# definitions

definition_id: oval:org.debian:def:27270666921267796981675963567857297184
title: CVE-2006-1753 fcheck
description:
A cron job in fcheck before 2.7.59 allows local users to overwrite arbitrary files via a symlink attack on a temporary file.


definition_id: oval:org.debian:def:32979419058583212949286919948806251750
title: CVE-2006-1790 thunderbird
description:
A regression fix in Mozilla Firefox 1.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the InstallTrigger.install method, which leads to memory corruption.


definition_id: oval:org.debian:def:173436126563853836056127745340139786557
title: CVE-2006-1796 wordpress
description:
Cross-site scripting (XSS) vulnerability in the paging links functionality in template-functions-links.php in Wordpress 1.5.2, and possibly other versions before 2.0.1, allows remote attackers to inject arbitrary web script or HTML to Internet Explorer users via the request URI ($_SERVER['REQUEST_URI']).


definition_id: oval:org.debian:def:220130842847420212182985283563924433612
title: CVE-2006-1827 asterisk
description:
Integer signedness error in format_jpeg.c in Asterisk 1.2.6 and earlier allows remote attackers to execute arbitrary code via a length value that passes a length check as a negative number, but triggers a buffer overflow when it is used as an unsigned length.


definition_id: oval:org.debian:def:123788163229873387817452862139671478243
title: CVE-2006-1844 shadow
description:
The Debian installer for the (1) shadow 4.0.14 and (2) base-config 2.53.10 packages includes sensitive information in world-readable log files, including preseeded passwords and pppoeconf passwords, which might allow local users to gain privileges.


definition_id: oval:org.debian:def:328164341217344441858073418903288660106
title: CVE-2006-1865 beagle
description:
Argument injection vulnerability in Beagle before 0.2.5 allows attackers to execute arbitrary commands via crafted filenames that inject command line arguments when Beagle launches external helper applications while indexing.


definition_id: oval:org.debian:def:273152213752855580517233881946617241440
title: CVE-2006-1905 xine-ui
description:
Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.3 allow remote attackers to execute arbitrary code via format string specifiers in a long filename on an EXTINFO line in a playlist file.


definition_id: oval:org.debian:def:269246244421543779686754793550687048801
title: CVE-2006-1945 awstats
description:
Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the config parameter.  NOTE: this might be the same core issue as CVE-2005-2732.


definition_id: oval:org.debian:def:85867617482784272873387301911582478380
title: CVE-2006-1989 clamav
description:
Buffer overflow in the get_database function in the HTTP client in Freshclam in ClamAV 0.80 to 0.88.1 might allow remote web servers to execute arbitrary code via long HTTP headers.


definition_id: oval:org.debian:def:3119531800912392671404039529654556876
title: CVE-2006-2017 dnsmasq
description:
Dnsmasq 2.29 allows remote attackers to cause a denial of service (application crash) via a DHCP client broadcast reply request.


definition_id: oval:org.debian:def:249599998681422337471124601916560771482
title: CVE-2006-2024 tiff
description:
Multiple vulnerabilities in libtiff before 3.8.1 allow context-dependent attackers to cause a denial of service via a TIFF image that triggers errors in (1) the TIFFFetchAnyArray function in (a) tif_dirread.c; (2) certain "codec cleanup methods" in (b) tif_lzw.c, (c) tif_pixarlog.c, and (d) tif_zip.c; (3) and improper restoration of setfield and getfield methods in cleanup functions within (e) tif_jpeg.c, tif_pixarlog.c, (f) tif_fax3.c, and tif_zip.c.


definition_id: oval:org.debian:def:108555327363582407610794920805632808370
title: CVE-2006-2025 tiff
description:
Integer overflow in the TIFFFetchData function in tif_dirread.c for libtiff before 3.8.1 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via a crafted TIFF image.


definition_id: oval:org.debian:def:156041044693148834637464378480552571134
title: CVE-2006-2026 tiff
description:
Double free vulnerability in tif_jpeg.c in libtiff before 3.8.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image that triggers errors related to "setfield/getfield methods in cleanup functions."


definition_id: oval:org.debian:def:146428443180827408373217904809683028008
title: CVE-2006-2069 pdns-recursor
description:
The recursor in PowerDNS before 3.0.1 allows remote attackers to cause a denial of service (application crash) via malformed EDNS0 packets.


definition_id: oval:org.debian:def:95871477196412844807080468898055582660
title: CVE-2006-2073 bind9
description:
Unspecified vulnerability in ISC BIND allows remote attackers to cause a denial of service via a crafted DNS message with a "broken" TSIG, as demonstrated by the OUSPG PROTOS DNS test suite.


definition_id: oval:org.debian:def:66840331423547202333018789112199927198
title: CVE-2006-2082 ioquake3
description:
Directory traversal vulnerability in Quake 3 engine, as used in products including Quake3 Arena, Return to Castle Wolfenstein, Wolfenstein: Enemy Territory, and Star Trek Voyager: Elite Force, when the sv_allowdownload cvar is enabled, allows remote attackers to read arbitrary files from the server via ".." sequences in a .pk3 file request.


definition_id: oval:org.debian:def:122812010043788124617595767475351644543
title: CVE-2006-2083 rsync
description:
Integer overflow in the receive_xattr function in the extended attributes patch (xattr.c) for rsync before 2.6.8 might allow attackers to execute arbitrary code via crafted extended attributes that trigger a buffer overflow.


definition_id: oval:org.debian:def:162003686860266196679432455374988692646
title: CVE-2006-2106 trac
description:
Cross-site scripting (XSS) vulnerability in Edgewall Software Trac 0.9.4 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors related to a "wiki macro."


definition_id: oval:org.debian:def:240440119574906086600965957455169239834
title: CVE-2006-2120 tiff
description:
The TIFFToRGB function in libtiff before 3.8.1 allows remote attackers to cause a denial of service (crash) via a crafted TIFF image with Yr/Yg/Yb values that exceed the YCR/YCG/YCB values, which triggers an out-of-bounds read.


definition_id: oval:org.debian:def:125461930586273124395503979868367541709
title: CVE-2006-2191 mailman
description:
** DISPUTED **  Format string vulnerability in Mailman before 2.1.9 allows attackers to execute arbitrary code via unspecified vectors. NOTE: the vendor has disputed this vulnerability, stating that it is "unexploitable."


definition_id: oval:org.debian:def:110920300296749483086169774390812197977
title: CVE-2006-2193 tiff
description:
Buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign extended to an integer that produces more digits than expected in an sprintf call.


definition_id: oval:org.debian:def:255999815670410464038531787777252440325
title: CVE-2006-2194 ppp
description:
The winbind plugin in pppd for ppp 2.4.4 and earlier does not check the return code from the setuid function call, which might allow local users to gain privileges by causing setuid to fail, such as exceeding PAM limits for the maximum number of user processes, which prevents the winbind NTLM authentication helper from dropping privileges.


definition_id: oval:org.debian:def:107671711356673974665074202126415779917
title: CVE-2006-2196 pinball
description:
Unspecified vulnerability in pinball 0.3.1 allows local users to gain privileges via unknown attack vectors that cause pinball to load plugins from an attacker-controlled directory while operating at raised privileges.


definition_id: oval:org.debian:def:31934501324614808130791322036434302260
title: CVE-2006-2200 libmms
description:
Stack-based buffer overflow in libmms, as used by (a) MiMMS 0.0.9 and (b) xine-lib 1.1.0 and earlier, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via the (1) send_command, (2) string_utf16, (3) get_data, and (4) get_media_packet functions, and possibly other functions.


definition_id: oval:org.debian:def:90411561129413234218314552906185093549
title: CVE-2006-2223 quagga
description:
RIPd in Quagga 0.98 and 0.99 before 20060503 does not properly implement configurations that (1) disable RIPv1 or (2) require plaintext or MD5 authentication, which allows remote attackers to obtain sensitive information (routing state) via REQUEST packets such as SEND UPDATE.


definition_id: oval:org.debian:def:103517742756622278805212278030929433165
title: CVE-2006-2224 quagga
description:
RIPd in Quagga 0.98 and 0.99 before 20060503 does not properly enforce RIPv2 authentication requirements, which allows remote attackers to modify routing state via RIPv1 RESPONSE packets.


definition_id: oval:org.debian:def:16063000454627710148827016296803201163
title: CVE-2006-2230 xine-ui
description:
Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.4 might allow attackers to cause a denial of service via format string specifiers in an MP3 filename specified on the command line. NOTE: this is a different vulnerability than CVE-2006-1905.  In addition, if the only attack vectors involve a user-assisted, local command line argument of a non-setuid program, this issue might not be a vulnerability.


definition_id: oval:org.debian:def:290048380737086445136274912145252442042
title: CVE-2006-2236 ioquake3
description:
Buffer overflow in the Quake 3 Engine, as used by (1) ET 2.60, (2) Return to Castle Wolfenstein 1.41, and (3) Quake III Arena 1.32b allows remote attackers to execute arbitrary commands via a long remapShader command.


definition_id: oval:org.debian:def:102864672374142701228633350073298414086
title: CVE-2006-2237 awstats
description:
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.


definition_id: oval:org.debian:def:312974333034414460432988705594051345406
title: CVE-2006-2276 quagga
description:
bgpd in Quagga 0.98 and 0.99 before 20060504 allows local users to cause a denial of service (CPU consumption) via a certain sh ip bgp command entered in the telnet interface.


definition_id: oval:org.debian:def:68069125913154802402305989070722708583
title: CVE-2006-2288 avahi
description:
Avahi before 0.6.10 allows local users to cause a denial of service (mDNS/DNS-SD service disconnect) via unspecified mDNS name conflicts.


definition_id: oval:org.debian:def:243304472396372558332907131793046850890
title: CVE-2006-2289 avahi
description:
Buffer overflow in avahi-core in Avahi before 0.6.10 allows local users to execute arbitrary code via unknown vectors.


definition_id: oval:org.debian:def:297434141728464784334154236640811459039
title: CVE-2006-2314 pygresql
description:
PostgreSQL 8.1.x before 8.1.4, 8.0.x before 8.0.8, 7.4.x before 7.4.13, 7.3.x before 7.3.15, and earlier versions allows context-dependent attackers to bypass SQL injection protection methods in applications that use multibyte encodings that allow the "\" (backslash) byte 0x5c to be the trailing byte of a multibyte character, such as SJIS, BIG5, GBK, GB18030, and UHC, which cannot be handled correctly by a client that does not understand multibyte encodings, aka a second variant of "Encoding-Based SQL Injection." NOTE: it could be argued that this is a class of issue related to interaction errors between the client and PostgreSQL, but a CVE has been assigned since PostgreSQL is treating this as a preventative measure against this class of problem.


definition_id: oval:org.debian:def:21824893791228866621881532123165573344
title: CVE-2006-2362 binutils
description:
Buffer overflow in getsym in tekhex.c in libbfd in Free Software Foundation GNU Binutils before 20060423, as used by GNU strings, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a file with a crafted Tektronix Hex Format (TekHex) record in which the length character is not a valid hexadecimal character.


definition_id: oval:org.debian:def:42716545098935427157426395056931815445
title: CVE-2006-2366 libopenobex
description:
ircp_io.c in libopenobex for ircp 1.2, when ircp is run with the -r option, does not prompt the user when overwriting files, which allows user-assisted remote attackers to overwrite dangerous files via an arbitrary destination file name in an OBEX File Transfer session.


definition_id: oval:org.debian:def:298550672141708058232100123305416119673
title: CVE-2006-2369 vnc4
description:
RealVNC 4.1.1, and other products that use RealVNC such as AdderLink IP and Cisco CallManager, allows remote attackers to bypass authentication via a request in which the client specifies an insecure security type such as "Type 1 - None", which is accepted even if it is not offered by the server, as originally demonstrated using a long password.


definition_id: oval:org.debian:def:52422485610379986211435476195690773767
title: CVE-2006-2413 gnunet
description:
GNUnet before SVN revision 2781 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an empty UDP datagram, possibly involving FIONREAD errors.


definition_id: oval:org.debian:def:209384074762868440289175412216898766331
title: CVE-2006-2414 dovecot
description:
Directory traversal vulnerability in Dovecot 1.0 beta and 1.0 allows remote attackers to list files and directories under the mbox parent directory and obtain mailbox names via ".." sequences in the (1) LIST or (2) DELETE IMAP command.


definition_id: oval:org.debian:def:9852554934655064257583314692989567976
title: CVE-2006-2440 imagemagick
description:
Heap-based buffer overflow in the libMagick component of ImageMagick 6.0.6.2 might allow attackers to execute arbitrary code via an image index array that triggers the overflow during filename glob expansion by the ExpandFilenames function.


definition_id: oval:org.debian:def:177154798171623340847137106787663309539
title: CVE-2006-2441 pioneers
description:
Pioneers meta-server before 0.9.55, when the server-console is not installed, allows remote attackers to cause a denial of service (crash) via certain requests from an older gnocatan client to create a new game.


definition_id: oval:org.debian:def:280463366574149678849985266038186684382
title: CVE-2006-2447 spamassassin
description:
SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username.


definition_id: oval:org.debian:def:211108432941734934518342621844263204558
title: CVE-2006-2450 libvncserver
description:
auth.c in LibVNCServer 0.7.1 allows remote attackers to bypass authentication via a request in which the client specifies an insecure security type such as "Type 1 - None", which is accepted even if it is not offered by the server, a different issue than CVE-2006-2369.


definition_id: oval:org.debian:def:131627184696357612445323703249729317991
title: CVE-2006-2453 dia
description:
Multiple unspecified format string vulnerabilities in Dia have unspecified impact and attack vectors, a different set of issues than CVE-2006-2480.


definition_id: oval:org.debian:def:221057756273056103473222898909010855083
title: CVE-2006-2458 libextractor
description:
Multiple heap-based buffer overflows in Libextractor 0.5.13 and earlier allow remote attackers to execute arbitrary code via (1) the asf_read_header function in the ASF plugin (plugins/asfextractor.c), and (2) the parse_trak_atom function in the QT plugin (plugins/qtextractor.c).


definition_id: oval:org.debian:def:240876912286473347657989359258006817866
title: CVE-2006-2465 mp3info
description:
Buffer overflow in MP3Info 0.8.4 allows attackers to execute arbitrary code via a long command line argument.  NOTE: if mp3info is not installed setuid or setgid in any reasonable context, then this issue might not be a vulnerability.


definition_id: oval:org.debian:def:325681537158543617588113797202047062339
title: CVE-2006-2480 dia
description:
Format string vulnerability in Dia 0.94 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering errors or warnings, as demonstrated via format string specifiers in a .bmp filename.  NOTE: the original exploit was demonstrated through a command line argument, but there are other mechanisms for input that are automatically processed by Dia, such as a crafted .dia file.


definition_id: oval:org.debian:def:119487204439367035023159298833301643363
title: CVE-2006-2575 netpanzer
description:
The setFrame function in Lib/2D/Surface.hpp for NetPanzer 0.8 and earlier allows remote attackers to cause a denial of service (crash) via a client flag (frameNum) that is greater than 41, which triggers an assert error.


definition_id: oval:org.debian:def:228022433589607180171873988671582326336
title: CVE-2006-2607 cron
description:
do_command.c in Vixie cron (vixie-cron) 4.1 does not check the return code of a setuid call, which might allow local users to gain root privileges if setuid fails in cases such as PAM failures or resource limits, as originally demonstrated by a program that exceeds the process limits as defined in /etc/security/limits.conf.


definition_id: oval:org.debian:def:183368930808551194619396155155879363256
title: CVE-2006-2644 awstats
description:
AWStats 6.5, and possibly other versions, allows remote authenticated users to execute arbitrary code by using the configdir parameter to awstats.pl to upload a configuration file whose name contains shell metacharacters, then access that file using the LogFile directive.


definition_id: oval:org.debian:def:237428511245083117993959241382338669932
title: CVE-2006-2656 tiff
description:
Stack-based buffer overflow in the tiffsplit command in libtiff 3.8.2 and earlier might might allow attackers to execute arbitrary code via a long filename.  NOTE: tiffsplit is not setuid.  If there is not a common scenario under which tiffsplit is called with attacker-controlled command line arguments, then perhaps this issue should not be included in CVE.


definition_id: oval:org.debian:def:336983116596306276832075522773237997153
title: CVE-2006-2658 xsp
description:
Directory traversal vulnerability in the xsp component in mod_mono in Mono/C# web server, as used in SUSE Open-Enterprise-Server 1 and SUSE Linux 9.2 through 10.0, allows remote attackers to read arbitrary files via a .. (dot dot) sequence in an HTTP request.


definition_id: oval:org.debian:def:276572048084200174375628445398798879270
title: CVE-2006-2659 courier
description:
libs/comverp.c in Courier MTA before 0.53.2 allows attackers to cause a denial of service (CPU consumption) via unknown vectors involving usernames that contain the "=" (equals) character, which is not properly handled during encoding.


definition_id: oval:org.debian:def:89467991222218854713442974046661564335
title: CVE-2006-2661 freetype
description:
ftutil.c in Freetype before 2.2 allows remote attackers to cause a denial of service (crash) via a crafted font file that triggers a null dereference.


definition_id: oval:org.debian:def:41360023763833910543451617413257132318
title: CVE-2006-2667 wordpress
description:
Direct static code injection vulnerability in WordPress 2.0.2 and earlier allows remote attackers to execute arbitrary commands by inserting a carriage return and PHP code when updating a profile, which is appended after a special comment sequence into files in (1) wp-content/cache/userlogins/ (2) wp-content/cache/users/ which are later included by cache.php, as demonstrated using the displayname argument.


definition_id: oval:org.debian:def:203380268477305401312625947412399666043
title: CVE-2006-2691 amule
description:
Unspecified "information leakage" vulnerabilities in aMuleWeb for AMule before 2.1.2 allow remote attackers to access arbitrary images, including dynamically generated images, via unknown vectors.


definition_id: oval:org.debian:def:312684516119222266448187233290303918331
title: CVE-2006-2692 amule
description:
Multiple unspecified vulnerabilities in aMuleWeb for AMule before 2.1.2 allow remote attackers to read arbitrary image, HTML, or PHP files via unknown vectors, probably related to directory traversal.


