=477979]
[https://bugzilla.redhat.com/show_bug.cgi?id=503582]
[firefox-xul-security-bypass(51076)]
[oval:org.mitre.oval:def:9448]
[RHSA-2009:1095]
[FEDORA-2009-6366]
[FEDORA-2009-6411]
js/src/xpconnect/src/xpcwrappedjsclass.cpp in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to execute arbitrary web script with the privileges of a chrome object, as demonstrated by the browser sidebar and the FeedWriter.
[RHSA-2009:1096]
[SSA:2009-167-01]
[SSA:2009-176-01]
[264308]
[DSA-1820]
[DSA-1830]
[MDVSA-2009:141]
[http://www.mozilla.org/security/announce/2009/mfsa2009-32.html]
[35326]
[35373]
[1022397]
[SSA:2009-178-01]
[USN-782-1]
[ADV-2009-1572]
[https://bugzilla.mozilla.org/show_bug.cgi?id=479560]
[https://bugzilla.redhat.com/show_bug.cgi?id=503583]
[oval:org.mitre.oval:def:9815]
[RHSA-2009:1095]
[FEDORA-2009-7567]
[FEDORA-2009-7614]
[FEDORA-2009-6366]
[FEDORA-2009-6411]
SQL injection vulnerability in main/tracking/userLog.php in Francisco Burzi PHP-Nuke 8.0 allows remote attackers to execute arbitrary SQL commands via the HTTP Referer header.
[http://gsasec.blogspot.com/2009/05/php-nuke-v80-referer-sql-injection.html]
[35117]
[phpnuke-userlog-sql-injection(50818)]
Multiple SQL injection vulnerabilities in Flash Quiz Beta 2 allow remote attackers to execute arbitrary SQL commands via the (1) quiz parameter to (a) num_questions.php, (b) answers.php, (c) high_score.php, (d) high_score_web.php, (e) results_table_web.php, and (f) question.php; and the (2) order_number parameter to (g) answers.php and (h) question.php.
[20090521 MULTIPLE SQL INJECTION VULNERABILITIES --Flash Quiz Beta 2-->]
[35060]
[flashquiz-quiz-sql-injection(50668)]
Multiple cross-site scripting (XSS) vulnerabilities in Drupal 5.x before 5.18 and 6.x before 6.12 allow (1) remote authenticated users to inject arbitrary web script or HTML via crafted UTF-8 byte sequences that are treated as UTF-7 by Internet Explorer 6 and 7, which are not properly handled in the "HTML exports of books" feature; and (2) allow remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML via the help text of an arbitrary vocabulary. NOTE: vector 1 exists because of an incomplete fix for CVE-2009-1575.
[http://drupal.org/node/461886]
[DSA-1808]
Cross-site scripting (XSS) vulnerability in ajax/updatecheck.php in Lussumo Vanilla 1.1.5 and 1.1.7 allows remote attackers to inject arbitrary web script or HTML via the RequestName parameter.
[http://gsasec.blogspot.com/2009/05/vanilla-v117-cross-site-scripting.html]
[http://lussumo.com/community/discussion/9524/vanilla-118-released/#Item_0]
[20090527 Vanilla v.1.1.7 Cross-Site Scripting]
Multiple directory traversal vulnerabilities in SiteX 0.7.4 Build 418 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the THEME_FOLDER parameter to (1) Corporate/homepage.php, (2) Fusion/homepage.php, (3) Joombo/homepage.php, (4) Streamline/homepage.php, and (5) Structure/homepage.php in themes/.
[35122]
[8816]
Directory traversal vulnerability in index.php in Easy PX 41 CMS 9.0 B1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the fiche parameter.
[35119]
[8815]
SQL injection vulnerability in the JoomlaMe AgoraGroups (aka AG or com_agoragroup) component 0.3.5.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a groupdetail action to index.php.
[35118]
[8814]
Cross-site scripting (XSS) vulnerability in the Monitor_Bandwidth function in PRTG Traffic Grapher 6.2.2.977 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://blog.bkis.com/?p=704]
[http://www.paessler.com/support/kb/questions/prtg6history]
[35128]
SQL injection vulnerability in index.php in phpBugTracker 1.0.3 allows remote attackers to execute arbitrary SQL commands via the password parameter.
[35101]
[phpbugtracker-password-sql-injection(50752)]
[8808]
SQL injection vulnerability in include.php in phpBugTracker 1.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[35125]
[ADV-2009-1432]
Multiple SQL injection vulnerabilities in Graphiks MyForum 1.3 allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields.
[35096]
[myforum-username-sql-injection(50749)]
[8803]
Multiple SQL injection vulnerabilities in index.php in Kensei Board 2.0 BETA (aka 2.0.0b) and earlier allow remote attackers to execute arbitrary SQL commands via the (1) f and (2) t parameters in a showforum action.
[kensei-index-sql-injection(50747)]
[8802]
Million Dollar Text Links 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the userid cookie to 1.
[8813]
Stack-based buffer overflow in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow attackers to execute arbitrary code via a PDF file containing a malformed U3D model file with a crafted extension block.
[SUSE-SA:2009:035]
[SUSE-SR:2009:012]
[GLSA-200907-06]
[1022361]
[http://www.adobe.com/support/security/bulletins/apsb09-07.html]
[RHSA-2009:1109]
[20090610 ZDI-09-042: Adobe Reader U3D RHAdobeMeta Stack Overflow Vulnerability]
[35274]
[35282]
[TA09-161A]
[ADV-2009-1547]
[http://www.zerodayinitiative.com/advisories/ZDI-09-042]
Integer overflow in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 allows attackers to cause a denial of service or possibly execute arbitrary code via a PDF file containing unspecified parameters to the FlateDecode filter, which triggers a heap-based buffer overflow.
[20090609 Adobe Reader and Acrobat FlateDecode Integer Overflow Vulnerability]
[SUSE-SA:2009:035]
[SUSE-SR:2009:012]
[GLSA-200907-06]
[1022361]
[http://www.adobe.com/support/security/bulletins/apsb09-07.html]
[RHSA-2009:1109]
[35274]
[35294]
[TA09-161A]
[ADV-2009-1547]
[acrobat-reader-unspecified-overflow(51021)]
Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 allow attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a PDF document with a crafted TrueType font.
[SUSE-SA:2009:035]
[SUSE-SR:2009:012]
[GLSA-200907-06]
[1022361]
[http://www.adobe.com/support/security/bulletins/apsb09-07.html]
[http://www.fortiguardcenter.com/advisory/FGA-2009-25.html]
[RHSA-2009:1109]
[20090611 FortiGuard Advisory: Adobe Reader/Acrobat TrueType Font Processing Memory Corruption Vulnerability]
[35274]
[35296]
[TA09-161A]
[ADV-2009-1547]
The JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors that trigger memory corruption.
[SUSE-SA:2009:035]
[SUSE-SR:2009:012]
[GLSA-200907-06]
[1022361]
[http://www.adobe.com/support/security/bulletins/apsb09-07.html]
[RHSA-2009:1109]
[35274]
[35298]
[TA09-161A]
[ADV-2009-1547]
[acrobat-reader-jbig2-code-execution(51016)]
Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow attackers to execute arbitrary code via unspecified vectors that trigger memory corruption.
[SUSE-SA:2009:035]
[SUSE-SR:2009:012]
[GLSA-200907-06]
[1022361]
[http://www.adobe.com/support/security/bulletins/apsb09-07.html]
[RHSA-2009:1109]
[35274]
[35289]
[TA09-161A]
[ADV-2009-1547]
Unspecified vulnerability in Adobe Shockwave Player before 11.5.0.600 allows remote attackers to execute arbitrary code via crafted Shockwave Player 10 content.
[http://www.adobe.com/support/security/bulletins/apsb09-08.html]
[35469]
[1022440]
Multiple heap-based buffer overflows in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF file with a JPX (aka JPEG2000) stream that triggers heap memory corruption.
[SUSE-SA:2009:035]
[SUSE-SR:2009:012]
[GLSA-200907-06]
[1022361]
[http://www.adobe.com/support/security/bulletins/apsb09-07.html]
[VU#568153]
[RHSA-2009:1109]
[35274]
[35295]
[TA09-161A]
[ADV-2009-1547]
Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (1) a crafted Flash application in a .pdf file or (2) a crafted .swf file, related to authplay.dll, as exploited in the wild in July 2009.
Per: http://www.kb.cert.org/vuls/id/259425
"Adobe Flash is a widely deployed multimedia platform typically used to provide content in web sites. Adobe Flash Player, Reader, Acrobat, and other Adobe products include Flash support.
Adobe Flash Player contains a code execution vulnerability. An attacker may be able to trigger this vulnerability by convincing a user to open a specially crafted Flash (SWF) file. The SWF file could be hosted or embedded in a web page or contained in a Portable Document Format (PDF) file. If an attacker can take control of a website or web server, trusted sites may exploit this vulnerability.
This vulnerability affects Adobe Flash versions 9.0.159.0 and 10.0.22.87 and earlier 9.x and 10.x versions. Adobe Reader 9, Acrobat 9, and other Adobe products (including Photoshop CS3, PhotoShop Lightroom, Freehand MX, Fireworks) provide Flash support independent of Flash Player. As of 2009-07-22, Adobe Reader 9.1.2 includes Flash 9.0.155.0, which is likely vulnerable to issues addressed by Flash 9.0.159.0"
[http://blogs.adobe.com/psirt/2009/07/potential_adobe_reader_and_fla.html]
[http://bugs.adobe.com/jira/browse/FP-1265]
[http://isc.sans.org/diary.html?storyid=6847]
[APPLE-SA-2009-09-10-1]
[APPLE-SA-2009-09-10-2]
[http://news.cnet.com/8301-27080_3-10293389-245.html]
[GLSA-200908-04]
[266108]
[http://support.apple.com/kb/HT3864]
[http://support.apple.com/kb/HT3865]
[http://www.adobe.com/support/security/advisories/apsa09-03.html]
[http://www.adobe.com/support/security/bulletins/apsb09-10.html]
[http://www.adobe.com/support/security/bulletins/apsb09-13.html]
[VU#259425]
[35759]
[http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-072209-2512-99]
[http://www.symantec.com/connect/blogs/next-generation-flash-vulnerability]
Unspecified vulnerability in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors, related to a "privilege escalation vulnerability."
[APPLE-SA-2009-09-10-1]
[APPLE-SA-2009-09-10-2]
[GLSA-200908-04]
[266108]
[http://support.apple.com/kb/HT3864]
[http://support.apple.com/kb/HT3865]
[http://www.adobe.com/support/security/bulletins/apsb09-10.html]
[http://www.adobe.com/support/security/bulletins/apsb09-13.html]
[35890]
[35900]
[1022629]
[ADV-2009-2086]
[adobe-flash-air-code-execution(52179)]
[oval:org.mitre.oval:def:16391]
[oval:org.mitre.oval:def:6961]
Heap-based buffer overflow in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors.
[APPLE-SA-2009-09-10-1]
[APPLE-SA-2009-09-10-2]
[GLSA-200908-04]
[266108]
[http://support.apple.com/kb/HT3864]
[http://support.apple.com/kb/HT3865]
[http://www.adobe.com/support/security/bulletins/apsb09-10.html]
[http://www.adobe.com/support/security/bulletins/apsb09-13.html]
[35890]
[35904]
[1022629]
[ADV-2009-2086]
[flash-air-unspecified-bo(52184)]
[oval:org.mitre.oval:def:16133]
[oval:org.mitre.oval:def:6660]
Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, related to a "null pointer vulnerability."
[APPLE-SA-2009-09-10-1]
[APPLE-SA-2009-09-10-2]
[GLSA-200908-04]
[266108]
[http://support.apple.com/kb/HT3864]
[http://support.apple.com/kb/HT3865]
[http://www.adobe.com/support/security/bulletins/apsb09-10.html]
[http://www.adobe.com/support/security/bulletins/apsb09-13.html]
[35890]
[35906]
[1022629]
[ADV-2009-2086]
[flash-air-code-execution-var1(52182)]
[oval:org.mitre.oval:def:16338]
[oval:org.mitre.oval:def:7011]
Stack-based buffer overflow in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors.
[APPLE-SA-2009-09-10-1]
[APPLE-SA-2009-09-10-2]
[GLSA-200908-04]
[266108]
[http://support.apple.com/kb/HT3864]
[http://support.apple.com/kb/HT3865]
[http://www.adobe.com/support/security/bulletins/apsb09-10.html]
[http://www.adobe.com/support/security/bulletins/apsb09-13.html]
[35890]
[35901]
[1022629]
[ADV-2009-2086]
[flash-air-unspecified-bo-var2(52186)]
[oval:org.mitre.oval:def:16198]
[oval:org.mitre.oval:def:7271]
Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to trick a user into (1) selecting a link or (2) completing a dialog, related to a "clickjacking vulnerability."
[APPLE-SA-2009-09-10-1]
[APPLE-SA-2009-09-10-2]
[GLSA-200908-04]
[266108]
[http://support.apple.com/kb/HT3864]
[http://support.apple.com/kb/HT3865]
[http://www.adobe.com/support/security/bulletins/apsb09-10.html]
[http://www.adobe.com/support/security/bulletins/apsb09-13.html]
[35890]
[35905]
[1022629]
[ADV-2009-2086]
[flash-air-unspecified-clickjacking(52183)]
[oval:org.mitre.oval:def:15430]
[oval:org.mitre.oval:def:6694]
Heap-based buffer overflow in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors involving URL parsing.
[APPLE-SA-2009-09-10-1]
[APPLE-SA-2009-09-10-2]
[GLSA-200908-04]
[266108]
[http://support.apple.com/kb/HT3864]
[http://support.apple.com/kb/HT3865]
[http://www.adobe.com/support/security/bulletins/apsb09-10.html]
[http://www.adobe.com/support/security/bulletins/apsb09-13.html]
[35890]
[35902]
[1022629]
[ADV-2009-2086]
[flash-air-unspecified-bo-var1(52185)]
[oval:org.mitre.oval:def:15955]
[oval:org.mitre.oval:def:6865]
Integer overflow in the ActionScript Virtual Machine 2 (AVM2) abcFile parser in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an AVM2 file with a large intrf_count value that triggers a dereference of an out-of-bounds pointer.
[APPLE-SA-2009-09-10-1]
[APPLE-SA-2009-09-10-2]
[http://roeehay.blogspot.com/2009/08/advisory-adobe-flash-player-avm2.html]
[http://roeehay.blogspot.com/2009/08/exploitation-of-cve-2009-1869.html]
[GLSA-200908-04]
[266108]
[http://support.apple.com/kb/HT3864]
[http://support.apple.com/kb/HT3865]
[http://www.adobe.com/support/security/bulletins/apsb09-10.html]
[http://www.adobe.com/support/security/bulletins/apsb09-13.html]
[20090802 Advisory: Adobe Flash Player and AIR AVM2 intf_count Integer Overflow Remote Code Execution (CVE-2009-1869)]
[35890]
[35907]
[1022629]
[ADV-2009-2086]
[flash-air-code-execution(52181)]
[oval:org.mitre.oval:def:15994]
[oval:org.mitre.oval:def:6998]
Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to obtain sensitive information via vectors involving saving an SWF file to a hard drive, related to a "local sandbox vulnerability."
[APPLE-SA-2009-09-10-1]
[APPLE-SA-2009-09-10-2]
[GLSA-200908-04]
[266108]
[http://support.apple.com/kb/HT3864]
[http://support.apple.com/kb/HT3865]
[http://www.adobe.com/support/security/bulletins/apsb09-10.html]
[http://www.adobe.com/support/security/bulletins/apsb09-13.html]
[35890]
[35908]
[1022629]
[ADV-2009-2086]
[flash-air-sandbox-info-disclosure(52180)]
[oval:org.mitre.oval:def:15887]
[oval:org.mitre.oval:def:6648]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2009. Notes: none.
Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion Server 8.0.1, 8, and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the startRow parameter to administrator/logviewer/searchlog.cfm, or the query string to (2) wizards/common/_logintowizard.cfm, (3) wizards/common/_authenticatewizarduser.cfm, or (4) administrator/enter.cfm.
[http://www.adobe.com/support/security/bulletins/apsb09-12.html]
[http://www.dsecrg.com/pages/vul/show.php?id=122]
[20090817 [DSECRG-09-022] Adobe Coldfusion 8 Multiple Linked XSS Vulnerabilies]
Directory traversal vulnerability in logging/logviewer.jsp in the Management Console in Adobe JRun Application Server 4 Updater 7 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the logfile parameter.
