# definitions

definition_id: oval:org.debian:def:266195270362283019758241234124623211361
title: CVE-2008-2667 courier-authlib
description:
SQL injection vulnerability in the Courier Authentication Library (aka courier-authlib) before 0.60.6 on SUSE openSUSE 10.3 and 11.0, and other platforms, when MySQL and a non-Latin character set are used, allows remote attackers to execute arbitrary SQL commands via the username and unspecified other vectors.


definition_id: oval:org.debian:def:41775142378191507214414080490406484944
title: CVE-2008-2696 exiv2
description:
Exiv2 0.16 allows user-assisted remote attackers to cause a denial of service (divide-by-zero and application crash) via a zero value in Nikon lens information in the metadata of an image, related to "pretty printing" and the RationalValue::toLong function.


definition_id: oval:org.debian:def:160880390520044502916321199101870133622
title: CVE-2008-2711 fetchmail
description:
fetchmail 6.3.8 and earlier, when running in -v -v (aka verbose) mode, allows remote attackers to cause a denial of service (crash and persistent mail failure) via a malformed mail message with long headers, which triggers an erroneous dereference when using vsnprintf to format log messages.


definition_id: oval:org.debian:def:232817017648747197294725898047377045880
title: CVE-2008-2712 vim
description:
Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properly sanitize inputs before invoking the execute or system functions, as demonstrated using (1) filetype.vim, (3) xpm.vim, (4) gzip_vim, and (5) netrw.  NOTE: the originally reported version was 7.1.314, but the researcher actually found this set of issues in 7.1.298.  NOTE: the zipplugin issue (originally vector 2 in this identifier) has been subsumed by CVE-2008-3075.


definition_id: oval:org.debian:def:27642319676158082471421152261733679831
title: CVE-2008-2713 clamav
description:
libclamav/petite.c in ClamAV before 0.93.1 allows remote attackers to cause a denial of service via a crafted Petite file that triggers an out-of-bounds read.


definition_id: oval:org.debian:def:293624542349449925800970560563971562841
title: CVE-2008-2719 nasm
description:
Off-by-one error in the ppscan function (preproc.c) in Netwide Assembler (NASM) 2.02 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted file that triggers a stack-based buffer overflow.


definition_id: oval:org.debian:def:321118587504241224383775400290753729726
title: CVE-2008-2827 perl
description:
The rmtree function in lib/File/Path.pm in Perl 5.10 does not properly check permissions before performing a chmod, which allows local users to modify the permissions of arbitrary files via a symlink attack, a different vulnerability than CVE-2005-0448 and CVE-2004-0452.


definition_id: oval:org.debian:def:241131280590769300852714097769375812272
title: CVE-2008-2935 libxslt
description:
Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4DecryptFunction) functions in crypto.c in libexslt in libxslt 1.1.8 through 1.1.24 allow context-dependent attackers to execute arbitrary code via an XML file containing a long string as "an argument in the XSL input."


definition_id: oval:org.debian:def:298866092690735717341457214165559807618
title: CVE-2008-2936 postfix
description:
Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a root-owned symlink points, by creating a hard link to this symlink and then sending a message.  NOTE: this can be leveraged to gain privileges if there is a symlink to an init script.


definition_id: oval:org.debian:def:145526028241616360663931245225707085167
title: CVE-2008-2937 postfix
description:
Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name.


definition_id: oval:org.debian:def:272978514291316008078524881775422252742
title: CVE-2008-2940 hplip
description:
The alert-mailing implementation in HP Linux Imaging and Printing (HPLIP) 1.6.7 allows local users to gain privileges and send e-mail messages from the root account via vectors related to the setalerts message, and lack of validation of the device URI associated with an event message.


definition_id: oval:org.debian:def:63360460354996372987954439091299042946
title: CVE-2008-2941 hplip
description:
The hpssd message parser in hpssd.py in HP Linux Imaging and Printing (HPLIP) 1.6.7 allows local users to cause a denial of service (process stop) via a crafted packet, as demonstrated by sending "msg=0" to TCP port 2207.


definition_id: oval:org.debian:def:339846069374057914237733617815247665184
title: CVE-2008-2942 mercurial
description:
Directory traversal vulnerability in patch.py in Mercurial 1.0.1 allows user-assisted attackers to modify arbitrary files via ".." (dot dot) sequences in a patch file.


definition_id: oval:org.debian:def:28149195677153325311991664297270644969
title: CVE-2008-2950 poppler
description:
The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not initialized by a Page constructor, which allows remote attackers to execute arbitrary code via a crafted PDF document.


definition_id: oval:org.debian:def:109978228412479270955686127519046817224
title: CVE-2008-2951 trac
description:
Open redirect vulnerability in the search script in Trac before 0.10.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter, possibly related to the quickjump function.


definition_id: oval:org.debian:def:309835213140795372792208532770979555074
title: CVE-2008-2952 openldap
description:
liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of service (program termination) via crafted ASN.1 BER datagrams that trigger an assertion error.


definition_id: oval:org.debian:def:213856015885597924308691017274575460382
title: CVE-2008-2955 pidgin
description:
Pidgin 2.4.1 allows remote attackers to cause a denial of service (crash) via a long filename that contains certain characters, as demonstrated using an MSN message that triggers the crash in the msn_slplink_process_msg function.


definition_id: oval:org.debian:def:88568950280442167580285525088253270310
title: CVE-2008-2957 pidgin
description:
The UPnP functionality in Pidgin 2.0.0, and possibly other versions, allows remote attackers to trigger the download of arbitrary files and cause a denial of service (memory or disk consumption) via a UDP packet that specifies an arbitrary URL.


definition_id: oval:org.debian:def:116789426083328482554052818710471716991
title: CVE-2008-3067 sudo
description:
sudo in SUSE openSUSE 10.3 does not clear the stdin buffer when password entry times out, which might allow local users to obtain a password by reading stdin from the parent process after a sudo child process exits.


definition_id: oval:org.debian:def:301871749130974350410712230966785065943
title: CVE-2008-3074 vim
description:
The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a tar archive and possibly (2) the filename of the first file in a tar archive, which is not properly handled by the VIM TAR plugin (tar.vim) v.10 through v.22, as demonstrated by the shellescape, tarplugin.v2, tarplugin, and tarplugin.updated test cases.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712. NOTE: this issue has the same root cause as CVE-2008-3075.  NOTE: due to the complexity of the associated disclosures and the incomplete information related to them, there may be inaccuracies in this CVE description and in external mappings to this identifier.


definition_id: oval:org.debian:def:209137291714897629080228377514876699670
title: CVE-2008-3075 vim
description:
The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a ZIP archive and possibly (2) the filename of the first file in a ZIP archive, which is not properly handled by zip.vim in the VIM ZIP plugin (zipPlugin.vim) v.11 through v.21, as demonstrated by the zipplugin and zipplugin.v2 test cases.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.  NOTE: this issue has the same root cause as CVE-2008-3074.  NOTE: due to the complexity of the associated disclosures and the incomplete information related to them, there may be inaccuracies in this CVE description and in external mappings to this identifier.


definition_id: oval:org.debian:def:56885200864221991929717332955814859206
title: CVE-2008-3076 vim
description:
The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test cases.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.


definition_id: oval:org.debian:def:273745248985128764494440428621956282465
title: CVE-2008-3134 graphicsmagick
description:
Multiple unspecified vulnerabilities in GraphicsMagick before 1.2.4 allow remote attackers to cause a denial of service (crash, infinite loop, or memory consumption) via (a) unspecified vectors in the (1) AVI, (2) AVS, (3) DCM, (4) EPT, (5) FITS, (6) MTV, (7) PALM, (8) RLA, and (9) TGA decoder readers; and (b) the GetImageCharacteristics function in magick/image.c, as reachable from a crafted (10) PNG, (11) JPEG, (12) BMP, or (13) TIFF file.


definition_id: oval:org.debian:def:188869651741848355131601393950400049626
title: CVE-2008-3137 wireshark
description:
The GSM SMS dissector in Wireshark (formerly Ethereal) 0.99.2 through 1.0.0 allows remote attackers to cause a denial of service (application crash) via unknown vectors.


definition_id: oval:org.debian:def:82113668145714679977465545399401870767
title: CVE-2008-3138 wireshark
description:
The (1) PANA and (2) KISMET dissectors in Wireshark (formerly Ethereal) 0.99.3 through 1.0.0 allow remote attackers to cause a denial of service (application stop) via unknown vectors.


definition_id: oval:org.debian:def:200578039590905177313116367209373887667
title: CVE-2008-3139 wireshark
description:
The RTMPT dissector in Wireshark (formerly Ethereal) 0.99.8 through 1.0.0 allows remote attackers to cause a denial of service (crash) via unknown vectors.  NOTE: this might be due to a use-after-free error.


definition_id: oval:org.debian:def:310317138317974130599287620724264297087
title: CVE-2008-3140 wireshark
description:
The syslog dissector in Wireshark (formerly Ethereal) 1.0.0 allows remote attackers to cause a denial of service (application crash) via unknown vectors, possibly related to an "incomplete SS7 MSU syslog encapsulated packet."


definition_id: oval:org.debian:def:41193744018342977353145155568621695704
title: CVE-2008-3141 wireshark
description:
Unspecified vulnerability in the RMI dissector in Wireshark (formerly Ethereal) 0.9.5 through 1.0.0 allows remote attackers to read system memory via unspecified vectors.


definition_id: oval:org.debian:def:230199533617289928061902499182168917358
title: CVE-2008-3145 wireshark
description:
The fragment_add_work function in epan/reassemble.c in Wireshark 0.8.19 through 1.0.1 allows remote attackers to cause a denial of service (crash) via a series of fragmented packets with non-sequential fragmentation offset values, which lead to a buffer over-read.


definition_id: oval:org.debian:def:170655873404211653951243215226036365107
title: CVE-2008-3146 wireshark
description:
Multiple buffer overflows in packet_ncp2222.inc in Wireshark (formerly Ethereal) 0.9.7 through 1.0.2 allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted NCP packet that causes an invalid pointer to be used.


definition_id: oval:org.debian:def:104488852119143757818217221272157853620
title: CVE-2008-3162 ffmpeg
description:
Stack-based buffer overflow in the str_read_packet function in libavformat/psxstr.c in FFmpeg before r13993 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted STR file that interleaves audio and video sectors.


definition_id: oval:org.debian:def:223718742297965294555828691608723794629
title: CVE-2008-3196 byacc
description:
skeleton.c in yacc does not properly handle reduction of a rule with an empty right hand side, which allows context-dependent attackers to cause an out-of-bounds stack access when the yacc stack pointer points to the end of the stack.


definition_id: oval:org.debian:def:283169108772708012229492280860691792977
title: CVE-2008-3214 dnsmasq
description:
dnsmasq 2.25 allows remote attackers to cause a denial of service (daemon crash) by (1) renewing a nonexistent lease or (2) sending a DHCPREQUEST for an IP address that is not in the same network, related to the DHCP NAK response from the daemon.


definition_id: oval:org.debian:def:19566830336311227537778534361599732345
title: CVE-2008-3215 clamav
description:
libclamav/petite.c in ClamAV before 0.93.3 allows remote attackers to cause a denial of service via a malformed Petite file that triggers an out-of-bounds memory access.  NOTE: this issue exists because of an incomplete fix for CVE-2008-2713.


definition_id: oval:org.debian:def:222220467271096825475119326536830482394
title: CVE-2008-3216 projectl
description:
The save function in br/prefmanager.d in projectl 1.001 creates a projectL.prf file in the current working directory, which allows local users to overwrite arbitrary files via a symlink attack.


definition_id: oval:org.debian:def:299217341305306020076708915006440125664
title: CVE-2008-3217 pdns-recursor
description:
PowerDNS Recursor before 3.1.6 does not always use the strongest random number generator for source port selection, which makes it easier for remote attack vectors to conduct DNS cache poisoning.  NOTE: this is related to incomplete integration of security improvements associated with addressing CVE-2008-1637.


definition_id: oval:org.debian:def:230245803511837777425053545331567730334
title: CVE-2008-3230 ffmpeg
description:
The ffmpeg lavf demuxer allows user-assisted attackers to cause a denial of service (application crash) via a crafted GIF file, possibly related to gstreamer, as demonstrated by lol-giftopnm.gif.


definition_id: oval:org.debian:def:32627241706216443414184105607989083033
title: CVE-2008-3258 zoph
description:
Multiple SQL injection vulnerabilities in Zoph before 0.7.0.5 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.


definition_id: oval:org.debian:def:188876944298016342302236504964477645354
title: CVE-2008-3263 asterisk
description:
The IAX2 protocol implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x before C.1.10.3; AsteriskNOW; Appliance Developer Kit 0.x.x; and s800i 1.0.x before 1.2.0.1 allows remote attackers to cause a denial of service (call-number exhaustion and CPU consumption) by quickly sending a large number of IAX2 (IAX) POKE requests.


definition_id: oval:org.debian:def:97519759119499568733926795107780723348
title: CVE-2008-3264 asterisk
description:
The FWDOWNL firmware-download implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x before C.1.10.3; AsteriskNOW; Appliance Developer Kit 0.x.x; and s800i 1.0.x before 1.2.0.1 allows remote attackers to cause a denial of service (traffic amplification) via an IAX2 FWDOWNL request.


definition_id: oval:org.debian:def:117636126394256664024715182287334918936
title: CVE-2008-3281 libxml2
description:
libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.


definition_id: oval:org.debian:def:55936970045450423739918889057301928030
title: CVE-2008-3328 trac
description:
Cross-site scripting (XSS) vulnerability in the wiki engine in Trac before 0.10.5 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.


definition_id: oval:org.debian:def:216360577046601119022017860919119245038
title: CVE-2008-3329 links2
description:
Unspecified vulnerability in Links before 2.1, when "only proxies" is enabled, has unknown impact and attack vectors related to providing "URLs to external programs."


definition_id: oval:org.debian:def:234315060166430258599745992709309066076
title: CVE-2008-3337 pdns
description:
PowerDNS Authoritative Server before 2.9.21.1 drops malformed queries, which might make it easier for remote attackers to poison DNS caches of other products running on other servers, a different issue than CVE-2008-1447 and CVE-2008-3217.


definition_id: oval:org.debian:def:249250488781661677015161827649767479394
title: CVE-2008-3350 dnsmasq
description:
dnsmasq 2.43 allows remote attackers to cause a denial of service (daemon crash) by (1) sending a DHCPINFORM while lacking a DHCP lease, or (2) attempting to renew a nonexistent DHCP lease for an invalid subnet as an "unknown client," a different vulnerability than CVE-2008-3214.


definition_id: oval:org.debian:def:301953332918195925705766576071889288069
title: CVE-2008-3381 moin
description:
Multiple cross-site scripting (XSS) vulnerabilities in macro/AdvancedSearch.py in moin (and MoinMoin) 1.6.3 and 1.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:320557992494004432514436798561130848294
title: CVE-2008-3422 mono
description:
Multiple cross-site scripting (XSS) vulnerabilities in the ASP.net class libraries in Mono 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted attributes related to (1) HtmlControl.cs (PreProcessRelativeReference), (2) HtmlForm.cs (RenderAttributes), (3) HtmlInputButton (RenderAttributes), (4) HtmlInputRadioButton (RenderAttributes), and (5) HtmlSelect (RenderChildren).


definition_id: oval:org.debian:def:121250461662506285026363552929149953473
title: CVE-2008-3429 httrack
description:
Buffer overflow in URI processing in HTTrack and WinHTTrack before 3.42-3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long URL.


definition_id: oval:org.debian:def:329279606871604173559620713870674723321
title: CVE-2008-3459 openvpn
description:
Unspecified vulnerability in OpenVPN 2.1-beta14 through 2.1-rc8, when running on non-Windows systems, allows remote servers to execute arbitrary commands via crafted (1) lladdr and (2) iproute configuration directives, probably related to shell metacharacters.


definition_id: oval:org.debian:def:212329905225681823733892564697397285180
title: CVE-2008-3520 ghostscript
description:
Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation.


definition_id: oval:org.debian:def:165316034471239371885566776416885050415
title: CVE-2008-3522 ghostscript
description:
Buffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via vectors related to the mif_hdr_put function and use of vsprintf.


definition_id: oval:org.debian:def:286934078112818050449439572787244943265
title: CVE-2008-3532 pidgin
description:
The NSS plugin in libpurple in Pidgin 2.4.3 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service.


definition_id: oval:org.debian:def:48174063540568286716427808014440402101
title: CVE-2008-3533 yelp
description:
Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line, as demonstrated by use of yelp within (1) man or (2) ghelp URI handlers in Firefox, Evolution, and unspecified other programs.


definition_id: oval:org.debian:def:302119197104399917246163499967108196156
title: CVE-2008-3547 openttd
description:
Buffer overflow in the server in OpenTTD 0.6.1 and earlier allows remote authenticated users to cause a denial of service (persistent game disruption) or possibly execute arbitrary code via vectors involving many long names for "companies and clients."


definition_id: oval:org.debian:def:311617226279555548467053148536613905697
title: CVE-2008-3576 openttd
description:
Buffer overflow in the TruncateString function in src/gfx.cpp in OpenTTD before 0.6.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted string.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:193017171924765016859592185399832719920
title: CVE-2008-3577 openttd
description:
Buffer overflow in src/openttd.cpp in OpenTTD before 0.6.2 allows local users to execute arbitrary code via a large filename supplied to the "-g" parameter in the ttd_main function.  NOTE: it is unlikely that this issue would cross privilege boundaries in typical environments.


definition_id: oval:org.debian:def:230242664637507743905255654754924183161
title: CVE-2008-3632 qt4-x11
description:
Use-after-free vulnerability in WebKit in Apple iPod touch 1.1 through 2.0.2, and iPhone 1.0 through 2.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a web page with crafted Cascading Style Sheets (CSS) import statements.


definition_id: oval:org.debian:def:111485663939621910884774711382337242588
title: CVE-2008-3639 cups
description:
Heap-based buffer overflow in the read_rle16 function in imagetops in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via an SGI image with malformed Run Length Encoded (RLE) data containing a small image and a large row count.


definition_id: oval:org.debian:def:28377303810753728848222935127684230458
title: CVE-2008-3640 cups
description:
Integer overflow in the WriteProlog function in texttops in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via a crafted PostScript file that triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:4240194739567690653521586235494498513
title: CVE-2008-3641 cups
description:
The Hewlett-Packard Graphics Language (HPGL) filter in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via crafted pen width and pen color opcodes that overwrite arbitrary memory.


definition_id: oval:org.debian:def:242211544189278254513800492554733084564
title: CVE-2008-3688 havp
description:
sockethandler.cpp in HTTP Antivirus Proxy (HAVP) 0.88 allows remote attackers to cause a denial of service (hang) by connecting to a non-responsive server, which triggers an infinite loop due to an uninitialized variable.


definition_id: oval:org.debian:def:129457590547990150549067517749109650704
title: CVE-2008-3714 awstats
description:
Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web script or HTML via the query_string, a different vulnerability than CVE-2006-3681 and CVE-2006-1945.


definition_id: oval:org.debian:def:196837357850279607803873292172837087026
title: CVE-2008-3732 vlc
description:
Integer overflow in the Open function in modules/demux/tta.c in VLC Media Player 0.8.6i allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TTA file, which triggers a heap-based buffer overflow.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:135640869747638530067084525692743818491
title: CVE-2008-3746 neon27
description:
neon 0.28.0 through 0.28.2 allows remote servers to cause a denial of service (NULL pointer dereference and crash) via vectors related to Digest authentication, Digest domain parameter support, and the parse_domain function.


definition_id: oval:org.debian:def:109724073454111688356689683427501348044
title: CVE-2008-3747 wordpress
description:
The (1) get_edit_post_link and (2) get_edit_comment_link functions in wp-includes/link-template.php in WordPress before 2.6.1 do not force SSL communication in the intended situations, which might allow remote attackers to gain administrative access by sniffing the network for a cookie.


definition_id: oval:org.debian:def:331079830793094399631115997313009781320
title: CVE-2008-3789 samba
description:
Samba 3.2.0 uses weak permissions (0666) for the (1) group_mapping.tdb and (2) group_mapping.ldb files, which allows local users to modify the membership of Unix groups.


definition_id: oval:org.debian:def:26364691486108578628741249185949356536
title: CVE-2008-3791 gpicview
description:
src/main-win.c in GPicView 0.1.9 in Lightweight X11 Desktop Environment (LXDE) allows local users to overwrite arbitrary files via a symlink attack on the /tmp/rot.jpg temporary file.


definition_id: oval:org.debian:def:8110448256146615958577030873193697828
title: CVE-2008-3794 vlc
description:
Integer signedness error in the mms_ReceiveCommand function in modules/access/mms/mmstu.c in VLC Media Player 0.8.6i allows remote attackers to execute arbitrary code via a crafted mmst link with a negative size value, which bypasses a size check and triggers an integer overflow followed by a heap-based buffer overflow.


definition_id: oval:org.debian:def:179119273264339222706720303940947998031
title: CVE-2008-3827 mplayer
description:
Multiple integer underflows in the Real demuxer (demux_real.c) in MPlayer 1.0_rc2 and earlier allow remote attackers to cause a denial of service (process termination) and possibly execute arbitrary code via a crafted video file that causes the stream_read function to read or write arbitrary memory.


definition_id: oval:org.debian:def:17150963541325650009340851204767583853
title: CVE-2008-3834 dbus
description:
The dbus_signature_validate function in the D-bus library (libdbus) before 1.2.4 allows remote attackers to cause a denial of service (application abort) via a message containing a malformed signature, which triggers a failed assertion error.


definition_id: oval:org.debian:def:71430733100562265128149352587978702838
title: CVE-2008-3863 enscript
description:
Stack-based buffer overflow in the read_special_escape function in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e (aka special escapes processing) option is enabled, allows user-assisted remote attackers to execute arbitrary code via a crafted ASCII file, related to the setfilename command.


definition_id: oval:org.debian:def:162943345124620768091070721793763145438
title: CVE-2008-3889 postfix
description:
Postfix 2.4 before 2.4.9, 2.5 before 2.5.5, and 2.6 before 2.6-20080902, when used with the Linux 2.6 kernel, leaks epoll file descriptors during execution of "non-Postfix" commands, which allows local users to cause a denial of service (application slowdown or exit) via a crafted command, as demonstrated by a command in a .forward file.


definition_id: oval:org.debian:def:14824271644582107488635386352552051910
title: CVE-2008-3903 asterisk
description:
Asterisk Open Source 1.2.x before 1.2.32, 1.4.x before 1.4.24.1, and 1.6.0.x before 1.6.0.8; Asterisk Business Edition A.x.x, B.x.x before B.2.5.8, C.1.x.x before C.1.10.5, and C.2.x.x before C.2.3.3; s800i 1.3.x before 1.3.0.2; and Trixbox PBX 2.6.1, when Digest authentication and authalwaysreject are enabled, generates different responses depending on whether a SIP username is valid, which allows remote attackers to enumerate valid usernames.


definition_id: oval:org.debian:def:41124278168033965797815597553501338291
title: CVE-2008-3904 gpicview
description:
src/main-win.c in GPicView 0.1.9 in Lightweight X11 Desktop Environment (LXDE) allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.


definition_id: oval:org.debian:def:84471733190706459626183189380934246970
title: CVE-2008-3906 mono
description:
CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the query string.


definition_id: oval:org.debian:def:256888799345439201531870054541799887195
title: CVE-2008-3907 newsbeuter
description:
The open-in-browser command in newsbeuter before 1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a feed URL.


definition_id: oval:org.debian:def:90630973187743303276022159594066469319
title: CVE-2008-3908 wordnet
description:
Multiple buffer overflows in Princeton WordNet (wn) 3.0 allow context-dependent attackers to execute arbitrary code via (1) a long argument on the command line; a long (2) WNSEARCHDIR, (3) WNHOME, or (4) WNDBVERSION environment variable; or (5) a user-supplied dictionary (aka data file).  NOTE: since WordNet itself does not run with special privileges, this issue only crosses privilege boundaries when WordNet is invoked as a third party component.


definition_id: oval:org.debian:def:303555423474296615170857908753814477575
title: CVE-2008-3909 python-django
description:
The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.


definition_id: oval:org.debian:def:228643149027634217456830599207821860396
title: CVE-2008-3910 dns2tcp
description:
dns2tcp before 0.4.1 does not properly handle negative values in a certain length field in the input argument to the (1) dns_simple_decode or (2) dns_decode function, which allows remote attackers to overwrite a buffer and have unspecified other impact.


definition_id: oval:org.debian:def:197519919818378771054215123613847311911
title: CVE-2008-3912 clamav
description:
libclamav in ClamAV before 0.94 allows attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors related to an out-of-memory condition.


definition_id: oval:org.debian:def:323034198975084220889287628398586401249
title: CVE-2008-3913 clamav
description:
Multiple memory leaks in freshclam/manager.c in ClamAV before 0.94 might allow attackers to cause a denial of service (memory consumption) via unspecified vectors related to "error handling logic".


definition_id: oval:org.debian:def:226774594476060173401857214974687651847
title: CVE-2008-3914 clamav
description:
Multiple unspecified vulnerabilities in ClamAV before 0.94 have unknown impact and attack vectors related to file descriptor leaks on the "error path" in (1) libclamav/others.c and (2) libclamav/sis.c.


definition_id: oval:org.debian:def:144232219964363702458270730784141841116
title: CVE-2008-3916 ed
description:
Heap-based buffer overflow in the strip_escapes function in signal.c in GNU ed before 1.0 allows context-dependent or user-assisted attackers to execute arbitrary code via a long filename.  NOTE: since ed itself does not typically run with special privileges, this issue only crosses privilege boundaries when ed is invoked as a third-party component.


definition_id: oval:org.debian:def:186471387172958919868748558539480024132
title: CVE-2008-3920 bitlbee
description:
Unspecified vulnerability in BitlBee before 1.2.2 allows remote attackers to "recreate" and "hijack" existing accounts via unspecified vectors.


definition_id: oval:org.debian:def:159403979498342056733541437202232694820
title: CVE-2008-3927 tiger
description:
genmsgidx in Tiger 3.2.2 allows local users to overwrite or delete arbitrary files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:272227516574845282798550226807448513019
title: CVE-2008-3930 citadel
description:
migrate_aliases.sh in Citadel Server 7.37 allows local users to overwrite arbitrary files via a symlink attack on a temporary file.


definition_id: oval:org.debian:def:78334483774745115444612090383436860258
title: CVE-2008-3931 r-base
description:
javareconf in R 2.7.2 allows local users to overwrite arbitrary files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:220346041034894681597913920532266188978
title: CVE-2008-3933 wireshark
description:
Wireshark (formerly Ethereal) 0.10.14 through 1.0.2 allows attackers to cause a denial of service (crash) via a packet with crafted zlib-compressed data that triggers an invalid read in the tvb_uncompress function.


definition_id: oval:org.debian:def:28629177468018130033651071690461028763
title: CVE-2008-3934 wireshark
description:
Unspecified vulnerability in Wireshark (formerly Ethereal) 0.99.6 through 1.0.2 allows attackers to cause a denial of service (crash) via a crafted Tektronix .rf5 file.


definition_id: oval:org.debian:def:271272984254594989387220677966373467793
title: CVE-2008-3969 bitlbee
description:
Multiple unspecified vulnerabilities in BitlBee before 1.2.3 allow remote attackers to "overwrite" and "hijack" existing accounts via unknown vectors related to "inconsistent handling of the USTATUS_IDENTIFIED state." NOTE: this issue exists because of an incomplete fix for CVE-2008-3920.


definition_id: oval:org.debian:def:198990245323912115951429570227443011501
title: CVE-2008-3970 libpam-mount
description:
pam_mount 0.10 through 0.45, when luserconf is enabled, does not verify mountpoint and source ownership before mounting a user-defined volume, which allows local users to bypass intended access restrictions via a local mount.


definition_id: oval:org.debian:def:170276378204780002616512682726119947170
title: CVE-2008-3971 gmanedit
description:
Heap-based buffer overflow in the open_man_file function in callbacks.c in gmanedit 0.4.1 allows remote attackers to execute arbitrary code via a crafted man page, which is not properly handled during utf8 conversion.  NOTE: another overflow was reported using a configuration file, but that vector does not have a scenario that crosses privilege boundaries.


definition_id: oval:org.debian:def:275658961073092214894654798683232550532
title: CVE-2008-3972 opensc
description:
pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart card unless the card's label matches the "OpenSC" string, which might allow physically proximate attackers to exploit vulnerabilities that the card owner expected were patched, as demonstrated by exploitation of CVE-2008-2235.


definition_id: oval:org.debian:def:292128117512060411360900377641887815605
title: CVE-2008-4085 plait
description:
plaiter in Plait before 1.6 allows local users to overwrite arbitrary files via a symlink attack on (1) cut.$$, (2) head.$$, (3) awk.$$, and (4) ps.$$ temporary files in /tmp/.


definition_id: oval:org.debian:def:199760325328372628262021153784006658596
title: CVE-2008-4094 rails
description:
Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.


definition_id: oval:org.debian:def:50340457903148539359229981477812131438
title: CVE-2008-4099 python-dns
description:
PyDNS (aka python-dns) before 2.3.1-4 in Debian GNU/Linux does not use random source ports or transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.


definition_id: oval:org.debian:def:144083468515107766627320631559643419396
title: CVE-2008-4100 adns
description:
GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.  NOTE: the vendor reports that this is intended behavior and is compatible with the product's intended role in a trusted environment.


definition_id: oval:org.debian:def:223466036136783547909727046629920168866
title: CVE-2008-4101 vim
description:
Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user-assisted attackers to (1) execute arbitrary shell commands by entering a K keystroke on a line that contains a ";" (semicolon) followed by a command, or execute arbitrary Ex commands by entering an argument after a (2) "Ctrl-]" (control close-square-bracket) or (3) "g]" (g close-square-bracket) keystroke sequence, a different issue than CVE-2008-2712.


definition_id: oval:org.debian:def:297537203489771359116733265992109677075
title: CVE-2008-4106 wordpress
description:
WordPress before 2.6.2 does not properly handle MySQL warnings about insertion of username strings that exceed the maximum column width of the user_login column, and does not properly handle space characters when comparing usernames, which allows remote attackers to change an arbitrary user's password to a random value by registering a similar username and then requesting a password reset, related to a "SQL column truncation vulnerability." NOTE: the attacker can discover the random password by also exploiting CVE-2008-4107.


definition_id: oval:org.debian:def:59489934305260951802196698584364804749
title: CVE-2008-4109 openssh
description:
A certain Debian patch for OpenSSH before 4.3p2-9etch3 on etch; before 4.6p1-1 on sid and lenny; and on other distributions such as SUSE uses functions that are not async-signal-safe in the signal handler for login timeouts, which allows remote attackers to cause a denial of service (connection slot exhaustion) via multiple login attempts. NOTE: this issue exists because of an incorrect fix for CVE-2006-5051.


definition_id: oval:org.debian:def:281661273293798531566848219586359963848
title: CVE-2008-4126 python-dns
description:
PyDNS (aka python-dns) before 2.3.1-5 in Debian GNU/Linux does not use random source ports for DNS requests and does not use random transaction IDs for DNS retries, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4099.


definition_id: oval:org.debian:def:180860223947232260017889728531212223082
title: CVE-2008-4191 emacspeak
description:
extract-table.pl in Emacspeak 26 and 28 allows local users to overwrite arbitrary files via a symlink attack on the extract-table.csv temporary file.


definition_id: oval:org.debian:def:259581332646324189080609520967687702404
title: CVE-2008-4201 faad2
description:
Heap-based buffer overflow in the decodeMP4file function (frontend/main.c) in FAAD2 2.6.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MPEG-4 (MP4) file.


definition_id: oval:org.debian:def:197451486444956517783844516028079032529
title: CVE-2008-4225 libxml2
description:
Integer overflow in the xmlBufferResize function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (infinite loop) via a large XML document.


definition_id: oval:org.debian:def:226632543033242763655983407175761665198
title: CVE-2008-4226 libxml2
description:
Integer overflow in the xmlSAX2Characters function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a large XML document.


definition_id: oval:org.debian:def:58826773748679645815131356713643070983
title: CVE-2008-4242 proftpd-dfsg
description:
ProFTPD 1.3.1 interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.


definition_id: oval:org.debian:def:244688064972700385511620247850796429179
title: CVE-2008-4297 mercurial
description:
Mercurial before 1.0.2 does not enforce the allowpull permission setting for a pull operation from hgweb, which allows remote attackers to read arbitrary files from a repository via an "hg pull" request.


definition_id: oval:org.debian:def:140874230796554339370394041599742346175
title: CVE-2008-4298 lighttpd
description:
Memory leak in the http_request_parse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests with duplicate request headers.


definition_id: oval:org.debian:def:136281184602462028227061127411831176091
title: CVE-2008-4306 enscript
description:
Buffer overflow in enscript before 1.6.4 has unknown impact and attack vectors, possibly related to the font escape sequence.


definition_id: oval:org.debian:def:203744493889811231125848228862727082777
title: CVE-2008-4311 dbus
description:
The default configuration of system.conf in D-Bus (aka DBus) before 1.2.6 omits the send_type attribute in certain rules, which allows local users to bypass intended access restrictions by (1) sending messages, related to send_requested_reply; and possibly (2) receiving messages, related to receive_requested_reply.


definition_id: oval:org.debian:def:176655688309705903973870032712515614810
title: CVE-2008-4314 samba
description:
smbd in Samba 3.0.29 through 3.2.4 might allow remote attackers to read arbitrary memory and cause a denial of service via crafted (1) trans, (2) trans2, and (3) nttrans requests, related to a "cut&paste error" that causes an improper bounds check to be performed.


definition_id: oval:org.debian:def:91740221096870175228844768814152418275
title: CVE-2008-4325 viewvc
description:
lib/viewvc.py in ViewVC 1.0.5 uses the content-type parameter in the HTTP request for the Content-Type header in the HTTP response, which allows remote attackers to cause content to be misinterpreted by the browser via a content-type parameter that is inconsistent with the requested object.  NOTE: this issue might not be a vulnerability, since it requires attacker access to the repository that is being viewed.


definition_id: oval:org.debian:def:315255202165396493389970538424167577207
title: CVE-2008-4359 lighttpd
description:
lighttpd before 1.4.20 compares URIs to patterns in the (1) url.redirect and (2) url.rewrite configuration settings before performing URL decoding, which might allow remote attackers to bypass intended access restrictions, and obtain sensitive information or possibly modify data.


definition_id: oval:org.debian:def:72986137950432192263333021343213867194
title: CVE-2008-4360 lighttpd
description:
mod_userdir in lighttpd before 1.4.20, when a case-insensitive operating system or filesystem is used, performs case-sensitive comparisons on filename components in configuration options, which might allow remote attackers to bypass intended access restrictions, as demonstrated by a request for a .PHP file when there is a configuration rule for .php files.


definition_id: oval:org.debian:def:294405527424340783791602699564667412686
title: CVE-2008-4395 ndiswrapper
description:
Multiple buffer overflows in the ndiswrapper module 1.53 for the Linux kernel 2.6 allow remote attackers to execute arbitrary code by sending packets over a local wireless network that specify long ESSIDs.


definition_id: oval:org.debian:def:105057926135318884244796032416987969449
title: CVE-2008-4408 mediawiki
description:
Cross-site scripting (XSS) vulnerability in MediaWiki 1.13.1, 1.12.0, and possibly other versions before 1.13.2 allows remote attackers to inject arbitrary web script or HTML via the useskin parameter to an unspecified component.


definition_id: oval:org.debian:def:150200576109788780406977910634071302319
title: CVE-2008-4474 freeradius
description:
freeradius-dialupadmin in freeradius 2.0.4 allows local users to overwrite arbitrary files via a symlink attack on temporary files in (1) backup_radacct, (2) clean_radacct, (3) monthly_tot_stats, (4) tot_stats, and (5) truncate_radacct.


definition_id: oval:org.debian:def:44936326300924367244989283449766509505
title: CVE-2008-4476 sympa
description:
sympa.pl in sympa 5.3.4 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/sympa_aliases.$$ temporary file.  NOTE: wwsympa.fcgi was also reported, but the issue occurred in a dead function, so it is not a vulnerability.


definition_id: oval:org.debian:def:111223220657318927067840044861054834450
title: CVE-2008-4539 qemu
description:
Heap-based buffer overflow in the Cirrus VGA implementation in (1) KVM before kvm-82 and (2) QEMU on Debian GNU/Linux and Ubuntu might allow local users to gain privileges by using the VNC console for a connection, aka the LGD-54XX "bitblt" heap overflow.  NOTE: this issue exists because of an incorrect fix for CVE-2007-1320.


definition_id: oval:org.debian:def:313985764026614082743203457978969364019
title: CVE-2008-4551 strongswan
description:
strongSwan 4.2.6 and earlier allows remote attackers to cause a denial of service (daemon crash) via an IKE_SA_INIT message with a large number of NULL values in a Key Exchange payload, which triggers a NULL pointer dereference for the return value of the mpz_export function in the GNU Multiprecision Library (GMP).


definition_id: oval:org.debian:def:297052634766644391268850652521697403236
title: CVE-2008-4552 nfs-utils
description:
The good_client function in nfs-utils 1.0.9, and possibly other versions before 1.1.3, invokes the hosts_ctl function with the wrong order of arguments, which causes TCP Wrappers to ignore netgroups and allows remote attackers to bypass intended access restrictions.


definition_id: oval:org.debian:def:234663554426767216851501739861363037620
title: CVE-2008-4553 qemu
description:
qemu-make-debian-root in qemu 0.9.1-5 on Debian GNU/Linux allows local users to overwrite arbitrary files via a symlink attack on temporary files and directories.


definition_id: oval:org.debian:def:180126652586303529386004246142138434369
title: CVE-2008-4555 graphviz
description:
Stack-based buffer overflow in the push_subg function in parser.y (lib/graph/parser.c) in Graphviz 2.20.2, and possibly earlier versions, allows user-assisted remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a DOT file with a large number of Agraph_t elements.


definition_id: oval:org.debian:def:45739840300228251861644152824936802277
title: CVE-2008-4558 vlc
description:
Array index error in VLC media player 0.9.2 allows remote attackers to overwrite arbitrary memory and execute arbitrary code via an XSPF playlist file with a negative identifier tag, which passes a signed comparison.


definition_id: oval:org.debian:def:141723839829227542747958859682950581296
title: CVE-2008-4575 jhead
description:
Buffer overflow in the DoCommand function in jhead before 2.84 might allow context-dependent attackers to cause a denial of service (crash) via (1) a long -cmd argument and (2) unspecified vectors related to "a bunch of potential string overflows."