definition_id: oval:org.debian:def:58411278397919708100736352698931167839
title: CVE-2006-2702 wordpress
description:
vars.php in WordPress 2.0.2, possibly when running on Mac OS X, allows remote attackers to spoof their IP address via a PC_REMOTE_ADDR HTTP header, which vars.php uses to redefine $_SERVER['REMOTE_ADDR'].


definition_id: oval:org.debian:def:149905358709943926349291255030761581500
title: CVE-2006-2723 firefox-esr
description:
Unspecified versions of Mozilla Firefox allow remote attackers to cause a denial of service (crash) via a web page that contains a large number of nested marquee tags.  NOTE: a followup post indicated that the initial report could not be verified.


definition_id: oval:org.debian:def:81221909615114007772261782987644792990
title: CVE-2006-2769 snort
description:
The HTTP Inspect preprocessor (http_inspect) in Snort 2.4.0 through 2.4.4 allows remote attackers to bypass "uricontent" rules via a carriage return (\r) after the URL and before the HTTP declaration.


definition_id: oval:org.debian:def:60953547874755580397804002189397463623
title: CVE-2006-2775 thunderbird
description:
Mozilla Firefox and Thunderbird before 1.5.0.4 associates XUL attributes with the wrong URL under certain unspecified circumstances, which might allow remote attackers to bypass restrictions by causing a persisted string to be associated with the wrong URL.


definition_id: oval:org.debian:def:66734224101706418855185198632270525817
title: CVE-2006-2776 thunderbird
description:
Certain privileged UI code in Mozilla Firefox and Thunderbird before 1.5.0.4 calls content-defined setters on an object prototype, which allows remote attackers to execute code at a higher privilege than intended.


definition_id: oval:org.debian:def:120230860256142525289521054434131775277
title: CVE-2006-2778 thunderbird
description:
The crypto.signText function in Mozilla Firefox and Thunderbird before 1.5.0.4 allows remote attackers to execute arbitrary code via certain optional Certificate Authority name arguments, which causes an invalid array index and triggers a buffer overflow.


definition_id: oval:org.debian:def:244168982080206156129994789674502836074
title: CVE-2006-2779 thunderbird
description:
Mozilla Firefox and Thunderbird before 1.5.0.4 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) nested <option> tags in a select tag, (2) a DOMNodeRemoved mutation event, (3) "Content-implemented tree views," (4) BoxObjects, (5) the XBL implementation, (6) an iframe that attempts to remove itself, which leads to memory corruption.


definition_id: oval:org.debian:def:19450418230691745987996979052420506422
title: CVE-2006-2780 thunderbird
description:
Integer overflow in Mozilla Firefox and Thunderbird before 1.5.0.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via "jsstr tagify," which leads to memory corruption.


definition_id: oval:org.debian:def:321174501609117181542171562625318567912
title: CVE-2006-2781 thunderbird
description:
Double free vulnerability in nsVCard.cpp in Mozilla Thunderbird before 1.5.0.4 and SeaMonkey before 1.0.2 allows remote attackers to cause a denial of service (hang) and possibly execute arbitrary code via a VCard that contains invalid base64 characters.


definition_id: oval:org.debian:def:178213305800206940837463326030050700817
title: CVE-2006-2783 qt4-x11
description:
Mozilla Firefox and Thunderbird before 1.5.0.4 strip the Unicode Byte-order-Mark (BOM) from a UTF-8 page before the page is passed to the parser, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a BOM sequence in the middle of a dangerous tag such as SCRIPT.


definition_id: oval:org.debian:def:309575710517051697389929521783128518267
title: CVE-2006-2786 thunderbird
description:
HTTP response smuggling vulnerability in Mozilla Firefox and Thunderbird before 1.5.0.4, when used with certain proxy servers, allows remote attackers to cause Firefox to interpret certain responses as if they were responses from two different sites via (1) invalid HTTP response headers with spaces between the header name and the colon, which might not be ignored in some cases, or (2) HTTP 1.1 headers through an HTTP 1.0 proxy, which are ignored by the proxy but processed by the client.


definition_id: oval:org.debian:def:8446339001751447612343482339530520620
title: CVE-2006-2787 thunderbird
description:
EvalInSandbox in Mozilla Firefox and Thunderbird before 1.5.0.4 allows remote attackers to gain privileges via javascript that calls the valueOf method on objects that were created outside of the sandbox.


definition_id: oval:org.debian:def:4081548796885767656167157111332005687
title: CVE-2006-2789 evolution
description:
Evolution 2.2.x and 2.3.x in GNOME 2.7 and 2.8, when "load images if sender in addressbook" is enabled, allows remote attackers to cause a denial of service (persistent crash) via a crafted "From" header that triggers an assert error in camel-internet-address.c when a null pointer is used.


definition_id: oval:org.debian:def:320060198638704695875630876898290279724
title: CVE-2006-2875 ioquake3
description:
Stack-based buffer overflow in the CL_ParseDownload function of Quake 3 Engine 1.32c and earlier, as used in multiple products, allows remote attackers to execute arbitrary code via a svc_download command with compressed data that triggers the overflow during expansion.


definition_id: oval:org.debian:def:5325969701842273546917962151265534097
title: CVE-2006-2878 dokuwiki
description:
The spellchecker (spellcheck.php) in DokuWiki 2006/06/04 and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly syntax" that is inserted into a regular expression that is processed by preg_replace with the /e (executable) modifier.


definition_id: oval:org.debian:def:52025656851365373325525559404757757244
title: CVE-2006-2898 asterisk
description:
The IAX2 channel driver (chan_iax2) for Asterisk 1.2.x before 1.2.9 and 1.0.x before 1.0.11 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via truncated IAX 2 (IAX2) video frames, which bypasses a length check and leads to a buffer overflow involving negative length check.  NOTE: the vendor advisory claims that only a DoS is possible, but the original researcher is reliable.


definition_id: oval:org.debian:def:286835350549702077660677006695903464017
title: CVE-2006-2906 libgd2
description:
The LZW decoding in the gdImageCreateFromGifPtr function in the Thomas Boutell graphics draw (GD) library (aka libgd) 2.0.33 allows remote attackers to cause a denial of service (CPU consumption) via malformed GIF data that causes an infinite loop.


definition_id: oval:org.debian:def:129583102189949591600686113611355857317
title: CVE-2006-2920 sylpheed
description:
Sylpheed-Claws before 2.2.2 and Sylpheed before 2.2.6 allow remote attackers to bypass the URI check functionality and makes it easier to conduct phishing attacks via a URI that begins with a space character.


definition_id: oval:org.debian:def:215876286467667030421992408751075131222
title: CVE-2006-2937 openssl
description:
OpenSSL 0.9.7 before 0.9.7l and 0.9.8 before 0.9.8d allows remote attackers to cause a denial of service (infinite loop and memory consumption) via malformed ASN.1 structures that trigger an improperly handled error condition.


definition_id: oval:org.debian:def:299524697816880048219334877050331906260
title: CVE-2006-2940 openssl
description:
OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows attackers to cause a denial of service (CPU consumption) via parasitic public keys with large (1) "public exponent" or (2) "public modulus" values in X.509 certificates that require extra time to process when using RSA signature verification.


definition_id: oval:org.debian:def:161381190632113763368805725528375507323
title: CVE-2006-2945 dokuwiki
description:
Unspecified vulnerability in the user profile change functionality in DokuWiki, when Access Control Lists are enabled, allows remote authenticated users to read unauthorized files via unknown attack vectors.


definition_id: oval:org.debian:def:76965631798427673579130617228054169342
title: CVE-2006-3082 gnupg2
description:
parse-packet.c in GnuPG (gpg) 1.4.3 and 1.9.20, and earlier versions, allows remote attackers to cause a denial of service (gpg crash) and possibly overwrite memory via a message packet with a large length (long user ID string), which could lead to an integer overflow, as demonstrated using the --no-armor option.


definition_id: oval:org.debian:def:214827654348651428840082744351754269224
title: CVE-2006-3083 krb5
description:
The (1) krshd and (2) v4rcp applications in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, when running on Linux and AIX, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which allows local users to gain privileges by causing setuid to fail to drop privileges using attacks such as resource exhaustion.


definition_id: oval:org.debian:def:262769232472701075227228324087487094653
title: CVE-2006-3084 krb5
description:
The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to gain privileges by causing setuid to fail to drop privileges.  NOTE: as of 20060808, it is not known whether an exploitable attack scenario exists for these issues.


definition_id: oval:org.debian:def:107352196562085173756751644967922312533
title: CVE-2006-3113 thunderbird
description:
Mozilla Firefox 1.5 before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via simultaneous XPCOM events, which causes a timer object to be deleted in a way that triggers memory corruption.


definition_id: oval:org.debian:def:336555982366199335094264639133715342978
title: CVE-2006-3119 fbi
description:
The fbgs framebuffer Postscript/PDF viewer in fbi before 2.01 has a typo that prevents a filter from working correctly, which allows user-assisted attackers to bypass the filter and execute malicious Postscript commands.


definition_id: oval:org.debian:def:23052142082307210345438872432243538910
title: CVE-2006-3121 heartbeat
description:
The peel_netstring function in cl_netstring.c in the heartbeat subsystem in High-Availability Linux before 1.2.5, and 2.0 before 2.0.7, allows remote attackers to cause a denial of service (crash) via the length parameter in a heartbeat message.


definition_id: oval:org.debian:def:220157634347091036398672398484332868873
title: CVE-2006-3124 streamripper
description:
Buffer overflow in the HTTP header parsing in Streamripper before 1.61.26 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted HTTP headers.


definition_id: oval:org.debian:def:223185272303862855558605944935712078115
title: CVE-2006-3126 capi4hylafax
description:
c2faxrecv in capi4hylafax 01.02.03 allows remote attackers to execute arbitrary commands via null (\0) and shell metacharacters in the TSI string, as demonstrated by a fax from an anonymous number.


definition_id: oval:org.debian:def:281662757724561082970742320123734260786
title: CVE-2006-3178 chmlib
description:
Directory traversal vulnerability in extract_chmLib example program in CHM Lib (chmlib) before 0.38 allows remote attackers to overwrite arbitrary files via a CHM archive containing files with a .. (dot dot) in their filename.


definition_id: oval:org.debian:def:262624383511811046818851242802670833431
title: CVE-2006-3242 mutt
description:
Stack-based buffer overflow in the browse_get_namespace function in imap/browse.c of Mutt 1.4.2.1 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via long namespaces received from the IMAP server.


definition_id: oval:org.debian:def:111839753500506245351949736982744931841
title: CVE-2006-3251 hashcash
description:
Heap-based buffer overflow in the array_push function in hashcash.c for Hashcash before 1.21 might allow attackers to execute arbitrary code via crafted entries.


definition_id: oval:org.debian:def:305836394644523342650079058843596902546
title: CVE-2006-3324 ioquake3
description:
The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake 3 Engine (ioquake3) before revision 804 allows remote attackers to overwrite arbitrary files in the quake3 directory (fs_homepath cvar) via a long string of filenames, as contained in the neededpaks buffer.


definition_id: oval:org.debian:def:121847831019122213619507073425536095113
title: CVE-2006-3325 ioquake3
description:
client/cl_parse.c in the id3 Quake 3 Engine 1.32c and the Icculus Quake 3 Engine (ioquake3) revision 810 and earlier allows remote malicious servers to overwrite arbitrary write-protected cvars variables on the client, such as cl_allowdownload for Automatic Downloading and fs_homepath for the quake3 path, via a string of cvar names and values sent from the server.  NOTE: this can be combined with another vulnerability to overwrite arbitrary files.


definition_id: oval:org.debian:def:94263300484220702061134067312617929540
title: CVE-2006-3355 mpg123
description:
Heap-based buffer overflow in httpdget.c in mpg123 before 0.59s-rll allows remote attackers to execute arbitrary code via a long URL, which is not properly terminated before being used with the strncpy function.  NOTE: This appears to be the result of an incomplete patch for CVE-2004-0982.


definition_id: oval:org.debian:def:208178317099220799454207407223697267693
title: CVE-2006-3376 libwmf
description:
Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file.


definition_id: oval:org.debian:def:292141756540272471026938162269190440631
title: CVE-2006-3378 shadow
description:
passwd command in shadow in Ubuntu 5.04 through 6.06 LTS, when called with the -f, -g, or -s flag, does not check the return code of a setuid call, which might allow local users to gain root privileges if setuid fails in cases such as PAM failures or resource limits.


definition_id: oval:org.debian:def:215467227002830515726939822644381217728
title: CVE-2006-3379 hiki
description:
Algorithmic complexity vulnerability in Hiki Wiki 0.6.0 through 0.6.5 and 0.8.0 through 0.8.5 allows remote attackers to cause a denial of service (CPU consumption) by performing a diff between large, crafted pages that trigger the worst case.


definition_id: oval:org.debian:def:218302417257447028270836972450381048119
title: CVE-2006-3389 wordpress
description:
index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information, such as SQL table prefixes, via an invalid paged parameter, which displays the information in an SQL error message.  NOTE: this issue has been disputed by a third party who states that the issue does not leak any target-specific information.


definition_id: oval:org.debian:def:231608796298484277960250440695853780559
title: CVE-2006-3390 wordpress
description:
WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-admin, (2) wp-content, and (3) wp-includes directories, possibly due to uninitialized variables.


definition_id: oval:org.debian:def:48655887814795911335261717476781996980
title: CVE-2006-3403 samba
description:
The smdb daemon (smbd/service.c) in Samba 3.0.1 through 3.0.22 allows remote attackers to cause a denial of service (memory consumption) via a large number of share connection requests.


definition_id: oval:org.debian:def:181676042737057004984901860408139550163
title: CVE-2006-3404 gimp
description:
Buffer overflow in the xcf_load_vector function in app/xcf/xcf-load.c for gimp before 2.2.12 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via an XCF file with a large num_axes value in the VECTORS property.


definition_id: oval:org.debian:def:191292274584438353963369746673324732123
title: CVE-2006-3407 tor
description:
Tor before 0.1.1.20 allows remote attackers to spoof log entries or possibly execute shell code via strings with non-printable characters.


definition_id: oval:org.debian:def:46368057604381939082950798695986822948
title: CVE-2006-3408 tor
description:
Unspecified vulnerability in the directory server (dirserver) in Tor before 0.1.1.20 allows remote attackers to cause an unspecified denial of service via unknown vectors.


definition_id: oval:org.debian:def:298199662343566476133470650681333309103
title: CVE-2006-3409 tor
description:
Integer overflow in Tor before 0.1.1.20 allows remote attackers to execute arbitrary code via crafted large inputs, which result in a buffer overflow when elements are added to smartlists.


definition_id: oval:org.debian:def:27782659800596629811854313787658797671
title: CVE-2006-3410 tor
description:
Tor before 0.1.1.20 creates "internal circuits" primarily consisting of nodes with "useful exit nodes," which allows remote attackers to conduct unspecified statistical attacks.


definition_id: oval:org.debian:def:184734034928619019740081359981962957024
title: CVE-2006-3411 tor
description:
TLS handshakes in Tor before 0.1.1.20 generate public-private keys based on TLS context rather than the connection, which makes it easier for remote attackers to conduct brute force attacks on the encryption keys.


definition_id: oval:org.debian:def:328211323094807420352044100419247896914
title: CVE-2006-3412 tor
description:
Tor before 0.1.1.20 does not sufficiently obey certain firewall options, which allows remote attackers to bypass intended access restrictions for dirservers, direct connections, or proxy servers.


definition_id: oval:org.debian:def:146401931562429661777699613821545662851
title: CVE-2006-3413 tor
description:
The privoxy configuration file in Tor before 0.1.1.20, when run on Apple OS X, logs all data via the "logfile", which allows attackers to obtain potentially sensitive information.


definition_id: oval:org.debian:def:113321484449472990970298937557184341109
title: CVE-2006-3414 tor
description:
Tor before 0.1.1.20 supports server descriptors that contain hostnames instead of IP addresses, which allows remote attackers to arbitrarily group users by providing preferential address resolution.


definition_id: oval:org.debian:def:262686834048689567829421616176683287638
title: CVE-2006-3415 tor
description:
Tor before 0.1.1.20 uses improper logic to validate the "OR" destination, which allows remote attackers to perform a man-in-the-middle (MITM) attack via unspecified vectors.


definition_id: oval:org.debian:def:260475429636589356967048472671067768592
title: CVE-2006-3416 tor
description:
** DISPUTED **  Tor before 0.1.1.20 kills the circuit when it receives an unrecognized relay command, which causes network circuits to be disbanded.  NOTE: while this item is listed under the "Security fixes" section of the developer changelog, the developer clarified on 20060707 that this is only a self-DoS.  Therefore this issue should not be included in CVE.


definition_id: oval:org.debian:def:200562377284985959661448377755765083733
title: CVE-2006-3417 tor
description:
Tor client before 0.1.1.20 prefers entry points based on is_fast or is_stable flags, which could allow remote attackers to be preferred over nodes that are identified as more trustworthy "entry guard" (is_guard) systems by directory authorities.


definition_id: oval:org.debian:def:143222790142270668094446173530813237153
title: CVE-2006-3418 tor
description:
Tor before 0.1.1.20 does not validate that a server descriptor's fingerprint line matches its identity key, which allows remote attackers to spoof the fingerprint line, which might be trusted by users or other applications.


definition_id: oval:org.debian:def:207076068333367153474267847883089645728
title: CVE-2006-3419 tor
description:
Tor before 0.1.1.20 uses OpenSSL pseudo-random bytes (RAND_pseudo_bytes) instead of cryptographically strong RAND_bytes, and seeds the entropy value at start-up with 160-bit chunks without reseeding, which makes it easier for attackers to conduct brute force guessing attacks.


definition_id: oval:org.debian:def:49834498487319895133540149375432489266
title: CVE-2006-3459 tiff
description:
Multiple stack-based buffer overflows in the TIFF library (libtiff) before 3.8.2, as used in Adobe Reader 9.3.0 and other products, allow context-dependent attackers to execute arbitrary code or cause a denial of service via unspecified vectors, including a large tdir_count value in the TIFFFetchShortPair function in tif_dirread.c.