[http://www.adobe.com/support/security/bulletins/apsb09-12.html]
[http://www.dsecrg.com/pages/vul/show.php?id=152]
[20090817 [DSECRG-09-052] Adobe JRun 4 Directory Traversal Vulnerabilities]
[9443]
Multiple cross-site scripting (XSS) vulnerabilities in the Management Console in Adobe JRun 4.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://www.adobe.com/support/security/bulletins/apsb09-12.html]
[http://www.dsecrg.com/pages/vul/show.php?id=151]
[20090817 [DSECRG-09-051] Adobe JRun 4 Multiple XSS]
Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion 8.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2009-1877.
[http://www.adobe.com/support/security/bulletins/apsb09-12.html]
Adobe ColdFusion 8.0.1 and earlier might allow attackers to obtain sensitive information via unspecified vectors, related to a "double-encoded null character vulnerability."
[http://www.adobe.com/support/security/bulletins/apsb09-12.html]
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 8.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2009-1875.
[http://www.adobe.com/support/security/bulletins/apsb09-12.html]
Session fixation vulnerability in Adobe ColdFusion 8.0.1 and earlier allows remote attackers to hijack web sessions via unspecified vectors.
[http://www.adobe.com/support/security/bulletins/apsb09-12.html]
Cross-site scripting (XSS) vulnerability in index.template.html in the express-install templates in the SDK in Adobe Flex before 3.4, when the installed Flash version is older than a specified requiredMajorVersion value, allows remote attackers to inject arbitrary web script or HTML via the query string.
[1022748]
[http://www.adobe.com/support/security/bulletins/apsb09-13.html]
[http://www.gdssecurity.com/l/b/2009/08/20/adobe-flex-3-3-sdk-dom-based-xss/]
[20090819 Adobe Flex 3.3 SDK DOM-Based XSS]
[flex-indextemplate-xss(52608)]
Cross-site scripting (XSS) vulnerability in MT312 REP-BBS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) model.php and (2) config.php with timestamps before 20090521.
[JVN#01115659]
[JVNDB-2009-000033]
Cross-site scripting (XSS) vulnerability in MT312 IMG-BBS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to model.php with a timestamp before 20090521.
[JVN#70836284]
[JVNDB-2009-000034]
Integer overflow in the XMakeImage function in magick/xwindow.c in ImageMagick 6.5.2-8, and GraphicsMagick, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF file, which triggers a buffer overflow. NOTE: some of these details are obtained from third party information.
[http://imagemagick.org/script/changelog.php]
[FEDORA-2010-0036]
[FEDORA-2010-0001]
[SUSE-SR:2009:012]
[http://mirror1.smudge-it.co.uk/imagemagick/www/changelog.html]
[GLSA-201311-10]
[http://wiki.rpath.com/Advisories:rPSA-2010-0074]
[DSA-1858]
[[oss-security] 20090608 Re: CVE Request -- ImageMagick -- Integer overflow in XMakeImage()]
[20101027 rPSA-2010-0074-1 ImageMagick]
[35111]
[ADV-2009-1449]
[USN-784-1]
The z90crypt_unlocked_ioctl function in the z90crypt driver in the Linux kernel 2.6.9 does not perform a capability check for the Z90QUIESCE operation, which allows local users to leverage euid 0 privileges to force a driver outage.
[SUSE-SA:2010:013]
[[oss-security] 20090915 CVE-2009-1883 kernel: missing capability check in z90crypt]
[[oss-security] 20090915 Re: CVE-2009-1883 kernel: missing capability check in z90crypt]
[RHSA-2009:1438]
[USN-852-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=505983]
[oval:org.mitre.oval:def:9513]
Off-by-one error in the bzinflate function in Bzip2.xs in the Compress-Raw-Bzip2 module before 2.018 for Perl allows context-dependent attackers to cause a denial of service (application hang or crash) via a crafted bzip2 compressed stream that triggers a buffer overflow, a related issue to CVE-2009-1391.
[GLSA-200908-07]
[36082]
[https://bugs.gentoo.org/show_bug.cgi?id=281955]
[https://bugzilla.redhat.com/show_bug.cgi?id=518278]
[compressrawbzip2-bzinflate-dos(52628)]
[FEDORA-2009-8868]
[FEDORA-2009-8888]
Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrated by the Codenomicon XML fuzzing framework.
[http://svn.apache.org/viewvc/xerces/c/trunk/src/xercesc/validators/DTD/DTDScanner.cpp?r1=781488&r2=781487&pathrev=781488&view=patch]
[http://svn.apache.org/viewvc?view=rev&revision=781488]
[http://www.cert.fi/en/reports/2009/vulnerability2009085.html]
[http://www.codenomicon.com/labs/xml/]
[MDVSA-2009:223]
[http://www.networkworld.com/columnists/2009/080509-xml-flaw.html]
[35986]
[ADV-2009-2196]
[https://bugzilla.redhat.com/show_bug.cgi?id=515515]
[xerces-c-dtd-dos(52321)]
[FEDORA-2009-8305]
[FEDORA-2009-8350]
[FEDORA-2009-8345]
[FEDORA-2009-8332]
Multiple format string vulnerabilities in client/client.c in smbclient in Samba 3.2.0 through 3.2.12 might allow context-dependent attackers to execute arbitrary code via format string specifiers in a filename.
[DSA-1823]
[MDVSA-2009:196]
[http://www.samba.org/samba/ftp/patches/security/samba-3.2.12-CVE-2009-1886.patch]
[http://www.samba.org/samba/security/CVE-2009-1886.html]
[35472]
[1022441]
[SSA:2009-177-01]
[USN-839-1]
[ADV-2009-1664]
[samba-smbclient-format-string(51328)]
agent/snmp_agent.c in snmpd in net-snmp 5.0.9 in Red Hat Enterprise Linux (RHEL) 3 allows remote attackers to cause a denial of service (daemon crash) via a crafted SNMP GETBULK request that triggers a divide-by-zero error. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-4309.
[MDVSA-2009:156]
[RHSA-2009:1124]
[https://bugzilla.redhat.com/show_bug.cgi?id=506903]
[oval:org.mitre.oval:def:8426]
[oval:org.mitre.oval:def:9716]
The acl_group_override function in smbd/posix_acls.c in smbd in Samba 3.0.x before 3.0.35, 3.1.x and 3.2.x before 3.2.13, and 3.3.x before 3.3.6, when dos filemode is enabled, allows remote attackers to modify access control lists for files via vectors related to read access to uninitialized memory.
[http://wiki.rpath.com/Advisories:rPSA-2009-0145]
[DSA-1823]
[MDVSA-2009:196]
[http://www.samba.org/samba/ftp/patches/security/samba-3.0.34-CVE-2009-1888.patch]
[http://www.samba.org/samba/ftp/patches/security/samba-3.2.12-CVE-2009-1888.patch]
[http://www.samba.org/samba/ftp/patches/security/samba-3.3.5-CVE-2009-1888.patch]
[http://www.samba.org/samba/security/CVE-2009-1888.html]
[20091112 rPSA-2009-0145-1 samba samba-client samba-server samba-swat]
[35472]
[1022442]
[SSA:2009-177-01]
[USN-839-1]
[ADV-2009-1664]
[samba-acl-security-bypass(51327)]
[oval:org.mitre.oval:def:10790]
[oval:org.mitre.oval:def:7292]
The OSCAR protocol implementation in Pidgin before 2.5.8 misinterprets the ICQWebMessage message type as the ICQSMS message type, which allows remote attackers to cause a denial of service (application crash) via a crafted ICQ web message that triggers allocation of a large amount of memory.
[http://developer.pidgin.im/ticket/9483]
[[devel] 20090528 [patch] libpurple/protocols/oscar: OOM and die on misparsed ICQWebMessage as ICQSMS]
[RHSA-2009:1139]
[35530]
[USN-796-1]
[ADV-2009-1749]
[https://bugzilla.redhat.com/show_bug.cgi?id=508738]
[pidgin-oscar-dos(51448)]
[oval:org.mitre.oval:def:10004]
[FEDORA-2009-7359]
[FEDORA-2009-7370]
[FEDORA-2009-7415]
The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.
[APPLE-SA-2009-11-09-1]
[SUSE-SA:2009:050]
[HPSBUX02612]
[GLSA-200907-04]
[http://support.apple.com/kb/HT3937]
[http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?r1=790587&r2=790586&pathrev=790587]
[http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?revision=790587]
[http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=790587&r2=790586&pathrev=790587]
[http://svn.apache.org/viewvc?view=rev&revision=790587]
[http://wiki.rpath.com/Advisories:rPSA-2009-0142]
[DSA-1834]
[MDVSA-2009:149]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
[RHSA-2009:1156]
[20091112 rPSA-2009-0142-1 httpd mod_ssl]
[20091113 rPSA-2009-0142-2 httpd mod_ssl]
[35565]
[1022509]
[USN-802-1]
[ADV-2009-3184]
[PK91259]
[PK99480]
[[httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[[httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[oval:org.mitre.oval:def:12330]
[oval:org.mitre.oval:def:8616]
[oval:org.mitre.oval:def:9403]
[RHSA-2009:1148]
[FEDORA-2009-8812]
The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534712]
[APPLE-SA-2009-11-09-1]
[SUSE-SA:2009:050]
[[apache-httpd-dev] 20090628 mod_deflate DoS]
[[apache-httpd-dev] 20090703 Re: mod_deflate DoS]
[HPSBUX02612]
[SSRT090208]
[GLSA-200907-04]
[http://support.apple.com/kb/HT3937]
[http://wiki.rpath.com/Advisories:rPSA-2009-0142]
[http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0142]
[DSA-1834]
[MDVSA-2009:149]
[RHSA-2009:1156]
[20091113 rPSA-2009-0142-2 httpd mod_ssl]
[1022529]
[USN-802-1]
[ADV-2009-1841]
[ADV-2009-3184]
[PK91361]
[PK99480]
[https://bugzilla.redhat.com/show_bug.cgi?id=509125]
[[httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[[httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[oval:org.mitre.oval:def:12361]
[oval:org.mitre.oval:def:8632]
[oval:org.mitre.oval:def:9248]
[RHSA-2009:1148]
[FEDORA-2009-8812]
dhcpd in ISC DHCP 3.0.4 and 3.1.1, when the dhcp-client-identifier and hardware ethernet configuration settings are both used, allows remote attackers to cause a denial of service (daemon crash) via unspecified requests.
[DSA-1833]
[MDVSA-2009:154]
[35669]
[dhcp-dhcp-dos(51717)]
[FEDORA-2009-8344]
[FEDORA-2009-9075]
The configtest function in the Red Hat dhcpd init script for DHCP 3.0.1 in Red Hat Enterprise Linux (RHEL) 3 allows local users to overwrite arbitrary files via a symlink attack on an unspecified temporary file, related to the "dhcpd -t" command.
[1022554]
[RHSA-2009:1154]
[35670]
[https://bugzilla.redhat.com/show_bug.cgi?id=510024]
[dhcp-dhcpdt-symlink(51718)]
[oval:org.mitre.oval:def:11597]
[oval:org.mitre.oval:def:6440]
Race condition in PulseAudio 0.9.9, 0.9.10, and 0.9.14 allows local users to gain privileges via vectors involving creation of a hard link, related to the application setting LD_BIND_NOW to 1, and then calling execv on the target of the /proc/self/exe symlink.
[http://blog.cr0.org/2009/07/old-school-local-root-vulnerability-in.html]
[GLSA-200907-13]
[http://taviso.decsystem.org/research.html]
[http://www.akitasecurity.nl/advisory.php?id=AK20090602]
[DSA-1838]
[MDVSA-2009:152]
[MDVSA-2009:171]
[20090717 PulseAudio local race condition privilege escalation vulnerability]
[35721]
[USN-804-1]
[https://admin.fedoraproject.org/updates/pulseaudio-0.9.10-1.el5.2]
[https://bugzilla.redhat.com/show_bug.cgi?id=510071]
[pulseaudio-suid-privilege-escalation(51804)]
The personality subsystem in the Linux kernel before 2.6.31-rc3 has a PER_CLEAR_ON_SETID setting that does not clear the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags when executing a setuid or setgid program, which makes it easier for local users to leverage the details of memory usage to (1) conduct NULL pointer dereference attacks, (2) bypass the mmap_min_addr protection mechanism, or (3) defeat address space layout randomization (ASLR).
[http://blog.cr0.org/2009/06/bypassing-linux-null-pointer.html]
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f9fabcb58a6d26d6efde842d1703ac7cfa9427b6]
[http://patchwork.kernel.org/patch/32598/]
[http://wiki.rpath.com/Advisories:rPSA-2009-0111]
[DSA-1844]
[DSA-1845]
[http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc3]
[MDVSA-2011:051]
[RHSA-2009:1193]
[RHSA-2009:1438]
[20090724 rPSA-2009-0111-1 kernel]
[20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components]
[20100625 VMSA-2010-0010 ESX 3.5 third party update for Service Console kernel]
[35647]
[USN-807-1]
[http://www.vmware.com/security/advisories/VMSA-2009-0016.html]
[ADV-2009-1866]
[ADV-2009-3316]
[https://bugs.launchpad.net/bugs/cve/2009-1895]
[oval:org.mitre.oval:def:11768]
[oval:org.mitre.oval:def:7826]
[oval:org.mitre.oval:def:9453]
[RHSA-2009:1540]
[RHSA-2009:1550]
[FEDORA-2009-8264]
[FEDORA-2009-8144]
The Java Web Start framework in IcedTea in OpenJDK before 1.6.0.0-20.b16.fc10 on Fedora 10, and before 1.6.0.0-27.b16.fc11 on Fedora 11, trusts an entire application when at least one of the listed jar files is trusted, which allows context-dependent attackers to execute arbitrary code without the untrusted-code restrictions via a crafted application, related to NetX.
[MDVSA-2009:209]
[https://bugzilla.redhat.com/show_bug.cgi?id=512101]
[FEDORA-2009-8329]
[FEDORA-2009-8337]
The tun_chr_poll function in drivers/net/tun.c in the tun subsystem in the Linux kernel 2.6.30 and 2.6.30.1, when the -fno-delete-null-pointer-checks gcc option is omitted, allows local users to gain privileges via vectors involving a NULL pointer dereference and an mmap of /dev/net/tun, a different vulnerability than CVE-2009-1894.
[20090716 Linux 2.6.30+/SELinux/RHEL5 test kernel 0day, exploiting the unexploitable]
[20090716 Re: Linux 2.6.30+/SELinux/RHEL5 test kernel 0day, exploiting the unexploitable]
[[netdev] 20090409 Oops in tun: bisected to Limit amount of queued packets per device]
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3c8a9c63d5fd738c261bd0ceece04d9c8357ca13]
[http://grsecurity.net/~spender/cheddar_bay.tgz]
[http://isc.sans.org/diary.html?storyid=6820]
[[linux-kernel] 20090706 Re: PROBLEM: tun/tap crashes if open() /dev/net/tun and then poll() it.]
[[oss-security] 20090717 Linux 2.6.30+/SELinux/RHEL5 test kernel 0day, exploiting the unexploitable]
[ADV-2009-1925]
[https://bugzilla.redhat.com/show_bug.cgi?id=512284]
[linux-kernel-tunchrpoll-code-execution(51803)]
[https://www.redhat.com/en/blog/security-flaws-caused-compiler-optimizations]
The secure login page in the Administrative Console component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35 does not redirect to an https page upon receiving an http request, which makes it easier for remote attackers to read the contents of WAS sessions by sniffing the network.
[35405]
[ADV-2009-1464]
[http://www-01.ibm.com/support/docview.wss?uid=swg27006876]
[was-securelogin-info-disclosure(51170)]
Unspecified vulnerability in the Administrative Configservice API in the System Management/Repository component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.25, and 7.0 before 7.0.0.5 on z/OS allows remote authenticated users to obtain sensitive information via unknown use of the wsadmin scripting tool, related to a "security exposure in wsadmin."
[35405]
[ADV-2009-1464]
[http://www-01.ibm.com/support/docview.wss?uid=swg27006876]
[http://www-01.ibm.com/support/docview.wss?uid=swg27007951]
[http://www-01.ibm.com/support/docview.wss?uid=swg27014463]
[PK77495]
[was-system-mgmt-unspecified(51172)]
[was-configservice-info-disclosure(52075)]
The Configservice APIs in the Administrative Console component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.25, and 7.0 before 7.0.0.5, when tracing is enabled, allow remote attackers to obtain sensitive information via unspecified use of the wsadmin scripting tool.