definition_id: oval:org.debian:def:81180631276856068461249879164367427227
title: CVE-2008-4577 dovecot
description:
The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions.


definition_id: oval:org.debian:def:284607854468911096083804332992715270275
title: CVE-2008-4578 dovecot
description:
The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended access restrictions by using the "k" right to create unauthorized "parent/child/child" mailboxes.


definition_id: oval:org.debian:def:324907584575882474314726139719610068619
title: CVE-2008-4610 ffmpeg
description:
MPlayer allows remote attackers to cause a denial of service (application crash) via (1) a malformed AAC file, as demonstrated by lol-vlc.aac; or (2) a malformed Ogg Media (OGM) file, as demonstrated by lol-ffplay.ogm, different vectors than CVE-2007-6718.


definition_id: oval:org.debian:def:218755470502233635731512547872400959713
title: CVE-2008-4639 jhead
description:
jhead.c in Matthias Wandel jhead 2.84 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file.


definition_id: oval:org.debian:def:241177956789456776538477883524597302019
title: CVE-2008-4640 jhead
description:
The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows local users to delete arbitrary files via vectors involving a modified input filename in which (1) a final "z" character is replaced by a "t" character or (2) a final "t" character is replaced by a "z" character.


definition_id: oval:org.debian:def:89513895420150966421859255761352157969
title: CVE-2008-4641 jhead
description:
The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows attackers to execute arbitrary commands via shell metacharacters in unspecified input.


definition_id: oval:org.debian:def:38025353640243441028857412827317403600
title: CVE-2008-4654 vlc
description:
Stack-based buffer overflow in the parse_master function in the Ty demux plugin (modules/demux/ty.c) in VLC Media Player 0.9.0 through 0.9.4 allows remote attackers to execute arbitrary code via a TiVo TY media file with a header containing a crafted size value.


definition_id: oval:org.debian:def:201384022335217767282362628150753065063
title: CVE-2008-4680 wireshark
description:
packet-usb.c in the USB dissector in Wireshark 0.99.7 through 1.0.3 allows remote attackers to cause a denial of service (application crash or abort) via a malformed USB Request Block (URB).


definition_id: oval:org.debian:def:208899902562856340199388149749128443226
title: CVE-2008-4681 wireshark
description:
Unspecified vulnerability in the Bluetooth RFCOMM dissector in Wireshark 0.99.7 through 1.0.3 allows remote attackers to cause a denial of service (application crash or abort) via unknown packets.


definition_id: oval:org.debian:def:161310055294567407673748126625529678573
title: CVE-2008-4682 wireshark
description:
wtap.c in Wireshark 0.99.7 through 1.0.3 allows remote attackers to cause a denial of service (application abort) via a malformed Tamos CommView capture file (aka .ncf file) with an "unknown/unexpected packet type" that triggers a failed assertion.


definition_id: oval:org.debian:def:119934871667630265225904250532500478421
title: CVE-2008-4683 wireshark
description:
The dissect_btacl function in packet-bthci_acl.c in the Bluetooth ACL dissector in Wireshark 0.99.2 through 1.0.3 allows remote attackers to cause a denial of service (application crash or abort) via a packet with an invalid length, related to an erroneous tvb_memcpy call.


definition_id: oval:org.debian:def:195831661044379767473688607573836727299
title: CVE-2008-4684 wireshark
description:
packet-frame in Wireshark 0.99.2 through 1.0.3 does not properly handle exceptions thrown by post dissectors, which allows remote attackers to cause a denial of service (application crash) via a certain series of packets, as demonstrated by enabling the (1) PRP or (2) MATE post dissector.


definition_id: oval:org.debian:def:13039797629673554818586193920344269672
title: CVE-2008-4685 wireshark
description:
Use-after-free vulnerability in the dissect_q931_cause_ie function in packet-q931.c in the Q.931 dissector in Wireshark 0.10.3 through 1.0.3 allows remote attackers to cause a denial of service (application crash or abort) via certain packets that trigger an exception.


definition_id: oval:org.debian:def:38582709473016290753539130819007550450
title: CVE-2008-4686 vlc
description:
Multiple integer overflows in ty.c in the TY demux plugin (aka the TiVo demuxer) in VideoLAN VLC media player, probably 0.9.4, might allow remote attackers to execute arbitrary code via a crafted .ty file, a different vulnerability than CVE-2008-4654.


definition_id: oval:org.debian:def:149506432044320275262356320035311346074
title: CVE-2008-4769 wordpress
description:
Directory traversal vulnerability in the get_category_template function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5, allows remote attackers to include and possibly execute arbitrary PHP files via the cat parameter in index.php.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:137871254928264754165461505842279575406
title: CVE-2008-4770 vnc4
description:
The CMsgReader::readRect function in the VNC Viewer component in RealVNC VNC Free Edition 4.0 through 4.1.2, Enterprise Edition E4.0 through E4.4.2, and Personal Edition P4.0 through P4.4.2 allows remote VNC servers to execute arbitrary code via crafted RFB protocol data, related to "encoding type."


definition_id: oval:org.debian:def:97619213639812799845935941643683896182
title: CVE-2008-4776 kadu
description:
libgadu before 1.8.2 allows remote servers to cause a denial of service (crash) via a contact description with a large length, which triggers a buffer over-read.


definition_id: oval:org.debian:def:321566817741238486727512283345643688022
title: CVE-2008-4796 libphp-snoopy
description:
The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier, as used in (1) ampache, (2) libphp-snoopy, (3) mahara, (4) mediamate, (5) opendb, (6) pixelpost, and possibly other products, allows remote attackers to execute arbitrary commands via shell metacharacters in https URLs.


definition_id: oval:org.debian:def:145455311136400875485507351857732642489
title: CVE-2008-4829 streamripper
description:
Multiple buffer overflows in lib/http.c in Streamripper 1.63.5 allow remote attackers to execute arbitrary code via (1) a long "Zwitterion v" HTTP header, related to the http_parse_sc_header function; (2) a crafted pls playlist with a long entry, related to the http_get_pls function; or (3) a crafted m3u playlist with a long File entry, related to the http_get_m3u function.


definition_id: oval:org.debian:def:122159047349963744680969091968823099321
title: CVE-2008-4863 blender
description:
Untrusted search path vulnerability in BPY_interface in Blender 2.46 allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to an erroneous setting of sys.path by the PySys_SetArgv function.


definition_id: oval:org.debian:def:184467724825040214780320712408270395147
title: CVE-2008-4865 valgrind
description:
Untrusted search path vulnerability in valgrind before 3.4.0 allows local users to execute arbitrary programs via a Trojan horse .valgrindrc file in the current working directory, as demonstrated using a malicious --db-command options.  NOTE: the severity of this issue has been disputed, but CVE is including this issue because execution of a program from an untrusted directory is a common scenario.


definition_id: oval:org.debian:def:179465378690189469278379567433842698589
title: CVE-2008-4866 ffmpeg
description:
Multiple buffer overflows in libavformat/utils.c in FFmpeg 0.4.9 before r14715, as used by MPlayer, allow context-dependent attackers to have an unknown impact via vectors related to execution of DTS generation code with a delay greater than MAX_REORDER_DELAY.


definition_id: oval:org.debian:def:274135619744342139511864115876275313522
title: CVE-2008-4867 ffmpeg
description:
Buffer overflow in libavcodec/dca.c in FFmpeg 0.4.9 before r14917, as used by MPlayer, allows context-dependent attackers to have an unknown impact via vectors related to an incorrect DCA_MAX_FRAME_SIZE value.


definition_id: oval:org.debian:def:108217884532257441841736257781869521454
title: CVE-2008-4868 kino
description:
Unspecified vulnerability in the avcodec_close function in libavcodec/utils.c in FFmpeg 0.4.9 before r14787, as used by MPlayer, has unknown impact and attack vectors, related to a free "on random pointers."


definition_id: oval:org.debian:def:157969329935763558092408185434934305199
title: CVE-2008-4869 kino
description:
FFmpeg 0.4.9, as used by MPlayer, allows context-dependent attackers to cause a denial of service (memory consumption) via unknown vectors, aka a "Tcp/udp memory leak."


definition_id: oval:org.debian:def:277744292417464223308138508997742304146
title: CVE-2008-4907 dovecot
description:
The message parsing feature in Dovecot 1.1.4 and 1.1.5, when using the FETCH ENVELOPE command in the IMAP client, allows remote attackers to cause a denial of service (persistent crash) via an email with a malformed From address, which triggers an assertion error, aka "invalid message address parsing bug."


definition_id: oval:org.debian:def:337572574419086784648501803547109148520
title: CVE-2008-4908 crossfire-maps
description:
maps/Info/combine.pl in CrossFire crossfire-maps 1.11.0 allows local users to overwrite arbitrary files via a symlink attack on a temporary file.


definition_id: oval:org.debian:def:271915046302290671517774243080041275377
title: CVE-2008-4935 aview
description:
asciiview in aview 1.3.0 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/aview#####.pgm temporary file.


definition_id: oval:org.debian:def:308799826531266628316290819928107682695
title: CVE-2008-4936 mgetty
description:
faxspool in mgetty 1.1.36 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/faxsp.##### temporary file.


definition_id: oval:org.debian:def:287835360037184452154044914595354435268
title: CVE-2008-4939 apertium
description:
apertium 3.0.7 allows local users to overwrite arbitrary files via a symlink attack on (a) /tmp/#####.lex.cc, (b) /tmp/#####.deformat.l, (c) /tmp/#####.reformat.l, (d) /tmp/#####docxorig, (e) /tmp/#####docxsalida.zip, (f) /tmp/#####xlsxembed, (g) /tmp/#####xlsxorig, and (h) /tmp/#####xslxsalida.zip temporary files, related to the (1) apertium-gen-deformat, (2) apertium-gen-reformat, and (3) apertium scripts.


definition_id: oval:org.debian:def:329563513721243736986137060412221912674
title: CVE-2008-4941 arb
description:
arb-common 0.0.20071207.1 allows local users to overwrite arbitrary files via a symlink attack on (a) /tmp/arb_fdnaml_*, (b) /tmp/arb_pids_*, (c) /tmp/arbdsmz.html, and (d) /tmp/arbdsmz.htm temporary files, related to the (1) arb_fastdnaml and (2) dszmconnect.pl scripts.


definition_id: oval:org.debian:def:118505075216097348303205437013969705904
title: CVE-2008-4942 audiolink
description:
audiolink in audiolink 0.05 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/audiolink.db.tmp and (2) /tmp/audiolink.tb.tmp temporary files.


definition_id: oval:org.debian:def:335416729764533526421217416426987565644
title: CVE-2008-4947 dhis-server
description:
dhis-dummy-log-engine in dhis-server 5.3 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/dhis-dummy-log-engine.log temporary file.


definition_id: oval:org.debian:def:52139761324807078362995934256592979252
title: CVE-2008-4949 dist
description:
dist 3.5 allows local users to overwrite arbitrary files via a symlink attack on (a) /tmp/cil#####, (b) /tmp/pdo#####, and (c) /tmp/pdn##### temporary files, related to the (1) patcil and (2) patdiff scripts.


definition_id: oval:org.debian:def:81612522867284632218291595007707747407
title: CVE-2008-4952 emacs-jabber
description:
emacs-jabber in emacs-jabber 0.7.91 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/*.log temporary file.


definition_id: oval:org.debian:def:115832691472815451504810362857653738287
title: CVE-2008-4956 fwbuilder
description:
fwb_install in fwbuilder 2.1.19 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/ssh-agent.##### temporary file.


definition_id: oval:org.debian:def:155512221710002457562775420541668476837
title: CVE-2008-4960 impose+
description:
impose in impose+ 0.2 allows local users to overwrite arbitrary files via a symlink attack on (1) /tmp/*-tmp.ps and (2) /tmp/bboxx-* temporary files.


definition_id: oval:org.debian:def:210398116500809286638813367309205326082
title: CVE-2008-4964 konwert
description:
filters/any-UTF8 in konwert 1.8 allows local users to delete arbitrary files via a symlink attack on a /tmp/any-##### temporary file.


definition_id: oval:org.debian:def:223506122497262402577994497034324567658
title: CVE-2008-4965 liquidsoap
description:
liguidsoap.py in liguidsoap 0.3.8.1+2 allows local users to overwrite arbitrary files via a symlink attack on (1) /tmp/liguidsoap.liq, (2) /tmp/lig.#####.log, and (3) /tmp/emission.ogg temporary files.


definition_id: oval:org.debian:def:210551811600301631273896780615090692040
title: CVE-2008-4968 lmbench
description:
The (1) rccs and (2) STUFF scripts in lmbench 3.0-a7 allow local users to overwrite arbitrary files via a symlink attack on a /tmp/sdiff.##### temporary file.


definition_id: oval:org.debian:def:13718407534244809862620743619617670290
title: CVE-2008-4971 mafft
description:
mafft-homologs in mafft 6.240 allows local users to overwrite arbitrary files via a symlink attack on (1) /tmp/_vf#?????, (2) /tmp/_if#?????, (3) /tmp/_pf#?????, (4) /tmp/_af#?????, (5) /tmp/_rid#?????, (6) /tmp/_res#?????, (7) /tmp/_q#?????, and (8) /tmp/_bf#????? temporary files.


definition_id: oval:org.debian:def:299533072902911630027778601731708675196
title: CVE-2008-4972 mgt
description:
mailgo in mgt 2.31 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/mailgo##### temporary file.


definition_id: oval:org.debian:def:217612984646242319644270060372002947323
title: CVE-2008-4973 myspell
description:
i2myspell in myspell 3.1 allows local users to overwrite arbitrary files via a symlink attack on (1) /tmp/i2my#####.1 and (2) /tmp/i2my#####.2 temporary files.


definition_id: oval:org.debian:def:145427081973944758340217657413360964385
title: CVE-2008-4979 rancid
description:
getipacctg in rancid 2.3.2~a8 allows local users to overwrite arbitrary files via a symlink attack on (1) /tmp/ipacct.#####.prefixes, (2) /tmp/ipacct.#####.sorted, (3) /tmp/ipacct.#####.pl, and (4) /tmp/ipacct.##### temporary files.


definition_id: oval:org.debian:def:264193812467206252831226666916705645446
title: CVE-2008-4982 rkhunter
description:
rkhunter in rkhunter 1.3.2 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/rkhunter-debug temporary file. NOTE: this is probably a different vulnerability than CVE-2005-1270.


definition_id: oval:org.debian:def:139715985039504853079717002838746834831
title: CVE-2008-4983 scilab
description:
scilab-bin 4.1.2 allows local users to overwrite arbitrary files via a symlink attack on (a) /tmp/SciLink#####1, (b) /tmp/SciLink#####2, (c) /tmp/SciLink#####3, (d) /tmp/*.#####, (e) /tmp/*.#####.res, (f) /tmp/*.#####.err, and (g) /tmp/*.#####.diff temporary files, related to the (1) scilink, (2) scidoc, and (3) scidem scripts.


definition_id: oval:org.debian:def:14591577599882712240584315667641643214
title: CVE-2008-4985 vdr
description:
vdrleaktest in Video Disk Recorder (aka vdr-dbg or vdr) 1.6.0 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/memleaktest.log temporary file.


definition_id: oval:org.debian:def:277313481234855723043086063656125898693
title: CVE-2008-4986 wims
description:
wims 3.62 allows local users to overwrite arbitrary files via a symlink attack on (a) /tmp/env#####, (b) /tmp/sed#####, and (c) /tmp/referer-home.log temporary files, related to the (1) coqweb and (2) account.sh scripts.


definition_id: oval:org.debian:def:110003933526830132553627204758995867955
title: CVE-2008-4987 xastir
description:
xastir 1.9.2 allows local users to overwrite arbitrary files via a symlink attack on the (a) /tmp/ldconfig.tmp, (b) /tmp/ldconf.tmp, and (c) /tmp/ld.so.conf temporary files, related to the (1) get-maptools.sh and (2) get_shapelib.sh scripts.


definition_id: oval:org.debian:def:275619007968860587672389772140601057408
title: CVE-2008-4988 xcal
description:
pscal in xcal 4.1 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/pscal##### temporary file.


definition_id: oval:org.debian:def:215581778149643344239778893620322296153
title: CVE-2008-5005 uw-imap
description:
Multiple stack-based buffer overflows in (1) University of Washington IMAP Toolkit 2002 through 2007c, (2) University of Washington Alpine 2.00 and earlier, and (3) Panda IMAP allow (a) local users to gain privileges by specifying a long folder extension argument on the command line to the tmail or dmail program; and (b) remote attackers to execute arbitrary code by sending e-mail to a destination mailbox name composed of a username and '+' character followed by a long string, processed by the tmail or possibly dmail program.


definition_id: oval:org.debian:def:304747679258581575935549134910170402865
title: CVE-2008-5006 uw-imap
description:
smtp.c in the c-client library in University of Washington IMAP Toolkit 2007b allows remote SMTP servers to cause a denial of service (NULL pointer dereference and application crash) by responding to the QUIT command with a close of the TCP connection instead of the expected 221 response code.


definition_id: oval:org.debian:def:153176533015900759186615943697160662849
title: CVE-2008-5007 lazarus
description:
create_lazarus_export_tgz.sh in lazarus 0.9.24 allows local users to overwrite or delete arbitrary files via a symlink attack on a (1) /tmp/lazarus.tgz temporary file or a (2) /tmp/lazarus temporary directory.


definition_id: oval:org.debian:def:126636720707169978413350589540191011573
title: CVE-2008-5008 libsamplerate
description:
Buffer overflow in src/src_sinc.c in Secret Rabbit Code (aka SRC or libsamplerate) before 0.1.4, when "extreme low conversion ratios" are used, allows user-assisted attackers to have an unknown impact via a crafted audio file.


definition_id: oval:org.debian:def:240629506870097361334628338294298046494
title: CVE-2008-5030 libcdaudio
description:
Heap-based buffer overflow in the cddb_read_disc_data function in cddb.c in libcdaudio 0.99.12p2 allows remote CDDB servers to execute arbitrary code via long CDDB data.


definition_id: oval:org.debian:def:130570246538027873509167503043750065779
title: CVE-2008-5032 vlc
description:
Stack-based buffer overflow in VideoLAN VLC media player 0.5.0 through 0.9.5 might allow user-assisted attackers to execute arbitrary code via the header of an invalid CUE image file, related to modules/access/vcd/cdrom.c.  NOTE: this identifier originally included an issue related to RealText, but that issue has been assigned a separate identifier, CVE-2008-5036.


definition_id: oval:org.debian:def:227698021960330342399656849521133241573
title: CVE-2008-5036 vlc
description:
Stack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow user-assisted attackers to execute arbitrary code via an an invalid RealText (rt) subtitle file, related to the ParseRealText function in modules/demux/subtitle.c.  NOTE: this issue was SPLIT from CVE-2008-5032 on 20081110.


definition_id: oval:org.debian:def:267590308284219953935794363093327527577
title: CVE-2008-5050 clamav
description:
Off-by-one error in the get_unicode_name function (libclamav/vba_extract.c) in Clam Anti-Virus (ClamAV) before 0.94.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted VBA project file, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:236542214516356096684559866013418197817
title: CVE-2008-5076 htop
description:
htop 0.7 writes process names to a terminal without sanitizing non-printable characters, which might allow local users to hide processes, modify arbitrary files, or have unspecified other impact via a process name with "crazy control strings."


definition_id: oval:org.debian:def:285216982728553585677204860638071569453
title: CVE-2008-5077 openssl
description:
OpenSSL 0.9.8i and earlier does not properly check the return value from the EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys.


definition_id: oval:org.debian:def:15089526560444177313775672214338700395
title: CVE-2008-5078 enscript
description:
Multiple buffer overflows in the (1) recognize_eps_file function (src/psgen.c) and (2) tilde_subst function (src/util.c) in GNU enscript 1.6.1, and possibly earlier, might allow remote attackers to execute arbitrary code via an epsf escape sequence with a long filename.


definition_id: oval:org.debian:def:74256697490754582259775096314484563226
title: CVE-2008-5080 awstats
description:
awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the query_string parameter.  NOTE: this issue exists because of an incomplete fix for CVE-2008-3714.


definition_id: oval:org.debian:def:112712017216067375462124509309773873667
title: CVE-2008-5081 avahi
description:
The originates_from_local_legacy_unicast_socket function (avahi-core/server.c) in avahi-daemon in Avahi before 0.6.24 allows remote attackers to cause a denial of service (crash) via a crafted mDNS packet with a source port of 0, which triggers an assertion failure.


definition_id: oval:org.debian:def:128503292972180289139394579271093397578
title: CVE-2008-5086 libvirt
description:
Multiple methods in libvirt 0.3.2 through 0.5.1 do not check if a connection is read-only, which allows local users to bypass intended access restrictions and perform administrative actions.


definition_id: oval:org.debian:def:11736285944543378007300697662257597881
title: CVE-2008-5101 optipng
description:
Buffer overflow in the BMP reader in OptiPNG 0.6 and 0.6.1 allows user-assisted attackers to execute arbitrary code via a crafted BMP image, related to an "array overflow."


definition_id: oval:org.debian:def:220199390447157341863020291729192075875
title: CVE-2008-5110 syslog-ng
description:
syslog-ng does not call chdir when it calls chroot, which might allow attackers to escape the intended jail. NOTE: this is only a vulnerability when a separate vulnerability is present. This flaw affects syslog-ng versions prior to and including 2.0.9.


definition_id: oval:org.debian:def:229947772565394632769999730526200721582
title: CVE-2008-5113 wordpress
description:
WordPress 2.6.3 relies on the REQUEST superglobal array in certain dangerous situations, which makes it easier for remote attackers to conduct delayed and persistent cross-site request forgery (CSRF) attacks via crafted cookies, as demonstrated by attacks that (1) delete user accounts or (2) cause a denial of service (loss of application access).  NOTE: this issue relies on the presence of an independent vulnerability that allows cookie injection.


definition_id: oval:org.debian:def:289492281524855039709274545686019215539
title: CVE-2008-5138 libpam-mount
description:
passwdehd in libpam-mount 0.43 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/passwdehd.##### temporary file.


definition_id: oval:org.debian:def:217803675273068550873199190347116644755
title: CVE-2008-5141 flamethrower
description:
flamethrower in flamethrower 0.1.8 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/multicast.tar.##### temporary file.


definition_id: oval:org.debian:def:266165939838782993307840339429811179762
title: CVE-2008-5149 ncbi-tools6
description:
fwd_check.sh in libncbi6 6.1.20080302 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/##### temporary file.


definition_id: oval:org.debian:def:326903204113719548888493545886800956178
title: CVE-2008-5161 openssh
description:
Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.2.4, and 5.3 through 5.3.8; Client and Server and ConnectSecure 6.0 through 6.0.4; Server for Linux on IBM System z 6.0.4; Server for IBM z/OS 5.5.1 and earlier, 6.0.0, and 6.0.1; and Client 4.0-J through 4.3.3-J and 4.0-K through 4.3.10-K; and (2) OpenSSH 4.7p1 and possibly other versions, when using a block cipher algorithm in Cipher Block Chaining (CBC) mode, makes it easier for remote attackers to recover certain plaintext data from an arbitrary block of ciphertext in an SSH session via unknown vectors.


definition_id: oval:org.debian:def:29268092140776438773538716695435986303
title: CVE-2008-5183 cups
description:
cupsd in CUPS 1.3.9 and earlier allows local users, and possibly remote attackers, to cause a denial of service (daemon crash) by adding a large number of RSS Subscriptions, which triggers a NULL pointer dereference.  NOTE: this issue can be triggered remotely by leveraging CVE-2008-5184.


definition_id: oval:org.debian:def:211263964026585385169500380561711448703
title: CVE-2008-5184 cups
description:
The web interface (cgi-bin/admin.c) in CUPS before 1.3.8 uses the guest username when a user is not logged on to the web server, which makes it easier for remote attackers to bypass intended policy and conduct CSRF attacks via the (1) add and (2) cancel RSS subscription functions.


definition_id: oval:org.debian:def:197205117352314960530613508964772081626
title: CVE-2008-5185 geshi
description:
The highlighting functionality in geshi.php in GeSHi before 1.0.8 allows remote attackers to cause a denial of service (infinite loop) via an XML sequence containing an opening delimiter without a closing delimiter, as demonstrated using "<".


definition_id: oval:org.debian:def:209240116997991709833934428825362763229
title: CVE-2008-5186 dokuwiki
description:
** DISPUTED **  The set_language_path function in geshi.php in Generic Syntax Highlighter (GeSHi) before 1.0.8.1 might allow remote attackers to conduct file inclusion attacks via crafted inputs that influence the default language path ($path variable).  NOTE: this issue has been disputed by a vendor, stating that only a static value is used, so this is not a vulnerability in GeSHi. Separate CVE identifiers would be created for web applications that integrate GeSHi in a way that allows control of the default language path.


definition_id: oval:org.debian:def:261702988468270048069772680846791127065
title: CVE-2008-5187 imlib2
description:
The load function in the XPM loader for imlib2 1.4.2, and possibly other versions, allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XPM file that triggers a "pointer arithmetic error" and a heap-based buffer overflow, a different vulnerability than CVE-2008-2426.


definition_id: oval:org.debian:def:125100389426358182542115938291367630417
title: CVE-2008-5189 rails
description:
CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function.


definition_id: oval:org.debian:def:133982830981516091398775306664476770464
title: CVE-2008-5244 faad2
description:
Unspecified vulnerability in xine-lib before 1.1.15 has unknown impact and attack vectors related to libfaad.  NOTE: due to the lack of details, it is not clear whether this is an issue in xine-lib or in libfaad.


definition_id: oval:org.debian:def:78892909554204254490559359519220079787
title: CVE-2008-5249 mediawiki
description:
Cross-site scripting (XSS) vulnerability in MediaWiki 1.13.0 through 1.13.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:112054698122412776025362527464048015050
title: CVE-2008-5250 mediawiki
description:
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.6.11, 1.12.x before 1.12.2, and 1.13.x before 1.13.3, when Internet Explorer is used and uploads are enabled, or an SVG scripting browser is used and SVG uploads are enabled, allows remote authenticated users to inject arbitrary web script or HTML by editing a wiki page.


definition_id: oval:org.debian:def:149957455660243711851998992794349922185
title: CVE-2008-5252 mediawiki
description:
Cross-site request forgery (CSRF) vulnerability in the Special:Import feature in MediaWiki 1.3.0 through 1.6.10, 1.12.x before 1.12.2, and 1.13.x before 1.13.3 allows remote attackers to perform unspecified actions as authenticated users via unknown vectors.


definition_id: oval:org.debian:def:311489039308669111549279116351175038298
title: CVE-2008-5262 devil
description:
Multiple stack-based buffer overflows in the iGetHdrHeader function in src-IL/src/il_hdr.c in DevIL 1.7.4 allow context-dependent attackers to execute arbitrary code via a crafted Radiance RGBE file.


definition_id: oval:org.debian:def:273135790831300135665703620688302907097
title: CVE-2008-5276 vlc
description:
Integer overflow in the ReadRealIndex function in real.c in the Real demuxer plugin in VideoLAN VLC media player 0.9.0 through 0.9.7 allows remote attackers to execute arbitrary code via a malformed RealMedia (.rm) file that triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:1946403902306879909576762763508089241
title: CVE-2008-5277 pdns
description:
PowerDNS before 2.9.21.2 allows remote attackers to cause a denial of service (daemon crash) via a CH HINFO query.


definition_id: oval:org.debian:def:61850288145259245682604619755706698296
title: CVE-2008-5278 wordpress
description:
Cross-site scripting (XSS) vulnerability in the self_link function in in the RSS Feed Generator (wp-includes/feed.php) for WordPress before 2.6.5 allows remote attackers to inject arbitrary web script or HTML via the Host header (HTTP_HOST variable).


definition_id: oval:org.debian:def:52619195974227588324366574905629429531
title: CVE-2008-5285 wireshark
description:
Wireshark 1.0.4 and earlier allows remote attackers to cause a denial of service via a long SMTP request, which triggers an infinite loop.


definition_id: oval:org.debian:def:227548849998343386915076387602356765127
title: CVE-2008-5286 cups
description:
Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow.


definition_id: oval:org.debian:def:251782899297338854457862775162107222105
title: CVE-2008-5298 chm2pdf
description:
chm2pdf 0.9 uses temporary files in directories with fixed names, which allows local users to cause a denial of service (chm2pdf failure) of other users by creating those directories ahead of time.


definition_id: oval:org.debian:def:332328110743868253043319430600252994262
title: CVE-2008-5299 chm2pdf
description:
chm2pdf 0.9 allows user-assisted local users to delete arbitrary files via a symlink attack on .chm files in the (1) /tmp/chm2pdf/work or (2) /tmp/chm2pdf/orig temporary directories.


definition_id: oval:org.debian:def:118010966068498383245732398805811923016
title: CVE-2008-5301 dovecot
description:
Directory traversal vulnerability in the ManageSieve implementation in Dovecot 1.0.15, 1.1, and 1.2 allows remote attackers to read and modify arbitrary .sieve files via a ".." (dot dot) in a script name.


definition_id: oval:org.debian:def:72151476065219693085436089359638696847
title: CVE-2008-5302 perl
description:
Race condition in the rmtree function in File::Path 1.08 and 2.07 (lib/File/Path.pm) in Perl 5.8.8 and 5.10.0 allows local users to create arbitrary setuid binaries via a symlink attack, a different vulnerability than CVE-2005-0448, CVE-2004-0452, and CVE-2008-2827. NOTE: this is a regression error related to CVE-2005-0448.  It is different from CVE-2008-5303 due to affected versions.


definition_id: oval:org.debian:def:143970990231954294299191153474031355388
title: CVE-2008-5303 perl
description:
Race condition in the rmtree function in File::Path 1.08 (lib/File/Path.pm) in Perl 5.8.8 allows local users to to delete arbitrary files via a symlink attack, a different vulnerability than CVE-2005-0448, CVE-2004-0452, and CVE-2008-2827. NOTE: this is a regression error related to CVE-2005-0448. It is different from CVE-2008-5302 due to affected versions.


definition_id: oval:org.debian:def:303433971312532332478496790781608263419
title: CVE-2008-5314 clamav
description:
Stack consumption vulnerability in libclamav/special.c in ClamAV before 0.94.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted JPEG file, related to the cli_check_jpeg_exploit, jpeg_check_photoshop, and jpeg_check_photoshop_8bim functions.


definition_id: oval:org.debian:def:28916684210423636268100555793814776102
title: CVE-2008-5368 muttprint
description:
muttprint in muttprint 0.72d allows local users to overwrite arbitrary files via a symlink attack on the /tmp/muttprint.log temporary file.


definition_id: oval:org.debian:def:65174026826947771573762231133520693750
title: CVE-2008-5370 pvpgn
description:
pvpgn-support-installer in pvpgn 1.8.1 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/pvpgn-support-1.0.tar.gz temporary file.


definition_id: oval:org.debian:def:252223364484827591631927846232745896834
title: CVE-2008-5371 screenie
description:
screenie in screenie 1.30.0 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/.screenie.##### temporary file.


definition_id: oval:org.debian:def:128418361170110174323933899548917463934
title: CVE-2008-5373 bacula
description:
mtx-changer.Adic-Scalar-24 in bacula-common 2.4.2 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/mtx.##### temporary file, probably a related issue to CVE-2005-2995.


definition_id: oval:org.debian:def:104452954611053805468881680603569149504
title: CVE-2008-5374 bash
description:
bash-doc 3.2 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/cb#####.? temporary file, related to the (1) aliasconv.sh, (2) aliasconv.bash, and (3) cshtobash scripts.


definition_id: oval:org.debian:def:19259299652558398341329313523335976175
title: CVE-2008-5375 cmus
description:
cmus-status-display in cmus 2.2.0 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/cmus-status temporary file.


definition_id: oval:org.debian:def:319621845072585734168300832256637851809
title: CVE-2008-5376 crip
description:
editcomment in crip 3.7 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/*.tag.tmp temporary file.


definition_id: oval:org.debian:def:76609996737498199296858842200166288828
title: CVE-2008-5377 cups
description:
pstopdf in CUPS 1.3.8 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/pstopdf.log temporary file, a different vulnerability than CVE-2001-1333.


definition_id: oval:org.debian:def:103832584750763908257711017061496125841
title: CVE-2008-5378 arb
description:
arb-kill in arb 0.0.20071207.1 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/arb_pids_*_* temporary file.


definition_id: oval:org.debian:def:151702173297701306059679047213327985167
title: CVE-2008-5394 shadow
description:
/bin/login in shadow 4.0.18.1 in Debian GNU/Linux, and probably other Linux distributions, allows local users in the utmp group to overwrite arbitrary files via a symlink attack on a temporary file referenced in a line (aka ut_line) field in a utmp entry.


definition_id: oval:org.debian:def:223157149691254132895501832226868063271
title: CVE-2008-5397 tor
description:
Tor before 0.2.0.32 does not properly process the (1) User and (2) Group configuration options, which might allow local users to gain privileges by leveraging unintended supplementary group memberships of the Tor process.


definition_id: oval:org.debian:def:306244883037320448938360117957287004330
title: CVE-2008-5398 tor
description:
Tor before 0.2.0.32 does not properly process the ClientDNSRejectInternalAddresses configuration option in situations where an exit relay issues a policy-based refusal of a stream, which allows remote exit relays to have an unknown impact by mapping an internal IP address to the destination hostname of a refused stream.


definition_id: oval:org.debian:def:11480991819294421733102096339119773537
title: CVE-2008-5514 alpine
description:
Off-by-one error in the rfc822_output_char function in the RFC822BUFFER routines in the University of Washington (UW) c-client library, as used by the UW IMAP toolkit before imap-2007e and other applications, allows context-dependent attackers to cause a denial of service (crash) via an e-mail message that triggers a buffer overflow.


definition_id: oval:org.debian:def:186728525568370163611196432496449263888
title: CVE-2008-5519 libapache-mod-jk
description:
The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that included a Content-Length header but no POST data or (2) a rapid series of requests, related to noncompliance with the AJP protocol's requirements for requests containing Content-Length headers.


definition_id: oval:org.debian:def:269851547084795695552976458245950847174
title: CVE-2008-5558 asterisk
description:
Asterisk Open Source 1.2.26 through 1.2.30.3 and Business Edition B.2.3.5 through B.2.5.5, when realtime IAX2 users are enabled, allows remote attackers to cause a denial of service (crash) via authentication attempts involving (1) an unknown user or (2) a user using hostname matching.


definition_id: oval:org.debian:def:254928845634547659451269181208071813501
title: CVE-2008-5587 phppgadmin
description:
Directory traversal vulnerability in libraries/lib.inc.php in phpPgAdmin 4.2.1 and earlier, when register_globals is enabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the _language parameter to index.php.


definition_id: oval:org.debian:def:145660149156035005742274301751951204989
title: CVE-2008-5616 mplayer
description:
Stack-based buffer overflow in the demux_open_vqf function in libmpdemux/demux_vqf.c in MPlayer 1.0 rc2 before r28150 allows remote attackers to execute arbitrary code via a malformed TwinVQ file.


definition_id: oval:org.debian:def:128286749553114197437623053594087657610
title: CVE-2008-5617 rsyslog
description:
The ACL handling in rsyslog 3.12.1 to 3.20.0, 4.1.0, and 4.1.1 does not follow $AllowedSender directive, which allows remote attackers to bypass intended access restrictions and spoof log messages or create a large number of spurious messages.


definition_id: oval:org.debian:def:266982769082718218738380666917279925432
title: CVE-2008-5618 rsyslog
description:
imudp in rsyslog 4.x before 4.1.2, 3.21 before 3.21.9 beta, and 3.20 before 3.20.2 generates a message even when it is sent by an unauthorized sender, which allows remote attackers to cause a denial of service (disk consumption) via a large number of spurious messages.


definition_id: oval:org.debian:def:221571676753884403462200816349329794801
title: CVE-2008-5619 roundcube
description:
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.


definition_id: oval:org.debian:def:116232331796962795485663273132090199637
title: CVE-2008-5620 roundcube
description:
RoundCube Webmail (roundcubemail) before 0.2-beta allows remote attackers to cause a denial of service (memory consumption) via crafted size parameters that are used to create a large quota image.


definition_id: oval:org.debian:def:25978969895226631633185977999568501103
title: CVE-2008-5646 trac
description:
Unspecified vulnerability in Trac before 0.11.2 allows attackers to cause a denial of service via unknown attack vectors related to "certain wiki markup."


definition_id: oval:org.debian:def:147445642682930687020273690362332583168
title: CVE-2008-5647 trac
description:
Unspecified vulnerability in the HTML sanitizer filter in Trac before 0.11.2 allows attackers to conduct phishing attacks via unknown attack vectors.


definition_id: oval:org.debian:def:1170889876064560767004501908068843335
title: CVE-2008-5657 quassel
description:
CRLF injection vulnerability in Quassel Core before 0.3.0.3 allows remote attackers to spoof IRC messages as other users via a crafted CTCP message.


definition_id: oval:org.debian:def:149029449764957522790616635863728127704
title: CVE-2008-5660 vinagre
description:
Format string vulnerability in the vinagre_utils_show_error function (src/vinagre-utils.c) in Vinagre 0.5.x before 0.5.2 and 2.x before 2.24.2 might allow remote attackers to execute arbitrary code via format string specifiers in a crafted URI or VNC server response.


definition_id: oval:org.debian:def:275661652065805911832432095654745113151
title: CVE-2008-5687 mediawiki
description:
MediaWiki 1.11, and other versions before 1.13.3, does not properly protect against the download of backups of deleted images, which might allow remote attackers to obtain sensitive information via requests for files in images/deleted/.


definition_id: oval:org.debian:def:271594206998140570866625810984915899432
title: CVE-2008-5688 mediawiki
description:
MediaWiki 1.8.1, and other versions before 1.13.3, when the wgShowExceptionDetails variable is enabled, sometimes provides the full installation path in a debugging message, which might allow remote attackers to obtain sensitive information via unspecified requests that trigger an uncaught exception.


definition_id: oval:org.debian:def:283092338546638149483086100768897234161
title: CVE-2008-5695 wordpress
description:
wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option, which allows remote authenticated users with manage_options and upload_files capabilities to execute arbitrary code by uploading a PHP script and adding this script's pathname to active_plugins.


definition_id: oval:org.debian:def:282996668755463104383412409190329881273
title: CVE-2008-5714 qemu
description:
Off-by-one error in monitor.c in Qemu 0.9.1 might make it easier for remote attackers to guess the VNC password, which is limited to seven characters where eight was intended.