definition_id: oval:org.debian:def:204962294482620270643568406890955187904
title: CVE-2006-3460 tiff
description:
Heap-based buffer overflow in the JPEG decoder in the TIFF library (libtiff) before 3.8.2 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via an encoded JPEG stream that is longer than the scan line size (TiffScanLineSize).


definition_id: oval:org.debian:def:328535445103882033795141413704225164238
title: CVE-2006-3461 tiff
description:
Heap-based buffer overflow in the PixarLog decoder in the TIFF library (libtiff) before 3.8.2 might allow context-dependent attackers to execute arbitrary code via unknown vectors.


definition_id: oval:org.debian:def:168297719694061274298081571966067856925
title: CVE-2006-3462 tiff
description:
Heap-based buffer overflow in the NeXT RLE decoder in the TIFF library (libtiff) before 3.8.2 might allow context-dependent attackers to execute arbitrary code via unknown vectors involving decoding large RLE images.


definition_id: oval:org.debian:def:154739228998206298797217413087140930400
title: CVE-2006-3463 tiff
description:
The EstimateStripByteCounts function in TIFF library (libtiff) before 3.8.2 uses a 16-bit unsigned short when iterating over an unsigned 32-bit value, which allows context-dependent attackers to cause a denial of service via a large td_nstrips value, which triggers an infinite loop.


definition_id: oval:org.debian:def:136153303706695935545564866796459015516
title: CVE-2006-3464 tiff
description:
TIFF library (libtiff) before 3.8.2 allows context-dependent attackers to pass numeric range checks and possibly execute code, and trigger assert errors, via large offset values in a TIFF directory that lead to an integer overflow and other unspecified vectors involving "unchecked arithmetic operations".


definition_id: oval:org.debian:def:286383295932907257234562198471606505597
title: CVE-2006-3465 tiff
description:
Unspecified vulnerability in the custom tag support for the TIFF library (libtiff) before 3.8.2 allows remote attackers to cause a denial of service (instability or crash) and execute arbitrary code via unknown vectors.


definition_id: oval:org.debian:def:291528188624136621152895317744163409584
title: CVE-2006-3581 adplug
description:
Multiple stack-based buffer overflows in Audacious AdPlug 2.0 and earlier allow remote user-assisted attackers to execute arbitrary code via large (1) DTM and (2) S3M files.


definition_id: oval:org.debian:def:107763350874095787212178095104120957915
title: CVE-2006-3582 adplug
description:
Multiple heap-based buffer overflows in Audacious AdPlug 2.0 and earlier allow remote user-assisted attackers to execute arbitrary code via the size specified in the package header of (1) CFF, (2) MTK, (3) DMO, and (4) U6M files.


definition_id: oval:org.debian:def:299037001717666798892551392785518823893
title: CVE-2006-3627 wireshark
description:
Unspecified vulnerability in the GSM BSSMAP dissector in Wireshark (aka Ethereal) 0.10.11 to 0.99.0 allows remote attackers to cause a denial of service (crash) via unspecified vectors.


definition_id: oval:org.debian:def:325139632270471997297944912375489666779
title: CVE-2006-3628 wireshark
description:
Multiple format string vulnerabilities in Wireshark (aka Ethereal) 0.10.x to 0.99.0 allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) ANSI MAP, (2) Checkpoint FW-1, (3) MQ, (4) XML, and (5) NTP dissectors.


definition_id: oval:org.debian:def:79275547348051844780934380809041513980
title: CVE-2006-3629 wireshark
description:
Unspecified vulnerability in the MOUNT dissector in Wireshark (aka Ethereal) 0.9.4 to 0.99.0 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.


definition_id: oval:org.debian:def:120818478042498639203300591454756989268
title: CVE-2006-3630 wireshark
description:
Multiple off-by-one errors in Wireshark (aka Ethereal) 0.9.7 to 0.99.0 have unknown impact and remote attack vectors via the (1) NCP NMAS and (2) NDPS dissectors.


definition_id: oval:org.debian:def:129414862756687197173099078997355805567
title: CVE-2006-3631 wireshark
description:
Unspecified vulnerability in the SSH dissector in Wireshark (aka Ethereal) 0.9.10 to 0.99.0 allows remote attackers to cause a denial of service (infinite loop) via unknown attack vectors.


definition_id: oval:org.debian:def:234894309994601918230713360122611208456
title: CVE-2006-3632 wireshark
description:
Buffer overflow in Wireshark (aka Ethereal) 0.8.16 to 0.99.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via the NFS dissector.


definition_id: oval:org.debian:def:134139241139333817537977847051316532417
title: CVE-2006-3636 mailman
description:
Multiple cross-site scripting (XSS) vulnerabilities in Mailman before 2.1.9rc1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:154521920965124624035025059598528356122
title: CVE-2006-3668 libdumb
description:
Heap-based buffer overflow in the it_read_envelope function in Dynamic Universal Music Bibliotheque (DUMB) 0.9.3 and earlier and current CVS as of 20060716, including libdumb, allows user-assisted attackers to execute arbitrary code via a ".it" (Impulse Tracker) file with an envelope with a large number of nodes.


definition_id: oval:org.debian:def:67121637418817978787776683376938839682
title: CVE-2006-3681 awstats
description:
Multiple cross-site scripting (XSS) vulnerabilities in awstats.pl in AWStats 6.5 build 1.857 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) refererpagesfilter, (2) refererpagesfilterex, (3) urlfilterex, (4) urlfilter, (5) hostfilter, or (6) hostfilterex parameters, a different set of vectors than CVE-2006-1945.


definition_id: oval:org.debian:def:35608438253830642936182816397414093130
title: CVE-2006-3682 awstats
description:
awstats.pl in AWStats 6.5 build 1.857 and earlier allows remote attackers to obtain the installation path via the (1) year, (2) pluginmode or (3) month parameters.


definition_id: oval:org.debian:def:236387620081216862394380931074212747657
title: CVE-2006-3695 trac
description:
Trac before 0.9.6 does not disable the "raw" or "include" commands when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows remote attackers to read arbitrary files, perform cross-site scripting (XSS) attacks, or cause a denial of service via unspecified vectors. NOTE: this might be related to CVE-2006-3458.


definition_id: oval:org.debian:def:23725875531872001922147971973870386745
title: CVE-2006-3738 openssl
description:
Buffer overflow in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions has unspecified impact and remote attack vectors involving a long list of ciphers.


definition_id: oval:org.debian:def:5363312160872544342821936579620298107
title: CVE-2006-3739 libxfont
description:
Integer overflow in the CIDAFM function in X.Org 6.8.2 and XFree86 X server allows local users to execute arbitrary code via crafted Adobe Font Metrics (AFM) files with a modified number of character metrics (StartCharMetrics), which leads to a heap-based buffer overflow.


definition_id: oval:org.debian:def:320089528845133038660293433929888179594
title: CVE-2006-3740 libxfont
description:
Integer overflow in the scan_cidfont function in X.Org 6.8.2 and XFree86 X server allows local users to execute arbitrary code via crafted (1) CMap and (2) CIDFont font data with modified item counts in the (a) begincodespacerange, (b) cidrange, and (c) notdefrange sections.


definition_id: oval:org.debian:def:9566569087366967534221952210127565012
title: CVE-2006-3743 graphicsmagick
description:
Multiple buffer overflows in ImageMagick before 6.2.9 allow user-assisted attackers to execute arbitrary code via crafted XCF images.


definition_id: oval:org.debian:def:64880912679673898411399225010718563427
title: CVE-2006-3744 graphicsmagick
description:
Multiple integer overflows in ImageMagick before 6.2.9 allows user-assisted attackers to execute arbitrary code via crafted Sun Rasterfile (bitmap) images that trigger heap-based buffer overflows.


definition_id: oval:org.debian:def:39384862221221848633807511493253829572
title: CVE-2006-3746 gnupg2
description:
Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message.


definition_id: oval:org.debian:def:258802665347034247897187142293226238839
title: CVE-2006-3747 apache2
description:
Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.


definition_id: oval:org.debian:def:285230179222938041614749447550284721564
title: CVE-2006-3801 thunderbird
description:
Mozilla Firefox 1.5 before 1.5.0.5 and SeaMonkey before 1.0.3 does not properly clear a JavaScript reference to a frame or window, which leaves a pointer to a deleted object that allows remote attackers to execute arbitrary native code.


definition_id: oval:org.debian:def:325758482954778234875505785014684501669
title: CVE-2006-3802 thunderbird
description:
Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to hijack native DOM methods from objects in another domain and conduct cross-site scripting (XSS) attacks using DOM methods of the top-level object.


definition_id: oval:org.debian:def:230685829727510772991982954430352609277
title: CVE-2006-3803 thunderbird
description:
Race condition in the JavaScript garbage collection in Mozilla Firefox 1.5 before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 might allow remote attackers to execute arbitrary code by causing the garbage collector to delete a temporary variable while it is still being used during the creation of a new Function object.


definition_id: oval:org.debian:def:279423248951295543594926648536044481738
title: CVE-2006-3804 thunderbird
description:
Heap-based buffer overflow in Mozilla Thunderbird before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to cause a denial of service (crash) via a VCard attachment with a malformed base64 field, which copies more data than expected due to an integer underflow.


definition_id: oval:org.debian:def:165161595193543388370449397309837264894
title: CVE-2006-3805 thunderbird
description:
The Javascript engine in Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 might allow remote attackers to execute arbitrary code via vectors involving garbage collection that causes deletion of a temporary object that is still being used.


definition_id: oval:org.debian:def:13641122716223033216633223799875086780
title: CVE-2006-3806 thunderbird
description:
Multiple integer overflows in the Javascript engine in Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 might allow remote attackers to execute arbitrary code via vectors involving (1) long strings in the toSource method of the Object, Array, and String objects; and (2) unspecified "string function arguments."


definition_id: oval:org.debian:def:219519013403067125881688389045901365405
title: CVE-2006-3807 thunderbird
description:
Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to execute arbitrary code via script that changes the standard Object() constructor to return a reference to a privileged object and calling "named JavaScript functions" that use the constructor.


definition_id: oval:org.debian:def:300933740032777765706338040654043394833
title: CVE-2006-3808 thunderbird
description:
Mozilla Firefox before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote Proxy AutoConfig (PAC) servers to execute code with elevated privileges via a PAC script that sets the FindProxyForURL function to an eval method on a privileged object.


definition_id: oval:org.debian:def:35047375153051400714660140382337844767
title: CVE-2006-3809 thunderbird
description:
Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows scripts with the UniversalBrowserRead privilege to gain UniversalXPConnect privileges and possibly execute code or obtain sensitive data by reading into a privileged context.


definition_id: oval:org.debian:def:33874009465613564167612678786209463610
title: CVE-2006-3810 thunderbird
description:
Cross-site scripting (XSS) vulnerability in Mozilla Firefox 1.5 before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the XPCNativeWrapper(window).Function construct.


definition_id: oval:org.debian:def:137898362073199202644584210778743811016
title: CVE-2006-3811 thunderbird
description:
Multiple vulnerabilities in Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via Javascript that leads to memory corruption, including (1) nsListControlFrame::FireMenuItemActiveEvent, (2) buffer overflows in the string class in out-of-memory conditions, (3) table row and column groups, (4) "anonymous box selectors outside of UA stylesheets," (5) stale references to "removed nodes," and (6) running the crypto.generateCRMFRequest callback on deleted context.


definition_id: oval:org.debian:def:181645388796191333620618581928245831749
title: CVE-2006-3812 thunderbird
description:
Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to reference remote files and possibly load chrome: URLs by tricking the user into copying or dragging links.


definition_id: oval:org.debian:def:241933981881587226678002324373941394060
title: CVE-2006-3815 heartbeat
description:
heartbeat.c in heartbeat before 2.0.6 sets insecure permissions in a shmget call for shared memory, which allows local users to cause an unspecified denial of service via unknown vectors, possibly during a short time window on startup.


definition_id: oval:org.debian:def:295210049261804376288024058255053870903
title: CVE-2006-3848 ipcalc
description:
Cross-site scripting (XSS) vulnerability in CGI wrapper for IP Calculator (IPCalc) 0.40 allows remote attackers to inject arbitrary web script or HTML via the URI (REQUEST_URI environment variable), which is used in the actionurl variable.


definition_id: oval:org.debian:def:226709711857388898636215551536075483313
title: CVE-2006-3913 freeciv
description:
Buffer overflow in Freeciv 2.1.0-beta1 and earlier, and SVN 15 Jul 2006 and earlier, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) negative chunk_length or a (2) large chunk->offset value in a PACKET_PLAYER_ATTRIBUTE_CHUNK packet in the generic_handle_player_attribute_chunk function in common/packets.c, and (3) a large packet->length value in the handle_unit_orders function in server/unithand.c.


definition_id: oval:org.debian:def:42055073292873783411195186979205009522
title: CVE-2006-3918 apache2
description:
http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.


definition_id: oval:org.debian:def:22925299449403510258645037788759967356
title: CVE-2006-4005 bomberclone
description:
BomberClone 0.11.6 and earlier allows remote attackers to cause a denial of service (daemon crash) via (1) a certain malformed PKGF_ackreq packet, which triggers a crash in the rscache_add() function in pkgcache.c; and (2) an error packet, which is intended to be received by clients and force client shutdown, but also triggers server shutdown.


definition_id: oval:org.debian:def:190440021841109602113539765785450091362
title: CVE-2006-4006 bomberclone
description:
The do_gameinfo function in BomberClone 0.11.6 and earlier, and possibly other functions, does not reset the packet data size, which causes the send_pkg function (packets.c) to use this data size when sending a reply, and allows remote attackers to read portions of server memory.


definition_id: oval:org.debian:def:238688740704720485345829858525994876783
title: CVE-2006-4018 clamav
description:
Heap-based buffer overflow in the pefromupx function in libclamav/upx.c in Clam AntiVirus (ClamAV) 0.81 through 0.88.3 allows remote attackers to execute arbitrary code via a crafted UPX packed file containing sections with large rsize values.


definition_id: oval:org.debian:def:188554333246747222534555549308013029818
title: CVE-2006-4028 wordpress
description:
Multiple unspecified vulnerabilities in WordPress before 2.0.4 have unknown impact and remote attack vectors.  NOTE: due to lack of details, it is not clear how these issues are different from CVE-2006-3389 and CVE-2006-3390, although it is likely that 2.0.4 addresses an unspecified issue related to "Anyone can register" functionality (user registration for guests).


definition_id: oval:org.debian:def:14721381982722628924414447476800486074
title: CVE-2006-4046 ocp
description:
Multiple stack-based buffer overflows in Open Cubic Player 2.6.0pre6 and earlier for Windows, and 0.1.10_rc5 and earlier on Linux/BSD, allow remote attackers to execute arbitrary code via (1) a large .S3M file handled by the mpLoadS3M function, (2) a crafted .IT file handled by the itplayerclass::module::load function, (3) a crafted .ULT file handled by the mpLoadULT function, or (4) a crafted .AMS file handled by the mpLoadAMS function.


definition_id: oval:org.debian:def:291423209060204774548928631570180755485
title: CVE-2006-4067 cakephp
description:
Cross-site scripting (XSS) vulnerability in cake/libs/error.php in CakePHP before 1.1.7.3363 allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected back in a 404 ("Not Found") error page.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:322877833661274606180529741006968912381
title: CVE-2006-4089 alsaplayer
description:
Multiple buffer overflows in Andy Lo-A-Foe AlsaPlayer 0.99.76 and earlier allow remote attackers to cause a denial of service (application crash), or have other unknown impact, via (1) a long Location field sent by a web server, which triggers an overflow in the reconnect function in reader/http/http.c; (2) a long URL sent by a web server when AlsaPlayer is seeking a media file for the playlist, which triggers overflows in new_list_item and CbUpdated in interface/gtk/PlaylistWindow.cpp; and (3) a long response sent by a CDDB server, which triggers an overflow in cddb_lookup in input/ccda/cdda_engine.c.


definition_id: oval:org.debian:def:264732437609995174669137464348229762057
title: CVE-2006-4095 bind9
description:
BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service (crash) via certain SIG queries, which cause an assertion failure when multiple RRsets are returned.


definition_id: oval:org.debian:def:295002002170011001793224169462714220904
title: CVE-2006-4096 bind9
description:
BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service (crash) via a flood of recursive queries, which cause an INSIST failure when the response is received after the recursion queue is empty.


definition_id: oval:org.debian:def:82869043573101693238231807509997222913
title: CVE-2006-4111 rails
description:
Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.


definition_id: oval:org.debian:def:323502255468439308985310415417864678188
title: CVE-2006-4112 rails
description:
Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby code via a URL that is not properly handled in the routing code, which leads to a denial of service (application hang) or "data loss," a different vulnerability than CVE-2006-4111.


definition_id: oval:org.debian:def:282549772100157853002767078917545936464
title: CVE-2006-4144 graphicsmagick
description:
Integer overflow in the ReadSGIImage function in sgi.c in ImageMagick before 6.2.9 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via large (1) bytes_per_pixel, (2) columns, and (3) rows values, which trigger a heap-based buffer overflow.


definition_id: oval:org.debian:def:241556378368099568561664768481384760698
title: CVE-2006-4146 gdb
description:
Buffer overflow in the (1) DWARF (dwarfread.c) and (2) DWARF2 (dwarf2read.c) debugging code in GNU Debugger (GDB) 6.5 allows user-assisted attackers, or restricted users, to execute arbitrary code via a crafted file with a location block (DW_FORM_block) that contains a large number of operations.


definition_id: oval:org.debian:def:233615996239020792417149553532528769766
title: CVE-2006-4168 libexif
description:
Integer overflow in the exif_data_load_data_entry function in libexif/exif-data.c in Libexif before 0.6.16 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via an image with many EXIF components, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:141907607767251018919342062225967819810
title: CVE-2006-4182 clamav
description:
Integer overflow in ClamAV 0.88.1 and 0.88.4, and other versions before 0.88.5, allows remote attackers to cause a denial of service (scanning service crash) and execute arbitrary code via a crafted Portable Executable (PE) file that leads to a heap-based buffer overflow when less memory is allocated than expected.