[35405]
[ADV-2009-1464]
[http://www-01.ibm.com/support/docview.wss?uid=swg27006876]
[http://www-01.ibm.com/support/docview.wss?uid=swg27007951]
[http://www-01.ibm.com/support/docview.wss?uid=swg27014463]
[PK84999]
[was-configserviceapis-info-disclosure(51171)]
[was-configservice-info-disclosure-var1(52077)]
The Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35 permits "non-standard http methods," which has unknown impact and remote attack vectors.
[35405]
[ADV-2009-1464]
[http://www-01.ibm.com/support/docview.wss?uid=swg27006876]
[PK73246]
[was-http-methods-unspecified(51173)]
The multipart processor in ModSecurity before 2.5.9 allows remote attackers to cause a denial of service (crash) via a multipart form datapost request with a missing part header name, which triggers a NULL pointer dereference.
[SUSE-SR:2009:011]
[GLSA-200907-02]
[http://sourceforge.net/project/shownotes.php?release_id=667542&group_id=68846]
[20090319 [ISecAuditors Security Advisories] ModSecurity < 2.5.9 remote Denial of Service]
[34096]
[ADV-2009-0703]
[modsecurity-multipart-dos(49212)]
[8241]
[FEDORA-2009-2654]
[FEDORA-2009-2686]
The PDF XSS protection feature in ModSecurity before 2.5.8 allows remote attackers to cause a denial of service (Apache httpd crash) via a request for a PDF file that does not use the GET method.
[GLSA-200907-02]
[http://sourceforge.net/project/shownotes.php?release_id=667538]
[34096]
[ADV-2009-0703]
[modsecurity-pdfxss-dos(49211)]
[FEDORA-2009-2654]
[FEDORA-2009-2686]
The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (application crash) via a string argument that represents a large number, as demonstrated by an attempted conversion to the Float data type.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=532689]
[http://bugs.gentoo.org/show_bug.cgi?id=273213]
[http://github.com/NZKoz/bigdecimal-segfault-fix/tree/master]
[[rubyonrails-security] 20090610 DoS Vulnerability in Ruby (CVE-2009-1904)]
[APPLE-SA-2010-03-29-1]
[[pkgsrc-changes] 20090610 CVS commit: pkgsrc/lang/ruby18-base]
[http://redmine.ruby-lang.org/issues/show/794]
[GLSA-200906-02]
[SSA:2009-170-02]
[http://support.apple.com/kb/HT4077]
[http://weblog.rubyonrails.org/2009/6/10/dos-vulnerability-in-ruby/]
[MDVSA-2009:160]
[RHSA-2009:1140]
[http://www.ruby-forum.com/topic/189071]
[http://www.ruby-lang.org/en/news/2009/06/09/dos-vulnerability-in-bigdecimal/]
[35278]
[1022371]
[USN-805-1]
[ADV-2009-1563]
[https://bugs.launchpad.net/bugs/385436]
[https://bugs.launchpad.net/bugs/cve/2009-1904]
[ruby-bigdecimal-dos(51032)]
[oval:org.mitre.oval:def:9780]
[FEDORA-2009-13066]
The Common Code Infrastructure component in IBM DB2 8 before FP17, 9.1 before FP7, and 9.5 before FP4, when LDAP security (aka IBMLDAPauthserver) and anonymous bind are enabled, allows remote attackers to bypass password authentication and establish a database connection via unspecified vectors.
[ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT]
[1022319]
[35171]
[36540]
[JR32268]
[JR32272]
[JR32273]
[http://www-01.ibm.com/support/docview.wss?uid=swg21293566]
[http://www-01.ibm.com/support/docview.wss?uid=swg21318189]
[http://www-01.ibm.com/support/docview.wss?uid=swg21386689]
[ibmdb2-ldap-security-bypass(50909)]
The DRDA Services component in IBM DB2 9.1 before FP7 and 9.5 before FP4 allows remote attackers to cause a denial of service (memory corruption and application crash) via an IPv6 address in the correlation token in the APPID string, as demonstrated by an APPID string sent by the third-party DataDirect JDBC driver 3.7.32.
[35171]
[IZ36683]
[IZ38874]
[http://www-01.ibm.com/support/docview.wss?uid=swg21293566]
Cross-site scripting (XSS) vulnerability in claroline/linker/notfound.php in Claroline 1.8.11 allows remote attackers to inject arbitrary web script or HTML via the Referer HTTP header.
[http://forum.claroline.net/viewtopic.php?f=69&t=16193&p=42102#p42099]
[http://gsasec.blogspot.com/2009/05/claroline-v1811-cross-site-scripting.html]
[20090508 Claroline v.1.8.11 Cross-Site Scripting]
[34883]
[1022198]
[claroline-notfound-xss(50404)]
Cross-site scripting (XSS) vulnerability in Skip 1.0.2 and earlier, and 1.1RC2 and earlier 1.1RC versions, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://dev.openskip.org/redmine/issues/show/677]
[JVN#43233160]
[JVNDB-2009-000025]
[http://portal.openskip.org/top/releasenote-ver1-0-0]
[34898]
SQL injection vulnerability in Skip 1.0.2 and earlier, and 1.1RC2 and earlier 1.1RC versions, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
[http://dev.openskip.org/redmine/issues/show/677]
[JVN#03114223]
[JVNDB-2009-000026]
[http://portal.openskip.org/top/releasenote-ver1-0-0]
[34898]
SQL injection vulnerability in index.php in RTWebalbum 1.0.462 allows remote attackers to execute arbitrary SQL commands via the AlbumId parameter.
[http://rtwebalbum.svn.sourceforge.net/viewvc/rtwebalbum/]
[http://rtwebalbum.svn.sourceforge.net/viewvc/rtwebalbum/index.php?view=log]
[20090508 BLIND SQL INJECTION exploit (GET var 'AlbumID')--RTWebalbum 1.0.462-->]
[34888]
[rtwebalbum-index-sql-injection(50406)]
[8648]
Directory traversal vulnerability in .include/init.php (aka admin/_include/init.php) in QuiXplorer 2.3.2 and earlier, as used in TinyWebGallery (TWG) 1.7.6 and earlier, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter to admin/index.php.
[20090510 TinyWebGallery <= 1.7.6 LFI / Remote Code Execution Exploit]
[34892]
[http://www.tinywebgallery.com/forum/viewtopic.php?t=1653]
[tinywebgallery-init-file-include(50408)]
[8649]
Directory traversal vulnerability in src/func/language.php in webSPELL 4.2.0e and earlier allows remote attackers to include and execute arbitrary local .php files via a .. (dot dot) in a language cookie. NOTE: this can be leveraged for SQL injection by including awards.php.
[34862]
[http://www.webspell.org/]
[http://www.webspell.org/index.php?site=files&file=30]
[http://www.webspell.org/index.php?site=news_comments&newsID=130]
[webspell-awards-sql-injection(50395)]
[8622]
SQL injection vulnerability in manager.php in LuxBum 0.5.5, when magic_quotes_gpc is disabled and dotclear authentication is used, allows remote attackers to execute arbitrary SQL commands via the username parameter in a login action.
[34889]
[ADV-2009-1281]
[luxbum-manager-sql-injection(50405)]
[8645]
The pci_register_iommu_region function in arch/sparc/kernel/pci_common.c in the Linux kernel before 2.6.29 on the sparc64 platform allows local users to cause a denial of service (system crash) by reading the /proc/iomem file, related to uninitialized pointers and the request_resource function.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=192d7a4667c6d11d1a174ec4cad9a3c5d5f9043c]
[DSA-1844]
[http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.29]
[[oss-security] 20090603 CVE request: kernel: sparc64: Fix crash with /proc/iomem]
[35415]
[USN-793-1]
[kernel-pciregister-dos(51196)]
Stack-based buffer overflow in the URL Search Hook (ICQToolBar.dll) in ICQ 6.5 allows remote attackers to cause a denial of service (persistent crash) and possibly execute arbitrary code via an Internet shortcut .URL file containing a long URL parameter, which triggers a crash when browsing a folder that contains this file.
[20090530 ICQ 6.5 URL Search Hook/ICQToolBar.dll .URL file processing Windows Explorer remote buffer overflow poc]
[35150]
[icq-icqtoolbar-bo(50858)]
[8832]
dig.php in GScripts.net DNS Tools allows remote attackers to execute arbitrary commands via shell metacharacters in the ns parameter.
[34559]
[8454]
Microsoft Internet Explorer 6 SP1; Internet Explorer 6 for Windows XP SP2 and SP3 and Server 2003 SP2; and Internet Explorer 7 and 8 for Windows XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 do not properly handle attempts to access deleted objects in memory, which allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption, aka "Memory Corruption Vulnerability."
[http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=953693]
[35831]
[1022611]
[TA09-195A]
[ADV-2009-2033]
[MS09-034]
[oval:org.mitre.oval:def:6072]
Microsoft Internet Explorer 5.01 SP4 and 6 SP1; Internet Explorer 6 for Windows XP SP2 and SP3 and Server 2003 SP2; and Internet Explorer 7 and 8 for Windows XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 do not properly handle table operations, which allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption by adding malformed elements to an empty DIV element, related to the getElementsByTagName method, aka "HTML Objects Memory Corruption Vulnerability."
[http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=953693]
[20090805 ZDI-09-047: Microsoft Internet Explorer getElementsByTagName Memory Corruption Vulnerability]
[35826]
[1022611]
[TA09-195A]
[ADV-2009-2033]
[http://www.zerodayinitiative.com/advisories/ZDI-09-047]
[MS09-034]
[oval:org.mitre.oval:def:5524]
Microsoft Internet Explorer 5.01 SP4 and 6 SP1; Internet Explorer 6 for Windows XP SP2 and SP3 and Server 2003 SP2; and Internet Explorer 7 and 8 for Windows XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 do not properly handle attempts to access deleted objects in memory, which allows remote attackers to execute arbitrary code via an HTML document containing embedded style sheets that modify unspecified rule properties that cause the behavior element to be "improperly processed," aka "Uninitialized Memory Corruption Vulnerability."
[20090805 ZDI-09-048: Microsoft Internet Explorer CSS Behavior Memory Corruption Vulnerability]
[1022611]
[TA09-195A]
[ADV-2009-2033]
[http://www.zerodayinitiative.com/advisories/ZDI-09-048]
[MS09-034]
[oval:org.mitre.oval:def:5660]
The JScript scripting engine 5.1, 5.6, 5.7, and 5.8 in JScript.dll in Microsoft Windows, as used in Internet Explorer, does not properly load decoded scripts into memory before execution, which allows remote attackers to execute arbitrary code via a crafted web site that triggers memory corruption, aka "JScript Remote Code Execution Vulnerability."
[TA09-251A]
[MS09-045]
[oval:org.mitre.oval:def:6316]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2009. Notes: none.
The Message Queuing (aka MSMQ) service for Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP2, and Vista Gold does not properly validate unspecified IOCTL request data from user mode before passing this data to kernel mode, which allows local users to gain privileges via a crafted request, aka "MSMQ Null Pointer Vulnerability."
[http://en.securitylab.ru/lab/PT-2008-09]
[20090812 [PT-2008-09] Microsoft Windows MSMQ Privilege Escalation Vulnerability]
[1022714]
[TA09-223A]
[MS09-040]
[oval:org.mitre.oval:def:6109]
Heap-based buffer overflow in the Windows Internet Name Service (WINS) component for Microsoft Windows 2000 SP4 and Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted WINS replication packet that triggers an incorrect buffer-length calculation, aka "WINS Heap Overflow Vulnerability."
[TA09-223A]
[MS09-039]
[oval:org.mitre.oval:def:6410]
Integer overflow in the Windows Internet Name Service (WINS) component for Microsoft Windows 2000 SP4 allows remote WINS replication partners to execute arbitrary code via crafted data structures in a packet, aka "WINS Integer Overflow Vulnerability."
[TA09-223A]
[MS09-039]
[oval:org.mitre.oval:def:6354]
The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 does not properly manage state information, which allows remote attackers to execute arbitrary code by sending packets to a listening service, and thereby triggering misinterpretation of an unspecified field as a function pointer, aka "TCP/IP Timestamps Code Execution Vulnerability."
[TA09-251A]
[MS09-048]
[oval:org.mitre.oval:def:6374]
Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allow remote attackers to cause a denial of service (TCP outage) via a series of TCP sessions that have pending data and a (1) small or (2) zero receive window size, and remain in the FIN-WAIT-1 or FIN-WAIT-2 state indefinitely, aka "TCP/IP Orphaned Connections Vulnerability."
[http://www.recurity-labs.com/content/pub/Microsoft_Windows_CVE-2009-1926]
[20090909 TCP/IP Orphaned Connections Vulnerability]
[36269]
[TA09-251A]
[MS09-048]
[oval:org.mitre.oval:def:5965]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2009. Notes: none.
Stack consumption vulnerability in the LDAP service in Active Directory on Microsoft Windows 2000 SP4, Server 2003 SP2, and Server 2008 Gold and SP2; Active Directory Application Mode (ADAM) on Windows XP SP2 and SP3 and Server 2003 SP2; and Active Directory Lightweight Directory Service (AD LDS) on Windows Server 2008 Gold and SP2 allows remote attackers to cause a denial of service (system hang) via a malformed (1) LDAP or (2) LDAPS request, aka "LSASS Recursive Stack Overflow Vulnerability."
[TA09-314A]
[MS09-066]
[oval:org.mitre.oval:def:5890]
Heap-based buffer overflow in the Microsoft Terminal Services Client ActiveX control running RDP 6.1 on Windows XP SP2, Vista SP1 or SP2, or Server 2008 Gold or SP2; or 5.2 or 6.1 on Windows XP SP3; allows remote attackers to execute arbitrary code via unspecified parameters to unknown methods, aka "Remote Desktop Connection ActiveX Control Heap Overflow Vulnerability."
[35973]
[1022709]
[TA09-223A]
[ADV-2009-2238]
[MS09-044]
[oval:org.mitre.oval:def:6329]
The Telnet service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote Telnet servers to execute arbitrary code on a client machine by replaying the NTLM credentials of a client user, aka "Telnet Credential Reflection Vulnerability," a related issue to CVE-2000-0834.
[1022716]
[35993]
[TA09-223A]
[ADV-2009-2237]
[MS09-042]
[oval:org.mitre.oval:def:6302]
Multiple integer overflows in the (1) user_info_callback, (2) user_endrow_callback, and (3) gst_pngdec_task functions (ext/libpng/gstpngdec.c) in GStreamer Good Plug-ins (aka gst-plugins-good or gstreamer-plugins-good) 0.10.15 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted PNG file, which triggers a buffer overflow.
[http://cgit.freedesktop.org/gstreamer/gst-plugins-good/commit/?id=d9544bcc44adcef769cbdf7f6453e140058a3adc]
[GLSA-200907-11]
[DSA-1839]
[MDVSA-2009:130]
[RHSA-2009:1123]
[35172]
[ADV-2009-1506]
[oval:org.mitre.oval:def:10798]
Kerberos in Sun Solaris 8, 9, and 10, and OpenSolaris before snv_117, does not properly manage credential caches, which allows local users to access Kerberized NFS mount points and Kerberized NFS shares via unspecified vectors.
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-140841-01-1]
[252787]
[http://support.avaya.com/elmodocs2/security/ASA-2009-210.htm]
[35205]
[ADV-2009-1499]
[ADV-2009-1559]
Cross-site scripting (XSS) vulnerability in the Reverse Proxy Plug-in in Sun Java System Web Server 6.1 before SP11 allows remote attackers to inject arbitrary web script or HTML via the query string in situations that result in a 502 Gateway error.
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-116648-23-1]
[259588]
[http://support.avaya.com/elmodocs2/security/ASA-2009-211.htm]
[35204]
[1022334]
[ADV-2009-1500]
[jsws-reverseproxyplugin-xss(50951)]
Integer overflow in the pipe_build_write_buffer function (sys/kern/sys_pipe.c) in the direct write optimization feature in the pipe implementation in FreeBSD 7.1 through 7.2 and 6.3 through 6.4 allows local users to bypass virtual-to-physical address lookups and read sensitive information in memory pages via unspecified vectors.