definition_id: oval:org.debian:def:176055380254433102886266865479044884551
title: CVE-2008-5718 netatalk
description:
The papd daemon in Netatalk before 2.0.4-beta2, when using certain variables in a pipe command for the print file, allows remote attackers to execute arbitrary commands via shell metacharacters in a print request, as demonstrated using a crafted Title.


definition_id: oval:org.debian:def:186845880751169946557921427071364882536
title: CVE-2008-5812 spip
description:
Multiple unspecified vulnerabilities in SPIP 1.8 before 1.8.3b, 1.9 before 1.9.2g, and 2.0 before 2.0.2 have unknown impact and attack vectors.


definition_id: oval:org.debian:def:90986822241034793754228558883605752292
title: CVE-2008-5813 spip
description:
SQL injection vulnerability in inc/rubriques.php in SPIP 1.8 before 1.8.3b, 1.9 before 1.9.2g, and 2.0 before 2.0.2 allows remote attackers to execute arbitrary SQL commands via the ID parameter. NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:53769335517647708360474030937053520015
title: CVE-2008-5824 audiofile
description:
Heap-based buffer overflow in msadpcm.c in libaudiofile in audiofile 0.2.6 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WAV file.


definition_id: oval:org.debian:def:214661742762872276347002851285710883984
title: CVE-2008-5902 xrdp
description:
Buffer overflow in the xrdp_bitmap_invalidate function in xrdp/xrdp_bitmap.c in xrdp 0.4.1 and earlier allows remote attackers to execute arbitrary code via a crafted request.


definition_id: oval:org.debian:def:36373849778250174847137447266078177050
title: CVE-2008-5903 xrdp
description:
Array index error in the xrdp_bitmap_def_proc function in xrdp/funcs.c in xrdp 0.4.1 and earlier allows remote attackers to execute arbitrary code via vectors that manipulate the value of the edit_pos structure member.


definition_id: oval:org.debian:def:96787478648504848644377951002710164936
title: CVE-2008-5904 xrdp
description:
The rdp_rdp_process_color_pointer_pdu function in rdp/rdp_rdp.c in xrdp 0.4.1 and earlier allows remote RDP servers to have an unknown impact via input data that sets crafted values for certain length variables, leading to a buffer overflow.


definition_id: oval:org.debian:def:227883608190751907666240712582199738476
title: CVE-2008-5905 ktorrent
description:
The web interface plugin in KTorrent before 3.1.4 allows remote attackers to bypass intended access restrictions and upload arbitrary torrent files, and trigger the start of downloads and seeding, via a crafted HTTP POST request.


definition_id: oval:org.debian:def:3692155271529911047730873640558433743
title: CVE-2008-5906 ktorrent
description:
Eval injection vulnerability in the web interface plugin in KTorrent before 3.1.4 allows remote attackers to execute arbitrary PHP code via unspecified parameters to this interface's PHP scripts.


definition_id: oval:org.debian:def:329892424656298714515459117374258675623
title: CVE-2008-5984 dia
description:
Untrusted search path vulnerability in the Python plugin in Dia 0.96.1, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).


definition_id: oval:org.debian:def:127756390131330771214275946881890002268
title: CVE-2008-5985 epiphany-browser
description:
Untrusted search path vulnerability in the Python interface in Epiphany 2.22.3, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).


definition_id: oval:org.debian:def:229533283851075351591347569404259969801
title: CVE-2008-5986 csound
description:
Untrusted search path vulnerability in the (1) "VST plugin with Python scripting" and (2) "VST plugin for writing score generators in Python" in Csound 5.08.2, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).


definition_id: oval:org.debian:def:160970319775406969121357059192750376201
title: CVE-2008-5987 eog
description:
Untrusted search path vulnerability in the Python interface in Eye of GNOME (eog) 2.22.3, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).


definition_id: oval:org.debian:def:15831301901130788891844089360399116227
title: CVE-2008-6070 graphicsmagick
description:
Multiple heap-based buffer underflows in the ReadPALMImage function in coders/palm.c in GraphicsMagick before 1.2.3 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted PALM image, a different vulnerability than CVE-2007-0770.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:225872906707990162564791824655110144695
title: CVE-2008-6071 graphicsmagick
description:
Heap-based buffer overflow in the DecodeImage function in coders/pict.c in GraphicsMagick before 1.1.14, and 1.2.x before 1.2.3, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted PICT image.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:92305717051919884231579759034932607297
title: CVE-2008-6072 graphicsmagick
description:
Multiple unspecified vulnerabilities in GraphicsMagick before 1.1.14, and 1.2.x before 1.2.3, allow remote attackers to cause a denial of service (crash) via unspecified vectors in (1) XCF and (2) CINEON images.


definition_id: oval:org.debian:def:14174613572406098708823929291856449638
title: CVE-2008-6079 imlib2
description:
imlib2 before 1.4.2 allows context-dependent attackers to have an unspecified impact via a crafted (1) ARGB, (2) BMP, (3) JPEG, (4) LBM, (5) PNM, (6) TGA, or (7) XPM file, related to "several heap and stack based buffer overflows - partly due to integer overflows."


definition_id: oval:org.debian:def:323530594444831712695120672754446810898
title: CVE-2008-6123 net-snmp
description:
The netsnmp_udp_fmtaddr function (snmplib/snmpUDPDomain.c) in net-snmp 5.0.9 through 5.4.2.1, when using TCP wrappers for client authorization, does not properly parse hosts.allow rules, which allows remote attackers to bypass intended access restrictions and execute SNMP queries, related to "source/destination IP address confusion."


definition_id: oval:org.debian:def:202029152186962944183015150630774425043
title: CVE-2008-6235 vim
description:
The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a filename used by the (1) "D" (delete) command or (2) b:netrw_curdir variable, as demonstrated using the netrw.v4 and netrw.v5 test cases.


definition_id: oval:org.debian:def:6161193935139113546262058530701715231
title: CVE-2008-6393 psi
description:
PSI Jabber client before 0.12.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a file transfer request with a negative value in a SOCKS5 option, which bypasses a signed integer check and triggers an integer overflow and a heap-based buffer overflow.


definition_id: oval:org.debian:def:283150757935272045679529882852560782864
title: CVE-2008-6397 sgml2x
description:
rlatex in AlcoveBook sgml2x 1.0.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:100532698496336542174330785532317181629
title: CVE-2008-6398 sng
description:
sng_regress in SNG 1.0.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/recompiled$$.png, (2) /tmp/decompiled$$.sng, and (3) /tmp/canonicalized$$.sng temporary files.


definition_id: oval:org.debian:def:120660944999658706686602330507366664782
title: CVE-2008-6472 wireshark
description:
The WLCCP dissector in Wireshark 0.99.7 through 1.0.4 allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors.


definition_id: oval:org.debian:def:91899593454029416665659218511182575
title: CVE-2008-6536 p7zip
description:
Unspecified vulnerability in 7-zip before 4.5.7 has unknown impact and remote attack vectors, as demonstrated by the PROTOS GENOME test suite for Archive Formats (c10).


definition_id: oval:org.debian:def:99335874340786271542825794072329323620
title: CVE-2008-6547 python-formencode
description:
schema.py in FormEncode for Python (python-formencode) 1.0 does not apply the chained_validators feature, which allows attackers to bypass intended access restrictions via unknown vectors.


definition_id: oval:org.debian:def:254741580429315663167347808770790113037
title: CVE-2008-6548 moin
description:
The rst parser (parser/text_rst.py) in MoinMoin 1.6.1 does not check the ACL of an included page, which allows attackers to read unauthorized include files via unknown vectors.


definition_id: oval:org.debian:def:320555101060126296031214375632524468638
title: CVE-2008-6549 moin
description:
The password_checker function in config/multiconfig.py in MoinMoin 1.6.1 uses the cracklib and python-crack features even though they are not thread-safe, which allows remote attackers to cause a denial of service (segmentation fault and crash) via unknown vectors.


definition_id: oval:org.debian:def:260184743360807130512402807260398245393
title: CVE-2008-6603 moin
description:
MoinMoin 1.6.2 and 1.7 does not properly enforce ACL checks when acl_hierarchic is set to True, which might allow remote attackers to bypass intended access restrictions, a different vulnerability than CVE-2008-1937.


definition_id: oval:org.debian:def:19476844243661605804209139364087585741
title: CVE-2008-6621 graphicsmagick
description:
Unspecified vulnerability in GraphicsMagick before 1.2.3 allows remote attackers to cause a denial of service (crash) via unspecified vectors in DPX images.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:260574000556201600344279757552421533278
title: CVE-2008-6679 ghostscript
description:
Buffer overflow in the BaseFont writer module in Ghostscript 8.62, and possibly other versions, allows remote attackers to cause a denial of service (ps2pdf crash) and possibly execute arbitrary code via a crafted Postscript file.


definition_id: oval:org.debian:def:48684876179463840569095344525383980540
title: CVE-2008-6680 clamav
description:
libclamav/pe.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (crash) via a crafted EXE file that triggers a divide-by-zero error.


definition_id: oval:org.debian:def:205305891971937115966480543139362774091
title: CVE-2008-6762 wordpress
description:
Open redirect vulnerability in wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the backto parameter.


definition_id: oval:org.debian:def:124929264219655616269459511304916316092
title: CVE-2008-6767 wordpress
description:
wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to upgrade the application, and possibly cause a denial of service (application outage), via a direct request.


definition_id: oval:org.debian:def:310701290008973395481686036442600678379
title: CVE-2008-6792 system-tools-backends
description:
system-tools-backends before 2.6.0-1ubuntu1.1 in Ubuntu 8.10, as used by "Users and Groups" in GNOME System Tools, hashes account passwords with 3DES and consequently limits effective password lengths to eight characters, which makes it easier for context-dependent attackers to successfully conduct brute-force password attacks.


definition_id: oval:org.debian:def:230658281022217514269599968975389736548
title: CVE-2008-6837 zoph
description:
SQL injection vulnerability in Zoph 0.7.2.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different issue than CVE-2008-3258.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


definition_id: oval:org.debian:def:57332696970215283080939059829445614500
title: CVE-2008-6838 zoph
description:
Cross-site scripting (XSS) vulnerability in search.php in Zoph 0.7.2.1 allows remote attackers to inject arbitrary web script or HTML via the _off parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


definition_id: oval:org.debian:def:252659211218395705282599991292101240830
title: CVE-2008-6845 clamav
description:
The unpack feature in ClamAV 0.93.3 and earlier allows remote attackers to cause a denial of service (segmentation fault) via a corrupted LZH file.


definition_id: oval:org.debian:def:169930997186808509334964452744333797290
title: CVE-2008-7148 synfig
description:
Unspecified vulnerability in Synfig Animation Studio before 0.61.08 allows attackers to execute arbitrary code via a crafted .sif file.


definition_id: oval:org.debian:def:255175980855355341429701072416960108909
title: CVE-2008-7177 nasm
description:
Buffer overflow in the listing module in Netwide Assembler (NASM) before 2.03.01 has unknown impact and attack vectors, a different vulnerability than CVE-2008-2719.


definition_id: oval:org.debian:def:30475847811920685264022560696831064798
title: CVE-2008-7191 polipo
description:
Unspecified vulnerability in Polipo before 1.0.4 allows remote attackers to cause a denial of service (crash) via a long request URL.


definition_id: oval:org.debian:def:326903102582102825427959905156162118795
title: CVE-2008-7220 asterisk
description:
Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2 allows attackers to make "cross-site ajax requests" via unknown vectors.


definition_id: oval:org.debian:def:225402909101018713800312202254696392675
title: CVE-2008-7224 elinks
description:
Buffer overflow in entity_cache in ELinks before 0.11.4rc0 allows remote attackers to cause a denial of service (crash) via a crafted link.


definition_id: oval:org.debian:def:120136625721772399371748480190649089620
title: CVE-2008-7265 proftpd-dfsg
description:
The pr_data_xfer function in ProFTPD before 1.3.2rc3 allows remote authenticated users to cause a denial of service (CPU consumption) via an ABOR command during a data transfer.


definition_id: oval:org.debian:def:37015286640977541747287443173961885018
title: CVE-2008-7270 openssl
description:
OpenSSL before 0.9.8j, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the use of a disabled cipher via vectors involving sniffing network traffic to discover a session identifier, a different vulnerability than CVE-2010-4180.


definition_id: oval:org.debian:def:340041521436753878168803657018960114913
title: CVE-2008-7275 otrs2
description:
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) before 2.3.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) AgentTicketMailbox or (2) CustomerTicketOverView.


definition_id: oval:org.debian:def:47798688302364203186940485779922938093
title: CVE-2008-7276 otrs2
description:
Kernel/System/Web/Request.pm in Open Ticket Request System (OTRS) before 2.3.2 creates a directory under /tmp/ with 1274 permissions, which might allow local users to bypass intended access restrictions via standard filesystem operations, related to incorrect interpretation of 0700 as a decimal value.


definition_id: oval:org.debian:def:244015036330357084634172130882196584598
title: CVE-2008-7277 otrs2
description:
Open Ticket Request System (OTRS) before 2.3.0-beta4 checks for the rw permission, instead of the configured merge permission, during authorization of merge operations, which might allow remote authenticated users to bypass intended access restrictions by merging two tickets.


definition_id: oval:org.debian:def:233915307274627143421259685224225198934
title: CVE-2008-7278 otrs2
description:
The S/MIME feature in Open Ticket Request System (OTRS) before 2.2.5, and 2.3.x before 2.3.0-beta1, does not properly configure the RANDFILE environment variable for OpenSSL, which might make it easier for remote attackers to decrypt e-mail messages that had lower than intended entropy available for cryptographic operations, related to inability to write to the seeding file.


definition_id: oval:org.debian:def:275857894010867524810319460247695061815
title: CVE-2008-7279 otrs2
description:
The CustomerInterface component in Open Ticket Request System (OTRS) before 2.2.8 allows remote authenticated users to bypass intended access restrictions and access tickets of arbitrary customers via unspecified vectors.


definition_id: oval:org.debian:def:328416769185717658865301046070558258739
title: CVE-2008-7280 otrs2
description:
Kernel/System/EmailParser.pm in PostmasterPOP3.pl in Open Ticket Request System (OTRS) before 2.2.7 does not properly handle e-mail messages containing malformed UTF-8 characters, which allows remote attackers to cause a denial of service (e-mail retrieval outage) via a crafted message.


definition_id: oval:org.debian:def:214587518055727345582497539107264092264
title: CVE-2008-7281 otrs2
description:
Open Ticket Request System (OTRS) before 2.2.7 sends e-mail containing a Bcc header field that lists the Blind Carbon Copy recipients, which allows remote attackers to obtain potentially sensitive e-mail address information by reading this field.


definition_id: oval:org.debian:def:15278089431679922424176045604954051717
title: CVE-2008-7282 otrs2
description:
Kernel/Output/HTML/CustomerNewTicketQueueSelectionGeneric.pm in Open Ticket Request System (OTRS) before 2.2.6, when the CustomerPanelOwnSelection and CustomerGroupSupport options are enabled, allows remote authenticated users to bypass intended access restrictions, and perform certain (1) list and (2) write operations on queues, via unspecified vectors.


definition_id: oval:org.debian:def:266116236734826716665636107584622702921
title: CVE-2008-7283 otrs2
description:
Open Ticket Request System (OTRS) before 2.2.6, when customer group support is enabled, allows remote authenticated users to bypass intended access restrictions and perform web-interface updates to tickets by leveraging queue read permissions.


definition_id: oval:org.debian:def:325693219044578375340616196377697884631
title: CVE-2008-7313 libphp-snoopy
description:
The _httpsrequest function in Snoopy allows remote attackers to execute arbitrary commands.  NOTE: this issue exists dues to an incomplete fix for CVE-2008-4796.


definition_id: oval:org.debian:def:46977299464516798835182384427842991023
title: CVE-2009-0021 ntp
description:
NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.


definition_id: oval:org.debian:def:199115657474326462377175908733633732812
title: CVE-2009-0022 samba
description:
Samba 3.2.0 through 3.2.6, when registry shares are enabled, allows remote authenticated users to access the root filesystem via a crafted connection request that specifies a blank share name.


definition_id: oval:org.debian:def:59751527199746159843066098433327936065
title: CVE-2009-0023 apr-util
description:
The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow.


definition_id: oval:org.debian:def:34285416862391787979544336038733150344
title: CVE-2009-0025 bind9
description:
BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3, and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.


definition_id: oval:org.debian:def:151592311426987969235539174461095427743
title: CVE-2009-0034 sudo
description:
parse.c in sudo 1.6.9p17 through 1.6.9p19 does not properly interpret a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command.


definition_id: oval:org.debian:def:175206042076123559566577326424735949559
title: CVE-2009-0036 libvirt
description:
Buffer overflow in the proxyReadClientSocket function in proxy/libvirt_proxy.c in libvirt_proxy 0.5.1 might allow local users to gain privileges by sending a portion of the header of a virProxyPacket packet, and then sending the remainder of the packet with crafted values in the header, related to use of uninitialized memory in a validation check.


definition_id: oval:org.debian:def:43586772625698701112063466345963344248
title: CVE-2009-0037 curl
description:
The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3) execute arbitrary commands via a redirect to an scp: URL.


definition_id: oval:org.debian:def:70189248486162121340873313222303741860
title: CVE-2009-0041 asterisk
description:
IAX2 in Asterisk Open Source 1.2.x before 1.2.31, 1.4.x before 1.4.23-rc4, and 1.6.x before 1.6.0.3-rc2; Business Edition A.x.x, B.x.x before B.2.5.7, C.1.x.x before C.1.10.4, and C.2.x.x before C.2.1.2.1; and s800i 1.2.x before 1.3.0 responds differently to a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.


definition_id: oval:org.debian:def:250345222190278432246459341011124304800
title: CVE-2009-0050 lasso
description:
Lasso 2.2.1 and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.


definition_id: oval:org.debian:def:309573339763862976527350426893271515187
title: CVE-2009-0115 multipath-tools
description:
The Device Mapper multipathing driver (aka multipath-tools or device-mapper-multipath) 0.4.8, as used in SUSE openSUSE, SUSE Linux Enterprise Server (SLES), Fedora, and possibly other operating systems, uses world-writable permissions for the socket file (aka /var/run/multipathd.sock), which allows local users to send arbitrary commands to the multipath daemon.


definition_id: oval:org.debian:def:186932802185840235977366222597056184121
title: CVE-2009-0126 boinc
description:
The decrypt_public function in lib/crypt.cpp in the client in Berkeley Open Infrastructure for Network Computing (BOINC) 6.2.14 and 6.4.5 does not check the return value from the OpenSSL RSA_public_decrypt function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.


definition_id: oval:org.debian:def:110713345226382525360760392544177769644
title: CVE-2009-0128 slurm-llnl
description:
plugins/crypto/openssl/crypto_openssl.c in Simple Linux Utility for Resource Management (aka SLURM or slurm-llnl) does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.


definition_id: oval:org.debian:def:263620027521204527208892008664485371205
title: CVE-2009-0129 libcrypt-openssl-dsa-perl
description:
libcrypt-openssl-dsa-perl does not properly check the return value from the OpenSSL DSA_verify and DSA_do_verify functions, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.


definition_id: oval:org.debian:def:212319530751986836571178866994884518896
title: CVE-2009-0146 poppler
description:
Multiple buffer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related to (1) JBIG2SymbolDict::setBitmap and (2) JBIG2Stream::readSymbolDictSeg.


definition_id: oval:org.debian:def:261183317501760360995168553620994848529
title: CVE-2009-0147 poppler
description:
Multiple integer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related to (1) JBIG2Stream::readSymbolDictSeg, (2) JBIG2Stream::readSymbolDictSeg, and (3) JBIG2Stream::readGenericBitmap.


definition_id: oval:org.debian:def:302652455032464999196214610216542226265
title: CVE-2009-0148 cscope
description:
Multiple buffer overflows in Cscope before 15.7a allow remote attackers to execute arbitrary code via long strings in input such as (1) source-code tokens and (2) pathnames, related to integer overflows in some cases. NOTE: this issue exists because of an incomplete fix for CVE-2004-2541.


definition_id: oval:org.debian:def:200841553750311024331080631705026808333
title: CVE-2009-0153 icu
description:
International Components for Unicode (ICU) 4.0, 3.6, and other 3.x versions, as used in Apple Mac OS X 10.5 before 10.5.7, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Fedora 9 and 10, and possibly other operating systems, does not properly handle invalid byte sequences during Unicode conversion, which might allow remote attackers to conduct cross-site scripting (XSS) attacks.


definition_id: oval:org.debian:def:190362497726379301614908620971725184400
title: CVE-2009-0159 ntp
description:
Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.


definition_id: oval:org.debian:def:88317626406101933393062078858439907961
title: CVE-2009-0163 cups
description:
Integer overflow in the TIFF image decoding routines in CUPS 1.3.9 and earlier allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a crafted TIFF image, which is not properly handled by the (1) _cupsImageReadTIFF function in the imagetops filter and (2) imagetoraster filter, leading to a heap-based buffer overflow.


definition_id: oval:org.debian:def:334039112782511458270006656417605631650
title: CVE-2009-0164 cups
description:
The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which makes it easier for remote attackers to conduct DNS rebinding attacks.


definition_id: oval:org.debian:def:243672837023505055821246547296052285158
title: CVE-2009-0165 xpdf
description:
Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, as used in Poppler and other products, when running on Mac OS X, has unspecified impact, related to "g*allocn."


definition_id: oval:org.debian:def:305272166883761480335980134356870369580
title: CVE-2009-0166 poppler
description:
The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers a free of uninitialized memory.


definition_id: oval:org.debian:def:12996623100061499874886610972986557025
title: CVE-2009-0179 libmikmod
description:
libmikmod 3.1.11 through 3.2.0, as used by MikMod and possibly other products, allows user-assisted attackers to cause a denial of service (application crash) by loading an XM file.


definition_id: oval:org.debian:def:116397483877047797038695856642884959253
title: CVE-2009-0186 libsndfile
description:
Integer overflow in libsndfile 1.0.18, as used in Winamp and other products, allows context-dependent attackers to execute arbitrary code via crafted description chunks in a CAF audio file, leading to a heap-based buffer overflow.


definition_id: oval:org.debian:def:98066701680594430309692982353042804224
title: CVE-2009-0195 xpdf
description:
Heap-based buffer overflow in Xpdf 3.02pl2 and earlier, CUPS 1.3.9, and probably other products, allows remote attackers to execute arbitrary code via a PDF file with crafted JBIG2 symbol dictionary segments.


definition_id: oval:org.debian:def:89421939530992430145590968523866554598
title: CVE-2009-0196 ghostscript
description:
Heap-based buffer overflow in the big2_decode_symbol_dict function (jbig2_symbol_dict.c) in the JBIG2 decoding library (jbig2dec) in Ghostscript 8.64, and probably earlier versions, allows remote attackers to execute arbitrary code via a PDF file with a JBIG2 symbol dictionary segment with a large run length value.


definition_id: oval:org.debian:def:303540112895458520500808969759339594179
title: CVE-2009-0217 mono
description:
The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.


definition_id: oval:org.debian:def:231255640956519639683732725397848829243
title: CVE-2009-0260 moin
description:
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter (aka the basename variable).


definition_id: oval:org.debian:def:135383435624364097002548661810171142426
title: CVE-2009-0312 moin
description:
Cross-site scripting (XSS) vulnerability in the antispam feature (security/antispam.py) in MoinMoin 1.7 and 1.8.1 allows remote attackers to inject arbitrary web script or HTML via crafted, disallowed content.


definition_id: oval:org.debian:def:197720443298605634688149597575622894822
title: CVE-2009-0314 gedit
description:
Untrusted search path vulnerability in the Python module in gedit allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).


definition_id: oval:org.debian:def:89913273714224696293895178921167673473
title: CVE-2009-0315 xchat
description:
Untrusted search path vulnerability in the Python module in xchat allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).


definition_id: oval:org.debian:def:52881235805217547056896710023742170996
title: CVE-2009-0316 vim
description:
Untrusted search path vulnerability in src/if_python.c in the Python interface in Vim before 7.2.045 allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983), as demonstrated by an erroneous search path for plugin/bike.vim in bicyclerepair.


definition_id: oval:org.debian:def:52428877234483749506253056157644214293
title: CVE-2009-0317 nautilus-python
description:
Untrusted search path vulnerability in the Python language bindings for Nautilus (nautilus-python) allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).


definition_id: oval:org.debian:def:73090903876676038228308894701341759701
title: CVE-2009-0318 gnumeric
description:
Untrusted search path vulnerability in the GObject Python interpreter wrapper in Gnumeric allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).


definition_id: oval:org.debian:def:2284415801188772627702549451069557226
title: CVE-2009-0359 samizdat
description:
Multiple cross-site scripting (XSS) vulnerabilities in Samizdat before 0.6.2 allow remote authenticated users to inject arbitrary web script or HTML via the (1) message title or (2) user full name.


definition_id: oval:org.debian:def:151873699624962567229396621191517744984
title: CVE-2009-0360 libpam-krb5
description:
Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application.


definition_id: oval:org.debian:def:239919775452409061004142669586591991208
title: CVE-2009-0361 libpam-krb5
description:
Russ Allbery pam-krb5 before 3.13, as used by libpam-heimdal, su in Solaris 10, and other software, does not properly handle calls to pam_setcred when running setuid, which allows local users to overwrite and change the ownership of arbitrary files by setting the KRB5CCNAME environment variable, and then launching a setuid application that performs certain pam_setcred operations.


definition_id: oval:org.debian:def:149953980793814439607324182924410217656
title: CVE-2009-0362 fail2ban
description:
filter.d/wuftpd.conf in Fail2ban 0.8.3 uses an incorrect regular expression that allows remote attackers to cause a denial of service (forced authentication failures) via a crafted reverse-resolved DNS name (rhost) entry that contains a substring that is interpreted as an IP address, a different vulnerability than CVE-2007-4321.


definition_id: oval:org.debian:def:182202399720850067303712590266366854139
title: CVE-2009-0363 barnowl
description:
Multiple buffer overflows in (a) BarnOwl before 1.0.5 and (b) owl 2.1.11 allow remote attackers to execute arbitrary code via vectors involving (1) a crafted zcrypt message, related to zcrypt.c; (2) a reply command on a message with a Zephyr Cc: list, related to zwrite.c; and unspecified other use of the products.


definition_id: oval:org.debian:def:141345153359104359305579119624139732896
title: CVE-2009-0364 webcit
description:
Format string vulnerability in the mini_calendar component in Citadel.org WebCit 7.22, and other versions before 7.39, allows remote attackers to execute arbitrary code via unspecified vectors.


definition_id: oval:org.debian:def:36413156278699218740005984264847847546
title: CVE-2009-0365 network-manager
description:
nm-applet.conf in GNOME NetworkManager before 0.7.0.99 contains an incorrect deny setting, which allows local users to discover (1) network connection passwords and (2) pre-shared keys via calls to the GetSecrets method in the dbus request handler.


definition_id: oval:org.debian:def:186846269767384817630089393682215715417
title: CVE-2009-0368 opensc
description:
OpenSC before 0.11.7 allows physically proximate attackers to bypass intended PIN requirements and read private data objects via a (1) low level APDU command or (2) debugging tool, as demonstrated by reading the 4601 or 4701 file with the opensc-explorer or opensc-tool program.


definition_id: oval:org.debian:def:3979904653538459537527696346499404692
title: CVE-2009-0385 ffmpeg
description:
Integer signedness error in the fourxm_read_header function in libavformat/4xm.c in FFmpeg before revision 16846 allows remote attackers to execute arbitrary code via a malformed 4X movie file with a large current_track value, which triggers a NULL pointer dereference.


definition_id: oval:org.debian:def:77174530110431847353533966222606824281
title: CVE-2009-0413 roundcube
description:
Cross-site scripting (XSS) vulnerability in RoundCube Webmail (roundcubemail) 0.2 stable allows remote attackers to inject arbitrary web script or HTML via the background attribute embedded in an HTML e-mail message.


definition_id: oval:org.debian:def:75579370031498296126265746500598973867
title: CVE-2009-0414 tor
description:
Unspecified vulnerability in Tor before 0.2.0.33 has unspecified impact and remote attack vectors that trigger heap corruption.


definition_id: oval:org.debian:def:120020427656552850506545767672987540137
title: CVE-2009-0415 trickle
description:
Untrusted search path vulnerability in trickle 1.07 allows local users to execute arbitrary code via a Trojan horse trickle-overload.so in the current working directory, which is referenced in the LD_PRELOAD path.


definition_id: oval:org.debian:def:340148286137848795254836040424068413440
title: CVE-2009-0478 squid
description:
Squid 2.7 to 2.7.STABLE5, 3.0 to 3.0.STABLE12, and 3.1 to 3.1.0.4 allows remote attackers to cause a denial of service via an HTTP request with an invalid version number, which triggers a reachable assertion in (1) HttpMsg.c and (2) HttpStatusLine.c.


definition_id: oval:org.debian:def:38566579121246438324783905459474447983
title: CVE-2009-0489 wicd
description:
The DBus configuration file for Wicd before 1.5.9 allows arbitrary users to own org.wicd.daemon, which allows local users to receive messages that were intended for the Wicd daemon, possibly including credentials.


definition_id: oval:org.debian:def:33184775348439097851978427296445315744
title: CVE-2009-0490 audacity
description:
Stack-based buffer overflow in the String_parse::get_nonspace_quoted function in lib-src/allegro/strparse.cpp in Audacity 1.2.6 and other versions before 1.3.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a .gro file containing a long string.


definition_id: oval:org.debian:def:180434932618604739972898356875932638470
title: CVE-2009-0542 proftpd-dfsg
description:
SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" (percent) character in the username, which introduces a "'" (single quote) character during variable substitution by mod_sql.


definition_id: oval:org.debian:def:189596090221679048847621669537812365452
title: CVE-2009-0543 proftpd-dfsg
description:
ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in (1) mod_sql_mysql and (2) mod_sql_postgres.


definition_id: oval:org.debian:def:146202320382435974619762708090204839491
title: CVE-2009-0544 python-crypto
description:
Buffer overflow in the PyCrypto ARC2 module 2.0.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large ARC2 key length.


definition_id: oval:org.debian:def:14372912252750120534198067374327833438
title: CVE-2009-0547 evolution-data-server
description:
Evolution 2.22.3.1 checks S/MIME signatures against a copy of the e-mail text within a signed-data blob, not the copy of the e-mail text displayed to the user, which allows remote attackers to spoof a signature by modifying the latter copy, a different vulnerability than CVE-2008-5077.


definition_id: oval:org.debian:def:315276501798106299179120317173800951028
title: CVE-2009-0578 network-manager-applet
description:
GNOME NetworkManager before 0.7.0.99 does not properly verify privileges for dbus (1) modify and (2) delete requests, which allows local users to change or remove the network connections of arbitrary users via unspecified vectors related to org.freedesktop.NetworkManagerUserSettings and at_console.


definition_id: oval:org.debian:def:151864253452003484927012260866116402263
title: CVE-2009-0579 pam
description:
Linux-PAM before 1.0.4 does not enforce the minimum password age (MINDAYS) as specified in /etc/shadow, which allows local users to bypass intended security policy and change their passwords sooner than specified.


definition_id: oval:org.debian:def:9163345184813165345173215903768526159
title: CVE-2009-0582 evolution-data-server
description:
The ntlm_challenge function in the NTLM SASL authentication mechanism in camel/camel-sasl-ntlm.c in Camel in Evolution Data Server (aka evolution-data-server) 2.24.5 and earlier, and 2.25.92 and earlier 2.25.x versions, does not validate whether a certain length value is consistent with the amount of data in a challenge packet, which allows remote mail servers to read information from the process memory of a client, or cause a denial of service (client crash), via an NTLM authentication type 2 packet with a length value that exceeds the amount of packet data.


definition_id: oval:org.debian:def:185747991631029017482532509650920856297
title: CVE-2009-0583 argyll
description:
CVE-2009-0583 ghostscript, argyllcms: Multiple integer overflows in the International Color Consortium Format Library


definition_id: oval:org.debian:def:295334184976766975464044013004394598680
title: CVE-2009-0584 argyll
description:
icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using a device file for processing a crafted image file associated with large integer values for certain sizes, related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.


definition_id: oval:org.debian:def:257330721380140858281714032999613264844
title: CVE-2009-0590 openssl
description:
The ASN1_STRING_print_ex function in OpenSSL before 0.9.8k allows remote attackers to cause a denial of service (invalid memory access and application crash) via vectors that trigger printing of a (1) BMPString or (2) UniversalString with an invalid encoded length.


definition_id: oval:org.debian:def:21627347054773168738284956980399029949
title: CVE-2009-0599 wireshark
description:
Buffer overflow in wiretap/netscreen.c in Wireshark 0.99.7 through 1.0.5 allows user-assisted remote attackers to cause a denial of service (application crash) via a malformed NetScreen snoop file.


definition_id: oval:org.debian:def:149854766411768654425245192906597384260
title: CVE-2009-0600 wireshark
description:
Wireshark 0.99.6 through 1.0.5 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted Tektronix K12 text capture file, as demonstrated by a file with exactly one frame.


definition_id: oval:org.debian:def:54609810157423132820218635114390729170
title: CVE-2009-0601 wireshark
description:
Format string vulnerability in Wireshark 0.99.8 through 1.0.5 on non-Windows platforms allows local users to cause a denial of service (application crash) via format string specifiers in the HOME environment variable.


definition_id: oval:org.debian:def:243766199587960528674261725017594905667
title: CVE-2009-0653 openssl
description:
OpenSSL, probably 0.9.6, does not verify the Basic Constraints for an intermediate CA-signed certificate, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack, a related issue to CVE-2002-0970.


definition_id: oval:org.debian:def:318063589912667575258867182199362913619
title: CVE-2009-0661 weechat
description:
Wee Enhanced Environment for Chat (WeeChat) 0.2.6 allows remote attackers to cause a denial of service (crash) via an IRC PRIVMSG command containing crafted color codes that trigger an out-of-bounds read.


definition_id: oval:org.debian:def:178316160974810673671371404702686951709
title: CVE-2009-0663 libdbd-pg-perl
description:
Heap-based buffer overflow in the DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module 1.49 for Perl might allow context-dependent attackers to execute arbitrary code via unspecified input to an application that uses the getline and pg_getline functions to read database rows.


definition_id: oval:org.debian:def:158553652268765859743786633743979634647
title: CVE-2009-0667 ocsinventory-agent
description:
Untrusted search path vulnerability in Agent/Backend.pm in Ocsinventory-Agent before 0.0.9.3, and 1.x before 1.0.1, in OCS Inventory allows local users to gain privileges via a Trojan horse Perl module in an arbitrary directory.


definition_id: oval:org.debian:def:206028378354436615621059481787328485133
title: CVE-2009-0668 zodb
description:
Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to execute arbitrary Python code via vectors involving the ZEO network protocol.


definition_id: oval:org.debian:def:54279403148133310171108497835859861615
title: CVE-2009-0669 zodb
description:
Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to bypass authentication via vectors involving the ZEO network protocol.


definition_id: oval:org.debian:def:184294769217105735343632619814357777299
title: CVE-2009-0688 cyrus-sasl2
description:
Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via strings that are used as input to the sasl_encode64 function in lib/saslutil.c.


definition_id: oval:org.debian:def:254315726478141121528798826673504329521
title: CVE-2009-0689 kde4libs
description:
Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4, K-Meleon 1.5.3, SeaMonkey 1.1.8, and other products, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large precision value in the format argument to a printf function, which triggers incorrect memory allocation and a heap-based buffer overflow during conversion to a floating-point number.


definition_id: oval:org.debian:def:218361505274603449625646839162445151206
title: CVE-2009-0696 bind9
description:
The dns_db_findrdataset function in db.c in named in ISC BIND 9.4 before 9.4.3-P3, 9.5 before 9.5.1-P3, and 9.6 before 9.6.1-P1, when configured as a master server, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an ANY record in the prerequisite section of a crafted dynamic update message, as exploited in the wild in July 2009.


definition_id: oval:org.debian:def:280590929790191348111911501616635657537
title: CVE-2009-0737 mediawiki
description:
Multiple cross-site scripting (XSS) vulnerabilities in the web-based installer (config/index.php) in MediaWiki 1.6 before 1.6.12, 1.12 before 1.12.4, and 1.13 before 1.13.4, when the installer is in active use, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:68490028983622821809158985251814895834
title: CVE-2009-0749 optipng
description:
Use-after-free vulnerability in the GIFReadNextExtension function in lib/pngxtern/gif/gifread.c in OptiPNG 0.6.2 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a crafted GIF image that causes the realloc function to return a new pointer, which triggers memory corruption when the old pointer is accessed.


definition_id: oval:org.debian:def:178242386569634280499581793727692463042
title: CVE-2009-0751 yaws
description:
Yaws before 1.80 allows remote attackers to cause a denial of service (memory consumption and crash) via a request with a large number of headers.


definition_id: oval:org.debian:def:205311575432816707140785484364621307623
title: CVE-2009-0753 mldonkey
description:
Absolute path traversal vulnerability in MLDonkey 2.8.4 through 2.9.7 allows remote attackers to read arbitrary files via a leading "//" (double slash) in the filename.


definition_id: oval:org.debian:def:55380440978346866244558085407955996945
title: CVE-2009-0755 poppler
description:
The FormWidgetChoice::loadDefaults function in Poppler before 0.10.4 allows remote attackers to cause a denial of service (crash) via a PDF file with an invalid Form Opt entry.


definition_id: oval:org.debian:def:115893099976848477756568356976503913451
title: CVE-2009-0756 poppler
description:
The JBIG2Stream::readSymbolDictSeg function in Poppler before 0.10.4 allows remote attackers to cause a denial of service (crash) via a PDF file that triggers a parsing error, which is not properly handled by JBIG2SymbolDict::~JBIG2SymbolDict and triggers an invalid memory dereference.


definition_id: oval:org.debian:def:256018928479317244399356656906479572888
title: CVE-2009-0758 avahi
description:
The originates_from_local_legacy_unicast_socket function in avahi-core/server.c in avahi-daemon 0.6.23 does not account for the network byte order of a port number when processing incoming multicast packets, which allows remote attackers to cause a denial of service (network bandwidth and CPU consumption) via a crafted legacy unicast mDNS query packet that triggers a multicast packet storm.


definition_id: oval:org.debian:def:220507251848750176847507352828291486019
title: CVE-2009-0759 znc
description:
Multiple CRLF injection vulnerabilities in webadmin in ZNC before 0.066 allow remote authenticated users to modify the znc.conf configuration file and gain privileges via CRLF sequences in the quit message and other vectors.