definition_id: oval:org.debian:def:137249097932728632289725405693216641684
title: CVE-2006-4192 libmodplug
description:
Multiple buffer overflows in MODPlug Tracker (OpenMPT) 1.17.02.43 and earlier and libmodplug 0.8 and earlier, as used in GStreamer and possibly other products, allow user-assisted remote attackers to execute arbitrary code via (1) long strings in ITP files used by the CSoundFile::ReadITProject function in soundlib/Load_it.cpp and (2) crafted modules used by the CSoundFile::ReadSample function in soundlib/Sndfile.cpp, as demonstrated by crafted AMF files.


definition_id: oval:org.debian:def:29020032485877332287803706641313404531
title: CVE-2006-4208 wordpress
description:
Directory traversal vulnerability in wp-db-backup.php in Skippy WP-DB-Backup plugin for WordPress 1.7 and earlier allows remote authenticated users with administrative privileges to read arbitrary files via a .. (dot dot) in the backup parameter to edit.php.


definition_id: oval:org.debian:def:73403748930946809629304420994015105207
title: CVE-2006-4244 sql-ledger
description:
SQL-Ledger 2.4.4 through 2.6.17 authenticates users by verifying that the value of the sql-ledger-[username] cookie matches the value of the sessionid parameter, which allows remote attackers to gain access as any logged-in user by setting the cookie and the parameter to the same value.


definition_id: oval:org.debian:def:112051242448737951350295242411195696593
title: CVE-2006-4250 man-db
description:
Buffer overflow in man and mandb (man-db) 2.4.3 and earlier allows local users to execute arbitrary code via crafted arguments to the -H flag.


definition_id: oval:org.debian:def:136447513375374117650838906816676766333
title: CVE-2006-4251 pdns
description:
Buffer overflow in PowerDNS Recursor 3.1.3 and earlier might allow remote attackers to execute arbitrary code via a malformed TCP DNS query that prevents Recursor from properly calculating the TCP DNS query length.


definition_id: oval:org.debian:def:169010052825022424586288345266914364973
title: CVE-2006-4252 pdns-recursor
description:
PowerDNS Recursor 3.1.3 and earlier allows remote attackers to cause a denial of service (resource exhaustion and application crash) via a CNAME record with a zero TTL, which triggers an infinite loop.


definition_id: oval:org.debian:def:183700420581963993296964300988610936628
title: CVE-2006-4253 thunderbird
description:
Concurrency vulnerability in Mozilla Firefox 1.5.0.6 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via multiple Javascript timed events that load a deeply nested XML file, followed by redirecting the browser to another page, which leads to a concurrency failure that causes structures to be freed incorrectly, as demonstrated by (1) ffoxdie and (2) ffoxdie3.  NOTE: it has been reported that Netscape 8.1 and K-Meleon 1.0.1 are also affected by ffoxdie.  Mozilla confirmed to CVE that ffoxdie and ffoxdie3 trigger the same underlying vulnerability.  NOTE: it was later reported that Firefox 2.0 RC2 and 1.5.0.7 are also affected.


definition_id: oval:org.debian:def:145833087716976153670548678628220498366
title: CVE-2006-4262 cscope
description:
Multiple buffer overflows in cscope 15.5 and earlier allow user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via multiple vectors including (1) a long pathname that is not properly handled during file list parsing, (2) long pathnames that result from path variable expansion such as tilde expansion for the HOME environment variable, and (3) a long -f (aka reffile) command line argument.


definition_id: oval:org.debian:def:110580956697881873885246711619062043463
title: CVE-2006-4310 firefox-esr
description:
Mozilla Firefox 1.5.0.6 allows remote attackers to cause a denial of service (crash) via a crafted FTP response, when attempting to connect with a username and password via the FTP URI.


definition_id: oval:org.debian:def:1255353152520145660197147298766026890
title: CVE-2006-4330 wireshark
description:
Unspecified vulnerability in the SCSI dissector in Wireshark (formerly Ethereal) 0.99.2 allows remote attackers to cause a denial of service (crash) via unspecified vectors.


definition_id: oval:org.debian:def:162956662724579864929317785107775339132
title: CVE-2006-4331 wireshark
description:
Multiple off-by-one errors in the IPSec ESP preference parser in Wireshark (formerly Ethereal) 0.99.2 allow remote attackers to cause a denial of service (crash) via unspecified vectors.


definition_id: oval:org.debian:def:230015248591334511855318506415014292851
title: CVE-2006-4333 wireshark
description:
The SSCOP dissector in Wireshark (formerly Ethereal) before 0.99.3 allows remote attackers to cause a denial of service (resource consumption) via malformed packets that cause the Q.2391 dissector to use excessive memory.


definition_id: oval:org.debian:def:332520065919137024880161028156231306567
title: CVE-2006-4334 gzip
description:
Unspecified vulnerability in gzip 1.3.5 allows context-dependent attackers to cause a denial of service (crash) via a crafted GZIP (gz) archive, which results in a NULL dereference.


definition_id: oval:org.debian:def:264545166987839617099521420606443390303
title: CVE-2006-4335 gzip
description:
Array index error in the make_table function in unlzh.c in the LZH decompression component in gzip 1.3.5, when running on certain platforms, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted GZIP archive that triggers an out-of-bounds write, aka a "stack modification vulnerability."


definition_id: oval:org.debian:def:225528936410206753638613928871468344586
title: CVE-2006-4336 gzip
description:
Buffer underflow in the build_tree function in unpack.c in gzip 1.3.5 allows context-dependent attackers to execute arbitrary code via a crafted leaf count table that causes a write to a negative index.


definition_id: oval:org.debian:def:288016502398698862950653409773111357806
title: CVE-2006-4337 gzip
description:
Buffer overflow in the make_table function in the LHZ component in gzip 1.3.5 allows context-dependent attackers to execute arbitrary code via a crafted decoding table in a GZIP archive.


definition_id: oval:org.debian:def:189083386313533890153328495996359609459
title: CVE-2006-4338 gzip
description:
unlzh.c in the LHZ component in gzip 1.3.5 allows context-dependent attackers to cause a denial of service (infinite loop) via a crafted GZIP archive.


definition_id: oval:org.debian:def:107321897440400064165024113885672807677
title: CVE-2006-4339 openssl
description:
OpenSSL before 0.9.7, 0.9.7 before 0.9.7k, and 0.9.8 before 0.9.8c, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents OpenSSL from correctly verifying X.509 and other certificates that use PKCS #1.


definition_id: oval:org.debian:def:42469214523945273772530995325140771248
title: CVE-2006-4340 thunderbird
description:
Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, and SeaMonkey before 1.0.5, when using an RSA key with exponent 3, does not properly handle extra data in a signature, which allows remote attackers to forge signatures for SSL/TLS and email certificates, a similar vulnerability to CVE-2006-4339.  NOTE: on 20061107, Mozilla released an advisory stating that these versions were not completely patched by MFSA2006-60. The newer fixes for 1.5.0.7 are covered by CVE-2006-5462.


definition_id: oval:org.debian:def:49025431676881959501850560928245975808
title: CVE-2006-4343 openssl
description:
The get_server_hello function in the SSLv2 client code in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows remote servers to cause a denial of service (client crash) via unknown vectors that trigger a null pointer dereference.


definition_id: oval:org.debian:def:151281199084203325946429585940756143456
title: CVE-2006-4345 asterisk
description:
Stack-based buffer overflow in channels/chan_mgcp.c in MGCP in Asterisk 1.0 through 1.2.10 allows remote attackers to execute arbitrary code via a crafted audit endpoint (AUEP) response.


definition_id: oval:org.debian:def:269339278407731715639650655662073169655
title: CVE-2006-4346 asterisk
description:
Asterisk 1.2.10 supports the use of client-controlled variables to determine filenames in the Record function, which allows remote attackers to (1) execute code via format string specifiers or (2) overwrite files via directory traversals involving unspecified vectors, as demonstrated by the CALLERIDNAME variable.


definition_id: oval:org.debian:def:4587618562656457952182064260612315645
title: CVE-2006-4434 sendmail
description:
Use-after-free vulnerability in Sendmail before 8.13.8 allows remote attackers to cause a denial of service (crash) via a long "header line", which causes a previously freed variable to be referenced. NOTE: the original developer has disputed the severity of this issue, saying "The only denial of service that is possible here is to fill up the disk with core dumps if the OS actually generates different core dumps (which is unlikely)... the bug is in the shutdown code (finis()) which leads directly to exit(3), i.e., the process would terminate anyway, no mail delivery or receiption is affected."


definition_id: oval:org.debian:def:255734338185305657800558123526619710310
title: CVE-2006-4436 isakmpd
description:
isakmpd in OpenBSD 3.8, 3.9, and possibly earlier versions, creates Security Associations (SA) with a replay window of size 0 when isakmpd acts as a responder during SA negotiation, which allows remote attackers to replay IPSec packets and bypass the replay protection.


definition_id: oval:org.debian:def:177222645216180173821773564755233395417
title: CVE-2006-4447 libx11
description:
X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit.


definition_id: oval:org.debian:def:208633334684604232063858755396143013905
title: CVE-2006-4484 libgd2
description:
Buffer overflow in the LWZReadByte_ function in ext/gd/libgd/gd_gif_in.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which triggers an overflow when initializing the table array.


definition_id: oval:org.debian:def:184004043591697398153477702283843239806
title: CVE-2006-4508 tor
description:
Unspecified vulnerability in (1) Tor 0.1.0.x before 0.1.0.18 and 0.1.1.x before 0.1.1.23, and (2) ScatterChat before 1.0.2, allows remote attackers operating a Tor entry node to route arbitrary Tor traffic through clients or cause a denial of service (flood) via unspecified vectors.


definition_id: oval:org.debian:def:285285448847530436071689868517316984209
title: CVE-2006-4513 abiword
description:
Multiple integer overflows in the WV library in wvWare (formerly mswordview) before 1.2.3, as used by AbiWord, KWord, and possibly other products, allow user-assisted remote attackers to execute arbitrary code via a crafted Microsoft Word (DOC) file that produces (1) large LFO clfolvl values in the wvGetLFO_records function or (2) a large LFO nolfo value in the wvGetFLO_PLF function.


definition_id: oval:org.debian:def:239590393481707332980145730630919328216
title: CVE-2006-4514 libgsf
description:
Heap-based buffer overflow in the ole_info_read_metabat function in Gnome Structured File library (libgsf) 1.14.0, and other versions before 1.14.2, allows context-dependent attackers to execute arbitrary code via a large num_metabat value in an OLE document, which causes the ole_init_info function to allocate insufficient memory.


definition_id: oval:org.debian:def:131600899809309826938969943398171122086
title: CVE-2006-4519 gimp
description:
Multiple integer overflows in the image loader plug-ins in GIMP before 2.2.16 allow user-assisted remote attackers to execute arbitrary code via crafted length values in (1) DICOM, (2) PNM, (3) PSD, (4) PSP, (5) Sun RAS, (6) XBM, and (7) XWD files.


definition_id: oval:org.debian:def:202885716351144360603470044599377153017
title: CVE-2006-4565 thunderbird
description:
Heap-based buffer overflow in Mozilla Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, and SeaMonkey before 1.0.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a JavaScript regular expression with a "minimal quantifier."


definition_id: oval:org.debian:def:27034435515485475741622787344057098198
title: CVE-2006-4566 thunderbird
description:
Mozilla Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, and SeaMonkey before 1.0.5 allows remote attackers to cause a denial of service (crash) via a malformed JavaScript regular expression that ends with a backslash in an unterminated character set ("[\\"), which leads to a buffer over-read.


definition_id: oval:org.debian:def:141763643439802534492690016541079607183
title: CVE-2006-4567 thunderbird
description:
Mozilla Firefox before 1.5.0.7 and Thunderbird before 1.5.0.7 makes it easy for users to accept self-signed certificates for the auto-update mechanism, which might allow remote user-assisted attackers to use DNS spoofing to trick users into visiting a malicious site and accepting a malicious certificate for the Mozilla update site, which can then be used to install arbitrary code on the next update.


definition_id: oval:org.debian:def:310875367946094297435912876141694430635
title: CVE-2006-4568 thunderbird
description:
Mozilla Firefox before 1.5.0.7 and SeaMonkey before 1.0.5 allows remote attackers to bypass the security model and inject content into the sub-frame of another site via targetWindow.frames[n].document.open(), which facilitates spoofing and other attacks.


definition_id: oval:org.debian:def:149593585727350799147793910050153395390
title: CVE-2006-4569 thunderbird
description:
The popup blocker in Mozilla Firefox before 1.5.0.7 opens the "blocked popups" display in the context of the Location bar instead of the subframe from which the popup originated, which might make it easier for remote user-assisted attackers to conduct cross-site scripting (XSS) attacks.


definition_id: oval:org.debian:def:1405991069237256699916566671542869930
title: CVE-2006-4570 thunderbird
description:
Mozilla Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5, with "Load Images" enabled, allows remote user-assisted attackers to bypass settings that disable JavaScript via a remote XBL file in a message that is loaded when the user views, forwards, or replies to the original message.


definition_id: oval:org.debian:def:86899209567657599531443861634308712055
title: CVE-2006-4571 thunderbird
description:
Multiple unspecified vulnerabilities in Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, and SeaMonkey before 1.0.5 allow remote attackers to cause a denial of service (crash), corrupt memory, and possibly execute arbitrary code via unspecified vectors, some of which involve JavaScript, and possibly large images or plugin data.


definition_id: oval:org.debian:def:246589659819085864238272816361959877532
title: CVE-2006-4573 screen
description:
Multiple unspecified vulnerabilities in the "utf8 combining characters handling" (utf8_handle_comb function in encoding.c) in screen before 4.0.3 allows user-assisted attackers to cause a denial of service (crash or hang) via certain UTF8 sequences.


definition_id: oval:org.debian:def:200714968909065380159306743055460966137
title: CVE-2006-4574 wireshark
description:
Off-by-one error in the MIME Multipart dissector in Wireshark (formerly Ethereal) 0.10.1 through 0.99.3 allows remote attackers to cause a denial of service (crash) via certain vectors that trigger an assertion error related to unexpected length values.


definition_id: oval:org.debian:def:16149864042957805432221429561561514059
title: CVE-2006-4624 mailman
description:
CRLF injection vulnerability in Utils.py in Mailman before 2.1.9rc1 allows remote attackers to spoof messages in the error log and possibly trick the administrator into visiting malicious URLs via CRLF sequences in the URI.


definition_id: oval:org.debian:def:162137673490161627210589967183071219454
title: CVE-2006-4674 dokuwiki
description:
Direct static code injection vulnerability in doku.php in DokuWiki before 2006-030-09c allows remote attackers to execute arbitrary PHP code via the X-FORWARDED-FOR HTTP header, which is stored in config.php.


definition_id: oval:org.debian:def:332893996812614176665388424720299091216
title: CVE-2006-4675 dokuwiki
description:
Unrestricted file upload vulnerability in lib/exe/media.php in DokuWiki before 2006-03-09c allows remote attackers to upload executable files into the data/media folder via unspecified vectors.


definition_id: oval:org.debian:def:232621183165070655628649021187747515006
title: CVE-2006-4679 dokuwiki
description:
DokuWiki before 2006-03-09c enables the debug feature by default, which allows remote attackers to obtain sensitive information by calling doku.php with the X-DOKUWIKI-DO HTTP header set to "debug".


definition_id: oval:org.debian:def:233784902467611703184313304473082463950
title: CVE-2006-4731 sql-ledger
description:
Multiple directory traversal vulnerabilities in (1) login.pl and (2) admin.pl in (a) SQL-Ledger before 2.6.19 and (b) LedgerSMB before 1.0.0p1 allow remote attackers to execute arbitrary Perl code via an unspecified terminal parameter value containing ../ (dot dot slash).


definition_id: oval:org.debian:def:254271442459549108106245282469482653457
title: CVE-2006-4743 wordpress
description:
WordPress 2.0.2 through 2.0.5 allows remote attackers to obtain sensitive information via a direct request for (1) 404.php, (2) akismet.php, (3) archive.php, (4) archives.php, (5) attachment.php, (6) blogger.php, (7) comments.php, (8) comments-popup.php, (9) dotclear.php, (10) footer.php, (11) functions.php, (12) header.php, (13) hello.php, (14) wp-content/themes/default/index.php, (15) links.php, (16) livejournal.php, (17) mt.php, (18) page.php, (19) rss.php, (20) searchform.php, (21) search.php, (22) sidebar.php, (23) single.php, (24) textpattern.php, (25) upgrade-functions.php, (26) upgrade-schema.php, or (27) wp-db-backup.php, which reveal the path in various error messages.  NOTE: another researcher has disputed the details of this report, stating that version 2.0.5 does not exist. NOTE: the admin-footer.php, admin-functions.php, default-filters.php, edit-form-advanced.php, edit-link-form.php, edit-page-form.php, kses.php, locale.php, rss-functions.php, template-loader.php, and wp-db.php vectors are already covered by CVE-2006-0986. The edit-form-comment.php, vars.php, and wp-settings.php vectors are already covered by CVE-2005-4463. The menu-header.php vector is already covered by CVE-2005-2110.


definition_id: oval:org.debian:def:178065199466888510477275398140496924001
title: CVE-2006-4798 sql-ledger
description:
SQL-Ledger before 2.4.4 stores a password in a query string, which might allow context-dependent attackers to obtain the password via a Referer field or browser history.


definition_id: oval:org.debian:def:137033725002139977582154636137600023866
title: CVE-2006-4800 ffmpeg
description:
Multiple buffer overflows in libavcodec in ffmpeg before 0.4.9_p20060530 allow remote attackers to cause a denial of service or possibly execute arbitrary code via multiple unspecified vectors in (1) dtsdec.c, (2) vorbis.c, (3) rm.c, (4) sierravmd.c, (5) smacker.c, (6) tta.c, (7) 4xm.c, (8) alac.c, (9) cook.c, (10) shorten.c, (11) smacker.c, (12) snow.c, and (13) tta.c.  NOTE: it is likely that this is a different vulnerability than CVE-2005-4048 and CVE-2006-2802.