[FreeBSD-SA-09:09]
[http://security.freebsd.org/patches/SA-09:09/pipe.patch]
[35279]
[1022365]
[freebsd-directpipe-info-disclosure(51109)]
_functions.php in cpCommerce 1.2.x, possibly including 1.2.9, sends a redirect but does not exit when it is called directly, which allows remote attackers to bypass a protection mechanism to conduct remote file inclusion and directory traversal attacks, execute arbitrary PHP code, or read arbitrary files via the GLOBALS[prefix] parameter, a different vector than CVE-2003-1500.
[35103]
[8790]
Cross-site scripting (XSS) vulnerability in the comment posting feature in LightNEasy 2.2.1 "no database" (aka flat) and 2.2.2 SQLite allows remote attackers to inject arbitrary web script or HTML via the (1) commentname (aka Author), (2) commentemail (aka Email), and (3) commentmessage (aka Comment) parameters. NOTE: some of these details are obtained from third party information.
[http://forum.intern0t.net/intern0t-advisories/1081-intern0t-lightneasy-2-2-2-html-injection-vulnerability.html]
[20090603 [InterN0T] LightNEasy 2.2.2 - HTML Injection Vulnerability]
[35229]
Cross-site scripting (XSS) vulnerability in Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to database output and the frontend administrative panel.
[http://developer.joomla.org/security/news/297-20090602-core-frontend-xss.html]
[http://www.joomla.org/announcements/release-news/5235-joomla-1511-security-release-now-available.html]
[35189]
[ADV-2009-1497]
[joomla-adminpanel-xss(50923)]
Cross-site scripting (XSS) vulnerability in the JA_Purity template for Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://developer.joomla.org/security/news/296-20090602-core-japurity-xss.html]
[http://www.joomla.org/announcements/release-news/5235-joomla-1511-security-release-now-available.html]
[35189]
[ADV-2009-1497]
[joomla-japurity-xss(50922)]
Cross-site scripting (XSS) vulnerability in the administrator panel in the com_users core component for Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://developer.joomla.org/security/news/295-20090601-core-comusers-xss.html]
[http://www.joomla.org/announcements/release-news/5235-joomla-1511-security-release-now-available.html]
[35189]
[ADV-2009-1497]
[joomla-comusers-xss(50924)]
PAD Site Scripts 3.6 stores sensitive information under the web document root with insufficient access control, which allows remote attackers to download the database and obtain sensitive information via a direct request for dbbackup.txt.
[pss-dbbackup-info-disclosure(50911)]
[8850]
Cross-site scripting (XSS) vulnerability in the Quiz module 5.x, 6.x-2.x before 6.x-2.2, and 6.x-3.x before 6.x-3.0, a module for Drupal, allows remote authenticated users, with create quizzes or quiz questions access, to inject arbitrary web script or HTML via unspecified vectors.
[http://drupal.org/node/481270]
[http://drupal.org/node/481274]
[http://drupal.org/node/481308]
[35199]
Stack-based buffer overflow in the IKE service (ireIke.exe) in SafeNet SoftRemote before 10.8.6 allows remote attackers to execute arbitrary code via a long request to UDP port 62514.
[20090601 ZDI-09-024: Safenet SoftRemote IKE Service Remote Stack Overflow Vulnerability]
[35154]
[1022316]
[ADV-2009-1472]
[http://www.zerodayinitiative.com/advisories/ZDI-09-024/]
[softremote-ireike-bo(50880)]
Stack-based buffer overflow in AIMP 2.51 build 330 allows remote attackers to execute arbitrary code via an MP3 file with a long ID3 tag.
[http://zeroscience.org/codes/aimp2_poc.txt]
[aimp-mp3-bo(50875)]
[8837]
SQL injection vulnerability in webCal3_detail.asp in WebCal 3.04 allows remote attackers to execute arbitrary SQL commands via the event_id parameter.
[webcal-webcal3detail-sql-injection(50905)]
[8857]
PHP remote file inclusion vulnerability in latestposts.php in AdaptBB 1.0, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the forumspath parameter.
[adaptbb-latestposts-file-include(50893)]
[8851]
SQL injection vulnerability in the UnbDbEncode function in unb_lib/database.lib.php in Unclassified NewsBoard (UNB) 1.6.4 allows remote attackers to execute arbitrary SQL commands via the Query parameter in a search action to forum.php, a different vector than CVE-2005-3686.
[35183]
[unb-forum-sql-injection(50876)]
[8841]
Multiple directory traversal vulnerabilities in forum.php in Unclassified NewsBoard (UNB) 1.6.4, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote attackers to (1) read arbitrary recently-modified files via a .. (dot dot) in the GLOBALS[filename] parameter or (2) include and execute arbitrary local files via a .. (dot dot) in the GLOBALS[UTE][__tplCollection][a][file] parameter.
[35183]
[unb-forum-directory-traversal(50877)]
[unb-forum-file-include(50878)]
[8841]
import_wbb1.php in Unclassified NewsBoard (UNB) 1.6.4 allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message.
[35183]
[unb-importwbb1-path-disclosure(50879)]
[8841]
SQL injection vulnerability in yorum.asp in WebEyes Guest Book 3 allows remote attackers to execute arbitrary SQL commands via the mesajid parameter.
[8859]
Cross-site scripting (XSS) vulnerability in index.php in PropertyMax Pro FREE 0.3 allows remote attackers to inject arbitrary web script or HTML via the pl parameter in a mi action.
[8858]
Multiple SQL injection vulnerabilities in the administrative login feature in PropertyMax Pro FREE 0.3, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
[8858]
IBM FileNet Content Manager 4.0, 4.0.1, and 4.5, as used in IBM WebSphere Application Server (WAS) and Oracle BEA WebLogic Application Server, when the CE Web Services listener has a certain WSEAF configuration, does not properly restrict use of a cached Subject, which allows remote attackers to obtain access with the credentials of a recently authenticated user via unspecified vectors.
[35228]
[ADV-2009-1512]
[http://www-01.ibm.com/support/docview.wss?uid=swg21389281]
Unspecified vulnerability in portmapper (aka portmap) in IBM AIX 5.3 allows attackers to cause a denial of service (daemon hang) via unknown vectors, related to libtli.
[ftp://ftp.software.ibm.com/aix/efixes/iz50802/IZ50802.53TL8SP6.epkg.Z]
[IZ50802]
[35211]
[aix-portmap-unspecified-dos(51167)]
The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.
[APPLE-SA-2009-11-09-1]
[SUSE-SR:2010:011]
[[apr-dev] 20090602 [PATCH] prevent "billion laughs" attack against expat]
[HPSBUX02612]
[GLSA-200907-03]
[SSA:2009-167-02]
[http://support.apple.com/kb/HT3937]
[http://svn.apache.org/viewvc?view=rev&revision=781403]
[http://wiki.rpath.com/Advisories:rPSA-2009-0123]
[http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3]
[DSA-1812]
[MDVSA-2009:131]
[MDVSA-2013:150]
[[oss-security] 20090603 CVE request: "billion laughs" attack against Apache APR]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
[RHSA-2009:1107]
[RHSA-2009:1108]
[20090824 rPSA-2009-0123-1 apr-util]
[35253]
[USN-786-1]
[USN-787-1]
[ADV-2009-1907]
[ADV-2009-3184]
[ADV-2010-1107]
[PK88342]
[PK91241]
[PK99478]
[http://www-01.ibm.com/support/docview.wss?uid=swg27014463]
[[httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[[httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[oval:org.mitre.oval:def:10270]
[oval:org.mitre.oval:def:12473]
[8842]
[FEDORA-2009-6014]
[FEDORA-2009-6261]
[FEDORA-2009-5969]
Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input.
[APPLE-SA-2009-11-09-1]
[HPSBUX02612]
[GLSA-200907-03]
[http://support.apple.com/kb/HT3937]
[http://svn.apache.org/viewvc?view=rev&revision=768417]
[http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3]
[[dev] 20090424 Buffer overflow in apr_brigade_vprintf() ?]
[[dev] 20090424 Re: Buffer overflow in apr_brigade_vprintf() ?]
[MDVSA-2009:131]
[MDVSA-2013:150]
[[oss-security] 20090605 CVE Request (apr-util)]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
[RHSA-2009:1107]
[RHSA-2009:1108]
[35251]
[USN-786-1]
[USN-787-1]
[ADV-2009-1907]
[ADV-2009-3184]
[PK88341]
[PK91241]
[PK99478]
[http://www-01.ibm.com/support/docview.wss?uid=swg27014463]
[https://bugzilla.redhat.com/show_bug.cgi?id=504390]
[[httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[[httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[oval:org.mitre.oval:def:11567]
[oval:org.mitre.oval:def:12237]
[FEDORA-2009-6014]
[FEDORA-2009-6261]
[FEDORA-2009-5969]
charon/sa/ike_sa.c in the charon daemon in strongSWAN before 4.3.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an invalid IKE_SA_INIT request that triggers "an incomplete state," followed by a CREATE_CHILD_SA request.
[http://download.strongswan.org/CHANGES4.txt]
[http://download.strongswan.org/patches/03_invalid_ike_state_patch/strongswan-4.x.x_invalid_ike_state.patch]
[http://download.strongswan.org/patches/03_invalid_ike_state_patch/strongswan-4.x.x_invalid_ike_state.readme]
[SUSE-SR:2009:012]
[DSA-1899]
[35178]
[[strongSwan] 20090527 [strongSwan] ANNOUNCE: strongSwan 4.3.1 and 4.2.15 released]
charon/sa/tasks/child_create.c in the charon daemon in strongSWAN before 4.3.1 switches the NULL checks for TSi and TSr payloads, which allows remote attackers to cause a denial of service via an IKE_AUTH request without a (1) TSi or (2) TSr traffic selector.
[http://download.strongswan.org/CHANGES4.txt]
[http://download.strongswan.org/patches/04_swapped_ts_check_patch/strongswan-4.x.x._swapped_ts_check.patch]
[http://download.strongswan.org/patches/04_swapped_ts_check_patch/strongswan-4.x.x._swapped_ts_check.readme]
[SUSE-SR:2009:012]
[DSA-1899]
[35178]
[[strongSwan] 20090527 [strongSwan] ANNOUNCE: strongSwan 4.3.1 and 4.2.15 released]
Off-by-one error in the event_wallops function in fe-common/irc/fe-events.c in irssi 0.8.13 allows remote IRC servers to cause a denial of service (crash) via an empty command, which triggers a one-byte buffer under-read and a one-byte buffer underflow.
[http://bugs.irssi.org/index.php?do=details&task_id=662]
[SUSE-SR:2009:012]
[http://www.irssi.org/ChangeLog]
[MDVSA-2009:133]
[[oss-security] 20090529 CVE Request (irssi)]
[35399]
[1022410]
[USN-800-1]
[ADV-2009-1596]
[http://xorl.wordpress.com/2009/05/28/irssi-event_wallops-off-by-one-readwrite/]
[irssi-eventwallops-dos(51184)]
[FEDORA-2009-7012]
inc/init.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via the config_cascade[main][default][] parameter to doku.php. NOTE: PHP remote file inclusion is also possible in PHP 5 using ftp:// URLs.
[http://bugs.splitbrain.org/index.php?do=details&task_id=1700]
[http://dev.splitbrain.org/darcsweb/darcsweb.cgi?r=dokuwiki;a=commitdiff;h=20090526145030-7ad00-c0483e021f47898c8597f3bfbdd26c637f891d86.gz]
[35095]
[8781]
[8812]
The inode double locking code in fs/ocfs2/file.c in the Linux kernel 2.6.30 before 2.6.30-rc3, 2.6.27 before 2.6.27.24, 2.6.29 before 2.6.29.4, and possibly other versions down to 2.6.19 allows local users to cause a denial of service (prevention of file creation and removal) via a series of splice system calls that trigger a deadlock between the generic_file_splice_write, splice_from_pipe, and ocfs2_file_splice_write functions.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=7bfac9ecf0585962fe13584f5cf526d8c8e76f17]
[SUSE-SA:2009:030]
[SUSE-SA:2009:031]
[SUSE-SA:2009:038]
[1022307]
[DSA-1844]
[MDVSA-2009:135]
[MDVSA-2009:148]
[[oss-security] 20090529 CVE request: kernel: splice local denial of service]
[[oss-security] 20090530 Re: CVE request: kernel: splice local denial of service]
[[oss-security] 20090602 Re: CVE request: kernel: splice local denial of service]
[[oss-security] 20090603 Re: CVE request: kernel: splice local denial of service]
[RHSA-2009:1157]
[35143]
[USN-793-1]
Xfig, possibly 3.2.5, allows local users to read and write arbitrary files via a symlink attack on the (1) xfig-eps[PID], (2) xfig-pic[PID].pix, (3) xfig-pic[PID].err, (4) xfig-pcx[PID].pix, (5) xfig-xfigrc[PID], (6) xfig[PID], (7) xfig-print[PID], (8) xfig-export[PID].err, (9) xfig-batch[PID], (10) xfig-exp[PID], or (11) xfig-spell.[PID] temporary files, where [PID] is a process ID.
[MDVSA-2009:244]
[[oss-security] 20090401 CVE id rquest: xfig insecure tmp files]
[34328]
[xfig-temp-symlink(49600)]
Unspecified vulnerability in the Network Foundation component in Oracle Database 11.1.0.6 allows remote authenticated users to affect integrity and availability via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[35677]
[1022560]
[ADV-2009-1900]
[oracle-database-netfound-unspecified(51751)]
Unspecified vulnerability in the Workspace Manager component in Oracle Database 10.2.0.4 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html]
[36755]
[1023057]
[TA09-294A]
Unspecified vulnerability in the Net Foundation Layer component in Oracle Database 9.2.0.8 and 10.1.0.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Per: http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2009.html
This vulnerability only affects the Windows platform.
[http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html]
[36760]
[1023057]
[TA09-294A]
Unspecified vulnerability in the Config Management component in (1) Oracle Database 11.1.0.7 and (2) Oracle Enterprise Manager 10.2.0.4 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-1967.
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[35676]
[1022560]
[ADV-2009-1900]
[oracle-db-em-config-unspecified(51752)]
Unspecified vulnerability in the Config Management component in (1) Oracle Database 11.1.0.7 and (2) Oracle Enterprise Manager 10.2.0.4 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-1966.
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[35692]
[1022560]
[ADV-2009-1900]
[oracle-db-em-configmgmt-unspecified(51753)]
Unspecified vulnerability in the Secure Enterprise Search component in Oracle Database 10.1.8.3 allows remote attackers to affect integrity via unknown vectors. NOTE: the previous information was obtained from the July 2009 CPU. Oracle has not commented on claims from an established researcher that this is cross-site scripting (XSS) via the search_p_groups parameter in search/query/search.
[20090716 [DSECRG-09-025] Oracle Secure Enterprise Search 10.1.8 Linked XSS vulnerability]
[http://dsecrg.com/pages/vul/show.php?id=125]
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[35681]
[1022560]
[ADV-2009-1900]
[oracle-db-ses-unspecified(51754)]
Unspecified vulnerability in the Auditing component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote authenticated users to affect confidentiality via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[35689]
[1022560]
[ADV-2009-1900]
[oracle-db-auditing-unspecified(51755)]
Unspecified vulnerability in the Listener component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote attackers to affect availability via unknown vectors, a different vulnerability than CVE-2009-0991.
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[35683]
[1022560]
[ADV-2009-1900]
[oracle-db-listener-unspecified(51756)]
Unspecified vulnerability in the Data Pump component in Oracle Database 10.1.0.5, 10.2.0.3, and 11.1.0.7 allows remote authenticated users to affect integrity via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html]
[36754]
[1023057]
[TA09-294A]
Unspecified vulnerability in the Auditing component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote authenticated users to affect integrity, related to DBMS_SYS_SQL and DBMS_SQL.
[http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html]
[36758]
[1023057]
[TA09-294A]
Unspecified vulnerability in the Virtual Private Database component in Oracle Database 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote authenticated users to affect confidentiality and integrity, related to VPD policies.
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[35687]
[1022560]
[ADV-2009-1900]
[oracle-db-vpd-unspecified(51757)]
Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, and 7.0 SP7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to the Servlet Container Package.
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[35674]
[1022561]
[ADV-2009-1900]
[oracle-bea-wls-container-unspecified(51758)]
Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3 allows remote attackers to affect confidentiality, integrity, and availability, related to the WLS Console Package.