definition_id: oval:org.debian:def:102692498058139983198348210081003881657
title: CVE-2009-0784 systemtap
description:
Race condition in the SystemTap stap tool 0.0.20080705 and 0.0.20090314 allows local users in the stapusr group to insert arbitrary SystemTap kernel modules and gain privileges via unknown vectors.


definition_id: oval:org.debian:def:55414255817473236389218049608212836478
title: CVE-2009-0790 strongswan
description:
The pluto IKE daemon in Openswan and Strongswan IPsec 2.6 before 2.6.21 and 2.4 before 2.4.14, and Strongswan 4.2 before 4.2.14 and 2.8 before 2.8.9, allows remote attackers to cause a denial of service (daemon crash and restart) via a crafted (1) R_U_THERE or (2) R_U_THERE_ACK Dead Peer Detection (DPD) IPsec IKE Notification message that triggers a NULL pointer dereference related to inconsistent ISAKMP state and the lack of a phase2 state association in DPD.


definition_id: oval:org.debian:def:300154866088903236976785109081876062642
title: CVE-2009-0792 argyll
description:
Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.  NOTE: this issue exists because of an incomplete fix for CVE-2009-0583.


definition_id: oval:org.debian:def:5078194478976803985778687518129397601
title: CVE-2009-0798 acpid
description:
ACPI Event Daemon (acpid) before 1.0.10 allows remote attackers to cause a denial of service (CPU consumption and connectivity loss) by opening a large number of UNIX sockets without closing them, which triggers an infinite loop.


definition_id: oval:org.debian:def:134417607316861048738787140041666755971
title: CVE-2009-0799 poppler
description:
The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers an out-of-bounds read.


definition_id: oval:org.debian:def:291270740499472428782527583193396561086
title: CVE-2009-0801 squid
description:
Squid, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web page that causes a client to send HTTP requests with a modified Host header.


definition_id: oval:org.debian:def:118843662159240723530123118709082967882
title: CVE-2009-0804 ziproxy
description:
Ziproxy 2.6.0, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web page that causes a client to send HTTP requests with a modified Host header.


definition_id: oval:org.debian:def:278926547394919705874548307997421443180
title: CVE-2009-0839 mapserver
description:
Stack-based buffer overflow in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when the server has a map with a long IMAGEPATH or NAME attribute, allows remote attackers to execute arbitrary code via a crafted id parameter in a query action.


definition_id: oval:org.debian:def:212517713201527388158623997684123650361
title: CVE-2009-0840 mapserver
description:
Heap-based buffer underflow in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to have an unknown impact via a negative value in the Content-Length HTTP header.


definition_id: oval:org.debian:def:32474523027373319446442980502042154235
title: CVE-2009-0841 mapserver
description:
Directory traversal vulnerability in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when running on Windows with Cygwin, allows remote attackers to create arbitrary files via a .. (dot dot) in the id parameter.


definition_id: oval:org.debian:def:45317363000173328254679412175882601989
title: CVE-2009-0842 mapserver
description:
mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to read arbitrary invalid .map files via a full pathname in the map parameter, which triggers the display of partial file contents within an error message, as demonstrated by a /tmp/sekrut.map symlink.


definition_id: oval:org.debian:def:264158962332482302978553642449310213486
title: CVE-2009-0843 mapserver
description:
The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists.


definition_id: oval:org.debian:def:246640517329233382505902575871662015509
title: CVE-2009-0844 krb5
description:
The get_input_token function in the SPNEGO implementation in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote attackers to cause a denial of service (daemon crash) and possibly obtain sensitive information via a crafted length value that triggers a buffer over-read.


definition_id: oval:org.debian:def:318011943905002421329427820938541545912
title: CVE-2009-0845 krb5
description:
The spnego_gss_accept_sec_context function in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3, when SPNEGO is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via invalid ContextFlags data in the reqFlags field in a negTokenInit token.


definition_id: oval:org.debian:def:198470286020481871857398671382365614367
title: CVE-2009-0846 krb5
description:
The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer.


definition_id: oval:org.debian:def:53516631563878626882886901757011241308
title: CVE-2009-0847 krb5
description:
The asn1buf_imbed function in the ASN.1 decoder in MIT Kerberos 5 (aka krb5) 1.6.3, when PK-INIT is used, allows remote attackers to cause a denial of service (application crash) via a crafted length value that triggers an erroneous malloc call, related to incorrect calculations with pointer arithmetic.


definition_id: oval:org.debian:def:195251303509438256459872949848084487990
title: CVE-2009-0887 pam
description:
Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM (aka pam) 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and might allow remote authenticated users to obtain login access with a different user's non-ASCII username, via a login attempt.


definition_id: oval:org.debian:def:148061938991085426165061826557132218739
title: CVE-2009-0934 ejabberd
description:
Cross-site scripting (XSS) vulnerability in ejabberd before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to links and MUC logs.


definition_id: oval:org.debian:def:53362821094057595042201454587821121256
title: CVE-2009-0936 tor
description:
Unspecified vulnerability in Tor before 0.2.0.34 allows attackers to cause a denial of service (infinite loop) via "corrupt votes."


definition_id: oval:org.debian:def:213924957083055402062655285895105345619
title: CVE-2009-0937 tor
description:
Unspecified vulnerability in Tor before 0.2.0.34 allows directory mirrors to cause a denial of service via unknown vectors.


definition_id: oval:org.debian:def:293071730269740378587922886884574260686
title: CVE-2009-0938 tor
description:
Unspecified vulnerability in Tor before 0.2.0.34 allows directory mirrors to cause a denial of service (exit node crash) via "malformed input."


definition_id: oval:org.debian:def:332119895560700578781854756490792392254
title: CVE-2009-0939 tor
description:
Tor before 0.2.0.34 treats incomplete IPv4 addresses as valid, which has unknown impact and attack vectors related to "Spec conformance," as demonstrated using 192.168.0.


definition_id: oval:org.debian:def:275692410580137256533706329397176796191
title: CVE-2009-0945 kde4libs
description:
Array index error in the insertItemBefore method in WebKit, as used in Apple Safari before 3.2.3 and 4 Public Beta, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Google Chrome Stable before 1.0.154.65, and possibly other products allows remote attackers to execute arbitrary code via a document with a SVGPathList data structure containing a negative index in the (1) SVGTransformList, (2) SVGStringList, (3) SVGNumberList, (4) SVGPathSegList, (5) SVGPointList, or (6) SVGLengthList SVGList object, which triggers memory corruption.


definition_id: oval:org.debian:def:20130684037504060476435673370625886980
title: CVE-2009-0946 freetype
description:
Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3) cff/cffload.c.


definition_id: oval:org.debian:def:163753826465732177236262675091980486798
title: CVE-2009-0947 file
description:
Multiple integer overflows in the (1) cdf_read_property_info and (2) cdf_read_sat functions in file before 5.02.


definition_id: oval:org.debian:def:182320737732732995258479530654853914572
title: CVE-2009-0948 file
description:
Multiple buffer overflows in the (1) cdf_read_sat, (2) cdf_read_long_sector_chain, and (3) cdf_read_ssat function in file before 5.02.


definition_id: oval:org.debian:def:193520064799020739183177534607187913356
title: CVE-2009-0949 cups
description:
The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a scheduler request with two consecutive IPP_TAG_UNSUPPORTED tags.


definition_id: oval:org.debian:def:306621922980663669164542285944522085411
title: CVE-2009-1045 vlc
description:
requests/status.xml in VLC 0.9.8a allows remote attackers to cause a denial of service (stack consumption and crash) via a long input argument in an in_play action.


definition_id: oval:org.debian:def:67320349683714100353063143510651505333
title: CVE-2009-1086 ldns
description:
Heap-based buffer overflow in the ldns_rr_new_frm_str_internal function in ldns 1.4.x allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a DNS resource record (RR) with a long (1) class field (clas variable) and possibly (2) TTL field.


definition_id: oval:org.debian:def:133772514262291126087126796708458488730
title: CVE-2009-1142 open-vm-tools
description:
An issue was discovered in open-vm-tools 2009.03.18-154848. Local users can gain privileges via a symlink attack on /tmp files if vmware-user-suid-wrapper is setuid root and the ChmodChownDirectory function is enabled.


definition_id: oval:org.debian:def:180568094844868075192784022861824828648
title: CVE-2009-1176 mapserver
description:
mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 does not ensure that the string holding the id parameter ends in a '\0' character, which allows remote attackers to conduct buffer-overflow attacks or have unspecified other impact via a long id parameter in a query action.


definition_id: oval:org.debian:def:274754051216910988260941121990762999630
title: CVE-2009-1177 mapserver
description:
Multiple stack-based buffer overflows in maptemplate.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 have unknown impact and remote attack vectors.


definition_id: oval:org.debian:def:241477246312697265297873976373732459520
title: CVE-2009-1180 poppler
description:
The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to execute arbitrary code via a crafted PDF file that triggers a free of invalid data.


definition_id: oval:org.debian:def:90206493142007816547724191587418316937
title: CVE-2009-1182 poppler
description:
Multiple buffer overflows in the JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF file.


definition_id: oval:org.debian:def:80351030197091172750161255963994070760
title: CVE-2009-1189 dbus
description:
The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before 1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature via a crafted key.  NOTE: this is due to an incorrect fix for CVE-2008-3834.


definition_id: oval:org.debian:def:127484042334205810835281560943719662658
title: CVE-2009-1191 apache2
description:
mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request.


definition_id: oval:org.debian:def:84388614938043412100966846440529247420
title: CVE-2009-1195 apache2
description:
The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.


definition_id: oval:org.debian:def:330931774603894601686083497263794409541
title: CVE-2009-1196 cups
description:
The directory-services functionality in the scheduler in CUPS 1.1.17 and 1.1.22 allows remote attackers to cause a denial of service (cupsd daemon outage or crash) via manipulations of the timing of CUPS browse packets, related to a "pointer use-after-delete flaw."


definition_id: oval:org.debian:def:157747584483693599913933846319680602387
title: CVE-2009-1210 wireshark
description:
Format string vulnerability in the PROFINET/DCP (PN-DCP) dissector in Wireshark 1.0.6 and earlier allows remote attackers to execute arbitrary code via a PN-DCP packet with format string specifiers in the station name.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:265779687081141387034638576972710992768
title: CVE-2009-1214 screen
description:
GNU screen 4.0.3 creates the /tmp/screen-exchange temporary file with world-readable permissions, which might allow local users to obtain sensitive session information.


definition_id: oval:org.debian:def:161516503494639426162034459616684054938
title: CVE-2009-1215 screen
description:
Race condition in GNU screen 4.0.3 allows local users to create or overwrite arbitrary files via a symlink attack on the /tmp/screen-exchange temporary file.


definition_id: oval:org.debian:def:159623786201366333774297141626403235455
title: CVE-2009-1241 clamav
description:
Unspecified vulnerability in ClamAV before 0.95 allows remote attackers to bypass detection of malware via a modified RAR archive.


definition_id: oval:org.debian:def:41775194647317277183539257163359609588
title: CVE-2009-1250 openafs
description:
The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remote attackers to cause a denial of service (system crash) via an RX response with a large error-code value that is interpreted as a pointer and dereferenced, related to use of the ERR_PTR macro.


definition_id: oval:org.debian:def:320973007355064943400534107553564219000
title: CVE-2009-1251 openafs
description:
Heap-based buffer overflow in the cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58 on Unix platforms allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via an RX response containing more data than specified in a request, related to use of XDR arrays.


definition_id: oval:org.debian:def:278860823917159489818112942527686202103
title: CVE-2009-1252 ntp
description:
Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.


definition_id: oval:org.debian:def:98682846325775990025318182836366929429
title: CVE-2009-1253 tunapie
description:
James Stone Tunapie 2.1 allows local users to overwrite arbitrary files via a symlink attack on an unspecified temporary file.


definition_id: oval:org.debian:def:313411580514110333387390097516453099544
title: CVE-2009-1254 tunapie
description:
James Stone Tunapie 2.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a stream URL.


definition_id: oval:org.debian:def:71237044958890619120824425574396981913
title: CVE-2009-1255 memcached
description:
The process_stat function in (1) Memcached before 1.2.8 and (2) MemcacheDB 1.2.0 discloses (a) the contents of /proc/self/maps in response to a stats maps command and (b) memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain sensitive information such as the locations of memory regions, and defeat ASLR protection, by sending a command to the daemon's TCP port.


definition_id: oval:org.debian:def:47942349020131640555593325846202186602
title: CVE-2009-1268 wireshark
description:
The Check Point High-Availability Protocol (CPHAP) dissector in Wireshark 0.9.6 through 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted FWHA_MY_STATE packet.


definition_id: oval:org.debian:def:24217160107913835558061298512041793357
title: CVE-2009-1269 wireshark
description:
Unspecified vulnerability in Wireshark 0.99.6 through 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted Tektronix .rf5 file.


definition_id: oval:org.debian:def:249561943066209082755902830207419674276
title: CVE-2009-1270 clamav
description:
libclamav/untar.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (infinite loop) via a crafted TAR file that causes (1) clamd and (2) clamscan to hang.


definition_id: oval:org.debian:def:241507194044817194781494588425389849103
title: CVE-2009-1273 libpam-ssh
description:
pam_ssh 1.92 and possibly other versions, as used when PAM is compiled with USE=ssh, generates different error messages depending on whether the username is valid or invalid, which makes it easier for remote attackers to enumerate usernames.


definition_id: oval:org.debian:def:47426028391624967487341014371311533276
title: CVE-2009-1275 tiles
description:
Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain circumstances, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via unspecified vectors, related to the (1) tiles:putAttribute and (2) tiles:insertTemplate JSP tags.


definition_id: oval:org.debian:def:4479070350847100939364898645180240045
title: CVE-2009-1284 texlive-bin
description:
Buffer overflow in BibTeX 0.99 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a long .bib bibliography file.


definition_id: oval:org.debian:def:325091184787127762109506115160020452307
title: CVE-2009-1297 open-iscsi
description:
iscsi_discovery in open-iscsi in SUSE openSUSE 10.3 through 11.1 and SUSE Linux Enterprise (SLE) 10 SP2 and 11, and other operating systems, allows local users to overwrite arbitrary files via a symlink attack on an unspecified temporary file that has a predictable name.


definition_id: oval:org.debian:def:166176436497053924758409446194557369193
title: CVE-2009-1299 pulseaudio
description:
The pa_make_secure_dir function in core-util.c in PulseAudio 0.9.10 and 0.9.19 allows local users to change the ownership and permissions of arbitrary files via a symlink attack on a /tmp/.esd-##### temporary file.


definition_id: oval:org.debian:def:328591436447519085121867201402916150990
title: CVE-2009-1300 apt
description:
apt 0.7.20 does not check when the date command returns an "invalid date" error, which can prevent apt from loading security updates in time zones for which DST occurs at midnight.


definition_id: oval:org.debian:def:274426936093708180595256809077701186687
title: CVE-2009-1301 mpg123
description:
Integer signedness error in the store_id3_text function in the ID3v2 code in mpg123 before 1.7.2 allows remote attackers to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via an ID3 tag with a negative encoding value.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:257636807247814041403206094664294915742
title: CVE-2009-1341 libdbd-pg-perl
description:
Memory leak in the dequote_bytea function in quote.c in the DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module before 2.0.0 for Perl allows context-dependent attackers to cause a denial of service (memory consumption) by fetching data with BYTEA columns.


definition_id: oval:org.debian:def:261563662934091320758060941433385374103
title: CVE-2009-1358 apt
description:
apt-get in apt before 0.7.21 does not check for the correct error code from gpgv, which causes apt to treat a repository as valid even when it has been signed with a key that has been revoked or expired, which might allow remote attackers to trick apt into installing malicious repositories.


definition_id: oval:org.debian:def:208101747466655385881334386588562419070
title: CVE-2009-1364 libwmf
description:
Use-after-free vulnerability in the embedded GD library in libwmf 0.2.8.4 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WMF file.


definition_id: oval:org.debian:def:226160311802283705052999861976560644825
title: CVE-2009-1371 clamav
description:
The CLI_ISCONTAINED macro in libclamav/others.h in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) via a malformed file with UPack encoding.


definition_id: oval:org.debian:def:23397706343809470303209549633989913850
title: CVE-2009-1372 clamav
description:
Stack-based buffer overflow in the cli_url_canon function in libclamav/phishcheck.c in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted URL.


definition_id: oval:org.debian:def:104329668521854916026272383147318713746
title: CVE-2009-1373 pidgin
description:
Buffer overflow in the XMPP SOCKS5 bytestream server in Pidgin (formerly Gaim) before 2.5.6 allows remote authenticated users to execute arbitrary code via vectors involving an outbound XMPP file transfer.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:37501136527130364632669581293503140564
title: CVE-2009-1374 pidgin
description:
Buffer overflow in the decrypt_out function in Pidgin (formerly Gaim) before 2.5.6 allows remote attackers to cause a denial of service (application crash) via a QQ packet.


definition_id: oval:org.debian:def:82037481643477310909222162673264015907
title: CVE-2009-1375 pidgin
description:
The PurpleCircBuffer implementation in Pidgin (formerly Gaim) before 2.5.6 does not properly maintain a certain buffer, which allows remote attackers to cause a denial of service (memory corruption and application crash) via vectors involving the (1) XMPP or (2) Sametime protocol.


definition_id: oval:org.debian:def:266861718313538491241346199837968426987
title: CVE-2009-1376 pidgin
description:
Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin (formerly Gaim) before 2.5.6 on 32-bit platforms allow remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value, leading to buffer overflows.  NOTE: this issue exists because of an incomplete fix for CVE-2008-2927.


definition_id: oval:org.debian:def:269467597488720461712451616909742341517
title: CVE-2009-1377 openssl
description:
The dtls1_buffer_record function in ssl/d1_pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service (memory consumption) via a large series of "future epoch" DTLS records that are buffered in a queue, aka "DTLS record buffer limitation bug."


definition_id: oval:org.debian:def:2728159683694428408127925143525718235
title: CVE-2009-1378 openssl
description:
Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."


definition_id: oval:org.debian:def:68046042055489434047618922119370273200
title: CVE-2009-1382 mimetex
description:
Multiple stack-based buffer overflows in mimetex.cgi in mimeTeX, when downloaded before 20090713, allow remote attackers to execute arbitrary code via a TeX file with long (1) picture, (2) circle, or (3) input tags.


definition_id: oval:org.debian:def:145910286106367462850072693956233337876
title: CVE-2009-1383 mathtex
description:
The getdirective function in mathtex.cgi in mathTeX, when downloaded before 20090713, allows remote attackers to execute arbitrary commands via shell metacharacters in the dpi tag.


definition_id: oval:org.debian:def:39663974668592571363487838576597417176
title: CVE-2009-1387 openssl
description:
The dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL before 1.0.0 Beta 2 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence DTLS handshake message, related to a "fragment bug."


definition_id: oval:org.debian:def:252444566431330852954194322024128193857
title: CVE-2009-1390 mutt
description:
Mutt 1.5.19, when linked against (1) OpenSSL (mutt_ssl.c) or (2) GnuTLS (mutt_ssl_gnutls.c), allows connections when only one TLS certificate in the chain is accepted instead of verifying the entire chain, which allows remote attackers to spoof trusted servers via a man-in-the-middle attack.


definition_id: oval:org.debian:def:141464200482678281125578289695025822421
title: CVE-2009-1391 libcompress-raw-zlib-perl
description:
Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow, as exploited in the wild by Trojan.Downloader-71014 in June 2009.


definition_id: oval:org.debian:def:266371194092275704791849666254563480191
title: CVE-2009-1438 libmodplug
description:
Integer overflow in the CSoundFile::ReadMed function (src/load_med.cpp) in libmodplug before 0.8.6, as used in gstreamer-plugins, TTPlayer, and other products, allows context-dependent attackers to execute arbitrary code via a MED file with a crafted (1) song comment or (2) song name, which triggers a heap-based buffer overflow, as exploited in the wild in August 2008.


definition_id: oval:org.debian:def:52416702669947710657044477229047461763
title: CVE-2009-1440 amule
description:
Incomplete blacklist vulnerability in DownloadListCtrl.cpp in amule 2.2.4 allows remote attackers to conduct argument injection attacks into a command for mplayer via a crafted filename.


definition_id: oval:org.debian:def:225064103066623485536957217628132710589
title: CVE-2009-1443 ocsinventory-server
description:
Multiple unspecified vulnerabilities in the Server component in OCS Inventory NG before 1.02 have unknown impact and attack vectors.


definition_id: oval:org.debian:def:149618902252016812984173692587892786382
title: CVE-2009-1482 moin
description:
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin 1.8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) an AttachFile sub-action in the error_msg function or (2) multiple vectors related to package file errors in the upload_form function, different vectors than CVE-2009-0260.


definition_id: oval:org.debian:def:300877690698606386002659334985896595218
title: CVE-2009-1490 sendmail
description:
Heap-based buffer overflow in Sendmail before 8.13.2 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a long X- header, as demonstrated by an X-Testing header.


definition_id: oval:org.debian:def:194894341169000336159736727174137486354
title: CVE-2009-1494 memcached
description:
The process_stat function in Memcached 1.2.8 discloses memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain potentially sensitive information by sending this command to the daemon's TCP port.


definition_id: oval:org.debian:def:152892664408545895599171306159608337255
title: CVE-2009-1513 libmodplug
description:
Buffer overflow in the PATinst function in src/load_pat.cpp in libmodplug before 0.8.7 allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a long instrument name.


definition_id: oval:org.debian:def:78816470577532026859205065550856709084
title: CVE-2009-1515 file
description:
Heap-based buffer overflow in the cdf_read_sat function in src/cdf.c in Christos Zoulas file 5.00 allows user-assisted remote attackers to execute arbitrary code via a crafted compound document file, as demonstrated by a .msi, .doc, or .mpp file.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:260573998619329460007491131575100723276
title: CVE-2009-1570 gimp
description:
Integer overflow in the ReadImage function in plug-ins/file-bmp/bmp-read.c in GIMP 2.6.7 might allow remote attackers to execute arbitrary code via a BMP file with crafted width and height values that trigger a heap-based buffer overflow.


definition_id: oval:org.debian:def:106607930891801778109625839466641514810
title: CVE-2009-1572 quagga
description:
The BGP daemon (bgpd) in Quagga 0.99.11 and earlier allows remote attackers to cause a denial of service (crash) via an AS path containing ASN elements whose string representation is longer than expected, which triggers an assert error.


definition_id: oval:org.debian:def:121409804583497762049898515197607449386
title: CVE-2009-1573 xorg-server
description:
xvfb-run 1.6.1 in Debian GNU/Linux, Ubuntu, Fedora 10, and possibly other operating systems place the magic cookie (MCOOKIE) on the command line, which allows local users to gain privileges by listing the process and its arguments.


definition_id: oval:org.debian:def:247167282347089283908213279582816968906
title: CVE-2009-1577 cscope
description:
Multiple stack-based buffer overflows in the putstring function in find.c in Cscope before 15.6 allow user-assisted remote attackers to execute arbitrary code via a long (1) function name or (2) symbol in a source-code file.


definition_id: oval:org.debian:def:221870202603721788881656575247193988618
title: CVE-2009-1603 opensc
description:
src/tools/pkcs11-tool.c in pkcs11-tool in OpenSC 0.11.7, when used with unspecified third-party PKCS#11 modules, generates RSA keys with incorrect public exponents, which allows attackers to read the cleartext form of messages that were intended to be encrypted.


definition_id: oval:org.debian:def:181085487804893974163600961117368892867
title: CVE-2009-1629 ajaxterm
description:
ajaxterm.js in AjaxTerm 0.10 and earlier generates session IDs with predictable random numbers based on certain JavaScript functions, which makes it easier for remote attackers to (1) hijack a session or (2) cause a denial of service (session ID exhaustion) via a brute-force attack.


definition_id: oval:org.debian:def:11156222691926957737087073577184562053
title: CVE-2009-1631 evolution
description:
The Mailer component in Evolution 2.26.1 and earlier uses world-readable permissions for the .evolution directory, and certain directories and files under .evolution/ related to local mail, which allows local users to obtain sensitive information by reading these files.


definition_id: oval:org.debian:def:215200141358285883250347329043871308648
title: CVE-2009-1681 qt4-x11
description:
WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not prevent web sites from loading third-party content into a subframe, which allows remote attackers to bypass the Same Origin Policy and conduct "clickjacking" attacks via a crafted HTML document.


definition_id: oval:org.debian:def:251430136480026991479532576834362619858
title: CVE-2009-1684 qt4-x11
description:
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via an event handler that triggers script execution in the context of the next loaded document.


definition_id: oval:org.debian:def:321902153538108596883795683279561628801
title: CVE-2009-1685 qt4-x11
description:
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML by overwriting the document.implementation property of (1) an embedded document or (2) a parent document.


definition_id: oval:org.debian:def:104058840073335761604673410085971308281
title: CVE-2009-1686 qt4-x11
description:
WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle constant (aka const) declarations in a type-conversion operation during JavaScript exception handling, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.


definition_id: oval:org.debian:def:260386028970925195284785336744393050722
title: CVE-2009-1687 kde4libs
description:
The JavaScript garbage collector in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle allocation failures, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document that triggers write access to an "offset of a NULL pointer."


definition_id: oval:org.debian:def:240743842649543885095221659409647465468
title: CVE-2009-1688 qt4-x11
description:
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to determining a security context through an approach that is not the "HTML 5 standard method."


definition_id: oval:org.debian:def:160904777442573372268651328126245658494
title: CVE-2009-1689 qt4-x11
description:
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving submission of a form to the about:blank URL, leading to security-context replacement.


definition_id: oval:org.debian:def:23546091022187247602727078003132137417
title: CVE-2009-1690 kde4libs
description:
Use-after-free vulnerability in WebKit, as used in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Google Chrome 1.0.154.53, and possibly other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by setting an unspecified property of an HTML tag that causes child elements to be freed and later accessed when an HTML error occurs, related to "recursion in certain DOM event handlers."


definition_id: oval:org.debian:def:47726598858378567150994483643627566573
title: CVE-2009-1691 qt4-x11
description:
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to insufficient access control for standard JavaScript prototypes in other domains.


definition_id: oval:org.debian:def:231203714357865704458852521474573812566
title: CVE-2009-1692 qt4-x11
description:
WebKit before r41741, as used in Apple iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Safari, and other software, allows remote attackers to cause a denial of service (memory consumption or device reset) via a web page containing an HTMLSelectElement object with a large length attribute, related to the length property of a Select object.


definition_id: oval:org.debian:def:294409132614583399959121364465461853436
title: CVE-2009-1693 qt4-x11
description:
WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to read images from arbitrary web sites via a CANVAS element with an SVG image, related to a "cross-site image capture issue."


definition_id: oval:org.debian:def:337414949682373508817292143815077581083
title: CVE-2009-1694 qt4-x11
description:
WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle redirects, which allows remote attackers to read images from arbitrary web sites via vectors involving a CANVAS element and redirection, related to a "cross-site image capture issue."


definition_id: oval:org.debian:def:7503117810758839733249301539731063433
title: CVE-2009-1695 qt4-x11
description:
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving access to frame contents after completion of a page transition.


definition_id: oval:org.debian:def:262017806448908761588482725353197778341
title: CVE-2009-1696 qt4-x11
description:
WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 uses predictable random numbers in JavaScript applications, which makes it easier for remote web servers to track the behavior of a Safari user during a session.


definition_id: oval:org.debian:def:95439492377176884547055558437366560821
title: CVE-2009-1697 qt4-x11
description:
CRLF injection vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject HTTP headers and bypass the Same Origin Policy via a crafted HTML document, related to cross-site scripting (XSS) attacks that depend on communication with arbitrary web sites on the same server through use of XMLHttpRequest without a Host header.


definition_id: oval:org.debian:def:239809924113687982193288102183670971709
title: CVE-2009-1698 kde4libs
description:
WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not initialize a pointer during handling of a Cascading Style Sheets (CSS) attr function call with a large numerical argument, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.


definition_id: oval:org.debian:def:317963421337208116686640152555763655857
title: CVE-2009-1699 qt4-x11
description:
The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as demonstrated by a file:///etc/passwd URL in an entity declaration, related to an "XXE attack."


definition_id: oval:org.debian:def:208788774836583544028827810085383001941
title: CVE-2009-1700 qt4-x11
description:
The XSLT implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle redirects, which allows remote attackers to read XML content from arbitrary web pages via a crafted document.


definition_id: oval:org.debian:def:170557103846528834539690549615031162458
title: CVE-2009-1701 qt4-x11
description:
Use-after-free vulnerability in the JavaScript DOM implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by destroying a document.body element that has an unspecified XML container with elements that support the dir attribute.


definition_id: oval:org.debian:def:309784286888466367239273078515325687574
title: CVE-2009-1702 qt4-x11
description:
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to improper handling of Location and History objects.


definition_id: oval:org.debian:def:45905219905432924132886610555564351779
title: CVE-2009-1703 qt4-x11
description:
WebKit in Apple Safari before 4.0 does not prevent references to file: URLs within (1) audio and (2) video elements, which allows remote attackers to determine the existence of arbitrary files via a crafted HTML document.


definition_id: oval:org.debian:def:62567800515918085390125567689721334873
title: CVE-2009-1710 qt4-x11
description:
WebKit in Apple Safari before 4.0 allows remote attackers to spoof the browser's display of (1) the host name, (2) security indicators, and unspecified other UI elements via a custom cursor in conjunction with a modified CSS3 hotspot property.


definition_id: oval:org.debian:def:240386604288105402948335867911837666447
title: CVE-2009-1711 qt4-x11
description:
WebKit in Apple Safari before 4.0 does not properly initialize memory for Attr DOM objects, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document.


definition_id: oval:org.debian:def:256052268913361787233325573955393266484
title: CVE-2009-1712 qt4-x11
description:
WebKit in Apple Safari before 4.0 does not prevent remote loading of local Java applets, which allows remote attackers to execute arbitrary code, gain privileges, or obtain sensitive information via an APPLET or OBJECT element.


definition_id: oval:org.debian:def:104180673828290010785549381049372234889
title: CVE-2009-1713 qt4-x11
description:
The XSLT functionality in WebKit in Apple Safari before 4.0 does not properly implement the document function, which allows remote attackers to read (1) arbitrary local files and (2) files from different security zones via unspecified vectors.


definition_id: oval:org.debian:def:246102509683784571297629208618656904200
title: CVE-2009-1714 qt4-x11
description:
Cross-site scripting (XSS) vulnerability in Web Inspector in WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to inject arbitrary web script or HTML, and read local files, via vectors related to the improper escaping of HTML attributes.


definition_id: oval:org.debian:def:16606406648339779106920826280600851050
title: CVE-2009-1715 qt4-x11
description:
Cross-site scripting (XSS) vulnerability in Web Inspector in WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to inject arbitrary web script or HTML, and read local files, via vectors related to script execution with incorrect privileges.


definition_id: oval:org.debian:def:149002569583873722490575033298352645550
title: CVE-2009-1718 qt4-x11
description:
WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to obtain sensitive information via vectors involving drag events and the dragging of content over a crafted web page.


definition_id: oval:org.debian:def:287230140963676213349113341773323323337
title: CVE-2009-1720 openexr
description:
Multiple integer overflows in OpenEXR 1.2.2 and 1.6.1 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors that trigger heap-based buffer overflows, related to (1) the Imf::PreviewImage::PreviewImage function and (2) compressor constructors.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:176701901440535772456826615525043252343
title: CVE-2009-1721 openexr
description:
The decompression implementation in the Imf::hufUncompress function in OpenEXR 1.2.2 and 1.6.1 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger a free of an uninitialized pointer.


definition_id: oval:org.debian:def:316741602078639721803970548724118741389
title: CVE-2009-1722 openexr
description:
Heap-based buffer overflow in the compression implementation in OpenEXR 1.2.2 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors.


definition_id: oval:org.debian:def:78545355019923177724212973557877708301
title: CVE-2009-1725 qt4-x11
description:
WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms; KHTML in kdelibs in KDE; QtWebKit (aka Qt toolkit); and possibly other products do not properly handle numeric character references, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.


definition_id: oval:org.debian:def:236503008042653248799476771124898692377
title: CVE-2009-1753 coccinelle
description:
Coccinelle 0.1.7 allows local users to overwrite arbitrary files via a symlink attack on an unspecified "result file."


definition_id: oval:org.debian:def:227335992412607120645722771060604909172
title: CVE-2009-1755 nsd
description:
Off-by-one error in the packet_read_query_section function in packet.c in nsd 3.2.1, and process_query_section in query.c in nsd 2.3.7, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors that trigger a buffer overflow.


definition_id: oval:org.debian:def:298211656366194994277604763404052828351
title: CVE-2009-1756 slim
description:
SLiM Simple Login Manager 1.3.0 places the X authority magic cookie (mcookie) on the command line when invoking xauth from (1) app.cpp and (2) switchuser.cpp, which allows local users to access the X session by listing the process and its arguments.


definition_id: oval:org.debian:def:100315230763869213438215337750009774565
title: CVE-2009-1757 transmission
description:
Cross-site request forgery (CSRF) vulnerability in Transmission 1.5 before 1.53 and 1.6 before 1.61 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.


definition_id: oval:org.debian:def:110594252090381341836912233080357839237
title: CVE-2009-1759 ctorrent
description:
Stack-based buffer overflow in the btFiles::BuildFromMI function (trunk/btfiles.cpp) in Enhanced CTorrent (aka dTorrent) 3.3.2 and probably earlier, and CTorrent 1.3.4, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Torrent file containing a long path.


definition_id: oval:org.debian:def:114313775752707857027208698847116106805
title: CVE-2009-1760 libtorrent-rasterbar
description:
Directory traversal vulnerability in src/torrent_info.cpp in Rasterbar libtorrent before 0.14.4, as used in firetorrent, qBittorrent, deluge Torrent, and other applications, allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) and partial relative pathname in a Multiple File Mode list element in a .torrent file.


definition_id: oval:org.debian:def:181130644250275155414239700273312983331
title: CVE-2009-1769 ocsinventory-server
description:
The web interface in Open Computer and Software Inventory Next Generation (OCS Inventory NG) 1.01 generates different error messages depending on whether a username is valid, which allows remote attackers to enumerate valid usernames.


definition_id: oval:org.debian:def:226511505271699374456681548240454886850
title: CVE-2009-1788 libsndfile
description:
Heap-based buffer overflow in voc_read_header in libsndfile 1.0.15 through 1.0.19, as used in Winamp 5.552 and possibly other media programs, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a VOC file with an invalid header value.


definition_id: oval:org.debian:def:180797773148341744289330461767139605285
title: CVE-2009-1789 eggdrop
description:
mod/server.mod/servmsg.c in Eggheads Eggdrop and Windrop 1.6.19 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PRIVMSG that causes an empty string to trigger a negative string length copy.  NOTE: this issue exists because of an incorrect fix for CVE-2007-2807.


definition_id: oval:org.debian:def:203909083586113972120979990947658267932
title: CVE-2009-1791 libsndfile
description:
Heap-based buffer overflow in aiff_read_header in libsndfile 1.0.15 through 1.0.19, as used in Winamp 5.552 and possibly other media programs, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an AIFF file with an invalid header value.


definition_id: oval:org.debian:def:233582373034493297591578929406707608538
title: CVE-2009-1829 wireshark
description:
Unspecified vulnerability in the PCNFSD dissector in Wireshark 0.8.20 through 1.0.7 allows remote attackers to cause a denial of service (crash) via crafted PCNFSD packets.


definition_id: oval:org.debian:def:226733781467473222940862071199261044135
title: CVE-2009-1882 graphicsmagick
description:
Integer overflow in the XMakeImage function in magick/xwindow.c in ImageMagick 6.5.2-8, and GraphicsMagick, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF file, which triggers a buffer overflow.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:325796050154074568679461610359218879764
title: CVE-2009-1885 xerces-c
description:
Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrated by the Codenomicon XML fuzzing framework.


definition_id: oval:org.debian:def:217059961636896520459072842491256885194
title: CVE-2009-1886 samba
description:
Multiple format string vulnerabilities in client/client.c in smbclient in Samba 3.2.0 through 3.2.12 might allow context-dependent attackers to execute arbitrary code via format string specifiers in a filename.


definition_id: oval:org.debian:def:181290405743222665189904300785379164258
title: CVE-2009-1888 samba
description:
The acl_group_override function in smbd/posix_acls.c in smbd in Samba 3.0.x before 3.0.35, 3.1.x and 3.2.x before 3.2.13, and 3.3.x before 3.3.6, when dos filemode is enabled, allows remote attackers to modify access control lists for files via vectors related to read access to uninitialized memory.


definition_id: oval:org.debian:def:268884902731360188882447881905316361473
title: CVE-2009-1889 pidgin
description:
The OSCAR protocol implementation in Pidgin before 2.5.8 misinterprets the ICQWebMessage message type as the ICQSMS message type, which allows remote attackers to cause a denial of service (application crash) via a crafted ICQ web message that triggers allocation of a large amount of memory.


definition_id: oval:org.debian:def:26317716075797878364632916812815638529
title: CVE-2009-1891 apache2
description:
The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).


definition_id: oval:org.debian:def:75431260087458950854639605098454749350
title: CVE-2009-1892 isc-dhcp
description:
dhcpd in ISC DHCP 3.0.4 and 3.1.1, when the dhcp-client-identifier and hardware ethernet configuration settings are both used, allows remote attackers to cause a denial of service (daemon crash) via unspecified requests.


definition_id: oval:org.debian:def:186747416982234221823903555264102806960
title: CVE-2009-1955 apr-util
description:
The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.


definition_id: oval:org.debian:def:152563419271831605449815250667138881191
title: CVE-2009-1956 apr-util
description:
Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input.


definition_id: oval:org.debian:def:126232051260083801149194372368517090769
title: CVE-2009-1957 strongswan
description:
charon/sa/ike_sa.c in the charon daemon in strongSWAN before 4.3.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an invalid IKE_SA_INIT request that triggers "an incomplete state," followed by a CREATE_CHILD_SA request.


definition_id: oval:org.debian:def:327857179248031889548856667074163370091
title: CVE-2009-1958 strongswan
description:
charon/sa/tasks/child_create.c in the charon daemon in strongSWAN before 4.3.1 switches the NULL checks for TSi and TSr payloads, which allows remote attackers to cause a denial of service via an IKE_AUTH request without a (1) TSi or (2) TSr traffic selector.