definition_id: oval:org.debian:def:127427605573346975273746362134119335999
title: CVE-2006-4805 wireshark
description:
epan/dissectors/packet-xot.c in the XOT dissector (dissect_xot_pdu) in Wireshark (formerly Ethereal) 0.9.8 through 0.99.3 allows remote attackers to cause a denial of service (memory consumption and crash) via an encoded XOT packet that produces a zero length value when it is decoded.


definition_id: oval:org.debian:def:70199136823615671266463171598679565861
title: CVE-2006-4806 imlib2
description:
Multiple integer overflows in imlib2 allow user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) ARGB (loader_argb.c), (2) PNG (loader_png.c), (3) LBM (loader_lbm.c), (4) JPEG (loader_jpeg.c), or (5) TIFF (loader_tiff.c) images.


definition_id: oval:org.debian:def:296284914550478957790819219813183893513
title: CVE-2006-4807 imlib2
description:
loader_tga.c in imlib2 before 1.2.1, and possibly other versions, allows user-assisted remote attackers to cause a denial of service (crash) via a crafted TGA image that triggers an out-of-bounds memory read, a different issue than CVE-2006-4808.


definition_id: oval:org.debian:def:225917605582168190482996787986644422582
title: CVE-2006-4808 imlib2
description:
Heap-based buffer overflow in loader_tga.c in imlib2 before 1.2.1, and possibly other versions, allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TGA image.


definition_id: oval:org.debian:def:253032877030779726694305837390571173728
title: CVE-2006-4809 imlib2
description:
Stack-based buffer overflow in loader_pnm.c in imlib2 before 1.2.1, and possibly other versions, allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PNM image.


definition_id: oval:org.debian:def:62864216129397294174762184332916905452
title: CVE-2006-4810 texinfo
description:
Buffer overflow in the readline function in util/texindex.c, as used by the (1) texi2dvi and (2) texindex commands, in texinfo 4.8 and earlier allows local users to execute arbitrary code via a crafted Texinfo file.


definition_id: oval:org.debian:def:318061932297344079199955642340255521883
title: CVE-2006-4811 qt4-x11
description:
Integer overflow in Qt 3.3 before 3.3.7, 4.1 before 4.1.5, and 4.2 before 4.2.1, as used in the KDE khtml library, kdelibs 3.1.3, and possibly other packages, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted pixmap image.


definition_id: oval:org.debian:def:150554217324109215310751795304212158143
title: CVE-2006-4924 openssh
description:
sshd in OpenSSH before 4.4, when using the version 1 SSH protocol, allows remote attackers to cause a denial of service (CPU consumption) via an SSH packet that contains duplicate blocks, which is not properly handled by the CRC compensation attack detector.


definition_id: oval:org.debian:def:329274645424493921477050970305801125127
title: CVE-2006-4925 openssh
description:
packet.c in ssh in OpenSSH allows remote attackers to cause a denial of service (crash) by sending an invalid protocol sequence with USERAUTH_SUCCESS before NEWKEYS, which causes newkeys[mode] to be NULL.


definition_id: oval:org.debian:def:107797969271565292821332422154024586534
title: CVE-2006-4976 phppgadmin
description:
The Date Library in John Lim ADOdb Library for PHP allows remote attackers to obtain sensitive information via a direct request for (1) server.php, (2) adodb-errorpear.inc.php, (3) adodb-iterator.inc.php, (4) adodb-pear.inc.php, (5) adodb-perf.inc.php, (6) adodb-xmlschema.inc.php, and (7) adodb.inc.php; files in datadict including (8) datadict-access.inc.php, (9) datadict-db2.inc.php, (10) datadict-generic.inc.php, (11) datadict-ibase.inc.php, (12) datadict-informix.inc.php, (13) datadict-mssql.inc.php, (14) datadict-mysql.inc.php, (15) datadict-oci8.inc.php, (16) datadict-postgres.inc.php, and (17) datadict-sybase.inc.php; files in drivers/ including (18) adodb-access.inc.php, (19) adodb-ado.inc.php, (20) adodb-ado_access.inc.php, (21) adodb-ado_mssql.inc.php, (22) adodb-borland_ibase.inc.php, (23) adodb-csv.inc.php, (24) adodb-db2.inc.php, (25) adodb-fbsql.inc.php, (26) adodb-firebird.inc.php, (27) adodb-ibase.inc.php, (28) adodb-informix.inc.php, (29) adodb-informix72.inc.php, (30) adodb-mssql.inc.php, (31) adodb-mssqlpo.inc.php, (32) adodb-mysql.inc.php, (33) adodb-mysqli.inc.php, (34) adodb-mysqlt.inc.php, (35) adodb-oci8.inc.php, (36) adodb-oci805.inc.php, (37) adodb-oci8po.inc.php, (38) adodb-odbc.inc.php, (39) adodb-odbc_mssql.inc.php, (40) adodb-odbc_oracle.inc.php, (41) adodb-oracle.inc.php, (42) adodb-postgres64.inc.php, (43) adodb-postgres7.inc.php, (44) adodb-proxy.inc.php, (45) adodb-sapdb.inc.php, (46) adodb-sqlanywhere.inc.php, (47) adodb-sqlite.inc.php, (48) adodb-sybase.inc.php, (49) adodb-vfp.inc.php; file in perf/ including (50) perf-db2.inc.php, (51) perf-informix.inc.php, (52) perf-mssql.inc.php, (53) perf-mysql.inc.php, (54) perf-oci8.inc.php, (55) perf-postgres.inc.php; tests/ files (56) benchmark.php, (57) client.php, (58) test-datadict.php, (59) test-perf.php, (60) test-pgblob.php, (61) test-php5.php, (62) test-xmlschema.php, (63) test.php, (64) test2.php, (65) test3.php, (66) test4.php, (67) test5.php, (68) test_rs_array.php, (69) testcache.php, (70) testdatabases.inc.php, (71) testgenid.php, (72) testmssql.php, (73) testoci8.php, (74) testoci8cursor.php, (75) testpaging.php, (76) testpear.php, (77) testsessions.php, (78) time.php, or (79) tmssql.php, which reveals the path in various error messages.


definition_id: oval:org.debian:def:34116044390151298464465173140176367382
title: CVE-2006-5031 cakephp
description:
Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, followed by a filename ending with "%00" and a .js filename.


definition_id: oval:org.debian:def:247854449399090224014354011225556238860
title: CVE-2006-5051 openssh
description:
Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code if GSSAPI authentication is enabled, via unspecified vectors that lead to a double-free.


definition_id: oval:org.debian:def:180560719893941205455772302193715843073
title: CVE-2006-5052 openssh
description:
Unspecified vulnerability in portable OpenSSH before 4.4, when running on some platforms, allows remote attackers to determine the validity of usernames via unknown vectors involving a GSSAPI "authentication abort."


definition_id: oval:org.debian:def:326192812566259860460504433562093896331
title: CVE-2006-5072 mono
description:
The System.CodeDom.Compiler classes in Novell Mono create temporary files with insecure permissions, which allows local users to overwrite arbitrary files or execute arbitrary code via a symlink attack.


definition_id: oval:org.debian:def:174100468373081685359777270246980439953
title: CVE-2006-5098 dokuwiki
description:
lib/exec/fetch.php in DokuWiki before 2006-03-09e allows remote attackers to cause a denial of service (CPU consumption) via large w and h parameters, when resizing an image.


definition_id: oval:org.debian:def:113682012595245660378971276576051099049
title: CVE-2006-5099 dokuwiki
description:
lib/exec/fetch.php in DokuWiki before 2006-03-09e, when conf[imconvert] is configured to use ImageMagick, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) w and (2) h parameters, which are not filtered when invoking convert.


definition_id: oval:org.debian:def:56662251416477689832455240895670004517
title: CVE-2006-5111 libksba
description:
The libksba library 0.9.12 and possibly other versions, as used by gpgsm in the newpg package on SUSE LINUX, allows attackers to cause a denial of service (application crash) via a malformed X.509 certificate in a signature.


definition_id: oval:org.debian:def:76994821088608774212251367088194550954
title: CVE-2006-5170 libpam-ldap
description:
pam_ldap in nss_ldap on Red Hat Enterprise Linux 4, Fedora Core 3 and earlier, and possibly other distributions does not return an error condition when an LDAP directory server responds with a PasswordPolicyResponse control response, which causes the pam_authenticate function to return a success code even if authentication has failed, as originally reported for xscreensaver.


definition_id: oval:org.debian:def:310129050743332786421451283279971368009
title: CVE-2006-5214 xdm
description:
Race condition in the Xsession script, as used by X Display Manager (xdm) in NetBSD before 20060212, X.Org before 20060225, and Solaris 8 through 10 before 20061006, causes a user's Xsession errors file to have weak permissions before a chmod is performed, which allows local users to read Xsession errors files of other users.


definition_id: oval:org.debian:def:202326909270330773660799327975888195355
title: CVE-2006-5215 xdm
description:
The Xsession script, as used by X Display Manager (xdm) in NetBSD before 20060212, X.Org before 20060317, and Solaris 8 through 10 before 20061006, allows local users to overwrite arbitrary files, or read another user's Xsession errors file, via a symlink attack on a /tmp/xses-$USER file.


definition_id: oval:org.debian:def:327111487175230523533407530215874656834
title: CVE-2006-5295 clamav
description:
Unspecified vulnerability in ClamAV before 0.88.5 allows remote attackers to cause a denial of service (scanning service crash) via a crafted Compressed HTML Help (CHM) file that causes ClamAV to "read an invalid memory location."


definition_id: oval:org.debian:def:121275028185762927467741793889826648506
title: CVE-2006-5297 mutt
description:
Race condition in the safe_open function in the Mutt mail client 1.5.12 and earlier, when creating temporary files in an NFS filesystem, allows local users to overwrite arbitrary files due to limitations of the use of the O_EXCL flag on NFS filesystems.


definition_id: oval:org.debian:def:322124557404123616102919854124271476475
title: CVE-2006-5298 mutt
description:
The mutt_adv_mktemp function in the Mutt mail client 1.5.12 and earlier does not properly verify that temporary files have been created with restricted permissions, which might allow local users to create files with weak permissions via a race condition between the mktemp and safe_fopen function calls.


definition_id: oval:org.debian:def:257600210837950294365050279850059239676
title: CVE-2006-5379 nvidia-graphics-drivers
description:
The accelerated rendering functionality of NVIDIA Binary Graphics Driver (binary blob driver) For Linux v8774 and v8762, and probably on other operating systems, allows local and remote attackers to execute arbitrary code via a large width value in a font glyph, which can be used to overwrite arbitrary memory locations.


definition_id: oval:org.debian:def:133714293937840653316906563161124472478
title: CVE-2006-5397 libx11
description:
The Xinput module (modules/im/ximcp/imLcIm.c) in X.Org libX11 1.0.2 and 1.0.3 opens a file for reading twice using the same file descriptor, which causes a file descriptor leak that allows local users to read files specified by the XCOMPOSEFILE environment variable via the duplicate file descriptor.


definition_id: oval:org.debian:def:158418647301092310166246356334137427622
title: CVE-2006-5442 viewvc
description:
ViewVC 1.0.2 and earlier does not specify a charset in its HTTP headers or HTML documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks that inject arbitrary UTF-7 encoded JavaScript code via a view.


definition_id: oval:org.debian:def:103932259290092986523848099449951166116
title: CVE-2006-5443 wims
description:
Unspecified vulnerability in XIAO Gang WWW Interactive Mathematics Server (WIMS) before 3.60 allows remote attackers to modify unspecified data via unspecified vectors involving "variable rights."


definition_id: oval:org.debian:def:253411657277270271932331038096859501397
title: CVE-2006-5444 asterisk
description:
Integer overflow in the get_input function in the Skinny channel driver (chan_skinny.c) in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13, as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integer comparison and leads to a heap-based buffer overflow.


definition_id: oval:org.debian:def:150610330987405306619261261600409105952
title: CVE-2006-5445 asterisk
description:
Unspecified vulnerability in the SIP channel driver (channels/chan_sip.c) in Asterisk 1.2.x before 1.2.13 and 1.4.x before 1.4.0-beta3 allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors that result in the creation of "a real pvt structure" that uses more resources than necessary.


definition_id: oval:org.debian:def:60032275067815740038724315057473925145
title: CVE-2006-5456 graphicsmagick
description:
Multiple buffer overflows in GraphicsMagick before 1.1.7 and ImageMagick 6.0.7 allow user-assisted attackers to cause a denial of service and possibly execute arbitrary code via (1) a DCM image that is not properly handled by the ReadDCMImage function in coders/dcm.c, or (2) a PALM image that is not properly handled by the ReadPALMImage function in coders/palm.c.


definition_id: oval:org.debian:def:7911585488741368071330764223294093686
title: CVE-2006-5461 avahi
description:
Avahi before 0.6.15 does not verify the sender identity of netlink messages to ensure that they come from the kernel instead of another process, which allows local users to spoof network changes to Avahi.


definition_id: oval:org.debian:def:70764450513178937424655822849843552507
title: CVE-2006-5462 firefox-esr
description:
Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6, when using an RSA key with exponent 3, does not properly handle extra data in a signature, which allows remote attackers to forge signatures for SSL/TLS and email certificates. NOTE: this identifier is for unpatched product versions that were originally intended to be addressed by CVE-2006-4340.


definition_id: oval:org.debian:def:294756114292992962761090851099950349159
title: CVE-2006-5463 firefox-esr
description:
Unspecified vulnerability in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6 allows remote attackers to execute arbitrary JavaScript bytecode via unspecified vectors involving modification of a Script object while it is executing.


definition_id: oval:org.debian:def:82331698898660010268887765612098202527
title: CVE-2006-5464 firefox-esr
description:
Multiple unspecified vulnerabilities in the layout engine in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6 allow remote attackers to cause a denial of service (crash) via unspecified vectors.


definition_id: oval:org.debian:def:318391809479783217785114007660729924483
title: CVE-2006-5466 rpm
description:
Heap-based buffer overflow in the showQueryPackage function in librpm in RPM Package Manager 4.4.8, when the LANG environment variable is set to ru_RU.UTF-8, might allow user-assisted attackers to execute arbitrary code via crafted RPM packages.


definition_id: oval:org.debian:def:96181331677338541652922787121653182798
title: CVE-2006-5468 wireshark
description:
Unspecified vulnerability in the HTTP dissector in Wireshark (formerly Ethereal) 0.99.3 allows remote attackers to cause a denial of service (crash) via unspecified vectors.


definition_id: oval:org.debian:def:226289453161147541926073249881808505074
title: CVE-2006-5469 wireshark
description:
Unspecified vulnerability in the WBXML dissector in Wireshark (formerly Ethereal) 0.10.11 through 0.99.3 allows remote attackers to cause a denial of service (crash) via certain vectors that trigger a null dereference.


definition_id: oval:org.debian:def:82212893694411772549982853718702150041
title: CVE-2006-5595 wireshark
description:
Unspecified vulnerability in the AirPcap support in Wireshark (formerly Ethereal) 0.99.3 has unspecified attack vectors related to WEP key parsing.


definition_id: oval:org.debian:def:11937942810204309348136917508720913758
title: CVE-2006-5633 firefox-esr
description:
Firefox 1.5.0.7 and 2.0, and Seamonkey 1.1b, allows remote attackers to cause a denial of service (crash) by creating a range object using createRange, calling selectNode on a DocType node (DOCUMENT_TYPE_NODE), then calling createContextualFragment on the range, which triggers a null dereference.  NOTE: the original Bugtraq post mentioned that code execution was possible, but followup analysis has shown that it is only a null dereference.


definition_id: oval:org.debian:def:5130993244622587560507256549409834691
title: CVE-2006-5680 libarchive
description:
The libarchive library in FreeBSD 6-STABLE after 2006-09-05 and before 2006-11-08 allows context-dependent attackers to cause a denial of service (CPU consumption) via a malformed archive that causes libarchive to skip a region past the actual end of the archive, which triggers an infinite loop that attempts to read more data.


definition_id: oval:org.debian:def:167939375598982201040732284332590798213
title: CVE-2006-5705 wordpress
description:
Multiple directory traversal vulnerabilities in plugins/wp-db-backup.php in WordPress before 2.0.5 allow remote authenticated users to read or overwrite arbitrary files via directory traversal sequences in the (1) backup and (2) fragment parameters in a GET request.


definition_id: oval:org.debian:def:136691040971735214810615715935800130487
title: CVE-2006-5740 wireshark
description:
Unspecified vulnerability in the LDAP dissector in Wireshark (formerly Ethereal) 0.99.3 allows remote attackers to cause a denial of service (crash) via a crafted LDAP packet.


definition_id: oval:org.debian:def:330776027092292631196042014897249760709
title: CVE-2006-5747 firefox-esr
description:
Unspecified vulnerability in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6 allows remote attackers to execute arbitrary code via the XML.prototype.hasOwnProperty JavaScript function.


definition_id: oval:org.debian:def:182048909011608799688197113844911630846
title: CVE-2006-5748 firefox-esr
description:
Multiple unspecified vulnerabilities in the JavaScript engine in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors that trigger memory corruption.


definition_id: oval:org.debian:def:65998110573395398206923122453213985684
title: CVE-2006-5752 apache2
description:
Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform "charset detection" when the content-type is not specified.


definition_id: oval:org.debian:def:217664676299705371519894814347138718658
title: CVE-2006-5794 openssh
description:
Unspecified vulnerability in the sshd Privilege Separation Monitor in OpenSSH before 4.5 causes weaker verification that authentication has been successful, which might allow attackers to bypass authentication. NOTE: as of 20061108, it is believed that this issue is only exploitable by leveraging vulnerabilities in the unprivileged process, which are not known to exist.


definition_id: oval:org.debian:def:130330254233796655588260803913861988135
title: CVE-2006-5815 proftpd-dfsg
description:
Stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and earlier allows remote attackers, probably authenticated, to cause a denial of service and execute arbitrary code, as demonstrated by vd_proftpd.pm, a "ProFTPD remote exploit."