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[35673]
[1022561]
[ADV-2009-1900]
[oracle-bea-wls-console-unspecified(51759)]
Unspecified vulnerability in the HTTP Server component in Oracle Application Server 10.1.2.3 allows remote attackers to affect integrity via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[35688]
[1022567]
[ADV-2009-1900]
[oracle-as-httpserver-unspecified(51760)]
Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the July 2009 Oracle CPU. Oracle has not commented on claims from an independent researcher that this vulnerability allows attackers to bypass authentication via unknown vectors involving the username parameter and login.php.
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[35672]
[1022565]
[ADV-2009-1900]
[http://www.zerodayinitiative.com/advisories/ZDI-09-058/]
[oracle-securebackup-sbc-unspecified(51761)]
Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the July 2009 Oracle CPU. Oracle has not commented on claims from an independent researcher that this vulnerability allows remote authenticated users to execute arbitrary code with SYSTEM privileges via vectors involving property_box.php.
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[35678]
[1022565]
[ADV-2009-1900]
[http://www.zerodayinitiative.com/advisories/ZDI-09-059/]
[oracle-sb-sbc-unspecified(51762)]
Unspecified vulnerability in the Network Authentication component in Oracle Database 10.1.0.5 and 10.2.0.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2009 CPU. Oracle has not commented on claims from an independent researcher that this is related to improper validation of the AUTH_SESSKEY parameter length that leads to arbitrary code execution.
Per: http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2009.html
# The CVSS Base Score is 10.0 only for Windows. For Linux, Unix and other platforms, the CVSS Base Score is 7.5, and the impacts for Confidentiality, Integrity and Availability are Partial+.
[http://blogs.conus.info/node/28]
[http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html]
[20091030 CVE-2009-1979 (Oracle RDBMS)]
[36747]
[1023057]
[TA09-294A]
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[35686]
[1022562]
[ADV-2009-1900]
[oracle-ebs-aol-unspecified(51763)]
Unspecified vulnerability in the Highly Interactive Client component in Siebel Product Suite 7.5.3, 7.7.2, 7.8.2, 8.0.0.5, and 8.1.0 allows local users to affect confidentiality and integrity via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[35698]
[1022564]
[ADV-2009-1900]
[oracle-sbs-hic-unspecified(51764)]
Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2 and 12.0.6 allows remote attackers to affect integrity via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[35693]
[1022562]
[ADV-2009-1900]
[oracle-ebs-af-unspecified(51765)]
Unspecified vulnerability in the Oracle iStore component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1 allows remote attackers to affect integrity via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[35697]
[1022562]
[ADV-2009-1900]
[oracle-ebs-istore-unspecified(51766)]
Unspecified vulnerability in the Application Install component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to the Patch Administrator.
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[35690]
[1022562]
[ADV-2009-1900]
[oracle-ebs-ai-unspecified(51767)]
Unspecified vulnerability in the Network Authentication component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Per: http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2009.html
"The CVSS Base Score is 10.0 only for Windows. For Linux, Unix and other platforms, the CVSS Base Score is 7.5, and the impacts for Confidentiality, Integrity and Availability are Partial+."
[http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html]
[36745]
[1023057]
[TA09-294A]
Unspecified vulnerability in the Oracle Applications Manager component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[35695]
[1022562]
[ADV-2009-1900]
[oracle-ebs-am-unspecified(51768)]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools - Enterprise Portal component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.49.21 allows remote attackers to affect integrity via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[35691]
[1022566]
[ADV-2009-1900]
[oracle-pse-jdee-pepep-unspecified(51769)]
Unspecified vulnerability in the PeopleSoft Enterprise HRMS eProfile Manager component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.8 SP1, 8.9 Bundle 19, and 9.0 Bundle 9 allows remote authenticated users to affect confidentiality via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[35696]
[1022566]
[ADV-2009-1900]
[oracle-pse-jdee-pehem-unspecified(51770)]
Unspecified vulnerability in the PeopleSoft Enterprise FMS component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.8 SP1, 8.9 Bundle 33, and 9.0 Bundle 24 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html]
[35694]
[1022566]
[ADV-2009-1900]
[oracle-pse-jdee-pef-unspecified(51771)]
Unspecified vulnerability in the Business Intelligence Enterprise Edition component in Oracle Application Server 10.1.3.4.1 allows local users to affect confidentiality via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html]
[36749]
[1023058]
[TA09-294A]
Unspecified vulnerability in the Oracle Text component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.4 allows remote authenticated users to affect confidentiality and integrity, related to CTXSYS.DRVXTABC. NOTE: the previous information was obtained from the October 2009 CPU. Oracle has not commented on claims from an established researcher that this is for multiple SQL injection vulnerabilities via the (1) idx_owner or (2) idx_name parameters to the create_tables procedure.
[http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html]
[36748]
[1023057]
[TA09-294A]
Unspecified vulnerability in the Core RDBMS component in Oracle Database 9.2.0.8, 10.1.0.5, and 10.2.0.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Per: http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2009.html
This vulnerability only affects the Windows platform.
The following Oracle Database Server vulnerability included in this Critical Patch Update affects client-only installations: CVE-2009-1992.
[http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html]
[36742]
[1023057]
[TA09-294A]
Unspecified vulnerability in the Application Express component in Oracle Database 3.0.1 allows remote authenticated users to affect confidentiality and integrity, related to FLOWS_030000.WWV_EXECUTE_IMMEDIATE.
Per: http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2009.html
"Overview of Oracle Application Express
Oracle Application Express is a rapid web application development tool for the Oracle Database. In Oracle Database releases up to and including 10g Release 2, Oracle Application Express was separately installed from a Companion CD supplied with the Oracle Database CD set or from a package downloaded from an Oracle web site. If you have not installed Oracle Application Express from the companion CD or from a packaged download from an Oracle web site, no further action is required. From Oracle Database 11g onwards, Oracle Application Express is included in the default installation of the Oracle Database.
If you have Oracle Application Express installed in an Oracle Database home, then refer to Critical Patch Update October 2009 Patch Availability Document for Oracle Products, My Oracle Support Note 881382.1 for the version to be installed. "
[http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html]
[36759]
[1023057]
[TA09-294A]
Unspecified vulnerability in the Oracle Spatial component in Oracle Database 10.1.0.5 allows remote authenticated users to affect confidentiality, integrity, and availability, related to MDSYS.PRVT_CMT_CBK.
[http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html]
[36744]
[1023057]
[TA09-294A]
Unspecified vulnerability in the Advanced Queuing component in Oracle Database 10.2.0.4 and 11.1.0.7 allows remote authenticated users to affect confidentiality and integrity, related to SYS.DBMS_AQ_INV.
[http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html]
[36752]
[1023057]
[TA09-294A]
Unspecified vulnerability in the Logical Standby component in Oracle Database allows remote authenticated users to affect integrity via unknown vectors.
Per: http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2010.html
"Fixed in all supported releases. Upgrade to any supported release to acquire this fix."
[http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html]
[TA10-012A]
Unspecified vulnerability in the Authentication component in Oracle Database 10.2.0.3 and 11.1.0.7 allows remote attackers to affect confidentiality via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html]
[36751]
[1023057]
[TA09-294A]
Unspecified vulnerability in the Oracle Communications Order and Service Management component in Oracle Industry Applications 2.8.0, 6.2.0, 6.3.0, and 6.3.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html]
[36775]
[1023060]
[TA09-294A]
Unspecified vulnerability in the Business Intelligence Enterprise Edition component in unspecified Oracle Application Server versions allows remote attackers to affect integrity via unknown vectors.
Per: http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2009.html
"Fixed in all supported versions. No patch provided in this Critical Patch Update."
[http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html]
[36746]
[1023058]
[TA09-294A]
Unspecified vulnerability in the Authentication component in Oracle Database 11.1.0.7 allows remote attackers to affect confidentiality via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html]
[36756]
[1023057]
[TA09-294A]
Unspecified vulnerability in the PL/SQL component in Oracle Database 10.2.0.4 and 11.1.0.7 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html]
[36743]
[1023057]
[TA09-294A]
Unspecified vulnerability in the WebLogic Portal component in BEA Product Suite 8.1.6, 9.2.3, 10.0.1, 10.2.1, and 10.3.1.0.0 allows remote attackers to affect integrity via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html]
[36774]
[1023062]
[TA09-294A]
Ascad Networks Password Protector SD 1.3.1 allows remote attackers to bypass authentication and gain administrative access by setting the (1) c7portal and (2) cookname cookies to "admin."
[34930]
[8668]
Multiple SQL injection vulnerabilities in main/mySpace/myStudents.php in Dokeos 1.8.5, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) student and (2) course parameters, a different vector than CVE-2007-2902.
[http://holisticinfosec.org/content/view/112/45/]
[http://www.dokeos.com/wiki/index.php/Security#Dokeos_1.8]
[34928]
[ADV-2009-1300]
[dokeos-mystudents-sql-injection(50501)]
Cross-site request forgery (CSRF) vulnerability in Dokeos 1.8.5, and possibly earlier, allows remote attackers to hijack the authentication of unspecified victims and add new personal agenda items via unknown vectors.
[http://holisticinfosec.org/content/view/112/45/]
[http://www.dokeos.com/wiki/index.php/Security#Dokeos_1.8]
[34928]
[ADV-2009-1300]
Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.5, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) search_term parameter to main/auth/courses.php; the (2) frm_title and (3) frm_content parameters in a new personal agenda item action; the (4) title and (5) tutor_name parameters in a new course action; and the (6) student and (7) course parameters to main/mySpace/myStudents.php. NOTE: vectors 2 and 3 might only be exploitable via a separate CSRF vulnerability.
[http://holisticinfosec.org/content/view/112/45/]
[http://www.dokeos.com/wiki/index.php/Security#Dokeos_1.8]
[34928]
[ADV-2009-1300]
[dokeos-agenda-item-xss(50498)]
[dokeos-new-course-xss(50500)]
[dokeos-mystudents-xss(50502)]
Multiple directory traversal vulnerabilities in Dokeos 1.8.5, and possibly earlier, allow remote attackers to (1) read portions of arbitrary files via a .. (dot dot) and a ..\ (dot dot backslash) in the lang parameter to main/exercice/hotspot_lang_conversion.php and (2) read arbitrary files via a .. (dot dot) in the doc_url parameter to main/exercice/Hpdownload.php.
[http://gsasec.blogspot.com/2009/05/dokeos-free-185-multiple.html]
[http://www.dokeos.com/wiki/index.php/Security#Dokeos_1.8]
[34928]
[ADV-2009-1300]
[dokeos-unspecified-directory-traversal(50503)]
Multiple SQL injection vulnerabilities in Dokeos 1.8.5, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) uInfo parameter to main/tracking/userLog.php and the (2) course parameter to main/mySpace/lp_tracking.php, a different vector than CVE-2009-2006.2.
[http://gsasec.blogspot.com/2009/05/dokeos-free-185-multiple.html]
[http://www.dokeos.com/wiki/index.php/Security#Dokeos_1.8]
[34928]
[ADV-2009-1300]
[dokeos-userlog-sql-injection(51141)]
Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.5, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) curdirpath parameter to main/document/slideshow.php and the (2) file parameter to main/exercice/testheaderpage.php.
[http://gsasec.blogspot.com/2009/05/dokeos-free-185-multiple.html]
[http://www.dokeos.com/wiki/index.php/Security#Dokeos_1.8]
[34928]
[ADV-2009-1300]
[dokeos-slideshow-xss(51140)]
Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.9 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) thread parameter to messageboard.php, (2) member parameter to profile.php, (3) pid parameter to gallery/index.php, and the (4) fcms_login_id cookie parameter.
[20090513 (GET var 'member') BLIND SQL INJECTION EXPLOIT --FAMILY CONNECTIONS <= v1.9 -->]
[34935]
[ADV-2009-1306]
[8671]
Worldweaver DX Studio Player 3.0.29.0, 3.0.22.0, 3.0.12.0, and probably other versions before 3.0.29.1, when used as a plug-in for Firefox, does not restrict access to the shell.execute JavaScript API method, which allows remote attackers to execute arbitrary commands via a .dxstudio file that invokes this method.
[http://www.coresecurity.com/content/DXStudio-player-firefox-plugin]
[http://www.dxstudio.com/forumtopic.aspx?topicid=b4152459-fb5f-4933-b700-b3fbd54f6bfd]
[20090609 CORE-2009-0521 - DX Studio Player Firefox plug-in command injection]
[35273]
[ADV-2009-1561]
[dxstudioplayer-shellexecute-command-exec(51035)]
[8922]
Unspecified vulnerability in idmap in Sun OpenSolaris snv_88 through snv_110, when a CIFS server is enabled, allows local users to cause a denial of service (idpmapd daemon crash and idmapd outage) via unknown vectors.
[260508]
[35252]
[ADV-2009-1519]
SQL injection vulnerability in bin/aps_browse_sources.php in Frontis 3.9.01.24 allows remote attackers to execute arbitrary SQL commands via the source_class parameter in a browse_classes action.
[ADV-2009-1531]
[8900]
SQL injection vulnerability in the ComSchool (com_school) component 1.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the classid parameter in a showclass action to index.php.
[35257]
[joomla-comschool-classid-sql-injection(50988)]
[8891]
Directory traversal vulnerability in includes/file_includer.php in the Ideal MooFAQ (com_moofaq) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
[35259]
[ADV-2009-1530]
[8898]
SQL injection vulnerability in products.php in Virtue Shopping Mall allows remote attackers to execute arbitrary SQL commands via the cid parameter.
[ADV-2009-1527]
[8894]
SQL injection vulnerability in products.php in Virtue Book Store allows remote attackers to execute arbitrary SQL commands via the cid parameter.
[ADV-2009-1526]
[8893]
SQL injection vulnerability in admin/index.php in Jared Eckersley MyCars, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the authuserid parameter.
[ADV-2009-1523]
[mycarsautomotive-index-sql-injection(50985)]
[8886]
SQL injection vulnerability in news_detail.php in Virtue News Manager allows remote attackers to execute arbitrary SQL commands via the nid parameter.
[ADV-2009-1528]
[8901]
Cross-site scripting (XSS) vulnerability in news_detail.php in Virtue News Manager allows remote attackers to inject arbitrary web script or HTML via the nid parameter.
[ADV-2009-1528]
[8901]
SQL injection vulnerability in search.php in Virtue Classifieds allows remote attackers to execute arbitrary SQL commands via the category parameter.
[ADV-2009-1525]
[8892]
fipsCMS Light 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file and obtain sensitive information via a direct request for _fipsdb/db.mdb.
[fipscms-db-info-disclosure(50987)]
[8890]
SQL injection vulnerability in index.php in Shop-Script Pro 2.12, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the current_currency parameter.
[ADV-2009-1533]
[8906]
Vlad Titarenko ASP VT Auth 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file and obtain usernames and passwords via a direct request for zHk8dEes3.txt.
[vtauth-zhk8dees3-info-disclosure(50986)]
[8889]
admin/login.php in DM FileManager 3.9.2 allows remote attackers to bypass authentication and gain administrative access by setting the (1) USER, (2) GROUPID, (3) GROUP, and (4) USERID cookies to certain values.
[ADV-2009-1532]
[8903]
Stack-based buffer overflow in a token searching function in the dtscore library in Data Transport Services in CA Software Delivery r11.2 C1, C2, C3, and SP4; Unicenter Software Delivery 4.0 C3; CA Advantage Data Transport 3.0 C1; and CA IT Client Manager r12 allows remote attackers to execute arbitrary code via crafted data.
[1022688]
[20090806 CA20090806-01: Security Notice for Data Transport Services]
[35984]
[ADV-2009-2195]
[http://www.zerodayinitiative.com/advisories/ZDI-09-052/]
[ca-multiple-dtscore-bo(52322)]
[https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=214090]
The Installer in Apple Safari before 4.0 on Windows allows local users to gain privileges by checking a box that specifies an immediate launch of the application after installation, related to an unspecified compression method.
[APPLE-SA-2009-06-08-1]
[http://support.apple.com/kb/HT3613]
[35339]
[safari-installer-privilege-escalation(51290)]
Multiple unspecified vulnerabilities in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 have unknown impact and attack vectors, related to "Adobe internally discovered issues."
[GLSA-200907-06]
[http://www.adobe.com/support/security/bulletins/apsb09-07.html]
[RHSA-2009:1109]
[acrobat-reader-multiple-unspecified(51126)]
Unspecified vulnerability in rpc.nisd in Sun Solaris 8 through 10, and OpenSolaris before snv_104, allows remote authenticated users to cause a denial of service (NIS+ daemon hang) via unspecified vectors related to NIS+ callbacks.