definition_id: oval:org.debian:def:264821896760517898830389176499916489673
title: CVE-2009-1959 irssi
description:
Off-by-one error in the event_wallops function in fe-common/irc/fe-events.c in irssi 0.8.13 allows remote IRC servers to cause a denial of service (crash) via an empty command, which triggers a one-byte buffer under-read and a one-byte buffer underflow.


definition_id: oval:org.debian:def:205142739946424585275468486261834368829
title: CVE-2009-1960 dokuwiki
description:
inc/init.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via the config_cascade[main][default][] parameter to doku.php.  NOTE: PHP remote file inclusion is also possible in PHP 5 using ftp:// URLs.


definition_id: oval:org.debian:def:238690468956056088465320423337515418289
title: CVE-2009-1962 xfig
description:
Xfig, possibly 3.2.5, allows local users to read and write arbitrary files via a symlink attack on the (1) xfig-eps[PID], (2) xfig-pic[PID].pix, (3) xfig-pic[PID].err, (4) xfig-pcx[PID].pix, (5) xfig-xfigrc[PID], (6) xfig[PID], (7) xfig-print[PID], (8) xfig-export[PID].err, (9) xfig-batch[PID], (10) xfig-exp[PID], or (11) xfig-spell.[PID] temporary files, where [PID] is a process ID.


definition_id: oval:org.debian:def:20377505483318330712684706424001602983
title: CVE-2009-2044 cairo
description:
Mozilla Firefox 3.0.10 and earlier on Linux allows remote attackers to cause a denial of service (application crash) via a URI for a large GIF image in the BACKGROUND attribute of a BODY element.


definition_id: oval:org.debian:def:156696470449296261862385476900727661434
title: CVE-2009-2084 slurm-llnl
description:
Simple Linux Utility for Resource Management (SLURM) 1.2 and 1.3 before 1.3.14 does not properly set supplementary groups before invoking (1) sbcast from the slurmd daemon or (2) strigger from the slurmctld daemon, which might allow local SLURM users to modify files and gain privileges.


definition_id: oval:org.debian:def:171844929339957540114773860932096565428
title: CVE-2009-2166 ocsinventory-server
description:
Absolute path traversal vulnerability in cvs.php in OCS Inventory NG before 1.02.1 on Unix allows remote attackers to read arbitrary files via a full pathname in the log parameter.


definition_id: oval:org.debian:def:264135998950516818315799196695300167303
title: CVE-2009-2174 gupnp
description:
GUPnP 0.12.7 allows remote attackers to cause a denial of service (crash) via an empty (1) subscription or (2) control message.


definition_id: oval:org.debian:def:100973735653003881447254576083345909921
title: CVE-2009-2175 xcftools
description:
Stack-based buffer overflow in the flattenIncrementally function in flatten.c in xcftools 1.0.4, as reachable from the (1) xcf2pnm and (2) xcf2png utilities, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted image that causes a conversion to a location "above or to the left of the canvas." NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:16007930785623427920233057576304284254
title: CVE-2009-2185 strongswan
description:
The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10, 4.2 before 4.2.16, and 4.3 before 4.3.2; and (b) openSwan 2.6 before 2.6.22 and 2.4 before 2.4.15 allows remote attackers to cause a denial of service (pluto IKE daemon crash) via an X.509 certificate with (1) crafted Relative Distinguished Names (RDNs), (2) a crafted UTCTIME string, or (3) a crafted GENERALIZEDTIME string.


definition_id: oval:org.debian:def:21132598645602838424096541079428266238
title: CVE-2009-2265 moin
description:
Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to unspecified connector modules, as exploited in the wild for remote code execution in July 2009, related to the file browser and the editor/filemanager/connectors/ directory.


definition_id: oval:org.debian:def:71863795599795562682229526981736124233
title: CVE-2009-2281 mapserver
description:
Multiple heap-based buffer underflows in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x through 4.10.4 and 5.x before 5.4.2 allow remote attackers to execute arbitrary code via (1) a crafted Content-Length HTTP header or (2) a large HTTP request, related to an integer overflow that triggers a heap-based buffer overflow.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-0840.


definition_id: oval:org.debian:def:152636045482938796410332986663151146012
title: CVE-2009-2285 tiff
description:
Buffer underflow in the LZWDecodeCompat function in libtiff 3.8.2 allows context-dependent attackers to cause a denial of service (crash) via a crafted TIFF image, a different vulnerability than CVE-2008-2327.


definition_id: oval:org.debian:def:157893224846972689246283406945812282558
title: CVE-2009-2286 libcompface
description:
Buffer overflow in compface 1.5.2 and earlier allows user-assisted attackers to cause a denial of service (crash) via a long declaration in a .xbm file.  NOTE: this issue only affects compface on distributions that used a certain patch.


definition_id: oval:org.debian:def:98182656478239180621717792390402833422
title: CVE-2009-2294 dillo
description:
Integer overflow in the Png_datainfo_callback function in Dillo 2.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PNG image with crafted (1) width or (2) height values.


definition_id: oval:org.debian:def:187759103582602074914748461749779543898
title: CVE-2009-2295 advi
description:
Multiple integer overflows in CamlImages 2.2 and earlier might allow context-dependent attackers to execute arbitrary code via a crafted PNG image with large width and height values that trigger a heap-based buffer overflow in the (1) read_png_file or (2) read_png_file_as_rgb24 function.


definition_id: oval:org.debian:def:199299666155966877727786128433692043835
title: CVE-2009-2324 moin
description:
Multiple cross-site scripting (XSS) vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to inject arbitrary web script or HTML via components in the samples (aka _samples) directory.


definition_id: oval:org.debian:def:278756605394426518775942568012157124621
title: CVE-2009-2334 wordpress
description:
wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as demonstrated by the (1) collapsing-archives/options.txt, (2) akismet/readme.txt, (3) related-ways-to-take-action/options.php, (4) wp-security-scan/securityscan.php, and (5) wp-ids/ids-admin.php files. NOTE: this can be leveraged for cross-site scripting (XSS) and denial of service.


definition_id: oval:org.debian:def:244677945050837520826360936587181700523
title: CVE-2009-2335 wordpress
description:
WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.  NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."


definition_id: oval:org.debian:def:104171003645694939709538853245143659988
title: CVE-2009-2336 wordpress
description:
The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.  NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."


definition_id: oval:org.debian:def:301635487589141220266245532515332570875
title: CVE-2009-2343 zoph
description:
Cross-site scripting (XSS) vulnerability in people.php in Zoph before 0.7.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:237469875008626333577129285405268064086
title: CVE-2009-2346 asterisk
description:
The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x before 1.6.0.15, and 1.6.1.x before 1.6.1.6; Business Edition B.x.x before B.2.5.10, C.2.x before C.2.4.3, and C.3.x before C.3.1.1; and s800i 1.3.x before 1.3.0.3 allows remote attackers to cause a denial of service (call-number exhaustion) by initiating many IAX2 message exchanges, a related issue to CVE-2008-3263.


definition_id: oval:org.debian:def:140857754136168502997010906789876043069
title: CVE-2009-2347 tiff
description:
Multiple integer overflows in inter-color spaces conversion tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow context-dependent attackers to execute arbitrary code via a TIFF image with large (1) width and (2) height values, which triggers a heap-based buffer overflow in the (a) cvt_whole_image function in tiff2rgba and (b) tiffcvt function in rgb2ycbcr.


definition_id: oval:org.debian:def:232952009893144092919424046548705335980
title: CVE-2009-2404 nss
description:
Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services (NSS) before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Instant Messenger (AIM), allows remote SSL servers to cause a denial of service (application crash) or possibly execute arbitrary code via a long domain name in the subject's Common Name (CN) field of an X.509 certificate, related to the cert_TestHostName function.


definition_id: oval:org.debian:def:265624469773197643570704287411027211514
title: CVE-2009-2408 nss
description:
Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. NOTE: this was originally reported for Firefox before 3.5.


definition_id: oval:org.debian:def:316168818269827681490263873092700999730
title: CVE-2009-2409 nss
description:
The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time.  NOTE: the scope of this issue is currently limited because the amount of computation required is still large.


definition_id: oval:org.debian:def:17939148550999958590457534619884751283
title: CVE-2009-2411 subversion
description:
Multiple integer overflows in the libsvn_delta library in Subversion before 1.5.7, and 1.6.x before 1.6.4, allow remote authenticated users and remote Subversion servers to execute arbitrary code via an svndiff stream with large windows that trigger a heap-based buffer overflow, a related issue to CVE-2009-2412.


definition_id: oval:org.debian:def:222555838155262542688241094210211461117
title: CVE-2009-2412 apr
description:
CVE-2009-2412 apr, apr-util: Integer overflows in memory pool (apr) and relocatable memory (apr-util) management


definition_id: oval:org.debian:def:86020115285173983371273126013393182284
title: CVE-2009-2414 libxml2
description:
Stack consumption vulnerability in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allows context-dependent attackers to cause a denial of service (application crash) via a large depth of element declarations in a DTD, related to a function recursion, as demonstrated by the Codenomicon XML fuzzing framework.


definition_id: oval:org.debian:def:231599164768019900502804537880944292693
title: CVE-2009-2415 memcached
description:
Multiple integer overflows in memcached 1.1.12 and 1.2.2 allow remote attackers to execute arbitrary code via vectors involving length attributes that trigger heap-based buffer overflows.


definition_id: oval:org.debian:def:15099694878083898185592328973417292444
title: CVE-2009-2416 libxml2
description:
CVE-2009-2416 libxml, libxml2, mingw32-libxml2: Pointer use-after-free flaws by parsing Notation and Enumeration attribute types


definition_id: oval:org.debian:def:194089816891249449228379305158527923476
title: CVE-2009-2417 curl
description:
lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.


definition_id: oval:org.debian:def:185275371269894502660822889486400539218
title: CVE-2009-2422 rails
description:
The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_or_request_with_http_digest block that returns nil instead of false when the user does not exist, which allows context-dependent attackers to bypass authentication for applications that are derived from this example by sending an invalid username without a password.


definition_id: oval:org.debian:def:101099172069426524439357425392016746108
title: CVE-2009-2425 tor
description:
Tor before 0.2.0.35 allows remote attackers to cause a denial of service (application crash) via a malformed router descriptor.


definition_id: oval:org.debian:def:59876714617119638918552221386266020438
title: CVE-2009-2426 tor
description:
The connection_edge_process_relay_cell_not_open function in src/or/relay.c in Tor 0.2.x before 0.2.0.35 and 0.1.x before 0.1.2.8-beta allows exit relays to have an unspecified impact by causing controllers to accept DNS responses that redirect to an internal IP address via unknown vectors.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:298419823197244481752783168020792231958
title: CVE-2009-2431 wordpress
description:
WordPress 2.7.1 places the username of a post's author in an HTML comment, which allows remote attackers to obtain sensitive information by reading the HTML source.


definition_id: oval:org.debian:def:10709517787207314260487611463974310429
title: CVE-2009-2432 wordpress
description:
WordPress and WordPress MU before 2.8.1 allow remote attackers to obtain sensitive information via a direct request to wp-settings.php, which reveals the installation path in an error message.


definition_id: oval:org.debian:def:146769292755418433207331839713877881403
title: CVE-2009-2459 mimetex
description:
Multiple unspecified vulnerabilities in mimeTeX, when downloaded before 20090713, have unknown impact and attack vectors related to the (1) \environ, (2) \input, and (3) \counter TeX directives.


definition_id: oval:org.debian:def:153655570374890447813990248733150685911
title: CVE-2009-2460 mathtex
description:
Multiple stack-based buffer overflows in mathtex.cgi in mathTeX, when downloaded before 20090713, have unspecified impact and remote attack vectors.


definition_id: oval:org.debian:def:336524861926704887874345735549866745923
title: CVE-2009-2461 mathtex
description:
mathtex.cgi in mathTeX, when downloaded before 20090713, does not securely create temporary files, which has unspecified impact and local attack vectors.


definition_id: oval:org.debian:def:320892559116146601824525688352946520672
title: CVE-2009-2463 nspr
description:
Multiple integer overflows in the (1) PL_Base64Decode and (2) PL_Base64Encode functions in nsprpub/lib/libc/src/base64.c in Mozilla Firefox before 3.0.12, Thunderbird before 2.0.0.24, and SeaMonkey before 1.1.19 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors that trigger buffer overflows.


definition_id: oval:org.debian:def:102011129042105680010244235469040221409
title: CVE-2009-2474 litmus
description:
neon before 0.28.6, when OpenSSL or GnuTLS is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.


definition_id: oval:org.debian:def:168260412050552017661519204025049984770
title: CVE-2009-2559 wireshark
description:
Buffer overflow in the IPMI dissector in Wireshark 1.2.0 allows remote attackers to cause a denial of service (crash) via unspecified vectors related to an array index error.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:81124050862192324853071520829716502947
title: CVE-2009-2560 wireshark
description:
Multiple unspecified vulnerabilities in Wireshark 1.2.0 allow remote attackers to cause a denial of service (application crash) via a file that records a malformed packet trace and is processed by the (1) Bluetooth L2CAP, (2) RADIUS, or (3) MIOP dissector. NOTE: it was later reported that the RADIUS issue also affects 0.10.13 through 1.0.9.


definition_id: oval:org.debian:def:214355960042843074241885289514990927923
title: CVE-2009-2561 wireshark
description:
Unspecified vulnerability in the sFlow dissector in Wireshark 1.2.0 allows remote attackers to cause a denial of service (CPU and memory consumption) via unspecified vectors.


definition_id: oval:org.debian:def:240704110048227942481293648559315319161
title: CVE-2009-2562 wireshark
description:
Unspecified vulnerability in the AFS dissector in Wireshark 0.9.2 through 1.2.0 allows remote attackers to cause a denial of service (crash) via unknown vectors.


definition_id: oval:org.debian:def:283220103337291650176916273827037548443
title: CVE-2009-2563 wireshark
description:
Unspecified vulnerability in the Infiniband dissector in Wireshark 1.0.6 through 1.2.0, when running on unspecified platforms, allows remote attackers to cause a denial of service (crash) via unknown vectors.


definition_id: oval:org.debian:def:41328305736141197989028808185452163488
title: CVE-2009-2624 gzip
description:
The huft_build function in inflate.c in gzip before 1.3.13 creates a hufts (aka huffman) table that is too small, which allows remote attackers to cause a denial of service (application crash or infinite loop) or possibly execute arbitrary code via a crafted archive.  NOTE: this issue is caused by a CVE-2006-4334 regression.


definition_id: oval:org.debian:def:304493765716272084089962096719797339379
title: CVE-2009-2625 libxerces2-java
description:
XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.


definition_id: oval:org.debian:def:277102502336591933830975325946454144364
title: CVE-2009-2629 nginx
description:
Buffer underflow in src/http/ngx_http_parse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows remote attackers to execute arbitrary code via crafted HTTP requests.


definition_id: oval:org.debian:def:231157586657320490967033978313572536385
title: CVE-2009-2632 dovecot
description:
Buffer overflow in the SIEVE script component (sieve/script.c), as used in cyrus-imapd in Cyrus IMAP Server 2.2.13 and 2.3.14, and Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, allows local users to execute arbitrary code and read or modify arbitrary messages via a crafted SIEVE script, related to the incorrect use of the sizeof operator for determining buffer length, combined with an integer signedness error.


definition_id: oval:org.debian:def:197828228852000175235175369656757564713
title: CVE-2009-2651 asterisk
description:
main/rtp.c in Asterisk Open Source 1.6.1 before 1.6.1.2 allows remote attackers to cause a denial of service (crash) via an RTP text frame without a certain delimiter, which triggers a NULL pointer dereference and the subsequent calculation of an invalid pointer.


definition_id: oval:org.debian:def:216907791962626840608289799204968505530
title: CVE-2009-2658 znc
description:
Directory traversal vulnerability in ZNC before 0.072 allows remote attackers to overwrite arbitrary files via a crafted DCC SEND request.


definition_id: oval:org.debian:def:218786097106123476278237714855994691260
title: CVE-2009-2659 python-django
description:
The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected "static media files," which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a crafted URL.


definition_id: oval:org.debian:def:286718974016234650223056106963057880087
title: CVE-2009-2660 advi
description:
Multiple integer overflows in CamlImages 2.2 might allow context-dependent attackers to execute arbitrary code via images containing large width and height values that trigger a heap-based buffer overflow, related to (1) crafted GIF files (gifread.c) and (2) crafted JPEG files (jpegread.c), a different vulnerability than CVE-2009-2295.


definition_id: oval:org.debian:def:126952981833205689869088225157955580367
title: CVE-2009-2661 strongswan
description:
The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and 4.3 before 4.3.3 does not properly handle X.509 certificates with crafted Relative Distinguished Names (RDNs), which allows remote attackers to cause a denial of service (pluto IKE daemon crash) via malformed ASN.1 data.  NOTE: this is due to an incomplete fix for CVE-2009-2185.


definition_id: oval:org.debian:def:314577991129111053764120338789693133316
title: CVE-2009-2663 libvorbis
description:
libvorbis before r16182, as used in Mozilla Firefox 3.5.x before 3.5.2 and other products, allows context-dependent attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted .ogg file.


definition_id: oval:org.debian:def:159079345828843489762978237414856274919
title: CVE-2009-2666 fetchmail
description:
socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.


definition_id: oval:org.debian:def:170312278152619371078250848488850724200
title: CVE-2009-2688 xemacs21
description:
Multiple integer overflows in glyphs-eimage.c in XEmacs 21.4.22, when running on Windows, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) the tiff_instantiate function processing a crafted TIFF file, (2) the png_instantiate function processing a crafted PNG file, and (3) the jpeg_instantiate function processing a crafted JPEG file, all which trigger a heap-based buffer overflow.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


definition_id: oval:org.debian:def:33617155369063178019811165922385047453
title: CVE-2009-2694 pidgin
description:
The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376.


definition_id: oval:org.debian:def:285515934069491326293190310111355713663
title: CVE-2009-2700 qt4-x11
description:
src/network/ssl/qsslcertificate.cpp in Nokia Trolltech Qt 4.x does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.


definition_id: oval:org.debian:def:155461090728900591151585626866189833713
title: CVE-2009-2701 zodb
description:
Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain ZEO database sharing and blob support are enabled, allows remote authenticated users to read or delete arbitrary files via unknown vectors.


definition_id: oval:org.debian:def:170761232493595018333012961467302567161
title: CVE-2009-2702 kde4libs
description:
KDE KSSL in kdelibs 3.5.4, 4.2.4, and 4.3 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.


definition_id: oval:org.debian:def:4517515358224261332998392134916091154
title: CVE-2009-2703 pidgin
description:
libpurple/protocols/irc/msgs.c in the IRC protocol plugin in libpurple in Pidgin before 2.6.2 allows remote IRC servers to cause a denial of service (NULL pointer dereference and application crash) via a TOPIC message that lacks a topic string.


definition_id: oval:org.debian:def:283108382663483304069075253279848984667
title: CVE-2009-2726 asterisk
description:
The SIP channel driver in Asterisk Open Source 1.2.x before 1.2.34, 1.4.x before 1.4.26.1, 1.6.0.x before 1.6.0.12, and 1.6.1.x before 1.6.1.4; Asterisk Business Edition A.x.x, B.x.x before B.2.5.9, C.2.x before C.2.4.1, and C.3.x before C.3.1; and Asterisk Appliance s800i 1.2.x before 1.3.0.3 does not use a maximum width when invoking sscanf style functions, which allows remote attackers to cause a denial of service (stack memory consumption) via SIP packets containing large sequences of ASCII decimal characters, as demonstrated via vectors related to (1) the CSeq value in a SIP header, (2) large Content-Length value, and (3) SDP.


definition_id: oval:org.debian:def:226204685415771751586364143684873295917
title: CVE-2009-2762 wordpress
description:
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array.


definition_id: oval:org.debian:def:58750475750515593577573923140174850791
title: CVE-2009-2797 qt4-x11
description:
The WebKit component in Safari in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, does not remove usernames and passwords from URLs sent in Referer headers, which allows remote attackers to obtain sensitive information by reading Referer logs on a web server.


definition_id: oval:org.debian:def:108156056333029794972766425518872500918
title: CVE-2009-2813 samba
description:
Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances involving user accounts that lack home directories.


definition_id: oval:org.debian:def:288959933677894741457854087705113032529
title: CVE-2009-2816 qt4-x11
description:
The implementation of Cross-Origin Resource Sharing (CORS) in WebKit, as used in Apple Safari before 4.0.4 and Google Chrome before 3.0.195.33, includes certain custom HTTP headers in the OPTIONS request during cross-origin operations with preflight, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web page.


definition_id: oval:org.debian:def:21616770850931933898202371721631100743
title: CVE-2009-2820 cups
description:
The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle (1) HTTP headers and (2) HTML templates, which allows remote attackers to conduct cross-site scripting (XSS) attacks and HTTP response splitting attacks via vectors related to (a) the product's web interface, (b) the configuration of the print system, and (c) the titles of printed jobs, as demonstrated by an XSS attack that uses the kerberos parameter to the admin program, and leverages attribute injection and HTTP Parameter Pollution (HPP) issues.


definition_id: oval:org.debian:def:281439643630465826740369085319040864488
title: CVE-2009-2830 file
description:
Multiple buffer overflows in Christos Zoulas file before 5.03 in Apple Mac OS X 10.6.x before 10.6.2 allow user-assisted remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Common Document Format (CDF) file.  NOTE: this might overlap CVE-2009-1515.


definition_id: oval:org.debian:def:213201849781831654120338134234939260197
title: CVE-2009-2841 qt4-x11
description:
The HTMLMediaElement::loadResource function in html/HTMLMediaElement.cpp in WebCore in WebKit before r49480, as used in Apple Safari before 4.0.4 on Mac OS X, does not perform the expected callbacks for HTML 5 media elements that have external URLs for media resources, which allows remote attackers to trigger sub-resource requests to arbitrary web sites via a crafted HTML document, as demonstrated by an HTML e-mail message that uses a media element for X-Confirm-Reading-To functionality, aka rdar problem 7271202.


definition_id: oval:org.debian:def:80778328249479244916138485035650801334
title: CVE-2009-2851 wordpress
description:
Cross-site scripting (XSS) vulnerability in the administrator interface in WordPress before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via a comment author URL.


definition_id: oval:org.debian:def:72497765616078278346608473666821123983
title: CVE-2009-2853 wordpress
description:
Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php, (3) edit-form-advanced.php, (4) edit-form-comment.php, (5) edit-link-category-form.php, (6) edit-link-form.php, (7) edit-page-form.php, and (8) edit-tag-form.php in wp-admin/.


definition_id: oval:org.debian:def:19940761191618801220961806669100976483
title: CVE-2009-2854 wordpress
description:
Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or additions via a direct request to (1) edit-comments.php, (2) edit-pages.php, (3) edit.php, (4) edit-category-form.php, (5) edit-link-category-form.php, (6) edit-tag-form.php, (7) export.php, (8) import.php, or (9) link-add.php in wp-admin/.


definition_id: oval:org.debian:def:188327652087283964038656090741838794100
title: CVE-2009-2855 squid
description:
The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function.


definition_id: oval:org.debian:def:243908649608121707952372316464563536635
title: CVE-2009-2905 newt
description:
Heap-based buffer overflow in textbox.c in newt 0.51.5, 0.51.6, and 0.52.2 allows local users to cause a denial of service (application crash) or possibly execute arbitrary code via a request to display a crafted text dialog box.


definition_id: oval:org.debian:def:152285594152827863579352045013097430925
title: CVE-2009-2911 systemtap
description:
SystemTap 1.0, when the --unprivileged option is used, does not properly restrict certain data sizes, which allows local users to (1) cause a denial of service or gain privileges via a print operation with a large number of arguments that trigger a kernel stack overflow, (2) cause a denial of service via crafted DWARF expressions that trigger a kernel stack frame overflow, or (3) cause a denial of service (infinite loop) via vectors that trigger creation of large unwind tables, related to Common Information Entry (CIE) and Call Frame Instruction (CFI) records.


definition_id: oval:org.debian:def:279821878024924764092435830953652341508
title: CVE-2009-2936 varnish
description:
** DISPUTED ** The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received through a TCP port, which allows remote attackers to (1) execute arbitrary code via a vcl.inline directive that provides a VCL configuration file containing inline C code; (2) change the ownership of the master process via param.set, stop, and start directives; (3) read the initial line of an arbitrary file via a vcl.load directive; or (4) conduct cross-site request forgery (CSRF) attacks that leverage a victim's location on a trusted network and improper input validation of directives.  NOTE: the vendor disputes this report, saying that it is "fundamentally misguided and pointless."


definition_id: oval:org.debian:def:202568865839035864099093631969405692561
title: CVE-2009-2937 planet-venus
description:
Cross-site scripting (XSS) vulnerability in Planet 2.0 and Planet Venus allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of an IMG element in a feed.


definition_id: oval:org.debian:def:261788049974532640050045893387170507569
title: CVE-2009-2939 postfix
description:
The postfix.postinst script in the Debian GNU/Linux and Ubuntu postfix 2.5.5 package grants the postfix user write access to /var/spool/postfix/pid, which might allow local users to conduct symlink attacks that overwrite arbitrary files.


definition_id: oval:org.debian:def:276358376336494467870341467565902485170
title: CVE-2009-2940 pygresql
description:
The pygresql module 3.8.1 and 4.0 for Python does not properly support the PQescapeStringConn function, which might allow remote attackers to leverage escaping issues involving multibyte character encodings.


definition_id: oval:org.debian:def:156156906366514517364493788927307903300
title: CVE-2009-2942 mysql-ocaml
description:
The mysql-ocaml bindings 1.0.4 for MySQL do not properly support the mysql_real_escape_string function, which might allow remote attackers to leverage escaping issues involving multibyte character encodings.


definition_id: oval:org.debian:def:175402103123146750367880257641912689818
title: CVE-2009-2943 postgresql-ocaml
description:
The postgresql-ocaml bindings 1.5.4, 1.7.0, and 1.12.1 for PostgreSQL libpq do not properly support the PQescapeStringConn function, which might allow remote attackers to leverage escaping issues involving multibyte character encodings.


definition_id: oval:org.debian:def:187138185985693500662038613448769494658
title: CVE-2009-2944 ikiwiki
description:
Incomplete blacklist vulnerability in the teximg plugin in ikiwiki before 3.1415926 and 2.x before 2.53.4 allows context-dependent attackers to read arbitrary files via crafted TeX commands.


definition_id: oval:org.debian:def:288251434919874062615049387793683461023
title: CVE-2009-2945 webauth
description:
weblogin/login.fcgi (aka the WebLogin login script) in Stanford University WebAuth 3.5.5, 3.6.0, and 3.6.1 places passwords in URLs in certain circumstances involving conversion of a POST request to a GET request, which allows context-dependent attackers to discover passwords by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.


definition_id: oval:org.debian:def:13123199226128086658774104856942357902
title: CVE-2009-2946 devscripts
description:
Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote attackers to execute arbitrary Perl code via crafted pathnames on distribution servers for upstream source code used in Debian GNU/Linux packages.


definition_id: oval:org.debian:def:229408503795291312278205516393010876674
title: CVE-2009-2947 xapian-omega
description:
Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to inject arbitrary web script or HTML via unspecified CGI parameter values, which are sometimes included in exception messages.


definition_id: oval:org.debian:def:157642303863690289932742794357916730179
title: CVE-2009-2948 samba
description:
mount.cifs in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8 and 3.4 before 3.4.2, when mount.cifs is installed suid root, does not properly enforce permissions, which allows local users to read part of the credentials file and obtain the password by specifying the path to the credentials file and using the --verbose or -v option.


definition_id: oval:org.debian:def:246004658159848010907889957897248462659
title: CVE-2009-2957 dnsmasq
description:
Heap-based buffer overflow in the tftp_request function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, might allow remote attackers to execute arbitrary code via a long filename in a TFTP packet, as demonstrated by a read (aka RRQ) request.


definition_id: oval:org.debian:def:322154306840957602060035497182225960775
title: CVE-2009-2958 dnsmasq
description:
The tftp_request function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a TFTP read (aka RRQ) request with a malformed blksize option.


definition_id: oval:org.debian:def:90350963512456067148803715029076812480
title: CVE-2009-2959 buildbot
description:
Cross-site scripting (XSS) vulnerability in the waterfall web status view (status/web/waterfall.py) in Buildbot 0.7.6 through 0.7.11p1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:151642752892950092571932649988614183750
title: CVE-2009-2967 buildbot
description:
Multiple cross-site scripting (XSS) vulnerabilities in Buildbot 0.7.6 through 0.7.11p2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, different vulnerabilities than CVE-2009-2959.


definition_id: oval:org.debian:def:105603668340950784310691379351587611593
title: CVE-2009-3009 rails
description:
Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper.


definition_id: oval:org.debian:def:207062130702250366898924734936388897506
title: CVE-2009-3024 libio-socket-ssl-perl
description:
The verify_hostname_of_cert function in the certificate checking feature in IO-Socket-SSL (IO::Socket::SSL) 1.14 through 1.25 only matches the prefix of a hostname when no wildcard is used, which allows remote attackers to bypass the hostname check for a certificate.


definition_id: oval:org.debian:def:198534330741522108319811369859942140463
title: CVE-2009-3025 pidgin
description:
Unspecified vulnerability in Pidgin 2.6.0 allows remote attackers to cause a denial of service (crash) via a link in a Yahoo IM.


definition_id: oval:org.debian:def:163860546688502455000666444520542426149
title: CVE-2009-3026 pidgin
description:
protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption and allows remote attackers to sniff sessions.


definition_id: oval:org.debian:def:91064102204529443242478808786574481467
title: CVE-2009-3040 ocsinventory-server
description:
Multiple SQL injection vulnerabilities in Open Computer and Software (OCS) Inventory NG 1.02 for Unix allow remote attackers to execute arbitrary SQL commands via the (1) N, (2) DL, (3) O and (4) V parameters to download.php and the (5) SYSTEMID parameter to group_show.php.


definition_id: oval:org.debian:def:124260882792404505680539612891458605999
title: CVE-2009-3041 spip
description:
SPIP 1.9 before 1.9.2i and 2.0.x through 2.0.8 does not use proper access control for (1) ecrire/exec/install.php and (2) ecrire/index.php, which allows remote attackers to conduct unauthorized activities related to installation and backups, as exploited in the wild in August 2009.


definition_id: oval:org.debian:def:202945604118434733963780146067626061122
title: CVE-2009-3042 ocsinventory-server
description:
SQL injection vulnerability in machine.php in Open Computer and Software (OCS) Inventory NG 1.02.1 allows remote attackers to execute arbitrary SQL commands via the systemid parameter, a different vector than CVE-2009-3040.


definition_id: oval:org.debian:def:165218588439385472658637393191257493039
title: CVE-2009-3050 htmldoc
description:
Buffer overflow in the set_page_size function in util.cxx in HTMLDOC 1.8.27 and earlier allows context-dependent attackers to execute arbitrary code via a long MEDIA SIZE comment.  NOTE: it was later reported that there were additional vectors in htmllib.cxx and ps-pdf.cxx using an AFM font file with a long glyph name, but these vectors do not cross privilege boundaries.


definition_id: oval:org.debian:def:285206647540308228391116875222403724034
title: CVE-2009-3083 pidgin
description:
The msn_slp_sip_recv function in libpurple/protocols/msn/slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.6.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an SLP invite message that lacks certain required fields, as demonstrated by a malformed message from a KMess client.


definition_id: oval:org.debian:def:198699467096361802081063845097189048235
title: CVE-2009-3084 pidgin
description:
The msn_slp_process_msg function in libpurple/protocols/msn/slpcall.c in the MSN protocol plugin in libpurple 2.6.0 and 2.6.1, as used in Pidgin before 2.6.2, allows remote attackers to cause a denial of service (application crash) via a handwritten (aka Ink) message, related to an uninitialized variable and the incorrect "UTF16-LE" charset name.


definition_id: oval:org.debian:def:294608177513024227785211725522723027671
title: CVE-2009-3085 pidgin
description:
The XMPP protocol plugin in libpurple in Pidgin before 2.6.2 does not properly handle an error IQ stanza during an attempted fetch of a custom smiley, which allows remote attackers to cause a denial of service (application crash) via XHTML-IM content with cid: images.


definition_id: oval:org.debian:def:101370027722286993380737289847070643415
title: CVE-2009-3086 rails
description:
A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts.


definition_id: oval:org.debian:def:105255367938072430042050412070676515411
title: CVE-2009-3094 apache2
description:
The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module in the Apache HTTP Server 2.0.63 and 2.2.13 allows remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command.


definition_id: oval:org.debian:def:150432487751440637607487750848230183835
title: CVE-2009-3095 apache2
description:
The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.


definition_id: oval:org.debian:def:337820251647819538673752925642307060309
title: CVE-2009-3111 freeradius
description:
The rad_decode function in FreeRADIUS before 1.1.8 allows remote attackers to cause a denial of service (radiusd crash) via zero-length Tunnel-Password attributes, as demonstrated by a certain module in VulnDisco Pack Professional 7.6 through 8.11.  NOTE: this is a regression error related to CVE-2003-0967.


definition_id: oval:org.debian:def:83561440539801013177028355369006028418
title: CVE-2009-3232 pam
description:
pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication.


definition_id: oval:org.debian:def:77519067271661085615908637117142463896
title: CVE-2009-3233 changetrack
description:
changetrack 4.3 allows local users to execute arbitrary commands via CRLF sequences and shell metacharacters in a filename in a directory that is checked by changetrack.


definition_id: oval:org.debian:def:96085401760679768789044073718547980880
title: CVE-2009-3235 dovecot
description:
Multiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SIEVE script, as demonstrated by forwarding an e-mail message to a large number of recipients, a different vulnerability than CVE-2009-2632.


definition_id: oval:org.debian:def:9786195431872739144462304794814206940
title: CVE-2009-3241 wireshark
description:
Unspecified vulnerability in the OpcUa (OPC UA) dissector in Wireshark 0.99.6 through 1.0.8 and 1.2.0 through 1.2.1 allows remote attackers to cause a denial of service (memory and CPU consumption) via malformed OPCUA Service CallRequest packets.


definition_id: oval:org.debian:def:239274394393885140999774421671208318003
title: CVE-2009-3242 wireshark
description:
Unspecified vulnerability in packet.c in the GSM A RR dissector in Wireshark 1.2.0 and 1.2.1 allows remote attackers to cause a denial of service (application crash) via unknown vectors related to "an uninitialized dissector handle," which triggers an assertion failure.


definition_id: oval:org.debian:def:171547433453547972729843363130353399080
title: CVE-2009-3245 openssl
description:
OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls in (1) crypto/bn/bn_div.c, (2) crypto/bn/bn_gf2m.c, (3) crypto/ec/ec2_smpl.c, and (4) engines/e_ubsec.c, which has unspecified impact and context-dependent attack vectors.


definition_id: oval:org.debian:def:57124108271738073518832475128381496461
title: CVE-2009-3287 thin
description:
lib/thin/connection.rb in Thin web server before 1.2.4 relies on the X-Forwarded-For header to determine the IP address of the client, which allows remote attackers to spoof the IP address and hide activities via a modified X-Forwarded-For header.


definition_id: oval:org.debian:def:146249366598113472856943339170912844190
title: CVE-2009-3289 glib2.0
description:
The g_file_copy function in glib 2.0 sets the permissions of a target file to the permissions of a symbolic link (777), which allows user-assisted local users to modify files of other users, as demonstrated by using Nautilus to modify the permissions of the user home directory.


definition_id: oval:org.debian:def:150387314635769531534728323264705197154
title: CVE-2009-3295 krb5
description:
The prep_reprocess_req function in kdc/do_tgs_req.c in the cross-realm referral implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a ticket request.


definition_id: oval:org.debian:def:45194398343222735092245981214555467308
title: CVE-2009-3296 advi
description:
Multiple integer overflows in tiffread.c in CamlImages 2.2 might allow remote attackers to execute arbitrary code via TIFF images containing large width and height values that trigger heap-based buffer overflows.


definition_id: oval:org.debian:def:219762604764395091631447323008148796088
title: CVE-2009-3300 shibboleth-sp
description:
Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via URLs that are encountered in redirections, and appear in automatically generated forms.


definition_id: oval:org.debian:def:330912351887301790464565143111439784137
title: CVE-2009-3305 polipo
description:
Polipo 1.0.4, and possibly other versions, allows remote attackers to cause a denial of service (crash) via a request with a Cache-Control header that lacks a value for the max-age field, which triggers a segmentation fault in the httpParseHeaders function in http_parse.c, and possibly other unspecified vectors.


definition_id: oval:org.debian:def:143144880097817850865696931753932166865
title: CVE-2009-3369 backuppc
description:
CgiUserConfigEdit in BackupPC 3.1.0, when SSH keys and Rsync are in use in a multi-user environment, does not restrict users from the ClientNameAlias function, which allows remote authenticated users to read and write sensitive files by modifying ClientNameAlias to match another system, then initiating a backup or restore.


definition_id: oval:org.debian:def:246808782143270726701959845602461037322
title: CVE-2009-3377 liboggz
description:
Multiple unspecified vulnerabilities in liboggz before cf5feeaab69b05e24, as used in Mozilla Firefox 3.5.x before 3.5.4, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors.


definition_id: oval:org.debian:def:122346497604306896844006973494488676698
title: CVE-2009-3378 liboggplay
description:
The oggplay_data_handle_theora_frame function in media/liboggplay/src/liboggplay/oggplay_data.c in liboggplay, as used in Mozilla Firefox 3.5.x before 3.5.4, attempts to reuse an earlier frame data structure upon encountering a decoding error for the first frame, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via a crafted .ogg video file.


definition_id: oval:org.debian:def:142882057237346681625449444006888972196
title: CVE-2009-3379 libvorbis
description:
Multiple unspecified vulnerabilities in libvorbis, as used in Mozilla Firefox 3.5.x before 3.5.4, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors.  NOTE: this might overlap CVE-2009-2663.


definition_id: oval:org.debian:def:1413351620607973229378614103098237508
title: CVE-2009-3384 qt4-x11
description:
Multiple unspecified vulnerabilities in WebKit in Apple Safari before 4.0.4 on Windows allow remote FTP servers to execute arbitrary code, cause a denial of service (application crash), or obtain sensitive information via a crafted directory listing in a reply.


definition_id: oval:org.debian:def:192832444796160004479909142948706184743
title: CVE-2009-3388 liboggplay
description:
liboggplay in Mozilla Firefox 3.5.x before 3.5.6 and SeaMonkey before 2.0.1 might allow context-dependent attackers to cause a denial of service (application crash) or execute arbitrary code via unspecified vectors, related to "memory safety issues."