definition_id: oval:org.debian:def:72414170486908842796875771143523214300
title: CVE-2006-5864 evince
description:
Stack-based buffer overflow in the ps_gettext function in ps.c for GNU gv 3.6.2, and possibly earlier versions, allows user-assisted attackers to execute arbitrary code via a PostScript (PS) file with certain headers that contain long comments, as demonstrated using the (1) DocumentMedia, (2) DocumentPaperSizes, and possibly (3) PageMedia and (4) PaperSize headers.  NOTE: this issue can be exploited through other products that use gv such as evince.


definition_id: oval:org.debian:def:120288301099159400979292400998086516210
title: CVE-2006-5867 fetchmail
description:
fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle (MITM) attacks.


definition_id: oval:org.debian:def:7145967364244470595666897968253494792
title: CVE-2006-5868 imagemagick
description:
Multiple buffer overflows in Imagemagick 6.0 before 6.0.6.2, and 6.2 before 6.2.4.5, has unknown impact and user-assisted attack vectors via a crafted SGI image.


definition_id: oval:org.debian:def:170075282938683264593974051068918736415
title: CVE-2006-5872 sql-ledger
description:
login.pl in SQL-Ledger before 2.6.21 and LedgerSMB before 1.1.5 allows remote attackers to execute arbitrary Perl code via the "-e" flag in the script parameter, which is used as an argument to the perl program.


definition_id: oval:org.debian:def:307091304764244624116048083298690106671
title: CVE-2006-5874 clamav
description:
Clam AntiVirus (ClamAV) 0.88 and earlier allows remote attackers to cause a denial of service (crash) via a malformed base64-encoded MIME attachment that triggers a null pointer dereference.


definition_id: oval:org.debian:def:251839872211228839255323769328789925178
title: CVE-2006-5877 enigmail
description:
The enigmail extension before 0.94.2 does not properly handle large, encrypted file e-mail attachments, which allows remote attackers to cause a denial of service (crash), as demonstrated with Mozilla Thunderbird.


definition_id: oval:org.debian:def:243014173813982721678092345235055560230
title: CVE-2006-5878 trac
description:
Cross-site request forgery (CSRF) vulnerability in Edgewall Trac 0.10 and earlier allows remote attackers to perform unauthorized actions as other users via unknown vectors.


definition_id: oval:org.debian:def:61660902842318873738064000532293277358
title: CVE-2006-5925 elinks
description:
Links web browser 1.00pre12 and Elinks 0.9.2 with smbclient installed allows remote attackers to execute arbitrary code via shell metacharacters in an smb:// URI, as demonstrated by using PUT and GET statements.


definition_id: oval:org.debian:def:90724348094883233994191993437378393987
title: CVE-2006-5969 fvwm
description:
CRLF injection vulnerability in the evalFolderLine function in fvwm 2.5.18 and earlier allows local users to execute arbitrary commands via carriage returns in a directory name, which is not properly handled by fvwm-menu-directory, a variant of CVE-2003-1308.


definition_id: oval:org.debian:def:47930698227691710607237443510875438543
title: CVE-2006-5973 dovecot
description:
Off-by-one buffer overflow in Dovecot 1.0test53 through 1.0.rc14, and possibly other versions, when index files are used and mmap_disable is set to "yes," allows remote authenticated IMAP or POP3 users to cause a denial of service (crash) via unspecified vectors involving the cache file.


definition_id: oval:org.debian:def:336576540184763236846890613521183451396
title: CVE-2006-5974 fetchmail
description:
fetchmail 6.3.5 and 6.3.6 before 6.3.6-rc4, when refusing a message delivered via the mda option, allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger a NULL pointer dereference when calling the (1) ferror or (2) fflush functions.


definition_id: oval:org.debian:def:24033965973711769354423207407694188483
title: CVE-2006-5989 libapache-mod-auth-kerb
description:
Off-by-one error in the der_get_oid function in mod_auth_kerb 5.0 allows remote attackers to cause a denial of service (crash) via a crafted Kerberos message that triggers a heap-based buffer overflow in the component array.


definition_id: oval:org.debian:def:206467314687651387788891483526666142716
title: CVE-2006-6016 wordpress
description:
wp-admin/user-edit.php in WordPress before 2.0.5 allows remote authenticated users to read the metadata of an arbitrary user via a modified user_id parameter.


definition_id: oval:org.debian:def:100042133326196692838796258709080869102
title: CVE-2006-6017 wordpress
description:
WordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object, which allows remote authenticated users to cause a denial of service (application crash) via a string that represents a (1) malformed or (2) large serialized object, because the object triggers automatic unserialization for display.


definition_id: oval:org.debian:def:2902656766125282116754838156198404118
title: CVE-2006-6085 kile
description:
Kile before 1.9.3 does not assign a backup file the same permissions as the original file, which might allow local users to obtain sensitive information.


definition_id: oval:org.debian:def:324690737949586589916424435330209623889
title: CVE-2006-6097 tar
description:
GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTYPE_NAMES record with a symbolic link, which is not properly handled by the extract_archive function in extract.c and extract_mangle function in mangle.c, a variant of CVE-2002-1216.


definition_id: oval:org.debian:def:205510191992204442464778028943183288756
title: CVE-2006-6101 xorg-server
description:
Integer overflow in the ProcRenderAddGlyphs function in the Render extension for X.Org 6.8.2, 6.9.0, 7.0, and 7.1, and XFree86 X server, allows local users to execute arbitrary code via a crafted X protocol request that triggers memory corruption during processing of glyph management data structures.


definition_id: oval:org.debian:def:74197471292749253494904547437918182364
title: CVE-2006-6102 xorg-server
description:
Integer overflow in the ProcDbeGetVisualInfo function in the DBE extension for X.Org 6.8.2, 6.9.0, 7.0, and 7.1, and XFree86 X server, allows local users to execute arbitrary code via a crafted X protocol request that triggers memory corruption during processing of unspecified data structures.


definition_id: oval:org.debian:def:34926540601103213069784858268279349396
title: CVE-2006-6103 xorg-server
description:
Integer overflow in the ProcDbeSwapBuffers function in the DBE extension for X.Org 6.8.2, 6.9.0, 7.0, and 7.1, and XFree86 X server, allows local users to execute arbitrary code via a crafted X protocol request that triggers memory corruption during processing of unspecified data structures.


definition_id: oval:org.debian:def:303550341398746407303016955907725430344
title: CVE-2006-6104 mono
description:
The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read source code by appending a space (%20) to a URI, and (2) read credentials via a request for Web.Config%20.


definition_id: oval:org.debian:def:209387465906935681279149906115970866128
title: CVE-2006-6107 dbus
description:
Unspecified vulnerability in the match_rule_equal function in bus/signals.c in D-Bus before 1.0.2 allows local applications to remove match rules for other applications and cause a denial of service (lost process messages).


definition_id: oval:org.debian:def:50451250243681531586664424077392466444
title: CVE-2006-6122 tin
description:
Multiple buffer overflows in TIN before 1.8.2 have unspecified impact and attack vectors, a different vulnerability than CVE-2006-0804.


definition_id: oval:org.debian:def:273897822389973635689344879558531107114
title: CVE-2006-6143 krb5
description:
The RPC library in Kerberos 5 1.4 through 1.4.4, and 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, calls an uninitialized function pointer in freed memory, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.


definition_id: oval:org.debian:def:288320391238705413828202195856612797868
title: CVE-2006-6169 gnupg2
description:
Heap-based buffer overflow in the ask_outfile_name function in openfile.c for GnuPG (gpg) 1.4 and 2.0, when running interactively, might allow attackers to execute arbitrary code via messages with "C-escape" expansions, which cause the make_printable_string function to return a longer string than expected while constructing a prompt.


definition_id: oval:org.debian:def:322958907726758837232210856443338637211
title: CVE-2006-6170 proftpd-dfsg
description:
Buffer overflow in the tls_x509_name_oneline function in the mod_tls module, as used in ProFTPD 1.3.0a and earlier, and possibly other products, allows remote attackers to execute arbitrary code via a large data length argument, a different vulnerability than CVE-2006-5815.


definition_id: oval:org.debian:def:138785046352628382699560147533822819331
title: CVE-2006-6171 proftpd-dfsg
description:
** DISPUTED **  ProFTPD 1.3.0a and earlier does not properly set the buffer size limit when CommandBufferSize is specified in the configuration file, which leads to an off-by-two buffer underflow.  NOTE: in November 2006, the role of CommandBufferSize was originally associated with CVE-2006-5815, but this was an error stemming from a vague initial disclosure.  NOTE: ProFTPD developers dispute this issue, saying that the relevant memory location is overwritten by assignment before further use within the affected function, so this is not a vulnerability.


definition_id: oval:org.debian:def:70708413540663594284919667371706915136
title: CVE-2006-6172 mplayer
description:
Buffer overflow in the asmrp_eval function in the RealMedia RTSP stream handler (asmrp.c) for Real Media input plugin, as used in (1) xine/xine-lib, (2) MPlayer 1.0rc1 and earlier, and possibly others, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a rulebook with a large number of rulematches.


definition_id: oval:org.debian:def:137101640039716261227211547009269562666
title: CVE-2006-6174 tdiary
description:
Cross-site scripting (XSS) vulnerability in tDiary before 2.0.3 and 2.1.x before 2.1.4.20061126 allows remote attackers to inject arbitrary web script or HTML via the conf parameter in (1) tdiary.rb and (2) skel/conf.rhtml.


definition_id: oval:org.debian:def:241779189936623484861494834941601663084
title: CVE-2006-6235 gnupg2
description:
A "stack overwrite" vulnerability in GnuPG (gpg) 1.x before 1.4.6, 2.x before 2.0.2, and 1.9.0 through 1.9.95 allows attackers to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to dereference a function pointer from deallocated stack memory.


definition_id: oval:org.debian:def:317180505477609237016555600084326396557
title: CVE-2006-6406 clamav
description:
Clam AntiVirus (ClamAV) 0.88.6 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.


definition_id: oval:org.debian:def:282035883088847432413347573988670309460
title: CVE-2006-6481 clamav
description:
Clam AntiVirus (ClamAV) 0.88.6 allows remote attackers to cause a denial of service (stack overflow and application crash) by wrapping many layers of multipart/mixed content around a document, a different vulnerability than CVE-2006-5874 and CVE-2006-6406.


definition_id: oval:org.debian:def:259833629848342984904488612478005808587
title: CVE-2006-6497 firefox-esr
description:
Multiple unspecified vulnerabilities in the layout engine for Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 allow remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via unknown attack vectors.


definition_id: oval:org.debian:def:70529887108298130644121824789799378246
title: CVE-2006-6498 firefox-esr
description:
Multiple unspecified vulnerabilities in the JavaScript engine for Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, SeaMonkey before 1.0.7, and Mozilla 1.7 and probably earlier on Solaris, allow remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via unknown impact and attack vectors.


definition_id: oval:org.debian:def:148519383343414365191618839353919639068
title: CVE-2006-6499 firefox-esr
description:
The js_dtoa function in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 overwrites memory instead of exiting when the floating point precision is reduced, which allows remote attackers to cause a denial of service via any plugins that reduce the precision.


definition_id: oval:org.debian:def:51876037724004027386196703259738084221
title: CVE-2006-6501 firefox-esr
description:
Unspecified vulnerability in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to gain privileges and install malicious code via the watch Javascript function.


definition_id: oval:org.debian:def:26688761862732667466304110344287777556
title: CVE-2006-6502 firefox-esr
description:
Use-after-free vulnerability in the LiveConnect bridge code for Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to cause a denial of service (crash) via unknown vectors.


definition_id: oval:org.debian:def:332394979386321283277231607488333729987
title: CVE-2006-6503 firefox-esr
description:
Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to bypass cross-site scripting (XSS) protection by changing the src attribute of an IMG element to a javascript: URI.


definition_id: oval:org.debian:def:267479334511924696566057036568190598659
title: CVE-2006-6504 firefox-esr
description:
Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to execute arbitrary code by appending an SVG comment DOM node to another type of document, which triggers memory corruption.


definition_id: oval:org.debian:def:44196515858878178534600206078962956544
title: CVE-2006-6563 proftpd-dfsg
description:
Stack-based buffer overflow in the pr_ctrls_recv_request function in ctrls.c in the mod_ctrls module in ProFTPD before 1.3.1rc1 allows local users to execute arbitrary code via a large reqarglen length value.


definition_id: oval:org.debian:def:187797222257552374974273176817914867320
title: CVE-2006-6585 firefox-esr
description:
The Extensions manager in Mozilla Firefox 2.0 does not properly populate the list of local extensions, which allows attackers to construct an extension that hides itself by finding its name in the list and then calling RemoveElement, as demonstrated by the FFsniFF extension.  NOTE: it was later reported that 3.0 is also affected.


definition_id: oval:org.debian:def:311986642498174759404691772910792681910
title: CVE-2006-6609 nexuiz
description:
Nexuiz before 2.2.1 allows remote attackers to cause a denial of service (resource exhaustion or crash) via unspecified vectors related to "fake players." NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:87258073570634478168234976895953665121
title: CVE-2006-6610 nexuiz
description:
clientcommands in Nexuiz before 2.2.1 has unknown impact and remote attack vectors related to "remote console command injection."


definition_id: oval:org.debian:def:138151928141002801994981867959227895918
title: CVE-2006-6614 fai
description:
The save_log_local function in Fully Automatic Installation (FAI) 2.10.1, and possibly 3.1.2, when verbose mode is enabled, stores the root password hash in /var/log/fai/current/fai.log, whose file permissions allow it to be copied to other hosts when fai-savelog is called and allows attackers to obtain the hash.


definition_id: oval:org.debian:def:244549103083098489702991545342154617421
title: CVE-2006-6678 netrik
description:
The edit_textarea function in form-file.c in Netrik 1.15.4 and earlier does not properly verify temporary filenames when editing textarea fields, which allows attackers to execute arbitrary commands via shell metacharacters in the filename.


definition_id: oval:org.debian:def:320059926056691461404365202407701315789
title: CVE-2006-6692 zabbix
description:
Multiple format string vulnerabilities in zabbix before 20061006 allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in information that would be recorded in the system log using (1) zabbix_log or (2) zabbix_syslog.


definition_id: oval:org.debian:def:211225632686995087964210101482288908581
title: CVE-2006-6693 zabbix
description:
Multiple buffer overflows in zabbix before 20061006 allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code via long strings to the (1) zabbix_log and (2) zabbix_syslog functions.


definition_id: oval:org.debian:def:226143437229812491991685243879110848825
title: CVE-2006-6719 wget
description:
The ftp_syst function in ftp-basic.c in Free Software Foundation (FSF) GNU wget 1.10.2 allows remote attackers to cause a denial of service (application crash) via a malicious FTP server with a large number of blank 220 responses to the SYST command.


definition_id: oval:org.debian:def:296483074833072641069344300231405227484
title: CVE-2006-6772 w3m
description:
Format string vulnerability in the inputAnswer function in file.c in w3m before 0.5.2, when run with the dump or backend option, allows remote attackers to execute arbitrary code via format string specifiers in the Common Name (CN) field of an SSL certificate associated with an https URL.


definition_id: oval:org.debian:def:291790637022255560555737560310875262482
title: CVE-2006-6799 cacti
description:
SQL injection vulnerability in Cacti 0.8.6i and earlier, when register_argc_argv is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) second or (2) third arguments to cmd.php.  NOTE: this issue can be leveraged to execute arbitrary commands since the SQL query results are later used in the polling_items array and popen function.


definition_id: oval:org.debian:def:132773490235647778903996444947510542710
title: CVE-2006-6808 wordpress
description:
Cross-site scripting (XSS) vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter.  NOTE: some sources have reported this as a vulnerability in the get_file_description function in wp-admin/admin-functions.php.


definition_id: oval:org.debian:def:163839653689413513098630603395719156751
title: CVE-2006-6852 tdiary
description:
Eval injection vulnerability in tDiary 2.0.3 and 2.1.4.200 61127 allows remote authenticated users to execute arbitrary Ruby code via unspecified vectors, possibly related to incorrect input validation by (1) conf.rhtml and (2) i.conf.rhtml.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:154559588100724687219136085280813874146
title: CVE-2006-6870 avahi
description:
The consume_labels function in avahi-core/dns.c in Avahi before 0.6.16 allows remote attackers to cause a denial of service (infinite loop) via a crafted compressed DNS response with a label that points to itself.


definition_id: oval:org.debian:def:175994554011743439209613095313970739178
title: CVE-2006-6931 snort
description:
Algorithmic complexity vulnerability in Snort before 2.6.1, during predicate evaluation in rule matching for certain rules, allows remote attackers to cause a denial of service (CPU consumption and detection outage) via crafted network traffic, aka a "backtracking attack."


definition_id: oval:org.debian:def:187038152951959550232810016143116846845
title: CVE-2006-6939 ed
description:
GNU ed before 0.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files, possibly in the open_sbuf function.


definition_id: oval:org.debian:def:99050158240238596460075181383669017370
title: CVE-2006-6965 dokuwiki
description:
CRLF injection vulnerability in lib/exe/fetch.php in DokuWiki 2006-03-09e, and possibly earlier, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the media parameter.  NOTE: this issue can be leveraged for XSS attacks.


definition_id: oval:org.debian:def:271011625410891807326655905715600128288
title: CVE-2006-7108 util-linux
description:
login in util-linux-2.12a skips pam_acct_mgmt and chauth_tok when authentication is skipped, such as when a Kerberos krlogin session has been established, which might allow users to bypass intended access policies that would be enforced by pam_acct_mgmt and chauth_tok.


definition_id: oval:org.debian:def:144643696115978346167623676844229564381
title: CVE-2006-7162 putty
description:
PuTTY 0.59 and earlier uses weak file permissions for (1) ppk files containing private keys generated by puttygen and (2) session logs created by putty, which allows local users to gain sensitive information by reading these files.


definition_id: oval:org.debian:def:48058918783700769565056620103219165216
title: CVE-2006-7221 gftp
description:
Multiple off-by-one errors in fsplib.c in fsplib before 0.8 allow attackers to cause a denial of service via unspecified vectors involving the (1) name and (2) d_name entry attributes.


definition_id: oval:org.debian:def:330146899231534198317096450126139428062
title: CVE-2006-7225 glib2.0
description:
Perl-Compatible Regular Expression (PCRE) library before 6.7 allows context-dependent attackers to cause a denial of service (error or crash) via a regular expression that involves a "malformed POSIX character class", as demonstrated via an invalid character after a [[ sequence.