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-112960-67-1]
[256748]
[35276]
[ADV-2009-1566]
[oval:org.mitre.oval:def:6331]
Unspecified vulnerability in the XML Digital Signature verification functionality in JVA-RUN in JDK 6.0 in IBM OS/400 i5/OS V5R4M0 and V6R1M0 has unknown impact and attack vectors related to "XML SECURITY PATCH."
[20090611 Why are SE38042 and SE38043 APARs related to security?]
[35265]
[ADV-2009-1536]
[SE38042]
[SE38043]
[os400-xml-unspecified(51005)]
smbfs in Sun OpenSolaris snv_84 through snv_110, when default mount permissions are used, allows local users to read arbitrary files, and list arbitrary directories, on CIFS volumes.
[257548]
[35306]
[ADV-2009-1569]
Cross-site scripting (XSS) vulnerability in search.asp in PDshopPro, when downloaded before 20070308, allows remote attackers to inject arbitrary web script or HTML via the search parameter.
[http://packetstorm.linuxsecurity.com/0906-exploits/pdshoppro-xss.txt]
Cross-site scripting (XSS) vulnerability in index.php in Yogurt 0.3 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
[35324]
[8932]
SQL injection vulnerability in writemessage.php in Yogurt 0.3, when register_globals is enabled, allows remote authenticated users to execute arbitrary SQL commands via the original parameter.
[35324]
[8932]
Unspecified vulnerability in Services 6.x before 6.x-0.14, a module for Drupal, when key-based access is enabled, allows remote attackers to read or add keys and access unauthorized services via unspecified vectors.
[http://drupal.org/node/487784]
[http://drupal.org/node/488004]
[35292]
SQL injection vulnerability in index.php in Open Biller 0.1 allows remote attackers to execute arbitrary SQL commands via the username parameter.
[20090610 (Post Form login var 'username') BLIND SQLi exploit--Open Biller 0.1-->]
[8927]
Multiple directory traversal vulnerabilities in Online Grades & Attendance 3.2.5 and earlier, and possibly 3.2.6, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) GLOBALS[SKIN] parameter to index.php and the (2) skin parameter to admin/admin.php.
[onlinegrades-globalsskin-file-include(50901)]
[onlinegrades-admin-file-include(50902)]
[8853]
Unspecified vulnerability in the Finnish Bank Payment module 2.2 for osCommerce has unknown impact and attack vectors related to bank charges.
[http://addons.oscommerce.com/info/5485]
[http://www.cert.fi/haavoittuvuudet/2009/haavoittuvuus-2009-046.html]
[finnishbank-unspecified-security-bypass(51007)]
Unspecified vulnerability in the Luottokunta module before 1.3 for osCommerce has unknown impact and attack vectors related to orders.
[http://addons.oscommerce.com/info/3698]
[http://www.cert.fi/haavoittuvuudet/2009/haavoittuvuus-2009-046.html]
[35191]
[luottokunta-unspecified-security-bypass(50925)]
admin/options.php in Grestul 1.2 does not properly restrict access, which allows remote attackers to bypass authentication and create administrative accounts via a manage_admin action in a direct request.
[grestul-options-security-bypass(50999)]
[8902]
Cross-site scripting (XSS) vulnerability in A51 D.O.O. activeCollab 0.7.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2009-1772.
[JVN#55752635]
[activecollab-unspecified-xss(51190)]
libpng before 1.2.37 does not properly parse 1-bit interlaced images with width values that are not divisible by 8, which causes libpng to include uninitialized bits in certain rows of a PNG file and might allow remote attackers to read portions of sensitive memory via "out-of-bounds pixels" in the file.
[20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues]
[20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues]
[APPLE-SA-2010-03-29-1]
[[security-announce] 20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues]
[GLSA-200906-01]
[SSA:2009-170-01]
[http://support.apple.com/kb/HT4077]
[USN-913-1]
[DSA-2032]
[http://www.libpng.org/pub/png/libpng.html]
[MDVSA-2010:063]
[35233]
[http://www.vmware.com/security/advisories/VMSA-2010-0007.html]
[ADV-2009-1510]
[ADV-2010-0637]
[ADV-2010-0682]
[ADV-2010-0847]
[libpng-interlaced-image-info-disclosure(50966)]
[FEDORA-2009-5977]
[FEDORA-2009-6400]
nsViewManager.cpp in Mozilla Firefox 3.0.2 through 3.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors related to interaction with TinyMCE.
[35413]
[https://bugzilla.mozilla.org/show_bug.cgi?id=490425]
[https://bugzilla.redhat.com/show_bug.cgi?id=488570]
[firefox-nsviewmanager-dos(51197)]
[RHSA-2009:1095]
Mozilla Firefox 3.0.10 and earlier on Linux allows remote attackers to cause a denial of service (application crash) via a URI for a large GIF image in the BACKGROUND attribute of a BODY element.
[http://e-rdc.org/v1/news.php?readmore=137]
[20090610 [ECHO_ADV_110$2009] Firefox (GNU/Linux version) <= 3.0.10 Denial Of Services]
[35280]
[https://bugzilla.mozilla.org/show_bug.cgi?id=496265]
[mozilla-firefox-gif-dos(51037)]
The Cisco Video Surveillance Stream Manager firmware before 5.3, as used on Cisco Video Surveillance Services Platforms and Video Surveillance Integrated Services Platforms, allows remote attackers to cause a denial of service (reboot) via a malformed payload in a UDP packet to port 37000, related to the xvcrman process, aka Bug ID CSCsj47924.
[http://www.cisco.com/en/US/products/products_applied_mitigation_bulletin09186a0080ad1002.html]
[20090624 Vulnerabilities in Cisco Video Surveillance Products]
[1022446]
The embedded web server on the Cisco Video Surveillance 2500 Series IP Camera with firmware before 2.1 allows remote attackers to read arbitrary files via a (1) http or (2) https request, related to the (a) SD Camera Web Server and the (b) Wireless Camera HTTP Server, aka Bug IDs CSCsu05515 and CSCsr96497.
[http://www.cisco.com/en/US/products/products_applied_mitigation_bulletin09186a0080ad1002.html]
[20090624 Vulnerabilities in Cisco Video Surveillance Products]
[35478]
[1022445]
Directory traversal vulnerability in the Administration interface in Cisco Customer Response Solutions (CRS) before 7.0(1) SR2 in Cisco Unified Contact Center Express (aka CCX) server allows remote authenticated users to read, modify, or delete arbitrary files via unspecified vectors.
[20090715 Vulnerabilities in Unified Contact Center Express Administration Pages]
[35706]
[1022569]
[ADV-2009-1913]
[unified-ccx-interface-directory-traversal(51731)]
Cross-site scripting (XSS) vulnerability in the Administration interface in Cisco Customer Response Solutions (CRS) before 7.0(1) SR2 in Cisco Unified Contact Center Express (aka CCX) server allows remote authenticated users to inject arbitrary web script or HTML into the CCX database via unspecified vectors.
[20090715 Vulnerabilities in Unified Contact Center Express Administration Pages]
[35705]
[1022569]
[ADV-2009-1913]
[unified-ccx-interface-xss(51730)]
Cisco IOS 12.0(32)S12 through 12.0(32)S13 and 12.0(33)S3 through 12.0(33)S4, 12.0(32)SY8 through 12.0(32)SY9, 12.2(33)SXI1 through 12.2(33)SXI2, 12.2XNC before 12.2(33)XNC2, 12.2XND before 12.2(33)XND1, and 12.4(24)T1; and IOS XE 2.3 through 2.3.1t and 2.4 through 2.4.0; when RFC4893 BGP routing is enabled, allows remote attackers to cause a denial of service (device reload) by using an RFC4271 peer to send a malformed update, aka Bug ID CSCta33973.
[20090729 Cisco IOS Software Border Gateway Protocol 4-Byte Autonomous System Number Vulnerabilities]
[35860]
[1022619]
[ADV-2009-2082]
[oval:org.mitre.oval:def:6853]
Cisco Unified Communications Manager (aka CUCM, formerly CallManager) before 6.1(1) allows remote attackers to cause a denial of service (voice-services outage) via a malformed header in a SIP message, aka Bug ID CSCsi46466.
[20090826 Cisco Unified Communications Manager Denial of Service Vulnerabilities]
[36152]
[1022775]
Cisco IOS 12.2 through 12.4 and 15.0 through 15.1, Cisco IOS XE 2.5.x and 2.6.x before 2.6.1, and Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.x, 5.x before 5.1(3g), 6.x before 6.1(4), and 7.x before 7.1(2) allow remote attackers to cause a denial of service (device reload or voice-services outage) via a malformed SIP INVITE message that triggers an improper call to the sipSafeStrlen function, aka Bug IDs CSCsz40392 and CSCsz43987.
[20090826 Cisco Unified Communications Manager Denial of Service Vulnerabilities]
[20100922 Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerabilities]
[36152]
[1022775]
Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.x, 5.x before 5.1(3g), 6.x before 6.1(4), 7.0 before 7.0(2), and 7.1 before 7.1(2); and Cisco Unified Presence 1.x, 6.x before 6.0(6), and 7.x before 7.0(4); allows remote attackers to cause a denial of service (TCP services outage) via a large number of TCP connections, related to "tracking of network connections," aka Bug IDs CSCsq22534 and CSCsw52371.
[1023018]
[20090826 Cisco Unified Communications Manager Denial of Service Vulnerabilities]
[20091014 Cisco Unified Presence Denial of Service Vulnerabilities]
[36152]
[36676]
[1022775]
[ADV-2009-2915]
Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.x, 5.x before 5.1(3g), 6.x before 6.1(4), 7.0 before 7.0(2a)su1, and 7.1 before 7.1(2) allows remote attackers to cause a denial of service (file-descriptor exhaustion and SCCP outage) via a flood of TCP packets, aka Bug ID CSCsx32236.
[20090826 Cisco Unified Communications Manager Denial of Service Vulnerabilities]
[36152]
[1022775]
Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.x, 5.x before 5.1(3g), 6.x before 6.1(4), 7.0 before 7.0(2a)su1, and 7.1 before 7.1(2a)su1 allows remote attackers to cause a denial of service (file-descriptor exhaustion and SIP outage) via a flood of TCP packets, aka Bug ID CSCsx23689.
[20090826 Cisco Unified Communications Manager Denial of Service Vulnerabilities]
[36152]
[1022775]
Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid attribute, as demonstrated in the wild on 17 August 2009.
[[nanog] 20090817 RE: Anyone else seeing "(invalid or corrupt AS path) 3 bytes E01100" ?]
[1022739]
[20090818 Cisco IOS XR Software Border Gateway Protocol Vulnerability]
Cisco IOS XR 3.8.1 and earlier allows remote authenticated users to cause a denial of service (process crash) via vectors involving a BGP UPDATE message with many AS numbers prepended to the AS path.
[1022756]
[20090818 Cisco IOS XR Software Border Gateway Protocol Vulnerability]
Microsoft Internet Explorer before 8 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.
[http://research.microsoft.com/apps/pubs/default.aspx?id=79323]
[http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf]
Apple Safari before 3.2.2 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.
[http://research.microsoft.com/apps/pubs/default.aspx?id=79323]
[http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf]
[safari-connect-code-execution(51193)]
Opera, possibly before 9.25, uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.
[http://research.microsoft.com/apps/pubs/default.aspx?id=79323]
[http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf]
src/net/http/http_transaction_winhttp.cc in Google Chrome before 1.0.154.53 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.
[http://code.google.com/p/chromium/issues/detail?id=7338]
[http://code.google.com/p/chromium/issues/detail?id=8473]
[http://research.microsoft.com/apps/pubs/default.aspx?id=79323]
[http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf]
[http://sites.google.com/a/chromium.org/dev/getting-involved/dev-channel/release-notes/releasenotes1015453]
[http://src.chromium.org/viewvc/chrome/branches/release_154.next/src/net/http/http_transaction_winhttp.cc?r1=11621&r2=11669&pathrev=11669]
[http://src.chromium.org/viewvc/chrome?view=rev&revision=11669]
[https://bugzilla.mozilla.org/show_bug.cgi?id=479880]
[googlechrome-connect-code-execution(51194)]
Mozilla Firefox before 3.0.10 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site.
[http://research.microsoft.com/apps/pubs/default.aspx?id=79323]
[http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf]
[35412]
[firefox-httpconnect-code-execution(51203)]
Apple Safari before 3.2.2 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site.
[http://research.microsoft.com/apps/pubs/default.aspx?id=79323]
[http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf]
[35412]
[safari-httpconnect-code-execution(51202)]
Opera, possibly before 9.25, processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site.
[http://research.microsoft.com/apps/pubs/default.aspx?id=79323]
[http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf]
[35412]
[opera-httpconnect-code-execution(51204)]
Microsoft Internet Explorer 8, and possibly other versions, detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."
[http://research.microsoft.com/apps/pubs/default.aspx?id=79323]
[http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf]
[35403]
[ie-https-security-bypass(51186)]
Mozilla Firefox 3.0.10, and possibly other versions, detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."
[http://research.microsoft.com/apps/pubs/default.aspx?id=79323]
[http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf]
[35403]
[firefox-https-security-bypass(51189)]
Apple Safari detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."
[http://research.microsoft.com/apps/pubs/default.aspx?id=79323]
[http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf]
[35403]
[safari-http-security-bypass(51187)]
Opera detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."
[http://research.microsoft.com/apps/pubs/default.aspx?id=79323]
[http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf]
[35403]
Google Chrome detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."
[http://research.microsoft.com/apps/pubs/default.aspx?id=79323]
[http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf]
[googlechrome-https-security-bypass(51192)]
Microsoft Internet Explorer before 8 displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server, which allows man-in-the-middle attackers to spoof an arbitrary https site by letting a browser obtain a valid certificate from this site during one request, and then sending the browser a crafted 502 response page upon a subsequent request.
[http://research.microsoft.com/apps/pubs/default.aspx?id=79323]
[http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf]
[35411]
Opera displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server, which allows man-in-the-middle attackers to spoof an arbitrary https site by letting a browser obtain a valid certificate from this site during one request, and then sending the browser a crafted 502 response page upon a subsequent request.
[http://research.microsoft.com/apps/pubs/default.aspx?id=79323]
[http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf]
[35411]
Google Chrome before 1.0.154.53 displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server, which allows man-in-the-middle attackers to spoof an arbitrary https site by letting a browser obtain a valid certificate from this site during one request, and then sending the browser a crafted 502 response page upon a subsequent request.
[http://code.google.com/p/chromium/issues/detail?id=7338]
[http://code.google.com/p/chromium/issues/detail?id=8473]
[http://research.microsoft.com/apps/pubs/default.aspx?id=79323]
[http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf]
[http://sites.google.com/a/chromium.org/dev/getting-involved/dev-channel/release-notes/releasenotes1015453]
[http://src.chromium.org/viewvc/chrome/branches/release_154.next/src/net/http/http_transaction_winhttp.cc?r1=11621&r2=11669&pathrev=11669]
[http://src.chromium.org/viewvc/chrome?view=rev&revision=11669]
[35411]
[https://bugzilla.mozilla.org/show_bug.cgi?id=479880]
Apple Safari does not require a cached certificate before displaying a lock icon for an https web site, which allows man-in-the-middle attackers to spoof an arbitrary https site by sending the browser a crafted (1) 4xx or (2) 5xx CONNECT response page for an https request sent through a proxy server.
[http://research.microsoft.com/apps/pubs/default.aspx?id=79323]
[http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf]
[35411]
Cross-site request forgery (CSRF) vulnerability in Linksys WRT160N wireless router hardware 1 and firmware 1.02.2 allows remote attackers to hijack the authentication of other users for unspecified requests via unknown vectors, as demonstrated using administrator privileges and actions.
[http://holisticinfosec.org/content/view/109/45/]
[34448]
[ADV-2009-0982]
[wrt160n-unspecified-csrf(49775)]
Cross-site scripting (XSS) vulnerability in Nodequeue 5.x before 5.x-2.7 and 6.x before 6.x-2.2, a module for Drupal, allows remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML via vocabulary names.
[http://drupal.org/node/488092]
[http://drupal.org/node/488102]
[http://drupal.org/node/488104]
[http://lampsecurity.org/drupal-nodeque-xss-vulnerability]
[35305]
Nodequeue 5.x before 5.x-2.7 and 6.x before 6.x-2.2, a module for Drupal, does not properly restrict access when displaying node titles, which has unknown impact and attack vectors.