definition_id: oval:org.debian:def:40670995117817945969470854509251114675
title: CVE-2009-3389 libtheora
description:
Integer overflow in libtheora in Xiph.Org Theora before 1.1, as used in Mozilla Firefox 3.5 before 3.5.6 and SeaMonkey before 2.0.1, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a video with large dimensions.


definition_id: oval:org.debian:def:254378000695016024477702764069915628957
title: CVE-2009-3474 opensaml
description:
OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.


definition_id: oval:org.debian:def:142695376365109180667185554254666292555
title: CVE-2009-3475 opensaml
description:
Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.


definition_id: oval:org.debian:def:211294332540363635554298812196798845864
title: CVE-2009-3476 opensaml
description:
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.


definition_id: oval:org.debian:def:305901175255623164309151382819944338780
title: CVE-2009-3490 wget
description:
GNU Wget before 1.12 does not properly handle a '\0' character in a domain name in the Common Name field of an X.509 certificate, which allows man-in-the-middle remote attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.


definition_id: oval:org.debian:def:279776571411227787426827077401372633178
title: CVE-2009-3549 wireshark
description:
packet-paltalk.c in the Paltalk dissector in Wireshark 1.2.0 through 1.2.2, on SPARC and certain other platforms, allows remote attackers to cause a denial of service (application crash) via a file that records a malformed packet trace.


definition_id: oval:org.debian:def:174763477250931979727874542720482829258
title: CVE-2009-3553 cups
description:
CVE-2009-3553 cups: Use-after-free (crash) due improper reference counting in abstract file descriptors handling interface


definition_id: oval:org.debian:def:336497893371828427184638501706542853935
title: CVE-2009-3560 audacity
description:
The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib/xmlparse.c, a different vulnerability than CVE-2009-2625 and CVE-2009-3720.


definition_id: oval:org.debian:def:8959500964358026294798231058469411616
title: CVE-2009-3563 ntp
description:
ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons.


definition_id: oval:org.debian:def:150738329620373780907275797260832361566
title: CVE-2009-3564 puppet
description:
puppetmasterd in puppet 0.24.6 does not reset supplementary groups when it switches to a different user, which might allow local users to access restricted files.


definition_id: oval:org.debian:def:227508772215104676349100354248940879440
title: CVE-2009-3575 aria2
description:
Buffer overflow in DHTRoutingTableDeserializer.cc in aria2 0.15.3, 1.2.0, and other versions allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors.


definition_id: oval:org.debian:def:126280283443012033778762446105878086618
title: CVE-2009-3589 incron
description:
incron 0.5.5 does not initialize supplementary groups when running a process from a user's incrontabs, which causes the process to be run with the incrond supplementary groups and allows local users to gain privileges via an incrontab table.


definition_id: oval:org.debian:def:219408452707851819378345160371891992636
title: CVE-2009-3591 dopewars
description:
Dopewars 1.5.12 allows remote attackers to cause a denial of service (segmentation fault) via a REQUESTJET message with an invalid location.


definition_id: oval:org.debian:def:57924039000648879152313560284099295069
title: CVE-2009-3602 unbound
description:
Unbound before 1.3.4 does not properly verify signatures for NSEC3 records, which allows remote attackers to cause secure delegations to be downgraded via DNS spoofing or other DNS-related attacks in conjunction with crafted delegation responses.


definition_id: oval:org.debian:def:314770635656440562754252942436541919429
title: CVE-2009-3604 poppler
description:
CVE-2009-3604 xpdf/poppler: Splash::drawImage integer overflow and missing allocation return value check


definition_id: oval:org.debian:def:118871793043378707805519560593691513189
title: CVE-2009-3611 backintime
description:
common/snapshots.py in Back In Time (aka backintime) 0.9.26 changes certain permissions to 0777 before deleting the files in an old backup snapshot, which allows local users to obtain sensitive information by reading these files, or interfere with backup integrity by modifying files that are shared across snapshots.


definition_id: oval:org.debian:def:303945791293197440087957580904471471520
title: CVE-2009-3615 pidgin
description:
The OSCAR protocol plugin in libpurple in Pidgin before 2.6.3 and Adium before 1.3.7 allows remote attackers to cause a denial of service (application crash) via crafted contact-list data for (1) ICQ and possibly (2) AIM, as demonstrated by the SIM IM client.


definition_id: oval:org.debian:def:244404020710299262334553650323979735388
title: CVE-2009-3616 qemu
description:
Multiple use-after-free vulnerabilities in vnc.c in the VNC server in QEMU 0.10.6 and earlier might allow guest OS users to execute arbitrary code on the host OS by establishing a connection from a VNC client and then (1) disconnecting during data transfer, (2) sending a message using incorrect integer data types, or (3) using the Fuzzy Screen Mode protocol, related to double free vulnerabilities.


definition_id: oval:org.debian:def:147220210345465548592323170101931571399
title: CVE-2009-3617 aria2
description:
Format string vulnerability in the AbstractCommand::onAbort function in src/AbstractCommand.cc in aria2 before 1.6.2, when logging is enabled, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a download URI.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:3348782882943779494507998165598895186
title: CVE-2009-3618 viewvc
description:
Cross-site scripting (XSS) vulnerability in viewvc.py in ViewVC 1.0 before 1.0.9 and 1.1 before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the view parameter.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:39805444639540346893160533074564837732
title: CVE-2009-3619 viewvc
description:
Unspecified vulnerability in ViewVC 1.0 before 1.0.9 and 1.1 before 1.1.2 has unknown impact and remote attack vectors related to "printing illegal parameter names and values."


definition_id: oval:org.debian:def:234735104283908577771376090871845235057
title: CVE-2009-3622 wordpress
description:
Algorithmic complexity vulnerability in wp-trackback.php in WordPress before 2.8.5 allows remote attackers to cause a denial of service (CPU consumption and server hang) via a long title parameter in conjunction with a charset parameter composed of many comma-separated "UTF-8" substrings, related to the mb_convert_encoding function in PHP.


definition_id: oval:org.debian:def:290822505423206881242140623418796830878
title: CVE-2009-3626 perl
description:
Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression match.


definition_id: oval:org.debian:def:219922518042788255594564720328933915269
title: CVE-2009-3627 libhtml-parser-perl
description:
The decode_entities function in util.c in HTML-Parser before 3.63 allows context-dependent attackers to cause a denial of service (infinite loop) via an incomplete SGML numeric character reference, which triggers generation of an invalid UTF-8 character.


definition_id: oval:org.debian:def:239944271998930339480579798399479265445
title: CVE-2009-3637 alien-arena
description:
Stack-based buffer overflow in the M_AddToServerList function in client/menu.c in Red Planet Arena Alien Arena 7.30 allows remote attackers to execute arbitrary code via a packet with a crafted server description to UDP port 27901 followed by a packet with a long print command.


definition_id: oval:org.debian:def:29870809295032337327393686871187785843
title: CVE-2009-3639 proftpd-dfsg
description:
The mod_tls module in ProFTPD before 1.3.2b, and 1.3.3 before 1.3.3rc2, when the dNSNameRequired TLS option is enabled, does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 client certificate, which allows remote attackers to bypass intended client-hostname restrictions via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.


definition_id: oval:org.debian:def:73255955687550570100388035019003178889
title: CVE-2009-3641 snort
description:
Snort before 2.8.5.1, when the -v option is enabled, allows remote attackers to cause a denial of service (application crash) via a crafted IPv6 packet that uses the (1) TCP or (2) ICMP protocol.


definition_id: oval:org.debian:def:216177655507979703413128867138319181672
title: CVE-2009-3695 python-django
description:
Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression.


definition_id: oval:org.debian:def:168299124442827066957440472468938416956
title: CVE-2009-3700 squidguard
description:
Buffer overflow in sgLog.c in squidGuard 1.3 and 1.4 allows remote attackers to cause a denial of service (application hang or loss of blocking functionality) via a long URL with many / (slash) characters, related to "emergency mode."


definition_id: oval:org.debian:def:19797904637710153629271860285040086364
title: CVE-2009-3720 audacity
description:
The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.


definition_id: oval:org.debian:def:104377398486781075955000959286247907494
title: CVE-2009-3727 asterisk
description:
Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.3, 1.6.0.x before 1.6.0.17, and 1.6.1.x before 1.6.1.9; Business Edition A.x.x, B.x.x before B.2.5.12, C.2.x.x before C.2.4.5, and C.3.x.x before C.3.2.2; AsteriskNOW 1.5; and s800i 1.3.x before 1.3.0.5 generate different error messages depending on whether a SIP username is valid, which allows remote attackers to enumerate valid usernames via multiple crafted REGISTER messages with inconsistent usernames in the URI in the To header and the Digest in the Authorization header.


definition_id: oval:org.debian:def:43775761269608330359417082250531151849
title: CVE-2009-3736 clamav
description:
ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, as used in Ham Radio Control Libraries, Q, and possibly other products, attempts to open a .la file in the current working directory, which allows local users to gain privileges via a Trojan horse file.


definition_id: oval:org.debian:def:70166005387112709055944526118405659514
title: CVE-2009-3743 ghostscript
description:
Off-by-one error in the Ins_MINDEX function in the TrueType bytecode interpreter in Ghostscript before 8.71 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a malformed TrueType font in a document that trigger an integer overflow and a heap-based buffer overflow.


definition_id: oval:org.debian:def:160048741137195978178027836257774446320
title: CVE-2009-3767 openldap
description:
libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.


definition_id: oval:org.debian:def:168206531751871920368589104816608777443
title: CVE-2009-3826 squidguard
description:
Multiple buffer overflows in squidGuard 1.4 allow remote attackers to bypass intended URL blocking via a long URL, related to (1) the relationship between a certain buffer size in squidGuard and a certain buffer size in Squid and (2) a redirect URL that contains information about the originally requested URL.


definition_id: oval:org.debian:def:264461322360592565882167984935438741690
title: CVE-2009-3829 wireshark
description:
Integer overflow in wiretap/erf.c in Wireshark before 1.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted erf file, related to an "unsigned integer wrap vulnerability."


definition_id: oval:org.debian:def:188071125740830609151245358488828944407
title: CVE-2009-3890 wordpress
description:
Unrestricted file upload vulnerability in the wp_check_filetype function in wp-includes/functions.php in WordPress before 2.8.6, when a certain configuration of the mod_mime module in the Apache HTTP Server is enabled, allows remote authenticated users to execute arbitrary code by posting an attachment with a multiple-extension filename, and then accessing this attachment via a direct request to a wp-content/uploads/ pathname, as demonstrated by a .php.jpg filename.


definition_id: oval:org.debian:def:43731808304273476974076085161912217902
title: CVE-2009-3891 wordpress
description:
Cross-site scripting (XSS) vulnerability in wp-admin/press-this.php in WordPress before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML via the s parameter (aka the selection variable).


definition_id: oval:org.debian:def:148254481403883793149527715168457413585
title: CVE-2009-3894 dstat
description:
Multiple untrusted search path vulnerabilities in dstat before 0.7.0 allow local users to gain privileges via a Trojan horse Python module in (1) the current working directory or (2) a certain subdirectory of the current working directory.


definition_id: oval:org.debian:def:186952476671091000663165433847386699063
title: CVE-2009-3895 libexif
description:
Heap-based buffer overflow in the exif_entry_fix function (aka the tag fixup routine) in libexif/exif-entry.c in libexif 0.6.18 allows remote attackers to cause a denial of service or possibly execute arbitrary code via an invalid EXIF image.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:233897752789633534711560494878401870275
title: CVE-2009-3896 nginx
description:
src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.14 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a long URI.


definition_id: oval:org.debian:def:109959956508363769542133171264522149759
title: CVE-2009-3897 dovecot
description:
Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base_dir directory, and possibly the base_dir directory itself.


definition_id: oval:org.debian:def:264933489684327477276297277887402203380
title: CVE-2009-3898 nginx
description:
Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine X) before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a .. (dot dot) in the Destination HTTP header for the WebDAV (1) COPY or (2) MOVE method.


definition_id: oval:org.debian:def:4482674901574421682253981838170470785
title: CVE-2009-3909 gimp
description:
Integer overflow in the read_channel_data function in plug-ins/file-psd/psd-load.c in GIMP 2.6.7 might allow remote attackers to execute arbitrary code via a crafted PSD file that triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:324616488893016744891220061523715808360
title: CVE-2009-3930 file
description:
Multiple integer overflows in Christos Zoulas file before 5.02 allow user-assisted remote attackers to have an unspecified impact via a malformed compound document (aka cdf) file that triggers a buffer overflow.


definition_id: oval:org.debian:def:148100868983996917604827799839300905440
title: CVE-2009-3938 poppler
description:
Buffer overflow in the ABWOutputDev::endWord function in poppler/ABWOutputDev.cc in Poppler (aka libpoppler) 0.10.6, 0.12.0, and possibly other versions, as used by the Abiword pdftoabw utility, allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted PDF file.


definition_id: oval:org.debian:def:163160080232126515202779701099588538833
title: CVE-2009-3994 devil
description:
Stack-based buffer overflow in the GetUID function in src-IL/src/il_dicom.c in DevIL 1.7.8 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted DICOM file.


definition_id: oval:org.debian:def:50145860444983911539462760327365863537
title: CVE-2009-3995 libmikmod
description:
Multiple heap-based buffer overflows in IN_MOD.DLL (aka the Module Decoder Plug-in) in Winamp before 5.57, and libmikmod 3.1.12, might allow remote attackers to execute arbitrary code via (1) crafted samples or (2) crafted instrument definitions in an Impulse Tracker file.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:17137133551543328742670171722446700286
title: CVE-2009-3996 libmikmod
description:
Heap-based buffer overflow in IN_MOD.DLL (aka the Module Decoder Plug-in) in Winamp before 5.57, and libmikmod 3.1.12, might allow remote attackers to execute arbitrary code via an Ultratracker file.


definition_id: oval:org.debian:def:247212444498858708971928003984991596974
title: CVE-2009-4007 openttd
description:
Unspecified vulnerability in the NormaliseTrainConsist function in src/train_cmd.cpp in OpenTTD before 0.7.5-RC1 allows remote attackers to cause a denial of service (daemon crash) via certain game actions involving a wagon and a dual-headed engine.


definition_id: oval:org.debian:def:282345634307562150929559811990494563941
title: CVE-2009-4008 unbound
description:
Unbound before 1.4.4 does not send responses for signed zones after mishandling an unspecified query, which allows remote attackers to cause a denial of service (DNSSEC outage) via a crafted query.


definition_id: oval:org.debian:def:283063459829223298977632300513449513529
title: CVE-2009-4009 pdns-recursor
description:
Buffer overflow in PowerDNS Recursor before 3.1.7.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via crafted packets.


definition_id: oval:org.debian:def:44047669120305908948876538417656542316
title: CVE-2009-4010 pdns-recursor
description:
Unspecified vulnerability in PowerDNS Recursor before 3.1.7.2 allows remote attackers to spoof DNS data via crafted zones.


definition_id: oval:org.debian:def:293757058310605080495632080344781830455
title: CVE-2009-4011 dtc-xen
description:
dtc-xen 0.5.x before 0.5.4 suffers from a race condition where an attacker could potentially get a bash access as xenXX user on the dom0, and then access a potentially reuse an already opened VPS console.


definition_id: oval:org.debian:def:156014450348230213176563859151691762214
title: CVE-2009-4012 libthai
description:
Multiple integer overflows in LibThai before 0.1.13 might allow context-dependent attackers to execute arbitrary code via long strings that trigger heap-based buffer overflows, related to (1) thbrk/thbrk.c and (2) thwbrk/thwbrk.c.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:68198966392865855379883957147896544184
title: CVE-2009-4013 lintian
description:
Multiple directory traversal vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to overwrite arbitrary files or obtain sensitive information via vectors involving (1) control field names, (2) control field values, and (3) control files of patch systems.


definition_id: oval:org.debian:def:169032219629965050013867365713905318208
title: CVE-2009-4014 lintian
description:
Multiple format string vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to have an unspecified impact via vectors involving (1) check scripts and (2) the Lintian::Schedule module.


definition_id: oval:org.debian:def:335798743679777439720006982956894741587
title: CVE-2009-4015 lintian
description:
Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allows remote attackers to execute arbitrary commands via shell metacharacters in filename arguments.


definition_id: oval:org.debian:def:262442801780507556860379699739958446138
title: CVE-2009-4016 ircd-hybrid
description:
Integer underflow in the clean_string function in irc_string.c in (1) IRCD-hybrid 7.2.2 and 7.2.3, (2) ircd-ratbox before 2.2.9, and (3) oftc-hybrid before 1.6.8, when flatten_links is disabled, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a LINKS command.


definition_id: oval:org.debian:def:247096126059699170218137890114510430576
title: CVE-2009-4022 bind9
description:
Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P4, 9.5 before 9.5.2-P1, 9.6 before 9.6.1-P2, and 9.7 beta before 9.7.0b3, with DNSSEC validation enabled and checking disabled (CD), allows remote attackers to conduct DNS cache poisoning attacks by receiving a recursive client query and sending a response that contains an Additional section with crafted data, which is not properly handled when the response is processed "at the same time as requesting DNSSEC records (DO)," aka Bug 20438.


definition_id: oval:org.debian:def:145552388996707376713533171460515065912
title: CVE-2009-4023 php-mail
description:
Argument injection vulnerability in the sendmail implementation of the Mail::Send method (Mail/sendmail.php) in the Mail package 1.1.14 for PEAR allows remote attackers to read and write arbitrary files via a crafted $from parameter, a different vector than CVE-2009-4111.


definition_id: oval:org.debian:def:292820598589873074468448400020565020517
title: CVE-2009-4035 poppler
description:
The FoFiType1::parse function in fofi/FoFiType1.cc in Xpdf 3.0.0, gpdf 2.8.2, kpdf in kdegraphics 3.3.1, and possibly other libraries and versions, does not check the return value of the getNextLine function, which allows context-dependent attackers to execute arbitrary code via a PDF file with a crafted Type 1 font that can produce a negative value, leading to a signed-to-unsigned integer conversion error and a buffer overflow.


definition_id: oval:org.debian:def:289365474280179430882142180622843630333
title: CVE-2009-4055 asterisk
description:
rtp.c in Asterisk Open Source 1.2.x before 1.2.37, 1.4.x before 1.4.27.1, 1.6.0.x before 1.6.0.19, and 1.6.1.x before 1.6.1.11; Business Edition B.x.x before B.2.5.13, C.2.x.x before C.2.4.6, and C.3.x.x before C.3.2.3; and s800i 1.3.x before 1.3.0.6 allows remote attackers to cause a denial of service (daemon crash) via an RTP comfort noise payload with a long data length.


definition_id: oval:org.debian:def:143415497632580096643851416091533389979
title: CVE-2009-4076 roundcube
description:
Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail 0.2.2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that modify user information via unspecified vectors, a different vulnerability than CVE-2009-4077.


definition_id: oval:org.debian:def:134672021075082267810365714710314537217
title: CVE-2009-4077 roundcube
description:
Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail 0.2.2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that send arbitrary emails via unspecified vectors, a different vulnerability than CVE-2009-4076.


definition_id: oval:org.debian:def:54774142403210880279677856275357621104
title: CVE-2009-4111 php-mail
description:
Argument injection vulnerability in Mail/sendmail.php in the Mail package 1.1.14, 1.2.0b2, and possibly other versions for PEAR allows remote attackers to read and write arbitrary files via a crafted $recipients parameter, and possibly other parameters, a different vulnerability than CVE-2009-4023.


definition_id: oval:org.debian:def:180769177435122916255673433680877479353
title: CVE-2009-4112 cacti
description:
Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memory Usage" setting to contain arbitrary commands.


definition_id: oval:org.debian:def:219743235206913725400879821405682855954
title: CVE-2009-4128 grub2
description:
GNU GRand Unified Bootloader (GRUB) 2 1.97 only compares the submitted portion of a password with the actual password, which makes it easier for physically proximate attackers to conduct brute force attacks and bypass authentication by submitting a password whose length is 1.


definition_id: oval:org.debian:def:100154116889197270660452509767246136438
title: CVE-2009-4144 network-manager-applet
description:
NetworkManager (NM) 0.7.2 does not ensure that the configured Certification Authority (CA) certificate file for a (1) WPA Enterprise or (2) 802.1x network remains present upon a connection attempt, which might allow remote attackers to obtain sensitive information or cause a denial of service (connectivity disruption) by spoofing the identity of a wireless network.


definition_id: oval:org.debian:def:309790541333344844716546656263406745185
title: CVE-2009-4145 network-manager-applet
description:
nm-connection-editor in NetworkManager (NM) 0.7.x exports connection objects over D-Bus upon actions in the connection editor GUI, which allows local users to obtain sensitive information by reading D-Bus signals, as demonstrated by using dbus-monitor to discover the password for the WiFi network.


definition_id: oval:org.debian:def:95818388589795847683557835776185538847
title: CVE-2009-4193 merkaartor
description:
Merkaartor 0.14 allows local users to append data to arbitrary files via a symlink attack on the /tmp/merkaartor.log temporary file.


definition_id: oval:org.debian:def:173310279388878083337430031795466750457
title: CVE-2009-4212 krb5
description:
Multiple integer underflows in the (1) AES and (2) RC4 decryption functionality in the crypto library in MIT Kerberos 5 (aka krb5) 1.3 through 1.6.3, and 1.7 before 1.7.1, allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code by providing ciphertext with a length that is too short to be valid.


definition_id: oval:org.debian:def:150828578106729968284342514061815349720
title: CVE-2009-4214 rails
description:
Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.


definition_id: oval:org.debian:def:179758346705073751551853399040514789536
title: CVE-2009-4227 xfig
description:
Stack-based buffer overflow in the read_1_3_textobject function in f_readold.c in Xfig 3.2.5b and earlier, and in the read_textobject function in read1_3.c in fig2dev in Transfig 3.2.5a and earlier, allows remote attackers to execute arbitrary code via a long string in a malformed .fig file that uses the 1.3 file format.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:75825141555551885371899641695478991707
title: CVE-2009-4235 acpid
description:
acpid 1.0.4 sets an unrestrictive umask, which might allow local users to leverage weak permissions on /var/log/acpid, and obtain sensitive information by reading this file or cause a denial of service by overwriting this file, a different vulnerability than CVE-2009-4033.


definition_id: oval:org.debian:def:285890778318559515372976081035628628910
title: CVE-2009-4261 ganeti
description:
Multiple directory traversal vulnerabilities in the iallocator framework in Ganeti 1.2.4 through 1.2.8, 2.0.0 through 2.0.4, and 2.1.0 before 2.1.0~rc2 allow (1) remote attackers to execute arbitrary programs via a crafted external script name supplied through the HTTP remote API (RAPI) and allow (2) local users to execute arbitrary programs and gain privileges via a crafted external script name supplied through a gnt-* command, related to "path sanitization errors."


definition_id: oval:org.debian:def:165821677389890730985237965064765634239
title: CVE-2009-4270 ghostscript
description:
Stack-based buffer overflow in the errprintf function in base/gsmisc.c in ghostscript 8.64 through 8.70 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PDF file, as originally reported for debug logging code in gdevcups.c in the CUPS output driver.


definition_id: oval:org.debian:def:86334876177680096201810646920802433692
title: CVE-2009-4355 openssl
description:
Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678.


definition_id: oval:org.debian:def:63485382212092710988551165015432120501
title: CVE-2009-4376 wireshark
description:
Buffer overflow in the daintree_sna_read function in the Daintree SNA file parser in Wireshark 1.2.0 through 1.2.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet.


definition_id: oval:org.debian:def:91468298703595064185801308598493062599
title: CVE-2009-4377 wireshark
description:
The (1) SMB and (2) SMB2 dissectors in Wireshark 0.9.0 through 1.2.4 allow remote attackers to cause a denial of service (crash) via a crafted packet that triggers a NULL pointer dereference, as demonstrated by fuzz-2009-12-07-11141.pcap.


definition_id: oval:org.debian:def:89476666253614683443482859704126054406
title: CVE-2009-4404 t-prot
description:
Unspecified vulnerability in t-prot (TOFU Protection) before 2.8 allows remote attackers to cause a denial of service via unspecified vectors related to the "--maxlines" option and a crafted email message.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:273482112748232568751487595714311677047
title: CVE-2009-4405 trac
description:
Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to (1) "policy checks in report results when using alternate formats" or (2) a "check for the 'raw' role that is missing in docutils < 0.6."


definition_id: oval:org.debian:def:210793490735681703761673553220314677315
title: CVE-2009-4411 acl
description:
The (1) setfacl and (2) getfacl commands in XFS acl 2.2.47, when running in recursive (-R) mode, follow symbolic links even when the --physical (aka -P) or -L option is specified, which might allow local users to modify the ACL for arbitrary files or directories via a symlink attack.


definition_id: oval:org.debian:def:56937037202426383617615217104940904304
title: CVE-2009-4413 polipo
description:
The httpClientDiscardBody function in client.c in Polipo 0.9.8, 0.9.12, 1.0.4, and possibly other versions, allows remote attackers to cause a denial of service (crash) via a request with a large Content-Length value, which triggers an integer overflow, a signed-to-unsigned conversion error with a negative value, and a segmentation fault.


definition_id: oval:org.debian:def:143445708425907006768507707668409113831
title: CVE-2009-4498 zabbix
description:
The node_process_command function in Zabbix Server before 1.8 allows remote attackers to execute arbitrary commands via a crafted request.


definition_id: oval:org.debian:def:305344474490364976308321772890094142469
title: CVE-2009-4499 zabbix
description:
SQL injection vulnerability in the get_history_lastid function in the nodewatcher component in Zabbix Server before 1.6.8 allows remote attackers to execute arbitrary SQL commands via a crafted request, possibly related to the send_history_last_id function in zabbix_server/trapper/nodehistory.c.


definition_id: oval:org.debian:def:19491031231262089229115328625870320224
title: CVE-2009-4500 zabbix
description:
The process_trap function in trapper/trapper.c in Zabbix Server before 1.6.6 allows remote attackers to cause a denial of service (crash) via a crafted request with data that lacks an expected : (colon) separator, which triggers a NULL pointer dereference.


definition_id: oval:org.debian:def:125661480856953716216010016141252436622
title: CVE-2009-4501 zabbix
description:
The zbx_get_next_field function in libs/zbxcommon/str.c in Zabbix Server before 1.6.8 allows remote attackers to cause a denial of service (crash) via a request that lacks expected separators, which triggers a NULL pointer dereference, as demonstrated using the Command keyword.


definition_id: oval:org.debian:def:174439474111327620919512278921283924450
title: CVE-2009-4502 zabbix
description:
The NET_TCP_LISTEN function in net.c in Zabbix Agent before 1.6.7, when running on FreeBSD or Solaris, allows remote attackers to bypass the EnableRemoteCommands setting and execute arbitrary commands via shell metacharacters in the argument to net.tcp.listen.  NOTE: this attack is limited to attacks from trusted IP addresses.


definition_id: oval:org.debian:def:12043825636762169336776776220251276023
title: CVE-2009-4565 sendmail
description:
sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended access restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.


definition_id: oval:org.debian:def:250426128299715309481345853811506344504
title: CVE-2009-4589 mediawiki
description:
Cross-site scripting (XSS) vulnerability in the Special:Block implementation in the getContribsLink function in SpecialBlockip.php in MediaWiki 1.14.0 and 1.15.0 allows remote attackers to inject arbitrary web script or HTML via the ip parameter.


definition_id: oval:org.debian:def:102401761058858801899138188744964913500
title: CVE-2009-4631 ffmpeg
description:
Off-by-one error in the VP3 decoder (vp3.c) in FFmpeg 0.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted VP3 file that triggers an out-of-bounds read and possibly memory corruption.


definition_id: oval:org.debian:def:234736592490665402658479846265880475920
title: CVE-2009-4632 ffmpeg
description:
oggparsevorbis.c in FFmpeg 0.5 does not properly perform certain pointer arithmetic, which might allow remote attackers to obtain sensitive memory contents and cause a denial of service via a crafted file that triggers an out-of-bounds read.


definition_id: oval:org.debian:def:110723978515198093454405788212038691057
title: CVE-2009-4633 ffmpeg
description:
vorbis_dec.c in FFmpeg 0.5 uses an assignment operator when a comparison operator was intended, which might allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted file that modifies a loop counter and triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:150224188788633344887405500993733131136
title: CVE-2009-4634 ffmpeg
description:
Multiple integer underflows in FFmpeg 0.5 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted file that (1) bypasses a validation check in vorbis_dec.c and triggers a wraparound of the stack pointer, or (2) access a pointer from out-of-bounds memory in mov.c, related to an elst tag that appears before a tag that creates a stream.


definition_id: oval:org.debian:def:262367843103553564699812964097373936653
title: CVE-2009-4635 ffmpeg
description:
FFmpeg 0.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted MOV container with improperly ordered tags that cause (1) mov.c and (2) utils.c to use inconsistent codec types and identifiers, leading to processing of a video-structure pointer by the mp3 decoder, and a stack-based buffer overflow.


definition_id: oval:org.debian:def:104985485902365738954699557920911977195
title: CVE-2009-4636 ffmpeg
description:
FFmpeg 0.5 allows remote attackers to cause a denial of service (hang) via a crafted file that triggers an infinite loop.


definition_id: oval:org.debian:def:102756498396651600492550029896370331084
title: CVE-2009-4637 ffmpeg
description:
FFmpeg 0.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger a stack-based buffer overflow.


definition_id: oval:org.debian:def:266676596587458961687792291234387558832
title: CVE-2009-4638 ffmpeg
description:
Integer overflow in FFmpeg 0.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors.


definition_id: oval:org.debian:def:264275103468789430913049528608246510266
title: CVE-2009-4639 ffmpeg
description:
The av_rescale_rnd function in the AVI demuxer in FFmpeg 0.5 allows remote attackers to cause a denial of service (crash) via a crafted AVI file that triggers a divide-by-zero error.


definition_id: oval:org.debian:def:58996959841996048129751595287082702483
title: CVE-2009-4640 ffmpeg
description:
Array index error in vorbis_dec.c in FFmpeg 0.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Vorbis file that triggers an out-of-bounds read.


definition_id: oval:org.debian:def:46704425272327420898703462604985560761
title: CVE-2009-4641 gnome-screensaver
description:
gnome-screensaver 2.28.0 does not resume adherence to its activation settings after an inhibiting application becomes unavailable on the session bus, which allows physically proximate attackers to access an unattended workstation on which screen locking had been intended.


definition_id: oval:org.debian:def:46788674359482251838819473484409250706
title: CVE-2009-4642 gnome-screensaver
description:
gnome-screensaver 2.26.1 relies on the gnome-session D-Bus interface to determine session idle time, even when an Xfce desktop such as Xubuntu or Mythbuntu is used, which allows physically proximate attackers to access an unattended workstation on which screen locking had been intended.


definition_id: oval:org.debian:def:143260748449983672279768167335227638735
title: CVE-2009-4652 ngircd
description:
The (1) Conn_GetCipherInfo and (2) Conn_UsesSSL functions in src/ngircd/conn.c in ngIRCd 13 and 14, when SSL/TLS support is present and standalone mode is disabled, allow remote attackers to cause a denial of service (application crash) by sending the MOTD command from another server in the same IRC network, possibly related to an array index error.


definition_id: oval:org.debian:def:222142249939679647001214156585359769772
title: CVE-2009-4664 fwbuilder
description:
Firewall Builder 3.0.4, 3.0.5, and 3.0.6, when running on Linux, allows local users to gain privileges via a symlink attack on an unspecified temporary file that is created by the iptables script.


definition_id: oval:org.debian:def:205517367248774644431688050687030684445
title: CVE-2009-4762 moin
description:
MoinMoin 1.7.x before 1.7.3 and 1.8.x before 1.8.3 checks parent ACLs in certain inappropriate circumstances during processing of hierarchical ACLs, which allows remote attackers to bypass intended access restrictions by requesting an item, a different vulnerability than CVE-2008-6603.


definition_id: oval:org.debian:def:309832723986348400090229428573421038016
title: CVE-2009-4810 samhain
description:
The Secure Remote Password (SRP) implementation in Samhain before 2.5.4 does not check for a certain zero value where required by the protocol, which allows remote attackers to bypass authentication via crafted input.


definition_id: oval:org.debian:def:39281964295820095805578801548708413828
title: CVE-2009-4835 libsndfile
description:
The (1) htk_read_header, (2) alaw_init, (3) ulaw_init, (4) pcm_init, (5) float32_init, and (6) sds_read_header functions in libsndfile 1.0.20 allow context-dependent attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted audio file.


definition_id: oval:org.debian:def:248291180881400586878381502839342907319
title: CVE-2009-4880 glibc
description:
Multiple integer overflows in the strfmon implementation in the GNU C Library (aka glibc or libc6) 2.10.1 and earlier allow context-dependent attackers to cause a denial of service (memory consumption or application crash) via a crafted format string, as demonstrated by a crafted first argument to the money_format function in PHP, a related issue to CVE-2008-1391.


definition_id: oval:org.debian:def:41387361836986177833429379057974534316
title: CVE-2009-4881 glibc
description:
Integer overflow in the __vstrfmon_l function in stdlib/strfmon_l.c in the strfmon implementation in the GNU C Library (aka glibc or libc6) before 2.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a crafted format string, as demonstrated by the %99999999999999999999n string, a related issue to CVE-2008-1391.


definition_id: oval:org.debian:def:249380268632889901379881598354291925032
title: CVE-2009-4896 mlmmj
description:
Multiple directory traversal vulnerabilities in the mlmmj-php-admin web interface for Mailing List Managing Made Joyful (mlmmj) 1.2.15 through 1.2.17 allow remote authenticated users to overwrite, create, or delete arbitrary files, or determine the existence of arbitrary directories, via a .. (dot dot) in a list name in a (1) edit or (2) save action.


definition_id: oval:org.debian:def:117381545896879101544454138001316510488
title: CVE-2009-4897 ghostscript
description:
Buffer overflow in gs/psi/iscan.c in Ghostscript 8.64 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document containing a long name.


definition_id: oval:org.debian:def:109740820696324760191782879198100938671
title: CVE-2009-4924 python-cjson
description:
Dan Pascu python-cjson 1.0.5 does not properly handle a ['/'] argument to cjson.encode, which makes it easier for remote attackers to conduct certain cross-site scripting (XSS) attacks involving Firefox and the end tag of a SCRIPT element.


definition_id: oval:org.debian:def:71379386385261199021301064089944866264
title: CVE-2009-4997 gnome-power-manager
description:
gnome-power-manager 2.27.92 does not properly implement the lock_on_suspend and lock_on_hibernate settings for locking the screen when the suspend or hibernate button is pressed, which might make it easier for physically proximate attackers to access an unattended laptop via a resume action, a related issue to CVE-2010-2532.  NOTE: this issue exists because of a regression that followed a gnome-power-manager fix a few years earlier.


definition_id: oval:org.debian:def:41285909097245195314710676673985796799
title: CVE-2009-5009 openconnect
description:
Double free vulnerability in OpenConnect before 1.40 might allow remote AnyConnect SSL VPN servers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted DTLS Cipher option during a reconnect operation.


definition_id: oval:org.debian:def:293662960501301845023785746012494355659
title: CVE-2009-5011 python-pyftpdlib
description:
Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the getpeername function having an ENOTCONN error, a different vulnerability than CVE-2010-3494.


definition_id: oval:org.debian:def:266810092799229095338212920692519766888
title: CVE-2009-5012 python-pyftpdlib
description:
ftpserver.py in pyftpdlib before 0.5.2 does not require the l permission for the MLST command, which allows remote authenticated users to bypass intended access restrictions and list the root directory via an FTP session.


definition_id: oval:org.debian:def:72308047450647465928584205748837492768
title: CVE-2009-5013 python-pyftpdlib
description:
Memory leak in the on_dtp_close function in ftpserver.py in pyftpdlib before 0.5.2 allows remote authenticated users to cause a denial of service (memory consumption) by sending a QUIT command during a data transfer.


definition_id: oval:org.debian:def:283805397757711823838547570303404597746
title: CVE-2009-5014 turbogears2
description:
The default quickstart configuration of TurboGears2 (aka tg2) before 2.0.2 has a weak cookie salt, which makes it easier for remote attackers to bypass repoze.who authentication via a forged authorization cookie, a related issue to CVE-2010-3852.


definition_id: oval:org.debian:def:163265606285146815994285858782672627870
title: CVE-2009-5015 turbogears2
description:
The URL dispatch mechanism in TurboGears2 (aka tg2) before 2.0.2 exposes controller methods even when an @expose decoration is not used, which has unspecified impact and attack vectors.


definition_id: oval:org.debian:def:77346195752264321037693756497319400546
title: CVE-2009-5020 awstats
description:
Open redirect vulnerability in awredir.pl in AWStats before 6.95 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.


definition_id: oval:org.debian:def:294179974302455175184853212798724222109
title: CVE-2009-5023 fail2ban
description:
The (1) dshield.conf, (2) mail-buffered.conf, (3) mynetwatchman.conf, and (4) mynetwatchman.conf actions in action.d/ in Fail2ban before 0.8.5 allows local users to write to arbitrary files via a symlink attack on temporary files with predictable names, as demonstrated by /tmp/fail2ban-mail.txt.


definition_id: oval:org.debian:def:137955143700423760331351013965665248088
title: CVE-2009-5024 viewvc
description:
ViewVC before 1.1.11 allows remote attackers to bypass the cvsdb row_limit configuration setting, and consequently conduct resource-consumption attacks, via the limit parameter, as demonstrated by a "query revision history" request.


definition_id: oval:org.debian:def:210877419367046463811204197768383112158
title: CVE-2009-5028 namazu2
description:
Stack-based buffer overflow in Namazu before 2.0.20 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted request containing an empty uri field.


definition_id: oval:org.debian:def:192799551019556640598378589410321192893
title: CVE-2009-5044 groff
description:
contrib/pdfmark/pdfroff.sh in GNU troff (aka groff) before 1.21 allows local users to overwrite arbitrary files via a symlink attack on a pdf#####.tmp temporary file.


definition_id: oval:org.debian:def:105621269666722059199490494506826491124
title: CVE-2009-5052 smarty3
description:
Multiple unspecified vulnerabilities in Smarty before 3.0.0 beta 6 have unknown impact and attack vectors.


definition_id: oval:org.debian:def:276657749297392470665007539990517076522
title: CVE-2009-5053 smarty3
description:
Unspecified vulnerability in Smarty before 3.0.0 beta 6 allows remote attackers to execute arbitrary PHP code by injecting this code into a cache file.