definition_id: oval:org.debian:def:6115662683862698822244429157934983243
title: CVE-2006-7226 glib2.0
description:
Perl-Compatible Regular Expression (PCRE) library before 6.7 does not properly calculate the compiled memory allocation for regular expressions that involve a quantified "subpattern containing a named recursion or subroutine reference," which allows context-dependent attackers to cause a denial of service (error or crash).


definition_id: oval:org.debian:def:65968703421452648761143722703699513063
title: CVE-2006-7230 pcre3
description:
Perl-Compatible Regular Expression (PCRE) library before 7.0 does not properly calculate the amount of memory needed for a compiled regular expression pattern when the (1) -x or (2) -i UTF-8 options change within the pattern, which allows context-dependent attackers to cause a denial of service (PCRE or glibc crash) via crafted regular expressions.


definition_id: oval:org.debian:def:286996035203841684145793370333102804827
title: CVE-2006-7236 xterm
description:
The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attackers to execute arbitrary code or have unspecified other impact via escape sequences.


definition_id: oval:org.debian:def:127293561298832746565329131711967508787
title: CVE-2006-7240 gnome-power-manager
description:
gnome-power-manager 2.14.0 does not properly implement the lock_on_suspend and lock_on_hibernate settings for locking the screen when the suspend or hibernate button is pressed, which might make it easier for physically proximate attackers to access an unattended laptop via a resume action, a related issue to CVE-2010-2532.


definition_id: oval:org.debian:def:179167060861182976209208403448530326449
title: CVE-2006-7246 network-manager
description:
NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.11X authentication is used.


definition_id: oval:org.debian:def:263814857179301277363443568349260608269
title: CVE-2006-7250 openssl
description:
The mime_hdr_cmp function in crypto/asn1/asn_mime.c in OpenSSL 0.9.8t and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted S/MIME message.


definition_id: oval:org.debian:def:287106227071219520036127492065346355565
title: CVE-2006-7254 glibc
description:
The nscd daemon in the GNU C Library (glibc) before version 2.5 does not close incoming client sockets if they cannot be handled by the daemon, allowing local users to carry out a denial of service attack on the daemon.


definition_id: oval:org.debian:def:141705313308927008489715668828177791514
title: CVE-2007-0002 libwpd
description:
Multiple heap-based buffer overflows in WordPerfect Document importer/exporter (libwpd) before 0.8.9 allow user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted WordPerfect file in which values to loop counters are not properly handled in the (1) WP3TablesGroup::_readContents and (2) WP5DefinitionGroup_DefineTablesSubGroup::WP5DefinitionGroup_DefineTablesSubGroup functions.  NOTE: the integer overflow has been split into CVE-2007-1466.


definition_id: oval:org.debian:def:197397340057337863611524859224596034932
title: CVE-2007-0007 gnucash
description:
gnucash 2.0.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on the (1) gnucash.trace, (2) qof.trace, and (3) qof.trace.[PID] temporary files.


definition_id: oval:org.debian:def:100169555798103136986465187899375022789
title: CVE-2007-0010 gtk+2.0
description:
The GdkPixbufLoader function in GIMP ToolKit (GTK+) in GTK 2 (gtk2) before 2.4.13 allows context-dependent attackers to cause a denial of service (crash) via a malformed image file.


definition_id: oval:org.debian:def:334250129836014360997241696735294125806
title: CVE-2007-0017 vlc
description:
Multiple format string vulnerabilities in (1) the cdio_log_handler function in modules/access/cdda/access.c in the CDDA (libcdda_plugin) plugin, and the (2) cdio_log_handler and (3) vcd_log_handler functions in modules/access/vcdx/access.c in the VCDX (libvcdx_plugin) plugin, in VideoLAN VLC 0.7.0 through 0.8.6 allow user-assisted remote attackers to execute arbitrary code via format string specifiers in an invalid URI, as demonstrated by a udp://-- URI in an M3U file.


definition_id: oval:org.debian:def:250176503274247071348148225101890407220
title: CVE-2007-0104 poppler
description:
The Adobe PDF specification 1.3, as implemented by (a) xpdf 3.0.1 patch 2, (b) kpdf in KDE before 3.5.5, (c) poppler before 0.5.4, and other products, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.


definition_id: oval:org.debian:def:12586085135194623756445495122733354766
title: CVE-2007-0106 wordpress
description:
Cross-site scripting (XSS) vulnerability in the CSRF protection scheme in WordPress before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via a CSRF attack with an invalid token and quote characters or HTML tags in URL variable names, which are not properly handled when WordPress generates a new link to verify the request.


definition_id: oval:org.debian:def:304986622782542595360477817353652037845
title: CVE-2007-0107 wordpress
description:
WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets, as demonstrated using UTF-7.


definition_id: oval:org.debian:def:334946583678162383579449301456293240212
title: CVE-2007-0109 wordpress
description:
wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks.


definition_id: oval:org.debian:def:22649728134970231633148232745937411355
title: CVE-2007-0159 geoip
description:
Directory traversal vulnerability in the GeoIP_update_database_general function in libGeoIP/GeoIPUpdate.c in GeoIP 1.4.0 allows remote malicious update servers (possibly only update.maxmind.com) to overwrite arbitrary files via a .. (dot dot) in the database filename, which is returned by a request to app/update_getfilename.


definition_id: oval:org.debian:def:254326573949411800352928747275824593362
title: CVE-2007-0177 mediawiki
description:
Cross-site scripting (XSS) vulnerability in the AJAX module in MediaWiki before 1.6.9, 1.7 before 1.7.2, 1.8 before 1.8.3, and 1.9 before 1.9.0rc2, when wgUseAjax is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:109907320233416716795463336441535921712
title: CVE-2007-0233 wordpress
description:
wp-trackback.php in WordPress 2.0.6 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary SQL commands via the tb_id parameter.  NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in WordPress.


definition_id: oval:org.debian:def:224620617118930353227484842109375743863
title: CVE-2007-0235 libgtop2
description:
Stack-based buffer overflow in the glibtop_get_proc_map_s function in libgtop before 2.14.6 (libgtop2) allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a process with a long filename that is mapped in its address space, which triggers the overflow in gnome-system-monitor.


definition_id: oval:org.debian:def:38842813614394974608950231200889464318
title: CVE-2007-0237 lookup-el
description:
The ndeb-binary feature in Lookup (lookup-el) allows local users to overwrite arbitrary files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:89108162095533229059721231679448787359
title: CVE-2007-0242 qt4-x11
description:
The UTF-8 decoder in codecs/qutfcodec.cpp in Qt 3.3.8 and 4.2.3 does not reject long UTF-8 sequences as required by the standard, which allows remote attackers to conduct cross-site scripting (XSS) and directory traversal attacks via long sequences that decode to dangerous metacharacters.


definition_id: oval:org.debian:def:202241805903456632957666098487937054973
title: CVE-2007-0244 pptpd
description:
pptpgre.c in PoPToP Point to Point Tunneling Server (pptpd) before 1.3.4 allows remote attackers to cause a denial of service (PPTP connection tear-down) via (1) GRE packets with out-of-order sequence numbers or (2) certain GRE packets that are processed using a wrong pointer and improperly dequeued.


definition_id: oval:org.debian:def:182358929891101399236154398715046927317
title: CVE-2007-0247 squid
description:
squid/src/ftp.c in Squid before 2.6.STABLE7 allows remote FTP servers to cause a denial of service (core dump) via crafted FTP directory listing responses, possibly related to the (1) ftpListingFinish and (2) ftpHtmlifyListEntry functions.


definition_id: oval:org.debian:def:198910802534879885887332045336416769390
title: CVE-2007-0248 squid
description:
The aclMatchExternal function in Squid before 2.6.STABLE7 allows remote attackers to cause a denial of service (crash) by causing an external_acl queue overload, which triggers an infinite loop.


definition_id: oval:org.debian:def:97208672746437837614229184830381832941
title: CVE-2007-0254 xine-ui
description:
Format string vulnerability in the errors_create_window function in errors.c in xine-ui allows attackers to execute arbitrary code via unknown vectors.


definition_id: oval:org.debian:def:82182295147444212929490328992489571653
title: CVE-2007-0256 vlc
description:
VideoLAN VLC 0.8.6a allows remote attackers to cause a denial of service (application crash) via a crafted .wmv file.


definition_id: oval:org.debian:def:149543739784835914527952363588895948737
title: CVE-2007-0262 wordpress
description:
WordPress 2.0.6, and 2.1Alpha 3 (SVN:4662), does not properly verify that the m parameter value has the string data type, which allows remote attackers to obtain sensitive information via an invalid m[] parameter, as demonstrated by obtaining the path, and obtaining certain SQL information such as the table prefix.


definition_id: oval:org.debian:def:82865191153239650926673223349257193438
title: CVE-2007-0313 gosa
description:
Unspecified vulnerability in GONICUS System Administration (GOsa) before 2.5.8 allows remote authenticated users to modify certain settings, including the admin password, via crafted POST requests.


definition_id: oval:org.debian:def:173007719602695152616162407928007121852
title: CVE-2007-0317 filezilla
description:
Format string vulnerability in the LogMessage function in FileZilla before 3.0.0-beta5 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted arguments.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:294508419534159030823795391602183163932
title: CVE-2007-0404 python-django
description:
bin/compile-messages.py in Django 0.95 does not quote argument strings before invoking the msgfmt program through the os.system function, which allows attackers to execute arbitrary commands via shell metacharacters in a (1) .po or (2) .mo file.


definition_id: oval:org.debian:def:88171006242321998174749471645595838274
title: CVE-2007-0405 python-django
description:
The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remote authenticated users to gain the privileges of a different user.


definition_id: oval:org.debian:def:192324373607512282940093684194868076468
title: CVE-2007-0451 spamassassin
description:
Apache SpamAssassin before 3.1.8 allows remote attackers to cause a denial of service via long URLs in malformed HTML, which triggers "massive memory usage."


definition_id: oval:org.debian:def:219618556359940537844581349117539807613
title: CVE-2007-0452 samba
description:
smbd in Samba 3.0.6 through 3.0.23d allows remote authenticated users to cause a denial of service (memory and CPU exhaustion) by renaming a file in a way that prevents a request from being removed from the deferred open queue, which triggers an infinite loop.


definition_id: oval:org.debian:def:210233742782845931372500493191035911408
title: CVE-2007-0454 samba
description:
Format string vulnerability in the afsacl.so VFS module in Samba 3.0.6 through 3.0.23d allows context-dependent attackers to execute arbitrary code via format string specifiers in a filename on an AFS file system, which is not properly handled during Windows ACL mapping.


definition_id: oval:org.debian:def:138496538363355791513045981386519769690
title: CVE-2007-0455 libgd2
description:
Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted string with a JIS encoded font.


definition_id: oval:org.debian:def:101744166740616003688402692050782836130
title: CVE-2007-0456 wireshark
description:
Unspecified vulnerability in the LLT dissector in Wireshark (formerly Ethereal) 0.99.3 and 0.99.4 allows remote attackers to cause a denial of service (application crash) via unspecified vectors.


definition_id: oval:org.debian:def:16872983330281981267820905396007106421
title: CVE-2007-0457 wireshark
description:
Unspecified vulnerability in the IEEE 802.11 dissector in Wireshark (formerly Ethereal) 0.10.14 through 0.99.4 allows remote attackers to cause a denial of service (application crash) via unspecified vectors.


definition_id: oval:org.debian:def:41948891199022760645334032602565323390
title: CVE-2007-0458 wireshark
description:
Unspecified vulnerability in the HTTP dissector in Wireshark (formerly Ethereal) 0.99.3 and 0.99.4 allows remote attackers to cause a denial of service (application crash) via unspecified vectors, a different issue than CVE-2006-5468.


definition_id: oval:org.debian:def:140231117684359413914906741507116665287
title: CVE-2007-0459 wireshark
description:
packet-tcp.c in the TCP dissector in Wireshark (formerly Ethereal) 0.99.2 through 0.99.4 allows remote attackers to cause a denial of service (application crash or hang) via fragmented HTTP packets.


definition_id: oval:org.debian:def:46996160183784795472916138391201380805
title: CVE-2007-0472 smb4k
description:
Multiple race conditions in Smb4K before 0.8.0 allow local users to (1) modify arbitrary files via unspecified manipulations of Smb4K's lock file, which is not properly handled by the remove_lock_file function in core/smb4kfileio.cpp, and (2) add lines to the sudoers file via a symlink attack on temporary files, which isn't properly handled by the writeFile function in core/smb4kfileio.cpp.


definition_id: oval:org.debian:def:284707762096117940662486929774115101936
title: CVE-2007-0473 smb4k
description:
The writeFile function in core/smb4kfileio.cpp in Smb4K before 0.8.0 does not preserve /etc/sudoers permissions across modifications, which allows local users to obtain sensitive information (/etc/sudoers contents) by reading this file.


definition_id: oval:org.debian:def:314265693026921500424800169829086306953
title: CVE-2007-0474 smb4k
description:
Smb4K before 0.8.0 allow local users, when present on the Smb4K sudoers list, to kill arbitrary processes, related to a "design issue with smb4k_kill."


definition_id: oval:org.debian:def:286520923858086295482468950403319719564
title: CVE-2007-0475 smb4k
description:
Multiple stack-based buffer overflows in utilities/smb4k_*.cpp in Smb4K before 0.8.0 allow local users, when present on the Smb4K sudoers list, to gain privileges via unspecified vectors related to the args variable and unspecified other variables, in conjunction with the sudo configuration.


definition_id: oval:org.debian:def:178887618479683345671438374885089048419
title: CVE-2007-0494 bind9
description:
ISC BIND 9.0.x, 9.1.x, 9.2.0 up to 9.2.7, 9.3.0 up to 9.3.3, 9.4.0a1 up to 9.4.0a6, 9.4.0b1 up to 9.4.0b4, 9.4.0rc1, and 9.5.0a1 (Bind Forum only) allows remote attackers to cause a denial of service (exit) via a type * (ANY) DNS query response that contains multiple RRsets, which triggers an assertion error, aka the "DNSSEC Validation" vulnerability.


definition_id: oval:org.debian:def:154783767074549242218708267607430588988
title: CVE-2007-0539 wordpress
description:
The wp_remote_fopen function in WordPress before 2.1 allows remote attackers to cause a denial of service (bandwidth or thread consumption) via pingback service calls with a source URI that corresponds to a large file, which triggers a long download session without a timeout constraint.


definition_id: oval:org.debian:def:291981377839185470152142640252698050373
title: CVE-2007-0540 wordpress
description:
WordPress allows remote attackers to cause a denial of service (bandwidth or thread consumption) via pingback service calls with a source URI that corresponds to a file with a binary content type, which is downloaded even though it cannot contain usable pingback data.


definition_id: oval:org.debian:def:319740061829765354422756804602562363162
title: CVE-2007-0541 wordpress
description:
WordPress allows remote attackers to determine the existence of arbitrary files, and possibly read portions of certain files, via pingback service calls with a source URI that corresponds to a local pathname, which triggers different fault codes for existing and non-existing files, and in certain configurations causes a brief file excerpt to be published as a blog comment.


definition_id: oval:org.debian:def:35507553886913175490979732539074008465
title: CVE-2007-0578 mpg123
description:
The http_open function in httpget.c in mpg123 before 0.64 allows remote attackers to cause a denial of service (infinite loop) by closing the HTTP connection early.


definition_id: oval:org.debian:def:309142658101577070917494548662052913370
title: CVE-2007-0619 chmlib
description:
chmlib before 0.39 allows user-assisted remote attackers to execute arbitrary code via a crafted page block length in a CHM file, which triggers memory corruption.


definition_id: oval:org.debian:def:94950056356878724244974770240711819042
title: CVE-2007-0640 zabbix
description:
Buffer overflow in ZABBIX before 1.1.5 has unknown impact and attack vectors related to "SNMP IP addresses."


definition_id: oval:org.debian:def:151779110768026015801765710099159928790
title: CVE-2007-0657 nexuiz
description:
Unspecified vulnerability in Nexuiz 2.2.2 allows remote attackers to read and overwrite arbitrary files via the gamedir command.


definition_id: oval:org.debian:def:260217771540916444072106177367165264339
title: CVE-2007-0720 cups
description:
The CUPS service on multiple platforms allows remote attackers to cause a denial of service (service hang) via a "partially-negotiated" SSL connection, which prevents other requests from being accepted.


definition_id: oval:org.debian:def:192049164990729773255496054372770993830
title: CVE-2007-0770 graphicsmagick
description:
Buffer overflow in GraphicsMagick and ImageMagick allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a PALM image that is not properly handled by the ReadPALMImage function in coders/palm.c. NOTE: this issue is due to an incomplete patch for CVE-2006-5456.


definition_id: oval:org.debian:def:169476875685513758167231220506256338436
title: CVE-2007-0774 libapache-mod-jk
description:
Stack-based buffer overflow in the map_uri_to_worker function (native/common/jk_uri_worker_map.c) in mod_jk.so for Apache Tomcat JK Web Server Connector 1.2.19 and 1.2.20, as used in Tomcat 4.1.34 and 5.5.20, allows remote attackers to execute arbitrary code via a long URL that triggers the overflow in a URI worker map routine.


definition_id: oval:org.debian:def:214312925304473401286625488281887326516
title: CVE-2007-0801 firefox-esr
description:
The nsExternalAppHandler::SetUpTempFile function in Mozilla Firefox 1.5.0.9 creates temporary files with predictable filenames based on creation time, which allows remote attackers to execute arbitrary web script or HTML via a crafted XMLHttpRequest.


definition_id: oval:org.debian:def:270063847586007819174907685748746884884
title: CVE-2007-0844 libpam-ssh
description:
The auth_via_key function in pam_ssh.c in pam_ssh before 1.92, when the allow_blank_passphrase option is disabled, allows remote attackers to bypass authentication restrictions and use private encryption keys requiring a blank passphrase by entering a non-blank passphrase.