[http://drupal.org/node/488092]
[http://drupal.org/node/488102]
[http://drupal.org/node/488104]
[35305]
Cross-site scripting (XSS) vulnerability in Views 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via (1) exposed filters in the Views UI administrative interface and in the (2) view name parameter in the define custom views feature. NOTE: vector 2 is only exploitable by users with administer views permissions.
[http://drupal.org/node/488068]
[http://drupal.org/node/488082]
[http://lampsecurity.org/drupal-views-xss-vulnerability]
[35304]
Drupal 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to bypass access restrictions and (1) read unpublished content from anonymous users when a view is already configured to display the content, and (2) read private content in generated queries.
[http://drupal.org/node/488068]
[http://drupal.org/node/488082]
[35304]
Multiple cross-site scripting (XSS) vulnerabilities in Booktree 5.x before 5.x-7.3 and 6.x before 6.x-1.1, a module for Drupal, allow remote attackers to inject arbitrary web script or HTML via the (1) node title and (2) node body in a tree root page.
[http://drupal.org/node/487810]
[http://drupal.org/node/487812]
[http://drupal.org/node/487828]
[35287]
Cross-site scripting (XSS) vulnerability in the administrative page interface in Taxonomy manager 5.x before 5.x-1.2 and 6.x before 6.x-1.1, a module for Drupal, allows remote authenticated users, with administer taxonomy privileges or the ability to use free tagging to add taxonomy terms, to inject arbitrary web script or HTML via (1) vocabulary names, (2) synonyms, and (3) term names.
[http://drupal.org/node/487602]
[http://drupal.org/node/487620]
[http://drupal.org/node/487818]
[http://lampsecurity.org/drupal-6-taxonomy-manager-xss-vulnerability]
[35286]
admin.php in MRCGIGUY The Ticket System 2.0 does not properly restrict access, which allows remote attackers to (1) obtain sensitive configuration information via the editconfig action or (2) change the administrator's password via the id parameter in an editop action.
[ticketsystem-admin-security-bypass(51029)]
[8917]
Directory traversal vulnerability in help.php in phpWebThings 1.5.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the module parameter.
[35313]
[8928]
SQL injection vulnerability in insidepage.php in Creative Web Solutions Multi-Level CMS 1.21 allows remote attackers to execute arbitrary SQL commands via the catid parameter. NOTE: some of these details are obtained from third party information.
[http://packetstorm.linuxsecurity.com/0905-exploits/creativecms-sql.txt]
[35018]
Cross-site scripting (XSS) vulnerability in the term data detail page in Taxonomy manager 5.x before 5.x-1.2, a module for Drupal, allows remote authenticated users, with administer taxonomy privileges or the ability to use free tagging to add taxonomy terms, to inject arbitrary web script or HTML via "Parent and related terms."
[http://drupal.org/node/487620]
[http://drupal.org/node/487818]
[http://lampsecurity.org/drupal-6-taxonomy-manager-xss-vulnerability]
[35286]
Simple Linux Utility for Resource Management (SLURM) 1.2 and 1.3 before 1.3.14 does not properly set supplementary groups before invoking (1) sbcast from the slurmd daemon or (2) strigger from the slurmctld daemon, which might allow local SLURM users to modify files and gain privileges.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=524980]
[http://sourceforge.net/project/shownotes.php?release_id=676055&group_id=157944]
[DSA-1776]
[34638]
[ADV-2009-1128]
[slurm-sbcast-priv-escalation(50126)]
[slurm-slurmctld-privilege-escalation(50127)]
The Security component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5 does not properly handle use of Identity Assertion with CSIv2 Security, which allows remote attackers to bypass intended CSIv2 access restrictions via vectors involving Enterprise JavaBeans (EJB).
[http://www-01.ibm.com/support/docview.wss?uid=swg27007951]
[http://www-01.ibm.com/support/docview.wss?uid=swg27014463]
[was-csiv2-security-bypass(52076)]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2009-1900. Reason: This candidate is a duplicate of CVE-2009-1900. Notes: All CVE users should reference CVE-2009-1900 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
The Web Services functionality in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, in certain circumstances involving the ibm-webservicesclient-bind.xmi file and custom password encryption, uses weak password obfuscation, which allows local users to cause a denial of service (deployment failure) via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg27007951]
[http://www-01.ibm.com/support/docview.wss?uid=swg27014463]
[was-webservices-weak-security(52078)]
The Servlet Engine/Web Container component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, when SPNEGO Single Sign-on (SSO) and disableSecurityPreInvokeOnFilters are configured, allows remote attackers to bypass authentication via a request for a "secure URL," related to a certain invokefilterscompatibility property.
[http://www-01.ibm.com/support/docview.wss?uid=swg24022479]
[http://www-01.ibm.com/support/docview.wss?uid=swg27007951]
[http://www-01.ibm.com/support/docview.wss?uid=swg27014463]
[was-sso-security-bypass(52079)]
The Migration component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, when tracing is enabled and a 6.1 to 7.0 migration has occurred, allows remote authenticated users to obtain sensitive information by reading a Migration Trace file.
[36156]
[http://www-01.ibm.com/support/docview.wss?uid=swg27007951]
[http://www-01.ibm.com/support/docview.wss?uid=swg27014463]
[was-migration-info-disclosure(52081)]
Unspecified vulnerability in wsadmin in the System Management/Repository component in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.5 allows remote attackers to bypass intended Java Management Extensions (JMX) Management Beans (aka MBeans) access restrictions, and cause a denial of service (daemon stop), via unknown vectors.
[36153]
[http://www-01.ibm.com/support/docview.wss?uid=swg27014463]
[was-wsadmin-security-bypass(52082)]
The System Management/Repository component in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.5 on z/OS uses weak file permissions for new applications, which allows remote attackers to obtain sensitive information via unspecified vectors.
[36157]
[http://www-01.ibm.com/support/docview.wss?uid=swg27014463]
[was-zos-information-disclosure(52083)]
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.5 does not properly read the portletServingEnabled parameter in ibm-portlet-ext.xmi, which allows remote attackers to bypass intended access restrictions via unknown vectors.
[36155]
[http://www-01.ibm.com/support/docview.wss?uid=swg27014463]
[was-ibmportlet-security-bypass(52375)]
SQL injection vulnerability in the console in IBM WebSphere Partner Gateway (WPG) Enterprise 6.0 before FP8, 6.1 before FP3, 6.1.1 before FP2, and 6.2 before FP1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
[ADV-2009-2292]
[http://www-01.ibm.com/support/docview.wss?uid=swg21382117]
[wpg-console-sql-injection(52393)]
Unspecified vulnerability in IBM WebSphere Commerce 6.0 Enterprise before 6.0.0.8, when trace is enabled, allows local users to obtain sensitive information via unknown vectors.
[http://publib.boulder.ibm.com/infocenter/wchelp/v6r0m0/topic/com.ibm.commerce.admin.doc/refs/rig_new_and_changed.htm]
[wc-trace-info-disclosure(52398)]
PHP remote file inclusion vulnerability in template/simpledefault/admin/_masterlayout.php in Mundi Mail 0.8.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the top parameter. NOTE: when allow_url_fopen is disabled, directory traversal attacks are possible to include and execute arbitrary local files.
[8948]
SQL injection vulnerability in house/listing_view.php in phpCollegeExchange 0.1.5c allows remote attackers to execute arbitrary SQL commands via the itemnr parameter.
[8962]
SQL injection vulnerability in system/application/controllers/catalog.php in Zoki Soft Zoki Catalog (aka Smart Catalog) allows remote attackers to execute arbitrary SQL commands via the search_text parameter. NOTE: some of these details are obtained from third party information.
[http://www.davidsopas.com/2009/06/15/zoki-catalog-sql-injection/]
[20090615 [DSF-02-2009] - Zoki Catalog SQL Injection]
SQL injection vulnerability in topicler.php in phPortal 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
[35387]
[8966]
SQL injection vulnerability in the iJoomla RSS Feeder (com_ijoomla_rss) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cat parameter in an xml action to index.php.
[35379]
[8959]
Directory traversal vulnerability in the JoomlaPraise Projectfork (com_projectfork) component 2.0.10 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the section parameter to index.php.
[35378]
[8946]
Directory traversal vulnerability in archive.php in TorrentVolve 1.4, when register_globals is enabled, allows remote attackers to delete arbitrary files via a .. (dot dot) in the deleteTorrent parameter.
[torrentvolve-deletetorrent-dir-traversal(51088)]
[8931]
SQL injection vulnerability in the Jumi (com_jumi) component 2.0.3 and possibly other versions for Joomla allows remote attackers to execute arbitrary SQL commands via the fileid parameter to index.php.
[35384]
[8968]
SQL injection vulnerability in the Frontend MP3 Player (fe_mp3player) 0.2.3 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
[http://typo3.org/extensions/repository/view/fe_mp3player/0.2.4/]
[http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-008/]
[35394]
Cross-site scripting (XSS) vulnerability in the Modern Guestbook / Commenting System (ve_guestbook) extension 2.7.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://typo3.org/extensions/repository/view/ve_guestbook/2.7.2/]
[http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-009/]
[35397]
SQL injection vulnerability in the References database (t3references) extension 0.1.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
[http://typo3.org/extensions/repository/view/t3references/0.1.2/]
[http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-008/]
[35392]
SQL injection vulnerability in the Virtual Civil Services (civserv) extension 4.3.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
[http://typo3.org/extensions/repository/view/civserv/4.3.3/]
[http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-007/]
[35395]
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Webmedia Explorer (webmex) 5.09 and 5.10 allow remote attackers to inject arbitrary web script or HTML via event handlers such as onmouseover in the (1) search or (2) tag parameters; (3) arbitrary invalid parameter names that are not properly handled when triggered on a column; (4) bookmark parameter in an edit action; or (5) email parameter in a remember action.
[http://forum.intern0t.net/intern0t-advisories/1123-intern0t-webmedia-explorer-cross-site-scripting-vulnerability.html]
[20090612 [InterN0T] Webmedia Explorer - XSS Vulnerability]
[35368]
git-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request containing extra unrecognized arguments.
[http://article.gmane.org/gmane.comp.version-control.git/120733]
[GLSA-200907-05]
[http://thread.gmane.org/gmane.comp.version-control.git/120724]
[MDVSA-2009:155]
[[oss-security] 20090612 Git daemon infinite loop]
[35338]
[1022398]
[ADV-2009-1579]
[gitdaemon-xinetd-dos(51083)]
[FEDORA-2009-6809]
[FEDORA-2009-6936]
[FEDORA-2009-6839]
[[fedora-security-list] 20090612 git daemon DoS]
Multiple directory traversal vulnerabilities in FretsWeb 1.2 allow remote attackers to read arbitrary files via directory traversal sequences in the (1) language parameter to charts.php and the (2) fretsweb_language cookie parameter to unspecified vectors, possibly related to admin/common.php.
[8979]
Multiple directory traversal vulnerabilities in DB Top Sites 1.0, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the u parameter to (1) full.php, (2) index.php, and (3) contact.php.
[dbtopsites-index-file-include(51120)]
[8952]
Static code injection vulnerability in add_reg.php in DB Top Sites 1.0 allows remote attackers to inject arbitrary PHP code via a crafted (1) url and (2) location parameter.
[dbtopsites-addreg-code-execution(51121)]
[8951]
Directory traversal vulnerability in include/page_bottom.php in phpFK 7.03 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the _FORUM[settings_design_style] parameter.
[8975]
Multiple SQL injection vulnerabilities in FretsWeb 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) name parameter to player.php and the (2) hash parameter to song.php.
[http://sourceforge.net/forum/forum.php?forum_id=966939]
[8980]
Multiple cross-site scripting (XSS) vulnerabilities in admin.php in SkyBlueCanvas 1.1 r237 allow remote attackers to inject arbitrary web script or HTML via the (1) mgroup, (2) mgr, (3) objtype, (4) id, and (5) dir parameters.
[http://forum.intern0t.net/intern0t-advisories/1120-intern0t-skybluecanvas-1-1-r237-multiple-vulnerabilities.html]
[20090612 [InterN0T] SkyBlueCanvas 1.1 r237 - Multiple Vulnerabilities]
[skybluecanvas-admin-xss(51165)]
admin.php in SkyBlueCanvas 1.1 r237 allows remote authenticated administrators to obtain sensitive information via an invalid id parameter, which reveals the installation path in an error message.
[20090612 [InterN0T] SkyBlueCanvas 1.1 r237 - Multiple Vulnerabilities]
[skybluecanvas-admin-path-disclosure(51164)]
Directory traversal vulnerability in admin.php in SkyBlueCanvas 1.1 r237 allows remote authenticated administrators to list directory contents via a .. (dot dot) in the dir parameter.
[http://forum.intern0t.net/intern0t-advisories/1120-intern0t-skybluecanvas-1-1-r237-multiple-vulnerabilities.html]
[20090612 [InterN0T] SkyBlueCanvas 1.1 r237 - Multiple Vulnerabilities]
uye_paneli.php in phPortal 1.0 allows remote attackers to bypass authentication and obtain administrative access by setting the kulladi cookie to a valid username.
[8981]
Integer overflow in IrfanView 4.23, when the resampling or screen fitting option is enabled, allows remote attackers to execute arbitrary code via a crafted TIFF 1 BPP image, which triggers a heap-based buffer overflow.
[http://www.irfanview.com/main_history.htm]
[35423]
Cross-site scripting (XSS) vulnerability in the login interface (my.logon.php3) in F5 FirePass SSL VPN 5.5 through 5.5.2 and 6.0 through 6.0.3 allows remote attackers to inject arbitrary web script or HTML via a base64-encoded xcho parameter.
[20090611 F5 FirePass Cross-Site Scripting vulnerability]
[35312]
[1022387]
[ADV-2009-1570]
[firepasssslvpn-unspecified-xss(51064)]
[https://www.fox-it.com/nl/nieuws-en-events/nieuws/laatste-nieuws/nieuwsartikel/f5-firepass-cross-site-scripting-vulnerability/106]
[https://www.fox-it.com/uploads/pdf/advisory_xss_f5_firepass.pdf]
Multiple SQL injection vulnerabilities in TekBase All-in-One 3.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) ids parameter to admin.php, the (2) y parameter to members.php, and other unspecified vectors. NOTE: vector 1 requires administrative access.
[8977]
Buffer overflow in the browser kernel in Google Chrome before 2.0.172.33 allows remote HTTP servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted response.
[http://code.google.com/p/chromium/issues/detail?id=14508]
[http://googlechromereleases.blogspot.com/2009/06/stable-beta-update-security-fix.html]
[35462]
[1022429]
[ADV-2009-1656]
[googlechrome-httpresponse-bo(51307)]
SQL injection vulnerability in viewimg.php in the Paolo Palmonari Photoracer plugin 1.0 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
[35382]
[photoracer-viewimg-sql-injection(51152)]
[8961]
Multiple SQL injection vulnerabilities in Elvin 1.2.0 allow remote attackers to execute arbitrary SQL commands via the (1) inUser (aka Username) and (2) inPass (aka Password) parameters to (a) inc/login.ei, reachable through login.php; and the (3) id parameter to (b) show_bug.php and (c) show_activity.php. NOTE: it was later reported that vector 3c also affects 1.2.2.
[8953]
[9342]
Directory traversal vulnerability in page.php in Elvin 1.2.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the id parameter.
[8953]
delete_bug.php in Elvin before 1.2.1 does not require administrative privileges, which allows remote authenticated users to bypass intended access restrictions and delete arbitrary bugs.
[http://bugs.elvinbts.org/show_bug.php?id=50]
Cross-site scripting (XSS) vulnerability in close_bug.php in Elvin before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the title (aka subject) field.
[http://bugs.elvinbts.org/show_bug.php?id=49]
Cross-site scripting (XSS) vulnerability in show_activity.php in Elvin 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
[8953]
SQL injection vulnerability in close_bug.php in Elvin before 1.2.1 allows remote attackers to execute arbitrary SQL commands via the title (aka subject) field.
[http://bugs.elvinbts.org/show_bug.php?id=49]
Cross-site request forgery (CSRF) vulnerability in login.php in Elvin 1.2.0 allows remote attackers to hijack the authentication of arbitrary users via a logout action.