definition_id: oval:org.debian:def:249126597813175390252829144777878163353
title: CVE-2009-5054 smarty3
description:
Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations.


definition_id: oval:org.debian:def:106968368389061129965593593866821166642
title: CVE-2009-5055 otrs2
description:
Open Ticket Request System (OTRS) before 2.4.4 grants ticket access on the basis of single-digit substrings of the CustomerID value, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by visiting a ticket, as demonstrated by leveraging the CustomerID 12 account to read tickets that should be available only to CustomerID 1 or CustomerID 2.


definition_id: oval:org.debian:def:297604744905106699620001196040679930486
title: CVE-2009-5056 otrs2
description:
Open Ticket Request System (OTRS) before 2.4.0-beta2 does not properly enforce the move_into permission setting for a queue, which allows remote authenticated users to bypass intended access restrictions and read a ticket by watching this ticket, and then selecting the ticket from the watched-tickets list.


definition_id: oval:org.debian:def:35582010929230632643317787653896527545
title: CVE-2009-5057 otrs2
description:
The S/MIME feature in Open Ticket Request System (OTRS) before 2.3.4 does not configure the RANDFILE and HOME environment variables for OpenSSL, which might make it easier for remote attackers to decrypt e-mail messages that had lower than intended entropy available for cryptographic operations, related to inability to write to the seeding file.


definition_id: oval:org.debian:def:225211097816449795087973904706388730280
title: CVE-2009-5064 glibc
description:
** DISPUTED ** ldd in the GNU C Library (aka glibc or libc6) 2.13 and earlier allows local users to gain privileges via a Trojan horse executable file linked with a modified loader that omits certain LD_TRACE_LOADED_OBJECTS checks.  NOTE: the GNU C Library vendor states "This is just nonsense. There are a gazillion other ways to introduce code if people are downloading arbitrary binaries and install them in appropriate directories or set LD_LIBRARY_PATH etc."


definition_id: oval:org.debian:def:255874458212182111873336626094434778728
title: CVE-2009-5065 feedparser
description:
Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0 allows remote attackers to inject arbitrary web script or HTML via vectors involving nested CDATA stanzas.


definition_id: oval:org.debian:def:188095074479469403488377420838690095850
title: CVE-2009-5067 html2ps
description:
Directory traversal vulnerability in html2ps before 1.0b6 allows remote attackers to read arbitrary files via a .. (dot dot) in the "include file" SSI directive.  NOTE: this issue only might be a vulnerability in limited scenarios, such as if html2ps is invoked by a web application, or if a user-assisted attacker provides filenames whose contents could cause a denial of service, such as certain devices.


definition_id: oval:org.debian:def:290560594684930053381615868952448650617
title: CVE-2009-5078 groff
description:
contrib/pdfmark/pdfroff.sh in GNU troff (aka groff) before 1.21 launches the Ghostscript program without the -dSAFER option, which allows remote attackers to create, overwrite, rename, or delete arbitrary files via a crafted document.


definition_id: oval:org.debian:def:28213833330050507076608566089241538727
title: CVE-2009-5079 groff
description:
The (1) gendef.sh, (2) doc/fixinfo.sh, and (3) contrib/gdiffmk/tests/runtests.in scripts in GNU troff (aka groff) 1.21 and earlier allow local users to overwrite arbitrary files via a symlink attack on a gro#####.tmp or /tmp/##### temporary file.


definition_id: oval:org.debian:def:299126894509784250568379381283902206062
title: CVE-2009-5080 groff
description:
The (1) contrib/eqn2graph/eqn2graph.sh, (2) contrib/grap2graph/grap2graph.sh, and (3) contrib/pic2graph/pic2graph.sh scripts in GNU troff (aka groff) 1.21 and earlier do not properly handle certain failed attempts to create temporary directories, which might allow local users to overwrite arbitrary files via a symlink attack on a file in a temporary directory, a different vulnerability than CVE-2004-1296.


definition_id: oval:org.debian:def:339266028936364661097507230488065853024
title: CVE-2009-5081 groff
description:
The (1) config.guess, (2) contrib/groffer/perl/groffer.pl, and (3) contrib/groffer/perl/roff2.pl scripts in GNU troff (aka groff) 1.21 and earlier use an insufficient number of X characters in the template argument to the tempfile function, which makes it easier for local users to overwrite arbitrary files via a symlink attack on a temporary file, a different vulnerability than CVE-2004-0969.


definition_id: oval:org.debian:def:221944266709418403986842677917994127877
title: CVE-2009-5082 groff
description:
The (1) configure and (2) config.guess scripts in GNU troff (aka groff) 1.20.1 on Openwall GNU/*/Linux (aka Owl) improperly create temporary files upon a failure of the mktemp function, which makes it easier for local users to overwrite arbitrary files via a symlink attack on a temporary file.


definition_id: oval:org.debian:def:125316277566869415357729673806857183402
title: CVE-2009-5144 mod-gnutls
description:
mod-gnutls does not validate client certificates when "GnuTLSClientVerify require" is set in a directory context, which allows remote attackers to spoof clients via a crafted certificate.


definition_id: oval:org.debian:def:42801779376215163000524452972739908489
title: CVE-2009-5155 glibc
description:
In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match.


definition_id: oval:org.debian:def:228262698254321580944010342031095371203
title: CVE-2010-0004 viewvc
description:
ViewVC before 1.1.3 composes the root listing view without using the authorizer for each root, which might allow remote attackers to discover private root names by reading this view.


definition_id: oval:org.debian:def:328552754598264711677104115980460723876
title: CVE-2010-0005 viewvc
description:
query.py in the query interface in ViewVC before 1.1.3 does not reject configurations that specify an unsupported authorizer for a root, which might allow remote attackers to bypass intended access restrictions via a query.


definition_id: oval:org.debian:def:336494314739331186333093416843568011548
title: CVE-2010-0012 transmission
description:
Directory traversal vulnerability in libtransmission/metainfo.c in Transmission 1.22, 1.34, 1.75, and 1.76 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a pathname within a .torrent file.


definition_id: oval:org.debian:def:326209099895106554438122810314413187365
title: CVE-2010-0013 pidgin
description:
Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122.  NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon.


definition_id: oval:org.debian:def:110438076596120914000983341789319311334
title: CVE-2010-0014 sssd
description:
System Security Services Daemon (SSSD) before 1.0.1, when the krb5 auth_provider is configured but the KDC is unreachable, allows physically proximate attackers to authenticate, via an arbitrary password, to the screen-locking program on a workstation that has any user's Kerberos ticket-granting ticket (TGT); and might allow remote attackers to bypass intended access restrictions via vectors involving an arbitrary password in conjunction with a valid TGT.


definition_id: oval:org.debian:def:247798517088437637872781100767084295634
title: CVE-2010-0015 glibc
description:
nis/nss_nis/nis-pwd.c in the GNU C Library (aka glibc or libc6) 2.7 and Embedded GLIBC (EGLIBC) 2.10.2 adds information from the passwd.adjunct.byname map to entries in the passwd map, which allows remote attackers to obtain the encrypted passwords of NIS accounts by calling the getpwnam function.


definition_id: oval:org.debian:def:293101155317144598945904353470547245350
title: CVE-2010-0097 bind9
description:
ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta does not properly validate DNSSEC (1) NSEC and (2) NSEC3 records, which allows remote attackers to add the Authenticated Data (AD) flag to a forged NXDOMAIN response for an existing domain.


definition_id: oval:org.debian:def:306489803307067149965375373291248167536
title: CVE-2010-0098 clamav
description:
ClamAV before 0.96 does not properly handle the (1) CAB and (2) 7z file formats, which allows remote attackers to bypass virus detection via a crafted archive that is compatible with standard archive utilities.


definition_id: oval:org.debian:def:140566911189633025509239568154204427875
title: CVE-2010-0132 viewvc
description:
Cross-site scripting (XSS) vulnerability in ViewVC 1.1 before 1.1.5 and 1.0 before 1.0.11, when the regular expression search functionality is enabled, allows remote attackers to inject arbitrary web script or HTML via vectors related to "search_re input," a different vulnerability than CVE-2010-0736.


definition_id: oval:org.debian:def:307812855058020854407200805119061335922
title: CVE-2010-0156 puppet
description:
Puppet 0.24.x before 0.24.9 and 0.25.x before 0.25.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/daemonout, (2) /tmp/puppetdoc.txt, (3) /tmp/puppetdoc.tex, or (4) /tmp/puppetdoc.aux temporary file.


definition_id: oval:org.debian:def:40802050256799846141742365069664730796
title: CVE-2010-0206 poppler
description:
xpdf allows remote attackers to cause a denial of service (NULL pointer dereference and crash) in the way it processes JBIG2 PDF stream objects.


definition_id: oval:org.debian:def:278787073139028783326900389473901884784
title: CVE-2010-0207 poppler
description:
In xpdf, the xref table contains an infinite loop which allows remote attackers to cause a denial of service (application crash) in xpdf-based PDF viewers.


definition_id: oval:org.debian:def:75218941905685274502351737614967770551
title: CVE-2010-0211 openldap
description:
The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function, which allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a modrdn call with an RDN string containing invalid UTF-8 sequences, which triggers a free of an invalid, uninitialized pointer in the slap_mods_free function, as demonstrated using the Codenomicon LDAPv3 test suite.


definition_id: oval:org.debian:def:35857732841500491346910506853151745235
title: CVE-2010-0212 openldap
description:
OpenLDAP 2.4.22 allows remote attackers to cause a denial of service (crash) via a modrdn call with a zero-length RDN destination string, which is not properly handled by the smr_normalize function and triggers a NULL pointer dereference in the IA5StringNormalize function in schema_init.c, as demonstrated using the Codenomicon LDAPv3 test suite.


definition_id: oval:org.debian:def:127143202768498200924966819247729215822
title: CVE-2010-0213 bind9
description:
BIND 9.7.1 and 9.7.1-P1, when a recursive validating server has a trust anchor that is configured statically or via DNSSEC Lookaside Validation (DLV), allows remote attackers to cause a denial of service (infinite loop) via a query for an RRSIG record whose answer is not in the cache, which causes BIND to repeatedly send RRSIG queries to the authoritative servers.


definition_id: oval:org.debian:def:59513510521086962933992528018624641800
title: CVE-2010-0277 pidgin
description:
slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.6.6, including 2.6.4, and Adium 1.3.8 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed MSNSLP INVITE request in an SLP message, a different issue than CVE-2010-0013.


definition_id: oval:org.debian:def:261318158676863535034600441876219147793
title: CVE-2010-0280 lib3ds
description:
Array index error in Jan Eric Kyprianidis lib3ds 1.x, as used in Google SketchUp 7.x before 7.1 M2, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted structures in a 3DS file, probably related to mesh.c.


definition_id: oval:org.debian:def:52760891705660912004132488160075885337
title: CVE-2010-0283 krb5
description:
The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.2, and 1.8 alpha, allows remote attackers to cause a denial of service (assertion failure and daemon crash) via an invalid (1) AS-REQ or (2) TGS-REQ request.


definition_id: oval:org.debian:def:48979976836430134796429904462857113955
title: CVE-2010-0285 gnome-screensaver
description:
gnome-screensaver 2.14.3, 2.22.2, 2.27.x, 2.28.0, and 2.28.3, when the X configuration enables the extend screen option, allows physically proximate attackers to bypass screen locking, access an unattended workstation, and view half of the GNOME desktop by attaching an external monitor.


definition_id: oval:org.debian:def:203068147122868250394947349116870829388
title: CVE-2010-0287 dokuwiki
description:
Directory traversal vulnerability in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to list the contents of arbitrary directories via a .. (dot dot) in the ns parameter.


definition_id: oval:org.debian:def:211401591025673254724767045338158640479
title: CVE-2010-0288 dokuwiki
description:
A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to gain privileges and access closed wikis by editing current ACL statements, as demonstrated in the wild in January 2010.


definition_id: oval:org.debian:def:185645490693740297848975528726948350163
title: CVE-2010-0289 dokuwiki
description:
Multiple cross-site request forgery (CSRF) vulnerabilities in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25c allow remote attackers to hijack the authentication of administrators for requests that modify access control rules, and other unspecified requests, via unknown vectors.


definition_id: oval:org.debian:def:143951196221867914487344213058206493472
title: CVE-2010-0290 bind9
description:
Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta, with DNSSEC validation enabled and checking disabled (CD), allows remote attackers to conduct DNS cache poisoning attacks by receiving a recursive client query and sending a response that contains (1) CNAME or (2) DNAME records, which do not have the intended validation before caching, aka Bug 20737.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-4022.


definition_id: oval:org.debian:def:260737152950140551470790481641699994510
title: CVE-2010-0292 chrony
description:
The read_from_cmd_socket function in cmdmon.c in chronyd in Chrony before 1.23.1, and 1.24-pre1, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by sending a spoofed cmdmon packet that triggers a continuous exchange of NOHOSTACCESS messages between two daemons, a related issue to CVE-2009-3563.


definition_id: oval:org.debian:def:10654655045958524597973114888919941664
title: CVE-2010-0293 chrony
description:
The client logging functionality in chronyd in Chrony before 1.23.1 does not restrict the amount of memory used for storage of client information, which allows remote attackers to cause a denial of service (memory consumption) via spoofed (1) NTP or (2) cmdmon packets.


definition_id: oval:org.debian:def:299163089015682210458140098149820635555
title: CVE-2010-0294 chrony
description:
chronyd in Chrony before 1.23.1, and possibly 1.24-pre1, generates a syslog message for each unauthorized cmdmon packet, which allows remote attackers to cause a denial of service (disk consumption) via a large number of invalid packets.


definition_id: oval:org.debian:def:260073975992443796466967868934862921649
title: CVE-2010-0295 lighttpd
description:
lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to cause a denial of service (memory consumption) by breaking a request into small pieces that are sent at a slow rate.


definition_id: oval:org.debian:def:287558549173659316467741968144362223822
title: CVE-2010-0296 glibc
description:
The encode_name macro in misc/mntent_r.c in the GNU C Library (aka glibc or libc6) 2.11.1 and earlier, as used by ncpmount and mount.cifs, does not properly handle newline characters in mountpoint names, which allows local users to cause a denial of service (mtab corruption), or possibly modify mount options and gain privileges, via a crafted mount request.


definition_id: oval:org.debian:def:148387728804526596814690501988206210192
title: CVE-2010-0300 ircd-hybrid
description:
cache.c in ircd-ratbox before 2.2.9 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a HELP command.


definition_id: oval:org.debian:def:61093644851185795837215202687105632093
title: CVE-2010-0301 maildrop
description:
main.C in maildrop 2.3.0 and earlier, when run by root with the -d option, uses the gid of root for execution of the .mailfilter file in a user's home directory, which allows local users to gain privileges via a crafted file.


definition_id: oval:org.debian:def:138602748525933730152159407257703705405
title: CVE-2010-0302 cups
description:
Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS before 1.4.4, when kqueue or epoll is used, allows remote attackers to cause a denial of service (daemon crash or hang) via a client disconnection during listing of a large number of print jobs, related to improperly maintaining a reference count. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-3553.


definition_id: oval:org.debian:def:246816376951434939326904171269343120322
title: CVE-2010-0304 wireshark
description:
Multiple buffer overflows in the LWRES dissector in Wireshark 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allow remote attackers to cause a denial of service (crash) via a malformed packet, as demonstrated using a stack-based buffer overflow to the dissect_getaddrsbyname_request function.


definition_id: oval:org.debian:def:294429446339973639184547970941075414614
title: CVE-2010-0305 ejabberd
description:
ejabberd_c2s.erl in ejabberd before 2.1.3 allows remote attackers to cause a denial of service (daemon crash) via a large number of c2s (aka client2server) messages that trigger a queue overload.


definition_id: oval:org.debian:def:97278467342705982663877054989770359378
title: CVE-2010-0308 squid
description:
lib/rfc1035.c in Squid 2.x, 3.0 through 3.0.STABLE22, and 3.1 through 3.1.0.15 allows remote attackers to cause a denial of service (assertion failure) via a crafted DNS packet that only contains a header.


definition_id: oval:org.debian:def:219180247941517979631909594102059493997
title: CVE-2010-0364 vlc
description:
Stack-based buffer overflow in VideoLAN VLC Media Player 0.8.6 allows user-assisted remote attackers to execute arbitrary code via an ogg file with a crafted Advanced SubStation Alpha Subtitle (.ass) file, probably involving the Dialogue field.


definition_id: oval:org.debian:def:162530058705701271441609571078193530955
title: CVE-2010-0382 bind9
description:
ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta handles out-of-bailiwick data accompanying a secure response without re-fetching from the original source, which allows remote attackers to have an unspecified impact via a crafted response, aka Bug 20819.  NOTE: this vulnerability exists because of a regression during the fix for CVE-2009-4022.


definition_id: oval:org.debian:def:162005236657265938622219349571640544895
title: CVE-2010-0383 tor
description:
Tor before 0.2.1.22, and 0.2.2.x before 0.2.2.7-alpha, uses deprecated identity keys for certain directory authorities, which makes it easier for man-in-the-middle attackers to compromise the anonymity of traffic sources and destinations.


definition_id: oval:org.debian:def:137520747224840012387669011705716835548
title: CVE-2010-0385 tor
description:
Tor before 0.2.1.22, and 0.2.2.x before 0.2.2.7-alpha, when functioning as a bridge directory authority, allows remote attackers to obtain sensitive information about bridge identities and bridge descriptors via a dbg-stability.txt directory query.


definition_id: oval:org.debian:def:233355732528325559180283634431244654502
title: CVE-2010-0393 cups
description:
The _cupsGetlang function, as used by lppasswd.c in lppasswd in CUPS 1.2.2, 1.3.7, 1.3.9, and 1.4.1, relies on an environment variable to determine the file that provides localized message strings, which allows local users to gain privileges via a file that contains crafted localization data with format string specifiers.


definition_id: oval:org.debian:def:25416329069490692377755466634654202106
title: CVE-2010-0396 dpkg
description:
Directory traversal vulnerability in the dpkg-source component in dpkg before 1.14.29 allows remote attackers to modify arbitrary files via a crafted Debian source archive.


definition_id: oval:org.debian:def:196525339226878103451784979722169533651
title: CVE-2010-0398 autokey
description:
The init script in autokey before 0.61.3-2 allows local attackers to write to arbitrary files via a symlink attack.


definition_id: oval:org.debian:def:267782509345633149895345770904422425366
title: CVE-2010-0401 openttd
description:
OpenTTD before 1.0.1 accepts a company password for authentication in response to a request for the server password, which allows remote authenticated users to bypass intended access restrictions or cause a denial of service (daemon crash) by sending a company password packet.


definition_id: oval:org.debian:def:56116468021392841596862170452877754281
title: CVE-2010-0402 openttd
description:
OpenTTD before 1.0.1 does not properly validate index values of certain items, which allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted in-game command.


definition_id: oval:org.debian:def:335103541458900204204831575477360448618
title: CVE-2010-0405 bzip2
description:
Integer overflow in the BZ2_decompress function in decompress.c in bzip2 and libbzip2 before 1.0.6 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted compressed file.


definition_id: oval:org.debian:def:23003137711503912942820888805954266438
title: CVE-2010-0406 openttd
description:
OpenTTD before 1.0.1 allows remote attackers to cause a denial of service (file-descriptor exhaustion and daemon crash) by performing incomplete downloads of the map.


definition_id: oval:org.debian:def:191988631641133683876571315426906865751
title: CVE-2010-0407 pcsc-lite
description:
Multiple buffer overflows in the MSGFunctionDemarshall function in winscard_svc.c in the PC/SC Smart Card daemon (aka PCSCD) in MUSCLE PCSC-Lite before 1.5.4 allow local users to gain privileges via crafted message data, which is improperly demarshalled.


definition_id: oval:org.debian:def:252664573873682922609906496804012804909
title: CVE-2010-0408 apache2
description:
The ap_proxy_ajp_request function in mod_proxy_ajp.c in mod_proxy_ajp in the Apache HTTP Server 2.2.x before 2.2.15 does not properly handle certain situations in which a client sends no request body, which allows remote attackers to cause a denial of service (backend server outage) via a crafted request, related to use of a 500 error code instead of the appropriate 400 error code.


definition_id: oval:org.debian:def:59297277469530327138320595579656175513
title: CVE-2010-0411 systemtap
description:
Multiple integer signedness errors in the (1) __get_argv and (2) __get_compat_argv functions in tapset/aux_syscalls.stp in SystemTap 1.1 allow local users to cause a denial of service (script crash, or system crash or hang) via a process with a large number of arguments, leading to a buffer overflow.


definition_id: oval:org.debian:def:226180138664459271086818404994959726999
title: CVE-2010-0414 gnome-screensaver
description:
gnome-screensaver before 2.28.2 allows physically proximate attackers to bypass screen locking and access an unattended workstation by moving the mouse position to an external monitor and then disconnecting that monitor.


definition_id: oval:org.debian:def:291521901572541829957903697849254869061
title: CVE-2010-0420 pidgin
description:
libpurple in Finch in Pidgin before 2.6.6, when an XMPP multi-user chat (MUC) room is used, does not properly parse nicknames containing <br> sequences, which allows remote attackers to cause a denial of service (application crash) via a crafted nickname.


definition_id: oval:org.debian:def:211719429746451942091353475119689565028
title: CVE-2010-0421 pango1.0
description:
Array index error in the hb_ot_layout_build_glyph_classes function in pango/opentype/hb-ot-layout.cc in Pango before 1.27.1 allows context-dependent attackers to cause a denial of service (application crash) via a crafted font file, related to building a synthetic Glyph Definition (aka GDEF) table by using this font's charmap and the Unicode property database.


definition_id: oval:org.debian:def:196709240827562600437718067839128662676
title: CVE-2010-0422 gnome-screensaver
description:
gnome-screensaver 2.28.x before 2.28.3 does not properly synchronize the state of screen locking and the unlock dialog in situations involving a change to the number of monitors, which allows physically proximate attackers to bypass screen locking and access an unattended workstation by connecting and disconnecting monitors multiple times, a related issue to CVE-2010-0414.


definition_id: oval:org.debian:def:126330560045355754897057021438346673488
title: CVE-2010-0423 pidgin
description:
gtkimhtml.c in Pidgin before 2.6.6 allows remote attackers to cause a denial of service (CPU consumption and application hang) by sending many smileys in a (1) IM or (2) chat.


definition_id: oval:org.debian:def:33321330921527724904567603452063775832
title: CVE-2010-0426 sudo
description:
sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by a file named sudoedit in a user's home directory.


definition_id: oval:org.debian:def:160193584872547411731030264069411303561
title: CVE-2010-0427 sudo
description:
sudo 1.6.x before 1.6.9p21, when the runas_default option is used, does not properly set group memberships, which allows local users to gain privileges via a sudo command.


definition_id: oval:org.debian:def:172960435130290097005051010398128774008
title: CVE-2010-0434 apache2
description:
The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.


definition_id: oval:org.debian:def:170845590335618620512366523642399318389
title: CVE-2010-0438 otrs2
description:
Multiple SQL injection vulnerabilities in Kernel/System/Ticket.pm in OTRS-Core in Open Ticket Request System (OTRS) 2.1.x before 2.1.9, 2.2.x before 2.2.9, 2.3.x before 2.3.5, and 2.4.x before 2.4.7 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.


definition_id: oval:org.debian:def:33043488900864668058524383144234318662
title: CVE-2010-0441 asterisk
description:
Asterisk Open Source 1.6.0.x before 1.6.0.22, 1.6.1.x before 1.6.1.14, and 1.6.2.x before 1.6.2.2, and Business Edition C.3 before C.3.3.2, allows remote attackers to cause a denial of service (daemon crash) via an SIP T.38 negotiation with an SDP FaxMaxDatagram field that is (1) missing, (2) modified to contain a negative number, or (3) modified to contain a large number.


definition_id: oval:org.debian:def:157576004167769433390108559914545965486
title: CVE-2010-0464 roundcube
description:
Roundcube 0.3.1 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests.


definition_id: oval:org.debian:def:271617246553383537120599808979697642751
title: CVE-2010-0540 cups
description:
Cross-site request forgery (CSRF) vulnerability in the web interface in CUPS before 1.4.4, as used on Apple Mac OS X 10.5.8, Mac OS X 10.6 before 10.6.4, and other platforms, allows remote attackers to hijack the authentication of administrators for requests that change settings.


definition_id: oval:org.debian:def:7266935104860930441313342949648896407
title: CVE-2010-0542 cups
description:
The _WriteProlog function in texttops.c in texttops in the Text Filter subsystem in CUPS before 1.4.4 does not check the return values of certain calloc calls, which allows remote attackers to cause a denial of service (NULL pointer dereference or heap memory corruption) or possibly execute arbitrary code via a crafted file.


definition_id: oval:org.debian:def:207971411900425379529300836869312509593
title: CVE-2010-0547 samba
description:
client/mount.cifs.c in mount.cifs in smbfs in Samba 3.4.5 and earlier does not verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string.


definition_id: oval:org.debian:def:44274978312815875469583339510994992745
title: CVE-2010-0562 fetchmail
description:
The sdump function in sdump.c in fetchmail 6.3.11, 6.3.12, and 6.3.13, when running in verbose mode on platforms for which char is signed, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an SSL X.509 certificate containing non-printable characters with the high bit set, which triggers a heap-based buffer overflow during escaping.


definition_id: oval:org.debian:def:315626554121834773143462134613969147942
title: CVE-2010-0624 cpio
description:
Heap-based buffer overflow in the rmt_read__ function in lib/rtapelib.c in the rmt client functionality in GNU tar before 1.23 and GNU cpio before 2.11 allows remote rmt servers to cause a denial of service (memory corruption) or possibly execute arbitrary code by sending more data than was requested, related to archive filenames that contain a : (colon) character.


definition_id: oval:org.debian:def:332124450996494340538030313853757547366
title: CVE-2010-0628 krb5
description:
The spnego_gss_accept_sec_context function in lib/gssapi/spnego/spnego_mech.c in the SPNEGO GSS-API functionality in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.2 and 1.8 before 1.8.1 allows remote attackers to cause a denial of service (assertion failure and daemon crash) via an invalid packet that triggers incorrect preparation of an error token.


definition_id: oval:org.debian:def:293428589261210045772817302254525286852
title: CVE-2010-0629 krb5
description:
Use-after-free vulnerability in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote authenticated users to cause a denial of service (daemon crash) via a request from a kadmin client that sends an invalid API version number.


definition_id: oval:org.debian:def:181370612244698920950535632381104805537
title: CVE-2010-0634 flex
description:
Unspecified vulnerability in Fast Lexical Analyzer Generator (flex) before 2.5.35 has unknown impact and attack vectors.


definition_id: oval:org.debian:def:203110253377801191031472989236546704142
title: CVE-2010-0639 squid
description:
The htcpHandleTstRequest function in htcp.c in Squid 2.x before 2.6.STABLE24 and 2.7 before 2.7.STABLE8, and htcp.cc in 3.0 before 3.0.STABLE24, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets to the HTCP port.


definition_id: oval:org.debian:def:23009805887423762341244784200511550951
title: CVE-2010-0667 moin
description:
MoinMoin 1.9 before 1.9.1 does not perform the expected clearing of the sys.argv array in situations where the GATEWAY_INTERFACE environment variable is set, which allows remote attackers to obtain sensitive information via unspecified vectors.


definition_id: oval:org.debian:def:215116863842980078788330818617171627964
title: CVE-2010-0668 moin
description:
Unspecified vulnerability in MoinMoin 1.5.x through 1.7.x, 1.8.x before 1.8.7, and 1.9.x before 1.9.2 has unknown impact and attack vectors, related to configurations that have a non-empty superuser list, the xmlrpc action enabled, the SyncPages action enabled, or OpenID configured.


definition_id: oval:org.debian:def:302871719225654169374863583036253132231
title: CVE-2010-0669 moin
description:
MoinMoin before 1.8.7 and 1.9.x before 1.9.2 does not properly sanitize user profiles, which has unspecified impact and attack vectors.


definition_id: oval:org.debian:def:17662487553745348110501814631777275131
title: CVE-2010-0682 wordpress
description:
WordPress 2.9 before 2.9.2 allows remote authenticated users to read trash posts from other authors via a direct request with a modified p parameter.


definition_id: oval:org.debian:def:309593530659285643151953034085119979903
title: CVE-2010-0685 asterisk
description:
The design of the dialplan functionality in Asterisk Open Source 1.2.x, 1.4.x, and 1.6.x; and Asterisk Business Edition B.x.x and C.x.x, when using the ${EXTEN} channel variable and wildcard pattern matches, allows context-dependent attackers to inject strings into the dialplan using metacharacters that are injected when the variable is expanded, as demonstrated using the Dial application to process a crafted SIP INVITE message that adds an unintended outgoing channel leg.  NOTE: it could be argued that this is not a vulnerability in Asterisk, but a class of vulnerabilities that can occur in any program that uses this feature without the associated filtering functionality that is already available.


definition_id: oval:org.debian:def:281077061431203122605764003178299435150
title: CVE-2010-0717 moin
description:
The default configuration of cfg.packagepages_actions_excluded in MoinMoin before 1.8.7 does not prevent unsafe package actions, which has unspecified impact and attack vectors.


definition_id: oval:org.debian:def:207192183864201516417410794824134339609
title: CVE-2010-0726 tdiary
description:
Cross-site scripting (XSS) vulnerability in the tb-send.rb (TrackBack transmission) plugin in tDiary 2.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown vectors, possibly related to the (1) plugin_tb_url and (2) plugin_tb_excerpt parameters.


definition_id: oval:org.debian:def:152914835725969556918612592098061991955
title: CVE-2010-0728 samba
description:
smbd in Samba 3.3.11, 3.4.6, and 3.5.0, when libcap support is enabled, runs with the CAP_DAC_OVERRIDE capability, which allows remote authenticated users to bypass intended file permissions via standard filesystem operations with any client.


definition_id: oval:org.debian:def:46692466999502194839906514873754492533
title: CVE-2010-0732 gtk+2.0
description:
CVE-2010-0732 gnome-screensaver: Race condition between shaking the unlock dialog and clearing the screen


definition_id: oval:org.debian:def:333577928628476911275911823812323921810
title: CVE-2010-0734 curl
description:
content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that requests automatic decompression, which might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact by sending crafted compressed data to an application that relies on the intended data-length limit.


definition_id: oval:org.debian:def:171705494049575472721328902976067599631
title: CVE-2010-0736 viewvc
description:
Cross-site scripting (XSS) vulnerability in the view_queryform function in lib/viewvc.py in ViewVC before 1.0.10, and 1.1.x before 1.1.4, allows remote attackers to inject arbitrary web script or HTML via "user-provided input."


definition_id: oval:org.debian:def:115758478486205122849394963533329651516
title: CVE-2010-0740 openssl
description:
The ssl3_get_record function in ssl/s3_pkt.c in OpenSSL 0.9.8f through 0.9.8m allows remote attackers to cause a denial of service (crash) via a malformed record in a TLS connection that triggers a NULL pointer dereference, related to the minor version number.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:201535028578718278326364331625501127156
title: CVE-2010-0742 openssl
description:
The Cryptographic Message Syntax (CMS) implementation in crypto/cms/cms_asn1.c in OpenSSL before 0.9.8o and 1.x before 1.0.0a does not properly handle structures that contain OriginatorInfo, which allows context-dependent attackers to modify invalid memory locations or conduct double-free attacks, and possibly execute arbitrary code, via unspecified vectors.


definition_id: oval:org.debian:def:336069293408627480628806909062499350937
title: CVE-2010-0745 dovecot
description:
Unspecified vulnerability in Dovecot 1.2.x before 1.2.11 allows remote attackers to cause a denial of service (CPU consumption) via long headers in an e-mail message.


definition_id: oval:org.debian:def:191554189242138112130657058937905519390
title: CVE-2010-0748 transmission
description:
Transmission before 1.92 allows an attacker to cause a denial of service (crash) or possibly have other unspecified impact via a large number of tr arguments in a magnet link.


definition_id: oval:org.debian:def:170528578780927832705788772064226456384
title: CVE-2010-0749 transmission
description:
Transmission before 1.92 allows attackers to prevent download of a file by corrupted data during the endgame.


definition_id: oval:org.debian:def:121898731760745857566427782789434256906
title: CVE-2010-0751 libnids
description:
The ip_evictor function in ip_fragment.c in libnids before 1.24, as used in dsniff and possibly other products, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via crafted fragmented packets.


definition_id: oval:org.debian:def:243819575594683532404172120212900131749
title: CVE-2010-0787 samba
description:
client/mount.cifs.c in mount.cifs in smbfs in Samba 3.0.22, 3.0.28a, 3.2.3, 3.3.2, 3.4.0, and 3.4.5 allows local users to mount a CIFS share on an arbitrary mountpoint, and gain privileges, via a symlink attack on the mountpoint directory file.


definition_id: oval:org.debian:def:158245756386392601383017193208194449221
title: CVE-2010-0789 fuse
description:
fusermount in FUSE before 2.7.5, and 2.8.x before 2.8.2, allows local users to unmount an arbitrary FUSE filesystem share via a symlink attack on a mountpoint.


definition_id: oval:org.debian:def:142301956612344856045637820583530213880
title: CVE-2010-0793 barnowl
description:
Buffer overflow in BarnOwl before 1.5.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted CC: header.


definition_id: oval:org.debian:def:57558112698483088080523304429338552237
title: CVE-2010-0825 xemacs21
description:
lib-src/movemail.c in movemail in emacs 22 and 23 allows local users to read, modify, or delete arbitrary mailbox files via a symlink attack, related to improper file-permission checks.


definition_id: oval:org.debian:def:266413489647559043660654732444271411868
title: CVE-2010-0826 libnss-db
description:
The Free Software Foundation (FSF) Berkeley DB NSS module (aka libnss-db) 2.2.3pre1 reads the DB_CONFIG file in the current working directory, which allows local users to obtain sensitive information via a symlink attack involving a setgid or setuid application that uses this module.


definition_id: oval:org.debian:def:93788434195964669572996538067349126531
title: CVE-2010-0827 texlive-bin
description:
Integer overflow in dvips in TeX Live 2009 and earlier, and teTeX, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted virtual font (VF) file associated with a DVI file.


definition_id: oval:org.debian:def:207442430107572839089433580717605434782
title: CVE-2010-0828 moin
description:
Cross-site scripting (XSS) vulnerability in action/Despam.py in the Despam action module in MoinMoin 1.8.7 and 1.9.2 allows remote authenticated users to inject arbitrary web script or HTML by creating a page with a crafted URI.


definition_id: oval:org.debian:def:210288763842349460494368727036381750382
title: CVE-2010-0829 dvipng
description:
Multiple array index errors in set.c in dvipng 1.11 and 1.12, and teTeX, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed DVI file.


definition_id: oval:org.debian:def:292662968678767107213430656296824703961
title: CVE-2010-0830 glibc
description:
Integer signedness error in the elf_get_dynamic_info function in elf/dynamic-link.h in ld.so in the GNU C Library (aka glibc or libc6) 2.0.1 through 2.11.1, when the --verify option is used, allows user-assisted remote attackers to execute arbitrary code via a crafted ELF program with a negative value for a certain d_tag structure member in the ELF header.


definition_id: oval:org.debian:def:131859823243376033996916437649124196497
title: CVE-2010-0831 fastjar
description:
Directory traversal vulnerability in the extract_jar function in jartool.c in FastJar 0.98 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in a non-initial pathname component in a filename within a .jar archive, a related issue to CVE-2005-1080.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-3619.


definition_id: oval:org.debian:def:322137615504397884354687208202842425100
title: CVE-2010-0926 samba
description:
The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3, when a writable share exists, allows remote authenticated users to leverage a directory traversal vulnerability, and access arbitrary files, by using the symlink command in smbclient to create a symlink containing .. (dot dot) sequences, related to the combination of the unix extensions and wide links options.


definition_id: oval:org.debian:def:55197726121519098125349146191102217293
title: CVE-2010-0969 unbound
description:
Unbound before 1.4.3 does not properly align structures on 64-bit platforms, which allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.


definition_id: oval:org.debian:def:138646068689648568325390208574819260970
title: CVE-2010-1028 calibre
description:
Integer overflow in the decompression functionality in the Web Open Fonts Format (WOFF) decoder in Mozilla Firefox 3.6 before 3.6.2 and 3.7 before 3.7 alpha 3 allows remote attackers to execute arbitrary code via a crafted WOFF file that triggers a buffer overflow, as demonstrated by the vd_ff module in VulnDisco 9.0.


definition_id: oval:org.debian:def:276116979607332590399064097548685268042
title: CVE-2010-1132 spamass-milter
description:
The mlfi_envrcpt function in spamass-milter.cpp in SpamAssassin Milter Plugin 0.3.1, when using the expand option, allows remote attackers to execute arbitrary system commands via shell metacharacters in the RCPT TO field of an email message.


definition_id: oval:org.debian:def:112458335572278541425654436322398886334
title: CVE-2010-1152 memcached
description:
memcached.c in memcached before 1.4.3 allows remote attackers to cause a denial of service (daemon hang or crash) via a long line that triggers excessive memory allocation.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:60650013440201312717463107037034041675
title: CVE-2010-1155 irssi
description:
Irssi before 0.8.15, when SSL is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field or a Subject Alternative Name field of the X.509 certificate, which allows man-in-the-middle attackers to spoof IRC servers via an arbitrary certificate.


definition_id: oval:org.debian:def:300791588348572181293968048849830942673
title: CVE-2010-1156 irssi
description:
core/nicklist.c in Irssi before 0.8.15 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors related to an attempted fuzzy nick match at the instant that a victim leaves a channel.


definition_id: oval:org.debian:def:56154814630730127813856279142665537312
title: CVE-2010-1159 aircrack-ng
description:
Multiple heap-based buffer overflows in Aircrack-ng before 1.1 allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a (1) large length value in an EAPOL packet or (2) long EAPOL packet.


definition_id: oval:org.debian:def:321422281098636680749509907925929525405
title: CVE-2010-1160 nano
description:
GNU nano before 2.2.4 does not verify whether a file has been changed before it is overwritten in a file-save operation, which allows local user-assisted attackers to overwrite arbitrary files via a symlink attack on an attacker-owned file that is being edited by the victim.


definition_id: oval:org.debian:def:123907437593362728877693402524818351215
title: CVE-2010-1161 nano
description:
Race condition in GNU nano before 2.2.4, when run by root to edit a file that is not owned by root, allows local user-assisted attackers to change the ownership of arbitrary files via vectors related to the creation of backup files.


definition_id: oval:org.debian:def:65615662407433718142359818769509947342
title: CVE-2010-1163 sudo
description:
The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not properly handle when a file in the current working directory has the same name as a pseudo-command in the sudoers file and the PATH contains an entry for ".", which allows local users to execute arbitrary commands via a Trojan horse executable, as demonstrated using sudoedit, a different vulnerability than CVE-2010-0426.


definition_id: oval:org.debian:def:107008174492177494047034105875236582110
title: CVE-2010-1167 fetchmail
description:
fetchmail 4.6.3 through 6.3.16, when debug mode is enabled, does not properly handle invalid characters in a multi-character locale, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted (1) message header or (2) POP3 UIDL list.


definition_id: oval:org.debian:def:338915371004973415537484728371542765458
title: CVE-2010-1168 perl
description:
The Safe (aka Safe.pm) module before 2.25 for Perl allows context-dependent attackers to bypass intended (1) Safe::reval and (2) Safe::rdo access restrictions, and inject and execute arbitrary code, via vectors involving implicitly called methods and implicitly blessed objects, as demonstrated by the (a) DESTROY and (b) AUTOLOAD methods, related to "automagic methods."


definition_id: oval:org.debian:def:3853878439373205332537190107893176320
title: CVE-2010-1172 dbus-glib
description:
DBus-GLib 0.73 disregards the access flag of exported GObject properties, which allows local users to bypass intended access restrictions and possibly cause a denial of service by modifying properties, as demonstrated by properties of the (1) DeviceKit-Power, (2) NetworkManager, and (3) ModemManager services.


definition_id: oval:org.debian:def:56511431976502876329698449708601688789
title: CVE-2010-1189 mediawiki
description:
MediaWiki before 1.15.2 does not prevent wiki editors from linking to images from other web sites in wiki pages, which allows editors to obtain IP addresses and other information of wiki users by adding a link to an image on an attacker-controlled web site, aka "CSS validation issue."


definition_id: oval:org.debian:def:8518106240199462245307222651950594370
title: CVE-2010-1190 mediawiki
description:
thumb.php in MediaWiki before 1.15.2, when used with access-restriction mechanisms such as img_auth.php, does not check user permissions before providing scaled images, which allows remote attackers to bypass intended access restrictions and read private images via unspecified manipulations.


definition_id: oval:org.debian:def:67268244109489914231584342600124149436
title: CVE-2010-1192 libesmtp
description:
libESMTP, probably 1.0.4 and earlier, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.


definition_id: oval:org.debian:def:303599083649067900085270660554150415337
title: CVE-2010-1194 libesmtp
description:
The match_component function in smtp-tls.c in libESMTP 1.0.3.r1, and possibly other versions including 1.0.4, treats two strings as equal if one is a substring of the other, which allows remote attackers to spoof trusted certificates via a crafted subjectAltName.


definition_id: oval:org.debian:def:299039053168456187037674465328966680371
title: CVE-2010-1195 ikiwiki
description:
Cross-site scripting (XSS) vulnerability in the htmlscrubber component in ikiwiki 2.x before 2.53.5 and 3.x before 3.20100312 allows remote attackers to inject arbitrary web script or HTML via a crafted data:image/svg+xml URI.


definition_id: oval:org.debian:def:69229811347794303741351059044089405162
title: CVE-2010-1205 tuxonice-userui
description:
Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG image that triggers an additional data row.


definition_id: oval:org.debian:def:183516278412827164160673904593541983779
title: CVE-2010-1224 asterisk
description:
main/acl.c in Asterisk Open Source 1.6.0.x before 1.6.0.25, 1.6.1.x before 1.6.1.17, and 1.6.2.x before 1.6.2.5 does not properly enforce remote host access controls when CIDR notation "/0" is used in permit= and deny= configuration rules, which causes an improper arithmetic shift and might allow remote attackers to bypass ACL rules and access services from unauthorized hosts.


definition_id: oval:org.debian:def:322156921478672023006464984104378019243
title: CVE-2010-1238 moin
description:
MoinMoin 1.7.1 allows remote attackers to bypass the textcha protection mechanism by modifying the textcha-question and textcha-answer fields to have empty values.


definition_id: oval:org.debian:def:115571468839256984097120078418653568842
title: CVE-2010-1277 zabbix
description:
SQL injection vulnerability in the user.authenticate method in the API in Zabbix 1.8 before 1.8.2 allows remote attackers to execute arbitrary SQL commands via the user parameter in JSON data to api_jsonrpc.php.


definition_id: oval:org.debian:def:142237686275829544820312515824119170035
title: CVE-2010-1311 clamav
description:
The qtm_decompress function in libclamav/mspack.c in ClamAV before 0.96 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted CAB archive that uses the Quantum (aka .Q) compression format.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:189864405346256325166518116119096438824
title: CVE-2010-1320 krb5
description:
Double free vulnerability in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x before 1.8.2 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a request associated with (1) renewal or (2) validation.


definition_id: oval:org.debian:def:113293968243998779483103025306627195262
title: CVE-2010-1321 heimdal
description:
The kg_accept_krb5 function in krb5/accept_sec_context.c in the GSS-API library in MIT Kerberos 5 (aka krb5) through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an AP-REQ message in which the authenticator's checksum field is missing.


definition_id: oval:org.debian:def:300342903555596367536395878400703228366
title: CVE-2010-1322 krb5
description:
The merge_authdata function in kdc_authdata.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8.x before 1.8.4 does not properly manage an index into an authorization-data list, which allows remote attackers to cause a denial of service (daemon crash), or possibly obtain sensitive information, spoof authorization, or execute arbitrary code, via a TGS request that triggers an uninitialized pointer dereference, as demonstrated by a request from a Windows Active Directory client.


definition_id: oval:org.debian:def:69489532937089890965161192211883202556
title: CVE-2010-1323 krb5
description:
MIT Kerberos 5 (aka krb5) 1.3.x, 1.4.x, 1.5.x, 1.6.x, 1.7.x, and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to modify user-visible prompt text, modify a response to a Key Distribution Center (KDC), or forge a KRB-SAFE message via certain checksums that (1) are unkeyed or (2) use RC4 keys.


definition_id: oval:org.debian:def:196941808674392621876592659792199434387
title: CVE-2010-1324 krb5
description:
MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to forge GSS tokens, gain privileges, or have unspecified other impact via (1) an unkeyed checksum, (2) an unkeyed PAC checksum, or (3) a KrbFastArmoredReq checksum based on an RC4 key.


definition_id: oval:org.debian:def:231454688678982457321068348937226572534
title: CVE-2010-1330 jruby
description:
The regular expression engine in JRuby before 1.4.1, when $KCODE is set to 'u', does not properly handle characters immediately after a UTF-8 character, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted string.


definition_id: oval:org.debian:def:64773700179000921582185427861097100343
title: CVE-2010-1411 tiff
description:
Multiple integer overflows in the Fax3SetupState function in tif_fax3.c in the FAX3 decoder in LibTIFF before 3.9.3, as used in ImageIO in Apple Mac OS X 10.5.8 and Mac OS X 10.6 before 10.6.4, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF file that triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:333567347814336454000328900957201263317
title: CVE-2010-1431 cacti
description:
SQL injection vulnerability in templates_export.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via the export_item_id parameter.


definition_id: oval:org.debian:def:289729441572510794848661210630792154669
title: CVE-2010-1441 vlc
description:
Multiple heap-based buffer overflows in VideoLAN VLC media player before 1.0.6 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted byte stream to the (1) A/52, (2) DTS, or (3) MPEG Audio decoder.


definition_id: oval:org.debian:def:278095876430110590670001711223213803293
title: CVE-2010-1442 vlc
description:
VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute arbitrary code via a crafted byte stream to the (1) AVI, (2) ASF, or (3) Matroska (aka MKV) demuxer.


definition_id: oval:org.debian:def:129402130891117017653206639620628820688
title: CVE-2010-1443 vlc
description:
The parse_track_node function in modules/demux/playlist/xspf.c in the XSPF playlist parser in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty location element in an XML Shareable Playlist Format (XSPF) document.


definition_id: oval:org.debian:def:196073998740075371921708576142169339348
title: CVE-2010-1444 vlc
description:
The ZIP archive decompressor in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute arbitrary code via a crafted archive.


definition_id: oval:org.debian:def:112235288017454055584091274896788334186
title: CVE-2010-1445 vlc
description:
Heap-based buffer overflow in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted byte stream in an RTMP session.


definition_id: oval:org.debian:def:274943184504023920096414234869048675857
title: CVE-2010-1447 perl
description:
The Safe (aka Safe.pm) module 2.26, and certain earlier versions, for Perl, as used in PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 Beta before 9.0 Beta 2, allows context-dependent attackers to bypass intended (1) Safe::reval and (2) Safe::rdo access restrictions, and inject and execute arbitrary code, via vectors involving subroutine references and delayed execution.


definition_id: oval:org.debian:def:152768773515910594549146176434319123592
title: CVE-2010-1452 apache2
description:
The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.


definition_id: oval:org.debian:def:67551095131020074612144960915380128524
title: CVE-2010-1455 wireshark
description:
The DOCSIS dissector in Wireshark 0.9.6 through 1.0.12 and 1.2.0 through 1.2.7 allows user-assisted remote attackers to cause a denial of service (application crash) via a malformed packet trace file.


definition_id: oval:org.debian:def:131679078410313307181131362157637804439
title: CVE-2010-1457 gnustep-base
description:
Tools/gdomap.c in gdomap in GNUstep Base before 1.20.0 allows local users to read arbitrary files via a (1) -c or (2) -a option, which prints file contents in an error message.


definition_id: oval:org.debian:def:248621702020876142071775409630200301898
title: CVE-2010-1459 mono
description:
The default configuration of ASP.NET in Mono before 2.6.4 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by the __VIEWSTATE parameter to 2.0/menu/menu1.aspx in the XSP sample project.


definition_id: oval:org.debian:def:13366650891796850538594047619443663619
title: CVE-2010-1512 aria2
description:
Directory traversal vulnerability in aria2 before 1.9.3 allows remote attackers to create arbitrary files via directory traversal sequences in the name attribute of a file element in a metalink file.


definition_id: oval:org.debian:def:117121514150490272044334135986367723684
title: CVE-2010-1513 ziproxy
description:
Multiple integer overflows in src/image.c in Ziproxy before 3.0.1 allow remote attackers to execute arbitrary code via (1) a large JPG image, related to the jpg2bitmap function or (2) a large PNG image, related to the png2bitmap function, leading to heap-based buffer overflows.


definition_id: oval:org.debian:def:166009768071819857884567777677142597124
title: CVE-2010-1526 libgdiplus
description:
Multiple integer overflows in libgdiplus 2.6.7, as used in Mono, allow attackers to execute arbitrary code via (1) a crafted TIFF file, related to the gdip_load_tiff_image function in tiffcodec.c; (2) a crafted JPEG file, related to the gdip_load_jpeg_image_internal function in jpegcodec.c; or (3) a crafted BMP file, related to the gdip_read_bmp_image function in bmpcodec.c, leading to heap-based buffer overflows.


definition_id: oval:org.debian:def:284089698328719795168261815968490129203
title: CVE-2010-1594 ocsinventory-server
description:
Multiple cross-site scripting (XSS) vulnerabilities in ocsreports/index.php in OCS Inventory NG 1.02.1 allow remote attackers to inject arbitrary web script or HTML via (1) the query string, (2) the BASE parameter, or (3) the ega_1 parameter.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:225504486236941809466819868254132696178
title: CVE-2010-1595 ocsinventory-server
description:
Multiple SQL injection vulnerabilities in ocsreports/index.php in OCS Inventory NG 1.02.1 allow remote attackers to execute arbitrary SQL commands via the (1) c, (2) val_1, or (3) onglet_bis parameter.


definition_id: oval:org.debian:def:105248617904831630511575359849954631143
title: CVE-2010-1620 gnustep-base
description:
Integer overflow in the load_iface function in Tools/gdomap.c in gdomap in GNUstep Base before 1.20.0 might allow context-dependent attackers to execute arbitrary code via a (1) file or (2) socket that provides configuration data with many entries, leading to a heap-based buffer overflow.


definition_id: oval:org.debian:def:147696393539608836513028010543331823478
title: CVE-2010-1623 apache2
description:
Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket.


definition_id: oval:org.debian:def:66148139035696645956608010371056794089
title: CVE-2010-1628 ghostscript
description:
Ghostscript 8.64, 8.70, and possibly other versions allows context-dependent attackers to execute arbitrary code via a PostScript file containing unlimited recursive procedure invocations, which trigger memory corruption in the stack of the interpreter.


definition_id: oval:org.debian:def:256843928337524312323548639565089006553
title: CVE-2010-1635 samba
description:
The chain_reply function in process.c in smbd in Samba before 3.4.8 and 3.5.x before 3.5.2 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) via a Negotiate Protocol request with a certain 0x0003 field value followed by a Session Setup AndX request with a certain 0x8003 field value.


definition_id: oval:org.debian:def:153387505153692142253965007704425259467
title: CVE-2010-1639 clamav
description:
The cli_pdf function in libclamav/pdf.c in ClamAV before 0.96.1 allows remote attackers to cause a denial of service (crash) via a malformed PDF file, related to an inconsistency in the calculated stream length and the real stream length.


definition_id: oval:org.debian:def:65838710431028432669171474084974452182
title: CVE-2010-1640 clamav
description:
CVE-2010-1640 Clam AntiVirus: Off-by-one error (DoS, crash) by parsing a specially-crafted PE icon file


definition_id: oval:org.debian:def:251599750917136489891369879312137245184
title: CVE-2010-1642 samba
description:
The reply_sesssetup_and_X_spnego function in sesssetup.c in smbd in Samba before 3.4.8 and 3.5.x before 3.5.2 allows remote attackers to trigger an out-of-bounds read, and cause a denial of service (process crash), via a \xff\xff security blob length in a Session Setup AndX request.


definition_id: oval:org.debian:def:136240506348276626617427499427108196406
title: CVE-2010-1645 cacti
description:
Cacti before 0.8.7f, as used in Red Hat High Performance Computing (HPC) Solution and other products, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in (1) the FQDN field of a Device or (2) the Vertical Label field of a Graph Template.


definition_id: oval:org.debian:def:128314898291012654325468523816354264416
title: CVE-2010-1646 sudo
description:
The secure path feature in env.c in sudo 1.3.1 through 1.6.9p22 and 1.7.0 through 1.7.2p6 does not properly handle an environment that contains multiple PATH variables, which might allow local users to gain privileges via a crafted value of the last PATH variable.


definition_id: oval:org.debian:def:119367915599512204048239529738031260162
title: CVE-2010-1647 mediawiki
description:
Cross-site scripting (XSS) vulnerability in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to inject arbitrary web script or HTML via crafted Cascading Style Sheets (CSS) strings that are processed as script by Internet Explorer.


definition_id: oval:org.debian:def:313287161108697032326641821773132231911
title: CVE-2010-1648 mediawiki
description:
Cross-site request forgery (CSRF) vulnerability in the login interface in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to hijack the authentication of users for requests that (1) create accounts or (2) reset passwords, related to the Special:Userlogin form.


definition_id: oval:org.debian:def:286660886313485323453717626803691070962
title: CVE-2010-1666 python-cjson
description:
Buffer overflow in Dan Pascu python-cjson 1.0.5, when UCS-4 encoding is enabled, allows context-dependent attackers to cause a denial of service (application crash) or possibly have unspecified other impact via vectors involving crafted Unicode input to the cjson.encode function.


definition_id: oval:org.debian:def:9135378239480024697528556808453982124
title: CVE-2010-1673 ikiwiki
description:
A cross-site scripting (XSS) vulnerability in ikiwiki before 3.20101112 allows remote attackers to inject arbitrary web script or HTML via a comment.


definition_id: oval:org.debian:def:28863597697533795126033518179984589637
title: CVE-2010-1674 quagga
description:
The extended-community parser in bgpd in Quagga before 0.99.18 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed Extended Communities attribute.


definition_id: oval:org.debian:def:208116944251893744890804014010670001113
title: CVE-2010-1675 quagga
description:
bgpd in Quagga before 0.99.18 allows remote attackers to cause a denial of service (session reset) via a malformed AS_PATHLIMIT path attribute.


definition_id: oval:org.debian:def:80927954184206888576414157858867294106
title: CVE-2010-1676 tor
description:
Heap-based buffer overflow in Tor before 0.2.1.28 and 0.2.2.x before 0.2.2.20-alpha allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via unspecified vectors.


definition_id: oval:org.debian:def:45788035343794563156203647578294738490
title: CVE-2010-1677 mhonarc
description:
MHonArc 2.6.16 allows remote attackers to cause a denial of service (CPU consumption) via start tags that are placed within other start tags, as demonstrated by a <bo<bo<bo<bo<body>dy>dy>dy>dy> sequence, a different vulnerability than CVE-2010-4524.


definition_id: oval:org.debian:def:154887044481744373687507744336386643365
title: CVE-2010-1678 mapserver
description:
Mapserver 5.2, 5.4 and 5.6 before 5.6.5-2 improperly validates symbol index values during Mapfile parsing.


definition_id: oval:org.debian:def:329440803675141490316522501110531121233
title: CVE-2010-1679 dpkg
description:
Directory traversal vulnerability in dpkg-source in dpkg before 1.14.31 and 1.15.x allows user-assisted remote attackers to modify arbitrary files via directory traversal sequences in a patch for a source-format 3.0 package.


definition_id: oval:org.debian:def:101692737911355360571391990471800724056
title: CVE-2010-1748 cups
description:
The cgi_initialize_string function in cgi-bin/var.c in the web interface in CUPS before 1.4.4, as used on Apple Mac OS X 10.5.8, Mac OS X 10.6 before 10.6.4, and other platforms, does not properly handle parameter values containing a % (percent) character without two subsequent hex characters, which allows context-dependent attackers to obtain sensitive information from cupsd process memory via a crafted request, as demonstrated by the (1) /admin?OP=redirect&URL=% and (2) /admin?URL=/admin/&OP=% URIs.


definition_id: oval:org.debian:def:99058640833926720749486215855986009772
title: CVE-2010-1797 freetype
description:
Multiple stack-based buffer overflows in the cff_decoder_parse_charstrings function in the CFF Type2 CharStrings interpreter in cff/cffgload.c in FreeType before 2.4.2, as used in Apple iOS before 4.0.2 on the iPhone and iPod touch and before 3.2.2 on the iPad, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted CFF opcodes in embedded fonts in a PDF document, as demonstrated by JailbreakMe. NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:317744279153638146085112047027449930791
title: CVE-2010-1853 transmission
description:
Multiple stack-based buffer overflows in the tr_magnetParse function in libtransmission/magnet.c in Transmission 1.91 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted magnet URL with a large number of (1) tr or (2) ws links.


definition_id: oval:org.debian:def:29400484084998087867320523662138485543
title: CVE-2010-1869 ghostscript
description:
Stack-based buffer overflow in the parser function in GhostScript 8.70 and 8.64 allows context-dependent attackers to execute arbitrary code via a crafted PostScript file.


definition_id: oval:org.debian:def:3780524560627683484997182149673029396
title: CVE-2010-2023 exim4
description:
transports/appendfile.c in Exim before 4.72, when a world-writable sticky-bit mail directory is used, does not verify the st_nlink field of mailbox files, which allows local users to cause a denial of service or possibly gain privileges by creating a hard link to another user's file.


definition_id: oval:org.debian:def:246772245031974972559829810241742360152
title: CVE-2010-2024 exim4
description:
transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/.


definition_id: oval:org.debian:def:241866431828677590395051557489451032699
title: CVE-2010-2055 ghostscript
description:
Ghostscript 8.71 and earlier reads initialization files from the current working directory, which allows local users to execute arbitrary PostScript commands via a Trojan horse file, related to improper support for the -P- option to the gs program, as demonstrated using gs_init.ps, a different vulnerability than CVE-2010-4820.


definition_id: oval:org.debian:def:277568574915235729862086695368557361649
title: CVE-2010-2056 gv
description:
GNU gv before 3.7.0 allows local users to overwrite arbitrary files via a symlink attack on a temporary file.


definition_id: oval:org.debian:def:156867652190447730522943622784495829141
title: CVE-2010-2058 prewikka
description:
setup.py in Prewikka 0.9.14 installs prewikka.conf with world-readable permissions, which allows local users to obtain the SQL database password.


definition_id: oval:org.debian:def:219672816179607995510285174167183564685
title: CVE-2010-2059 rpm
description:
lib/fsm.c in RPM 4.8.0 and unspecified 4.7.x and 4.6.x versions, and RPM before 4.4.3, does not properly reset the metadata of an executable file during replacement of the file in an RPM package upgrade, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid or (2) setgid file.


definition_id: oval:org.debian:def:110945971905108727327304742631190282358
title: CVE-2010-2061 rpcbind
description:
rpcbind 0.2.0 does not properly validate (1) /tmp/portmap.xdr and (2) /tmp/rpcbind.xdr, which can be created by an attacker before the daemon is started.


definition_id: oval:org.debian:def:271586606405546289383594290601215183328
title: CVE-2010-2062 mplayer
description:
Integer underflow in the real_get_rdt_chunk function in real.c, as used in modules/access/rtsp/real.c in VideoLAN VLC media player before 1.0.1 and stream/realrtsp/real.c in MPlayer before r29447, allows remote attackers to execute arbitrary code via a crafted length value in an RDT chunk header.


definition_id: oval:org.debian:def:168321378905721219230999369920366148115
title: CVE-2010-2064 rpcbind
description:
rpcbind 0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /tmp/portmap.xdr and (2) /tmp/rpcbind.xdr.


definition_id: oval:org.debian:def:170950967126973562526635657475064744931
title: CVE-2010-2065 tiff
description:
Integer overflow in the TIFFroundup macro in LibTIFF before 3.9.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TIFF file that triggers a buffer overflow.


definition_id: oval:org.debian:def:261273169945357372052128969146949309292
title: CVE-2010-2072 pyftpd
description:
Pyftpd 0.8.4 creates log files with predictable names in a temporary directory, which allows local users to cause a denial of service and obtain sensitive information.


definition_id: oval:org.debian:def:79905685535328729790566187057377391982
title: CVE-2010-2073 pyftpd
description:
auth_db_config.py in Pyftpd 0.8.4 contains hard-coded usernames and passwords for the (1) test, (2) user, and (3) roxon accounts, which allows remote attackers to read arbitrary files from the FTP server.


definition_id: oval:org.debian:def:23282620973639353862482374948535654048
title: CVE-2010-2074 w3m
description:
istream.c in w3m 0.5.2 and possibly other versions, when ssl_verify_server is enabled, does not properly handle a '\0' character in a domain name in the (1) subject's Common Name or (2) Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.


definition_id: oval:org.debian:def:177336684222614764767009924160048755698
title: CVE-2010-2080 otrs2
description:
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:108424759864365753963653683380506725437
title: CVE-2010-2089 python2.7
description:
The audioop module in Python 2.7 and 3.2 does not verify the relationships between size arguments and byte string lengths, which allows context-dependent attackers to cause a denial of service (memory corruption and application crash) via crafted arguments, as demonstrated by a call to audioop.reverse with a one-byte string, a different vulnerability than CVE-2010-1634.


definition_id: oval:org.debian:def:4661073344485173206799152277073433493
title: CVE-2010-2092 cacti
description:
SQL injection vulnerability in graph.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via a crafted rra_id parameter in a GET request in conjunction with a valid rra_id value in a POST request or a cookie, which causes the POST or cookie value to bypass the validation routine, but inserts the $_GET value into the resulting query.


definition_id: oval:org.debian:def:336580821872629678895448098450919257638
title: CVE-2010-2156 isc-dhcp
description:
ISC DHCP 4.1 before 4.1.1-P1 and 4.0 before 4.0.2-P1 allows remote attackers to cause a denial of service (server exit) via a zero-length client ID.


definition_id: oval:org.debian:def:297227872981990541539291520800757993500
title: CVE-2010-2192 pmount
description:
The make_lockdir_name function in policy.c in pmount 0.9.18 allow local users to overwrite arbitrary files via a symlink attack on a file in /var/lock/.


definition_id: oval:org.debian:def:176474188835457379579299418404757367061
title: CVE-2010-2197 rpm
description:
rpmbuild in RPM 4.8.0 and earlier does not properly parse the syntax of spec files, which allows user-assisted remote attackers to remove home directories via vectors involving a ;~ (semicolon tilde) sequence in a Name tag.


definition_id: oval:org.debian:def:321731579669873440605635360620305417799
title: CVE-2010-2230 wordpress
description:
The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.


definition_id: oval:org.debian:def:45479826159364793422510846481493245672
title: CVE-2010-2237 libvirt
description:
Red Hat libvirt, possibly 0.6.1 through 0.8.2, looks up disk backing stores without referring to the user-defined main disk format, which might allow guest OS users to read arbitrary files on the host OS, and possibly have unspecified other impact, via unknown vectors.


definition_id: oval:org.debian:def:153223386426097441668311874893407041959
title: CVE-2010-2238 libvirt
description:
Red Hat libvirt, possibly 0.7.2 through 0.8.2, recurses into disk-image backing stores without extracting the defined disk backing-store format, which might allow guest OS users to read arbitrary files on the host OS, and possibly have unspecified other impact, via unknown vectors.


definition_id: oval:org.debian:def:337843977928557071196431013086913196171
title: CVE-2010-2239 libvirt
description:
Red Hat libvirt, possibly 0.6.0 through 0.8.2, creates new images without setting the user-defined backing-store format, which allows guest OS users to read arbitrary files on the host OS via unspecified vectors.


definition_id: oval:org.debian:def:210554920623525266150937776398237962718
title: CVE-2010-2242 libvirt
description:
Red Hat libvirt 0.2.0 through 0.8.2 creates iptables rules with improper mappings of privileged source ports, which allows guest OS users to bypass intended access restrictions by leveraging IP address and source-port values, as demonstrated by copying and deleting an NFS directory tree.


definition_id: oval:org.debian:def:326043840092709568025559491812688330103
title: CVE-2010-2244 avahi
description:
The AvahiDnsPacket function in avahi-core/socket.c in avahi-daemon in Avahi 0.6.16 and 0.6.25 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNS packet with an invalid checksum followed by a DNS packet with a valid checksum, a different vulnerability than CVE-2008-5081.


definition_id: oval:org.debian:def:175287866447941638525897205142301202428
title: CVE-2010-2246 feh
description:
feh before 1.8, when the --wget-timestamp option is enabled, might allow remote attackers to execute arbitrary commands via shell metacharacters in a URL.


definition_id: oval:org.debian:def:233176129041005759640190291351338728597
title: CVE-2010-2251 lftp
description:
The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.


definition_id: oval:org.debian:def:25526891327038019820547245414392861478
title: CVE-2010-2252 wget
description:
GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx redirect to a URL with a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.


definition_id: oval:org.debian:def:120102237131662860675593612219709324152
title: CVE-2010-2253 libwww-perl
description:
lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . (dot) character, which allows remote servers to create or overwrite files via (1) a 3xx redirect to a URL with a crafted filename or (2) a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.


definition_id: oval:org.debian:def:322094426154872685703948747930521161134
title: CVE-2010-2262 weborf
description:
Galileo Students Team Weborf before 0.12.1 allows remote attackers to cause a denial of service (crash) via a crafted Range header.


definition_id: oval:org.debian:def:283186150239945739291102970372847960305
title: CVE-2010-2273 dojo
description:
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.


definition_id: oval:org.debian:def:183253503902833134929063692985123007958
title: CVE-2010-2274 dojo
description:
Multiple open redirect vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, util/buildscripts/jslib/buildUtil.js, and util/doh/runner.html.


definition_id: oval:org.debian:def:280612726387957832176426069673682376619
title: CVE-2010-2275 dojo
description:
Cross-site scripting (XSS) vulnerability in dijit/tests/_testCommon.js in Dojo Toolkit SDK before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the theme parameter, as demonstrated by an attack against dijit/tests/form/test_Button.html.


definition_id: oval:org.debian:def:52843804306207531379342866199790568396
title: CVE-2010-2283 wireshark
description:
The SMB dissector in Wireshark 0.99.6 through 1.0.13, and 1.2.0 through 1.2.8 allows remote attackers to cause a denial of service (NULL pointer dereference) via unknown vectors.


definition_id: oval:org.debian:def:255555111163962734126593585606497744014
title: CVE-2010-2284 wireshark
description:
Buffer overflow in the ASN.1 BER dissector in Wireshark 0.10.13 through 1.0.13 and 1.2.0 through 1.2.8 has unknown impact and remote attack vectors.


definition_id: oval:org.debian:def:130694999948077684412509762375952967895
title: CVE-2010-2285 wireshark
description:
The SMB PIPE dissector in Wireshark 0.8.20 through 1.0.13 and 1.2.0 through 1.2.8 allows remote attackers to cause a denial of service (NULL pointer dereference) via unknown vectors.


definition_id: oval:org.debian:def:198293604511799696272323996489577556948
title: CVE-2010-2286 wireshark
description:
The SigComp Universal Decompressor Virtual Machine dissector in Wireshark 0.10.7 through 1.0.13 and 1.2.0 through 1.2.8 allows remote attackers to cause a denial of service (infinite loop) via unknown vectors.


definition_id: oval:org.debian:def:223517657720057765694541189847649461439
title: CVE-2010-2287 wireshark
description:
Buffer overflow in the SigComp Universal Decompressor Virtual Machine dissector in Wireshark 0.10.8 through 1.0.13 and 1.2.0 through 1.2.8 has unknown impact and remote attack vectors.


definition_id: oval:org.debian:def:76092753806911557467015070333278388886
title: CVE-2010-2322 fastjar
description:
Absolute path traversal vulnerability in the extract_jar function in jartool.c in FastJar 0.98 allows remote attackers to create or overwrite arbitrary files via a full pathname for a file within a .jar archive, a related issue to CVE-2010-0831.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-3619.


definition_id: oval:org.debian:def:71203780917847058838009060700669422044
title: CVE-2010-2350 ziproxy
description:
Heap-based buffer overflow in the PNG decoder in Ziproxy 3.1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PNG file.


definition_id: oval:org.debian:def:248542741339824659460886637781185788398
title: CVE-2010-2431 cups
description:
The cupsFileOpen function in CUPS before 1.4.4 allows local users, with lp group membership, to overwrite arbitrary files via a symlink attack on the (1) /var/cache/cups/remote.cache or (2) /var/cache/cups/job.cache file.


definition_id: oval:org.debian:def:57389335309095641187286975155407596119
title: CVE-2010-2432 cups
description:
The cupsDoAuthentication function in auth.c in the client in CUPS before 1.4.4, when HAVE_GSSAPI is omitted, does not properly handle a demand for authorization, which allows remote CUPS servers to cause a denial of service (infinite loop) via HTTP_UNAUTHORIZED responses.


definition_id: oval:org.debian:def:209427671283368760800416648282309125927
title: CVE-2010-2435 weborf
description:
Weborf HTTP Server 0.12.1 and earlier allows remote attackers to cause a denial of service (crash) via Unicode characters in a Connection HTTP header, and possibly other headers.


definition_id: oval:org.debian:def:110648638231256811090423117433068012039
title: CVE-2010-2443 tiff
description:
The OJPEGReadBufferFill function in tif_ojpeg.c in LibTIFF before 3.9.3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an OJPEG image with undefined strip offsets, related to the TIFFVGetField function.


definition_id: oval:org.debian:def:269406800376902648493305521797328114755
title: CVE-2010-2444 maradns
description:
parse/Csv2_parse.c in MaraDNS 1.3.03, and other versions before 1.4.03, does not properly handle hostnames that do not end in a "." (dot) character, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted csv2 zone file.


definition_id: oval:org.debian:def:327957473944890004924651675498396793965
title: CVE-2010-2445 freeciv
description:
freeciv 2.2 before 2.2.1 and 2.3 before 2.3.0 allows attackers to read arbitrary files or execute arbitrary commands via a scenario that contains Lua functionality, related to the (1) os, (2) io, (3) package, (4) dofile, (5) loadfile, (6) loadlib, (7) module, and (8) require modules or functions.


definition_id: oval:org.debian:def:9819838775719018673306067404594118432
title: CVE-2010-2449 gource
description:
Gource through 0.26 logs to a predictable file name (/tmp/gource-$UID.tmp), enabling attackers to overwrite an arbitrary file via a symlink attack.


definition_id: oval:org.debian:def:269168369387657243203090101029548297178
title: CVE-2010-2451 kvirc
description:
Multiple format string vulnerabilities in the DCC functionality in KVIrc 3.4 and 4.0 have unspecified impact and remote attack vectors.


definition_id: oval:org.debian:def:277221990684664634118507683588520741185
title: CVE-2010-2452 kvirc
description:
Directory traversal vulnerability in the DCC functionality in KVIrc 3.4 and 4.0 allows remote attackers to overwrite arbitrary files via unknown vectors.


definition_id: oval:org.debian:def:244724619672965211249034954931906262901
title: CVE-2010-2477 paste
description:
Multiple cross-site scripting (XSS) vulnerabilities in the paste.httpexceptions implementation in Paste before 1.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving a 404 status code, related to (1) paste.urlparser.StaticURLParser, (2) paste.urlparser.PkgResourcesParser, (3) paste.urlmap.URLMap, and (4) HTTPNotFound.


definition_id: oval:org.debian:def:73839949216085264590083967159966546682
title: CVE-2010-2479 php-htmlpurifier
description:
Cross-site scripting (XSS) vulnerability in HTML Purifier before 4.1.1, as used in Mahara and other products, when the browser is Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:246019728130988053452677638696063769364
title: CVE-2010-2487 moin
description:
Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, 1.8.x before 1.8.8, and 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) Page.py, (2) PageEditor.py, (3) PageGraphicalEditor.py, (4) action/CopyPage.py, (5) action/Load.py, (6) action/RenamePage.py, (7) action/backup.py, (8) action/login.py, (9) action/newaccount.py, and (10) action/recoverpass.py.


definition_id: oval:org.debian:def:269700367611146912607590738267911208791
title: CVE-2010-2488 znc
description:
NULL pointer dereference vulnerability in ZNC before 0.092 caused by traffic stats when there are unauthenticated connections.


definition_id: oval:org.debian:def:194671342090813505260901610349995163937
title: CVE-2010-2494 bogofilter
description:
Multiple buffer underflows in the base64 decoder in base64.c in (1) bogofilter and (2) bogolexer in bogofilter before 1.2.2 allow remote attackers to cause a denial of service (heap memory corruption and application crash) via an e-mail message with invalid base64 data that begins with an = (equals) character.


definition_id: oval:org.debian:def:140317751645450377087460888853851133422
title: CVE-2010-2496 cluster-glue
description:
stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and potentially influence its operations. This is fixed in cluster-glue 1.0.6 and newer, and pacemaker 1.1.3 and newer.


definition_id: oval:org.debian:def:319607375679805755082000819538644418625
title: CVE-2010-2497 freetype
description:
Integer underflow in glyph handling in FreeType before 2.4.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.


definition_id: oval:org.debian:def:135838908042579791675811590639420316627
title: CVE-2010-2498 freetype
description:
The psh_glyph_find_strong_points function in pshinter/pshalgo.c in FreeType before 2.4.0 does not properly implement hinting masks, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via a crafted font file that triggers an invalid free operation.


definition_id: oval:org.debian:def:139734955095112217954653716620398564954
title: CVE-2010-2499 freetype
description:
Buffer overflow in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.4.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted LaserWriter PS font file with an embedded PFB fragment.


definition_id: oval:org.debian:def:150028405775664113757506968915784128686
title: CVE-2010-2520 freetype
description:
Heap-based buffer overflow in the Ins_IUP function in truetype/ttinterp.c in FreeType before 2.4.0, when TrueType bytecode support is enabled, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.


definition_id: oval:org.debian:def:137161143295026942810647983461095774914
title: CVE-2010-2526 lvm2
description:
The cluster logical volume manager daemon (clvmd) in lvm2-cluster in LVM2 before 2.02.72, as used in Red Hat Global File System (GFS) and other products, does not verify client credentials upon a socket connection, which allows local users to cause a denial of service (daemon exit or logical-volume change) or possibly have unspecified other impact via crafted control commands.


definition_id: oval:org.debian:def:117873111638583950292303412319185107067
title: CVE-2010-2527 freetype
description:
Multiple buffer overflows in demo programs in FreeType before 2.4.0 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.


definition_id: oval:org.debian:def:100847362543813355467106994137156137457
title: CVE-2010-2528 pidgin
description:
The clientautoresp function in family_icbm.c in the oscar protocol plugin in libpurple in Pidgin before 2.7.2 allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via an X-Status message that lacks the expected end tag for a (1) desc or (2) title element.


definition_id: oval:org.debian:def:43422089294219696483946992034230842574
title: CVE-2010-2529 inetutils
description:
Unspecified vulnerability in ping.c in iputils 20020927, 20070202, 20071127, and 20100214 on Mandriva Linux allows remote attackers to cause a denial of service (hang) via a crafted echo response.


definition_id: oval:org.debian:def:10474584680243202736306205552697925990
title: CVE-2010-2532 lxsession
description:
** DISPUTED **  lxsession-logout in lxsession in LXDE, as used on SUSE openSUSE 11.3 and other platforms, does not lock the screen when the Suspend or Hibernate button is pressed, which might make it easier for physically proximate attackers to access an unattended laptop via a resume action.  NOTE: there is no general agreement that this is a vulnerability, because separate control over locking can be an equally secure, or more secure, behavior in some threat environments.


definition_id: oval:org.debian:def:121490441758762093234227794768467041663
title: CVE-2010-2534 openttd
description:
The NetworkSyncCommandQueue function in network/network_command.cpp in OpenTTD before 1.0.3 does not properly clear a pointer in a linked list, which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted request, related to the client command queue.


definition_id: oval:org.debian:def:106793149918834709267009754809453771665
title: CVE-2010-2539 mapserver
description:
Buffer overflow in the msTmpFile function in maputil.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 allows local users to cause a denial of service via vectors involving names of temporary files.


definition_id: oval:org.debian:def:255746326914595321874696087426058704342
title: CVE-2010-2540 mapserver
description:
mapserv.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 does not properly restrict the use of CGI command-line arguments that were intended for debugging, which allows remote attackers to have an unspecified impact via crafted arguments.


definition_id: oval:org.debian:def:209797462443485852291901562882976576119
title: CVE-2010-2541 freetype
description:
Buffer overflow in ftmulti.c in the ftmulti demo program in FreeType before 2.4.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.