[8953]
Elvin 1.2.0 allows remote attackers to read the PHP source code of (1) login.ei, (2) jump_bug.ei, or (3) create_account.ei in inc/ via a direct request.
[8953]
Cross-site scripting (XSS) vulnerability in 4images 1.7.7 and earlier allows remote authenticated users to inject arbitrary web script or HTML by providing a crafted user_homepage parameter to member.php, and then posting a comment associated with a picture.
[http://www.4homepages.de/forum/index.php?topic=15186.0]
[35342]
[ADV-2009-1582]
[4images-homepage-xss(51090)]
[8936]
Directory traversal vulnerability in global.php in 4images before 1.7.7, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the l parameter.
[http://bbs.wolvez.org/topic/56/]
[http://www.4homepages.de/forum/index.php?topic=15186.0]
Multiple cross-site scripting (XSS) vulnerabilities in Pivot 1.40.4 and 1.40.7 allow remote attackers to inject arbitrary web script or HTML via the (1) menu or (2) sort parameter to pivot/index.php, (3) the value of a check array parameter in a delete action to pivot/index.php, (4) the element name in a check array parameter in a delete action to pivot/index.php, (5) the edituser parameter in an edituser action to pivot/index.php, (6) the edit parameter in a templates action to pivot/index.php, (7) the blog parameter in a blog_edit1 action to pivot/index.php, (8) the cat parameter in a cat_edit action to pivot/index.php, (9) a certain form field in a doaction=1 request to pivot/index.php, (10) the url field in a my_weblog edit_prefs action to pivot/user.php, or (11) the username (aka name) field in a my_weblog reg_user action to pivot/user.php.
[http://forum.intern0t.net/intern0t-advisories/1119-intern0t-pivot-1-40-4-7-multiple-vulnerabilities.html]
[20090612 [InterN0T] Pivot 1.40.4-7 - Multiple Vulnerabilities]
[35363]
[pivot-index-xss(51098)]
[pivot-visitor-xss(51099)]
[8941]
pivot/tb.php in Pivot 1.40.4 and 1.40.7 allows remote attackers to obtain sensitive information via an invalid url parameter, which reveals the installation path in an error message.
[http://forum.intern0t.net/intern0t-advisories/1119-intern0t-pivot-1-40-4-7-multiple-vulnerabilities.html]
[20090612 [InterN0T] Pivot 1.40.4-7 - Multiple Vulnerabilities]
[8941]
Multiple race conditions in the Solaris Event Port API in Sun Solaris 10 and OpenSolaris before snv_107 allow local users to cause a denial of service (panic) via unspecified vectors related to a race between the port_dissociate and close functions.
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-141414-01-1]
[260449]
[http://support.avaya.com/elmodocs2/security/ASA-2009-246.htm]
[35437]
[1022422]
[ADV-2009-1634]
[solaris-eventportapi-dos(51284)]
[oval:org.mitre.oval:def:5906]
Unspecified vulnerability in the TCP/IP networking stack in Sun Solaris 10, and OpenSolaris snv_01 through snv_82 and snv_111 through snv_117, when a Cassini GigaSwift Ethernet Adapter (aka CE) interface is used, allows remote attackers to cause a denial of service (panic) via vectors involving jumbo frames.
Per http://sunsolve.sun.com/search/document.do?assetkey=1-66-257008-1
"Note 2: A system is only vulnerable to this issue if it is using a GigaSwift Ethernet Adapter (CE) interface (ce(7D)) which has been configured to accept jumbo frames, and hardware checksumming is enabled."
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-141414-01-1]
[257008]
[ADV-2009-2555]
Memory leak in the Ultra-SPARC T2 crypto provider device driver (aka n2cp) in Sun Solaris 10, and OpenSolaris snv_54 through snv_112, allows context-dependent attackers to cause a denial of service (memory consumption) via unspecified vectors related to a large keylen value.
[http://sunsolve.sun.com/search/document.do?assetkey=1-21-140386-03-1]
[258828]
Multiple open redirect vulnerabilities in TBDev.NET 01-01-08 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the returnto parameter to login.php or (2) the returnto parameter in a delete action to news.php. NOTE: this can be leveraged for cross-site scripting (XSS) by redirecting to a data: URI.
[http://forum.intern0t.net/intern0t-advisories/1121-intern0t-tbdev-01-01-2008-multiple-vulnerabilities.html]
[8942]
Heap-based buffer overflow in svtools/source/filter.vcl/wmf/enhwmf.cxx in Go-oo 2.x and 3.x before 3.0.1, previously named ooo-build and related to OpenOffice.org (OOo), allows remote attackers to execute arbitrary code via a crafted EMF file, a similar issue to CVE-2008-2238.
[http://cgit.freedesktop.org/ooo-build/ooo-build/commit/?id=49b4e38571912a7d28c4044e5b2bd57e51c77d55]
[SUSE-SR:2009:015]
[[oss-security] 20090910 Re: OpenOffice.org CVE-2009-2139]
[[oss-security] 20090911 Re: OpenOffice.org CVE-2009-2139]
[[oss-security] 20090922 Re: [oss-security] OpenOffice.org CVE-2009-2139]
[DSA-1880]
[MDVSA-2010:035]
[MDVSA-2010:091]
[MDVSA-2010:105]
[[oss-security] 20091026 Re: CVE-2009-3239 is a duplicate of CVE-2009-2139 and CVE-2009-2140]
[36291]
Multiple heap-based buffer overflows in cppcanvas/source/mtfrenderer/emfplus.cxx in Go-oo 2.x and 3.x before 3.0.1, previously named ooo-build and related to OpenOffice.org (OOo), allow remote attackers to execute arbitrary code via a crafted EMF+ file, a similar issue to CVE-2008-2238.
[http://cgit.freedesktop.org/ooo-build/ooo-build/commit/?id=49b4e38571912a7d28c4044e5b2bd57e51c77d55]
[[oss-security] 20090910 Re: OpenOffice.org CVE-2009-2139]
[[oss-security] 20090911 Re: OpenOffice.org CVE-2009-2139]
[[oss-security] 20090922 Re: [oss-security] OpenOffice.org CVE-2009-2139]
[MDVSA-2010:035]
[MDVSA-2010:091]
[MDVSA-2010:105]
Multiple cross-site scripting (XSS) vulnerabilities in TBDev.NET 01-01-08 allow remote attackers to inject arbitrary web script or HTML via (1) the returnto parameter to makepoll.php, (2) the returnto parameter in a delete action to polls.php, or the (3) Info or (4) Avatar field to my.php.
[http://forum.intern0t.net/intern0t-advisories/1121-intern0t-tbdev-01-01-2008-multiple-vulnerabilities.html]
[8942]
Multiple SQL injection vulnerabilities in admin/index.asp in Zip Store Chat 4.0 and 5.0 allow remote attackers to execute arbitrary SQL commands via the (1) login and (2) senha parameters.
[ADV-2009-1581]
[8935]
PHP remote file inclusion vulnerability in firestats-wordpress.php in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the fs_javascript parameter.
[http://firestats.cc/wiki/ChangeLog#a1.6.2-stable13062009]
[8945]
SQL injection vulnerability in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
[http://firestats.cc/wiki/ChangeLog#a1.6.2-stable13062009]
Multiple cross-site scripting (XSS) vulnerabilities in transLucid 1.75 allow remote attackers to inject arbitrary web script or HTML via the (a) NodeID and (b) action parameters to the default URI, and the (c) NodeID parameter to the default URI for the admin section; and allow remote authenticated users to inject arbitrary web script or HTML via the (d) Title (aka page name) and (e) Url fields in a (1) new or (2) modified page.
[http://forum.intern0t.net/intern0t-advisories/1122-intern0t-translucid-1-75-multiple-vulnerabilities.html]
[8943]
Unrestricted file upload vulnerability in the Compose Email feature in the Emails module in Sugar Community Edition (aka SugarCRM) before 5.2f allows remote authenticated users to execute arbitrary code by uploading a file with only an extension in its name, then accessing the file via a direct request to a modified filename under cache/modules/Emails/, as demonstrated using .php as the entire original name.
[35361]
[http://www.sugarforge.org/frs/download.php/5598/Sugar_CommunityEdition_ReleaseNotes_5.2f.pdf]
[http://www.ush.it/team/ush/hack-sugarcrm_520e/adv.txt]
SQL injection vulnerability in fdown.php in phpWebThings 1.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
[35336]
[phpwebthings-fdown-sql-injection(51094)]
[8939]
SQL injection vulnerability in news/index.php in Campus Virtual-LMS allows remote attackers to execute arbitrary SQL commands via the id parameter.
[ADV-2009-1583]
[8937]
Multiple cross-site scripting (XSS) vulnerabilities in Campus Virtual-LMS allow remote attackers to inject arbitrary web script or HTML via the (1) courseid parameter to enrolments/step1.php, or the (2) search or (3) siteid parameter to files/shared_list.php.
[ADV-2009-1583]
[8937]
Multiple cross-site request forgery (CSRF) vulnerabilities in Campus Virtual-LMS allow (1) remote attackers to hijack the authentication of arbitrary users for requests that terminate a session via login/logout.php, and might allow remote attackers to hijack the authentication of certain users via a (2) ADD or (3) DELETE action to enrolments/step2.php.
[8937]
Directory traversal vulnerability in index.php in AdaptWeb 0.9.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the newlang parameter.
[8954]
SQL injection vulnerability in a_index.php in AdaptWeb 0.9.2 allows remote attackers to execute arbitrary SQL commands via the CodigoDisciplina parameter in a TopicosCadastro1 action.
[8954]
Cross-site scripting (XSS) vulnerability in index.php in Impleo Music Collection 2.0 allows remote attackers to inject arbitrary web script or HTML via the sort parameter.
[8947]
SQL injection vulnerability in admin/login.php in Impleo Music Collection 2.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.
[8947]
Cross-site scripting (XSS) vulnerability in report/ReportViewAction.do in WebNMS Free Edition 5 allows remote attackers to inject arbitrary web script or HTML via the type parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
[webnms-reportviewaction-xss(51250)]
Multiple cross-site scripting (XSS) vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to inject arbitrary web script or HTML via (1) the Title field to requests.php, related to viewrequests.php; and (2) the Torrent Name field to torrents-upload.php, related to the logging of torrent uploads; and allow remote attackers to inject arbitrary web script or HTML via (3) the ttversion parameter to themes/default/footer.php, the (4) SITENAME and (5) CURUSER[username] parameters to themes/default/header.php, (6) the todayactive parameter to visitorstoday.php, (7) the activepeople parameter to visitorsnow.php, (8) the faq_categ[999][title] parameter to faq.php, and (9) the keepget parameter to torrents-details.php.
[20090615 [waraxe-2009-SA#074] - Multiple Vulnerabilities in TorrentTrader Classic 1.09]
[35369]
[http://www.waraxe.us/advisory-74.html]
[torrenttrader-viewrequests-xss(51144)]
[torrenttrader-multiplescripts-xss(51145)]
[8958]
Multiple SQL injection vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to execute arbitrary SQL commands via (1) the origmsg parameter to account-inbox.php; the categ parameter to (2) delreq.php and (3) admin-delreq.php; (4) the choice parameter to index.php; (5) the id parameter to modrules.php in an edited (aka edit) action; the (6) user, (7) torrent, (8) forumid, and (9) forumpost parameters to report.php; (10) the delmp parameter to take-deletepm.php; (11) the delreport parameter to takedelreport.php; (12) the delreq parameter to takedelreq.php; (13) the clases parameter to takestaffmess.php; and (14) the warndisable parameter to takewarndisable.php; and allow remote attackers to execute arbitrary SQL commands via (15) the wherecatin parameter to browse.php, (16) the limit parameter to today.php, and (17) the where parameter to torrents-details.php.
[20090615 [waraxe-2009-SA#074] - Multiple Vulnerabilities in TorrentTrader Classic 1.09]
[35369]
[http://www.waraxe.us/advisory-74.html]
[torrenttrader-browse-sql-injection(51142)]
[torrenttrader-accountinbox-sql-injection(51143)]
[torrenttrader-delreq-sql-injection(51178)]
[torrenttrader-choice-sql-injection(51179)]
[torrenttrader-modrules-sql-injection(51180)]
[torrenttrader-report-sql-injection(51181)]
[8958]
account-recover.php in TorrentTrader Classic 1.09 chooses random passwords from an insufficiently large set, which makes it easier for remote attackers to obtain a password via a brute-force attack.
[20090615 [waraxe-2009-SA#074] - Multiple Vulnerabilities in TorrentTrader Classic 1.09]
[35369]
[http://www.waraxe.us/advisory-74.html]
[torrenttrader-accountrecover-weak-security(51150)]
[8958]
backup-database.php in TorrentTrader Classic 1.09 does not require administrative authentication, which allows remote attackers to create and download a backup database by making a direct request and then retrieving a .gz file from backups/.
[20090615 [waraxe-2009-SA#074] - Multiple Vulnerabilities in TorrentTrader Classic 1.09]
[35369]
[http://www.waraxe.us/advisory-74.html]
[torrenttrader-backupdatabase-info-disc(51147)]
[8958]
TorrentTrader Classic 1.09 allows remote attackers to (1) obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function; and allows remote attackers to (2) obtain other potentially sensitive information via a direct request to check.php.
[20090615 [waraxe-2009-SA#074] - Multiple Vulnerabilities in TorrentTrader Classic 1.09]
[35369]
[http://www.waraxe.us/advisory-74.html]
[torrenttrader-check-info-disclosure(51148)]
[torrenttrader-phpinfo-info-disclosure(51149)]
[8958]
Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic 1.09, when used on a case-insensitive web site, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ss_uri parameter, in conjunction with a modified component name.
[20090615 [waraxe-2009-SA#074] - Multiple Vulnerabilities in TorrentTrader Classic 1.09]
[35369]
[http://www.waraxe.us/advisory-74.html]
[torrenttrader-ssuri-file-include(51146)]
[8958]
Cross-site scripting (XSS) vulnerability in the XOOPS MANIAC PukiWikiMod module 1.6.6.2 and earlier for XOOPS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[JVN#12244807]
[JVNDB-2009-000041]
[http://xoops.hypweb.net/wiki/6005.html]
[pukiwikimod-unspecified-xss(51260)]
Cross-site scripting (XSS) vulnerability in login/default.aspx in Sitecore CMS before 6.0.2 Update-1 090507 allows remote attackers to inject arbitrary web script or HTML via the sc_error parameter.
[http://forum.intern0t.net/intern0t-advisories/1082-intern0t-sitecore-net-6-0-0-cross-site-scripting-vulnerability.html]
[20090603 [InterN0T] SiteCore.NET 6.0.0 - XSS Vulnerability]
[20090605 Re: [InterN0T] SiteCore.NET 6.0.0 - XSS Vulnerability-fixed]
Multiple SQL injection vulnerabilities in Kjtechforce mailman beta1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the code parameter to activate.php or (2) the dest parameter to index.php.
[20090605 ('dest') Blind (SQLi) EXPLOIT --Kjtechforce mailman Beta-1 -->]
[8884]
[8885]
SerendipityNZ (aka SimpleBoxes) Serene Bach 2.20R and earlier, and 3.00 beta023 and earlier 3.x versions, uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a modified id.
[JVN#20689557]
[JVNDB-2009-000035]
[http://serenebach.net/log/sb221R.html]
[35254]
Absolute path traversal vulnerability in cvs.php in OCS Inventory NG before 1.02.1 on Unix allows remote attackers to read arbitrary files via a full pathname in the log parameter.
[http://www.leidecker.info/advisories/2009-05-30-ocs_inventory_ng_directory_traversal.shtml]
[20090602 OCS Inventory NG 1.02 - Directory Traversal]
[ocsinventory-cvs-info-disclosure(50946)]
[8868]
Multiple SQL injection vulnerabilities in cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter.
[ADV-2009-1491]
[egyplus-login-sql-injection(50935)]
[8865]
cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier sends a redirect to the web browser but does not exit when the supplied credentials are incorrect, which allows remote attackers to bypass authentication by providing arbitrary username and password parameters.
[8865]
Insecure method vulnerability in the PDFVIEWER.PDFViewerCtrl.1 ActiveX control (pdfviewer.ocx) in Edraw PDF Viewer Component before 3.2.0.126 allows remote attackers to create and overwrite arbitrary files via a URL argument to the FtpConnect argument and a target filename argument to the FtpDownloadFile method. NOTE: this can be leveraged for code execution by writing to a Startup folder.