definition_id: oval:org.debian:def:111920275558626787572501844779624147529
title: CVE-2007-0855 rar
description:
Stack-based buffer overflow in RARLabs Unrar, as packaged in WinRAR and possibly other products, allows user-assisted remote attackers to execute arbitrary code via a crafted, password-protected archive.


definition_id: oval:org.debian:def:94019754550954082927508928747621647458
title: CVE-2007-0857 moin
description:
Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin before 1.5.7 allow remote attackers to inject arbitrary web script or HTML via (1) the page info, or the page name in a (2) AttachFile, (3) RenamePage, or (4) LocalSiteMap action.


definition_id: oval:org.debian:def:171113361136423558355530128232374929505
title: CVE-2007-0897 clamav
description:
Clam AntiVirus ClamAV before 0.90 does not close open file descriptors under certain conditions, which allows remote attackers to cause a denial of service (file descriptor consumption and failed scans) via CAB archives with a cabinet header record length of zero, which causes a function to return without closing a file descriptor.


definition_id: oval:org.debian:def:58598307007772385481415146264167903421
title: CVE-2007-0898 clamav
description:
Directory traversal vulnerability in clamd in Clam AntiVirus ClamAV before 0.90 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the id MIME header parameter in a multi-part message.


definition_id: oval:org.debian:def:16303890248448027879990772885509686522
title: CVE-2007-0901 moin
description:
Multiple cross-site scripting (XSS) vulnerabilities in Info pages in MoinMoin 1.5.7 allow remote attackers to inject arbitrary web script or HTML via the (1) hitcounts and (2) general parameters, different vectors than CVE-2007-0857.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


definition_id: oval:org.debian:def:287406264849588497749853328987827074645
title: CVE-2007-0903 ejabberd
description:
Unspecified vulnerability in the mod_roster_odbc module in ejabberd before 1.1.3 has unknown impact and attack vectors.


definition_id: oval:org.debian:def:7970400963919038692515571025613497042
title: CVE-2007-0956 krb5
description:
The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows remote attackers to bypass authentication and gain system access via a username beginning with a '-' character, a similar issue to CVE-2007-0882.


definition_id: oval:org.debian:def:30096509045930309846036889520250579477
title: CVE-2007-0957 krb5
description:
Stack-based buffer overflow in the krb5_klog_syslog function in the kadm5 library, as used by the Kerberos administration daemon (kadmind) and Key Distribution Center (KDC), in MIT krb5 before 1.6.1 allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via crafted arguments, possibly involving certain format string specifiers.


definition_id: oval:org.debian:def:46278625268160452362625103127320516155
title: CVE-2007-1001 libgd2
description:
Multiple integer overflows in the (1) createwbmp and (2) readwbmp functions in wbmp.c in the GD library (libgd) in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allow context-dependent attackers to execute arbitrary code via Wireless Bitmap (WBMP) images with large width or height values.


definition_id: oval:org.debian:def:122805431283620869233578685456693546487
title: CVE-2007-1002 evolution
description:
Format string vulnerability in the write_html function in calendar/gui/e-cal-component-memo-preview.c in Evolution Shared Memo 2.8.2.1, and possibly earlier versions, allows user-assisted remote attackers to execute arbitrary code via format specifiers in the categories of a crafted shared memo.


definition_id: oval:org.debian:def:188989811313166208566526480398131157393
title: CVE-2007-1003 xorg-server
description:
Integer overflow in ALLOCATE_LOCAL in the ProcXCMiscGetXIDList function in the XC-MISC extension in the X.Org X11 server (xserver) 7.1-1.1.0, and other versions before 20070403, allows remote authenticated users to execute arbitrary code via a large expression, which results in memory corruption.


definition_id: oval:org.debian:def:166319929117679637289968542114421457750
title: CVE-2007-1049 wordpress
description:
Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and possibly other vectors involving the action variable.


definition_id: oval:org.debian:def:236096238814470171914632369253810661727
title: CVE-2007-1054 mediawiki
description:
Cross-site scripting (XSS) vulnerability in the AJAX features in index.php in MediaWiki 1.6.x through 1.9.2, when $wgUseAjax is enabled, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded value of the rs parameter, which is processed by Internet Explorer.


definition_id: oval:org.debian:def:128081588672147273674001223661396791636
title: CVE-2007-1055 mediawiki
description:
Cross-site scripting (XSS) vulnerability in the AJAX features in index.php in MediaWiki 1.9.x before 1.9.0rc2, and 1.8.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the rs parameter.  NOTE: this issue might be a duplicate of CVE-2007-0177.


definition_id: oval:org.debian:def:108353928688351437886637304889440748153
title: CVE-2007-1099 dropbear
description:
dbclient in Dropbear SSH client before 0.49 does not sufficiently warn the user when it detects a hostkey mismatch, which might allow remote attackers to conduct man-in-the-middle attacks.


definition_id: oval:org.debian:def:128273600976050017074412565531487280530
title: CVE-2007-1216 krb5
description:
Double free vulnerability in the GSS-API library (lib/gssapi/krb5/k5unseal.c), as used by the Kerberos administration daemon (kadmind) in MIT krb5 before 1.6.1, when used with the authentication method provided by the RPCSEC_GSS RPC library, allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via a message with an "an invalid direction encoding".


definition_id: oval:org.debian:def:315212264352685508739757416844342015342
title: CVE-2007-1217 isdnutils
description:
Buffer overflow in the bufprint function in capiutil.c in libcapi, as used in Linux kernel 2.6.9 to 2.6.20 and isdn4k-utils, allows local users to cause a denial of service (crash) and possibly gain privileges via a crafted CAPI packet.


definition_id: oval:org.debian:def:217808554413671197553947338931487339803
title: CVE-2007-1218 tcpdump
description:
Off-by-one buffer overflow in the parse_elements function in the 802.11 printer code (print-802_11.c) for tcpdump 3.9.5 and earlier allows remote attackers to cause a denial of service (crash) via a crafted 802.11 frame.  NOTE: this was originally referred to as heap-based, but it might be stack-based.


definition_id: oval:org.debian:def:223811540511950870975895728807531936108
title: CVE-2007-1230 wordpress
description:
Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/functions.php in WordPress before 2.1.2-alpha allow remote attackers to inject arbitrary web script or HTML via (1) the Referer HTTP header or (2) the URI, a different vulnerability than CVE-2007-1049.


definition_id: oval:org.debian:def:114637830040377040056858331199076754924
title: CVE-2007-1244 wordpress
description:
Cross-site request forgery (CSRF) vulnerability in the AdminPanel in WordPress 2.1.1 and earlier allows remote attackers to perform privileged actions as administrators, as demonstrated using the delete action in wp-admin/post.php.  NOTE: this issue can be leveraged to perform cross-site scripting (XSS) attacks and steal cookies via the post parameter.


definition_id: oval:org.debian:def:212909863032917891138493548875744616744
title: CVE-2007-1246 mplayer
description:
The DMO_VideoDecoder_Open function in loader/dmo/DMO_VideoDecoder.c in MPlayer 1.0rc1 and earlier, as used in xine-lib, does not set the biSize before use in a memcpy, which allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code, a different vulnerability than CVE-2007-1387.


definition_id: oval:org.debian:def:222797275401278948433585551051302464406
title: CVE-2007-1253 blender
description:
Eval injection vulnerability in the (a) kmz_ImportWithMesh.py Script for Blender 0.1.9h, as used in (b) Blender before 2.43, allows user-assisted remote attackers to execute arbitrary Python code by importing a crafted (1) KML or (2) KMZ file.


definition_id: oval:org.debian:def:321139076727114702679602919838676408304
title: CVE-2007-1263 gnupg2
description:
GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.


definition_id: oval:org.debian:def:117699118861009168762443744937961678784
title: CVE-2007-1264 enigmail
description:
Enigmail 0.94.2 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Enigmail from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.


definition_id: oval:org.debian:def:185795554919444800203660957861256942747
title: CVE-2007-1306 asterisk
description:
Asterisk 1.4 before 1.4.1 and 1.2 before 1.2.16 allows remote attackers to cause a denial of service (crash) by sending a Session Initiation Protocol (SIP) packet without a URI and SIP-version header, which results in a NULL pointer dereference.


definition_id: oval:org.debian:def:282931999724105785183862605341919878478
title: CVE-2007-1320 qemu
description:
Multiple heap-based buffer overflows in the cirrus_invalidate_region function in the Cirrus VGA extension in QEMU 0.8.2, as used in Xen and possibly other products, might allow local users to execute arbitrary code via unspecified vectors related to "attempting to mark non-existent regions as dirty," aka the "bitblt" heap overflow.


definition_id: oval:org.debian:def:234997957351953819835226482147800213031
title: CVE-2007-1321 qemu
description:
Integer signedness error in the NE2000 emulator in QEMU 0.8.2, as used in Xen and possibly other products, allows local users to trigger a heap-based buffer overflow via certain register values that bypass sanity checks, aka QEMU NE2000 "receive" integer signedness error. NOTE: this identifier was inadvertently used by some sources to cover multiple issues that were labeled "NE2000 network driver and the socket code," but separate identifiers have been created for the individual vulnerabilities since there are sometimes different fixes; see CVE-2007-5729 and CVE-2007-5730.


definition_id: oval:org.debian:def:228470103662300077825972978559053391882
title: CVE-2007-1349 libapache2-mod-perl2
description:
PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.


definition_id: oval:org.debian:def:9127892279460973163250759289328516035
title: CVE-2007-1351 freetype
description:
Integer overflow in the bdfReadCharacters function in bdfread.c in (1) X.Org libXfont before 20070403 and (2) freetype 2.3.2 and earlier allows remote authenticated users to execute arbitrary code via crafted BDF fonts, which result in a heap overflow.


definition_id: oval:org.debian:def:112004219039958462355565962303592377749
title: CVE-2007-1352 libxfont
description:
Integer overflow in the FontFileInitTable function in X.Org libXfont before 20070403 allows remote authenticated users to execute arbitrary code via a long first line in the fonts.dir file, which results in a heap overflow.


definition_id: oval:org.debian:def:144234393464818017610493604793824316461
title: CVE-2007-1366 qemu
description:
QEMU 0.8.2 allows local users to crash a virtual machine via the divisor operand to the aam instruction, as demonstrated by "aam 0x0," which triggers a divide-by-zero error.


definition_id: oval:org.debian:def:255313830314070443546172594697225046652
title: CVE-2007-1384 ktorrent
description:
Directory traversal vulnerability in torrent.cpp in KTorrent before 2.1.2 allows remote attackers to overwrite arbitrary files via ".." sequences in a torrent filename.


definition_id: oval:org.debian:def:80548500439270216144634346887639240987
title: CVE-2007-1385 ktorrent
description:
chunkcounter.cpp in KTorrent before 2.1.2 allows remote attackers to cause a denial of service (crash) and heap corruption via a negative or large idx value.


definition_id: oval:org.debian:def:291965633986266064758534777614398109950
title: CVE-2007-1387 mplayer
description:
The DirectShow loader (loader/dshow/DS_VideoDecoder.c) in MPlayer 1.0rc1 and earlier, as used in xine-lib, does not set the biSize before use in a memcpy, which allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code, a different vulnerability than CVE-2007-1246.


definition_id: oval:org.debian:def:266822400745721696334878537852070470160
title: CVE-2007-1405 trac
description:
Cross-site scripting (XSS) vulnerability in the "download wiki page as text" feature in Trac before 0.10.3.1, when Microsoft Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.


definition_id: oval:org.debian:def:67475618900737291861539163078113055753
title: CVE-2007-1406 trac
description:
Trac before 0.10.3.1 does not send a Content-Disposition HTTP header specifying an attachment in certain "unsafe" situations, which has unknown impact and remote attack vectors.


definition_id: oval:org.debian:def:339023048021688472782891469209111348607
title: CVE-2007-1436 sql-ledger
description:
Unspecified vulnerability in admin.pl in SQL-Ledger before 2.6.26 and LedgerSMB before 1.1.9 allows remote attackers to bypass authentication via unknown vectors that prevents a password check from occurring.


definition_id: oval:org.debian:def:219256248326305682475598864417631444681
title: CVE-2007-1437 sql-ledger
description:
Unspecified vulnerability in LedgerSMB before 1.1.5 and SQL-Ledger before 2.6.25 allows remote attackers to overwrite files and possibly bypass authentication, and remote authenticated users to execute unauthorized code, by calling a custom error function that returns from execution.


definition_id: oval:org.debian:def:259490718989255825456921914384958997285
title: CVE-2007-1463 inkscape
description:
Format string vulnerability in Inkscape before 0.45.1 allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a URI, which is not properly handled by certain dialogs.


definition_id: oval:org.debian:def:139137354946200563063124407848093105002
title: CVE-2007-1464 inkscape
description:
Format string vulnerability in the whiteboard Jabber protocol in Inkscape before 0.45.1 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors.


definition_id: oval:org.debian:def:160455407107758885352206809208475256173
title: CVE-2007-1466 libwpd
description:
Integer overflow in the WP6GeneralTextPacket::_readContents function in WordPerfect Document importer/exporter (libwpd) before 0.8.9 allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted WordPerfect file, a different vulnerability than CVE-2007-0002.


definition_id: oval:org.debian:def:45697448918741607211585474816639413419
title: CVE-2007-1507 openafs
description:
The default configuration in OpenAFS 1.4.x before 1.4.4 and 1.5.x before 1.5.17 supports setuid programs within the local cell, which might allow attackers to gain privileges by spoofing a response to an AFS cache manager FetchStatus request, and setting setuid and root ownership for files in the cache.


definition_id: oval:org.debian:def:4121770592123891316728744259933043121
title: CVE-2007-1536 file
description:
Integer underflow in the file_printf function in the "file" program before 4.20 allows user-assisted attackers to execute arbitrary code via a file that triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:227128315508758954455771191759393007691
title: CVE-2007-1540 sql-ledger
description:
Directory traversal vulnerability in am.pl in (1) SQL-Ledger 2.6.27 and earlier, and (2) LedgerSMB before 1.2.0, allows remote attackers to run arbitrary executables and bypass authentication via a .. (dot dot) sequence and trailing NULL (%00) in the login parameter.  NOTE: this issue was reportedly addressed in SQL-Ledger 2.6.27, however third-party researchers claim that the file is still executed even though an error is generated.


definition_id: oval:org.debian:def:247652925468480258866898022350717557935
title: CVE-2007-1541 sql-ledger
description:
Directory traversal vulnerability in am.pl in SQL-Ledger 2.6.27 only checks for the presence of a NULL (%00) character to protect against directory traversal attacks, which allows remote attackers to run arbitrary executables and bypass authentication via a .. (dot dot) sequence in the login parameter.


definition_id: oval:org.debian:def:286700573106761369387407428280374862231
title: CVE-2007-1543 nas
description:
Stack-based buffer overflow in the accept_att_local function in server/os/connection.c in Network Audio System (NAS) before 1.8a SVN 237 allows remote attackers to execute arbitrary code via a long path slave name in a USL socket connection.


definition_id: oval:org.debian:def:270261292796282477476478179728906905789
title: CVE-2007-1544 nas
description:
Integer overflow in the ProcAuWriteElement function in server/dia/audispatch.c in Network Audio System (NAS) before 1.8a SVN 237 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large max_samples value.


definition_id: oval:org.debian:def:316058421498618840970964935600090230175
title: CVE-2007-1545 nas
description:
The AddResource function in server/dia/resource.c in Network Audio System (NAS) before 1.8a SVN 237 allows remote attackers to cause a denial of service (server crash) via a nonexistent client ID.


definition_id: oval:org.debian:def:224164765423769242602423398991182937678
title: CVE-2007-1546 nas
description:
Array index error in Network Audio System (NAS) before 1.8a SVN 237 allows remote attackers to cause a denial of service (crash) via (1) large num_action values in the ProcAuSetElements function in server/dia/audispatch.c or (2) a large inputNum parameter to the compileInputs function in server/dia/auutil.c.


definition_id: oval:org.debian:def:294790660245138950856028450422350693003
title: CVE-2007-1547 nas
description:
The ReadRequestFromClient function in server/os/io.c in Network Audio System (NAS) before 1.8a SVN 237 allows remote attackers to cause a denial of service (crash) via multiple simultaneous connections, which triggers a NULL pointer dereference.


definition_id: oval:org.debian:def:165848687707343555867803697218947968277
title: CVE-2007-1558 balsa
description:
The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions.  NOTE: this design-level issue potentially affects all products that use APOP, including (1) Thunderbird 1.x before 1.5.0.12 and 2.x before 2.0.0.4, (2) Evolution, (3) mutt, (4) fetchmail before 6.3.8, (5) SeaMonkey 1.0.x before 1.0.9 and 1.1.x before 1.1.2, (6) Balsa 2.3.16 and earlier, (7) Mailfilter before 0.8.2, and possibly other products.


definition_id: oval:org.debian:def:2336365566357436042091624316158393164
title: CVE-2007-1560 squid
description:
The clientProcessRequest() function in src/client_side.c in Squid 2.6 before 2.6.STABLE12 allows remote attackers to cause a denial of service (daemon crash) via crafted TRACE requests that trigger an assertion error.


definition_id: oval:org.debian:def:253547428923399707624141953494326660554
title: CVE-2007-1561 asterisk
description:
The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP INVITE message with an SDP containing one valid and one invalid IP address.


definition_id: oval:org.debian:def:199168816761020288781803959103859489836
title: CVE-2007-1595 asterisk
description:
The Asterisk Extension Language (AEL) in pbx/pbx_ael.c in Asterisk does not properly generate extensions, which allows remote attackers to execute arbitrary extensions and have an unknown impact by specifying an invalid extension in a certain form.


definition_id: oval:org.debian:def:184662906411459260389261252251257871232
title: CVE-2007-1599 wordpress
description:
wp-login.php in WordPress allows remote attackers to redirect authenticated users to other websites and potentially obtain sensitive information via the redirect_to parameter.


definition_id: oval:org.debian:def:215750132876923823772357943792374088865
title: CVE-2007-1614 zziplib
description:
Stack-based buffer overflow in the zzip_open_shared_io function in zzip/file.c in ZZIPlib Library before 0.13.49 allows user-assisted remote attackers to cause a denial of service (application crash) or execute arbitrary code via a long filename.


definition_id: oval:org.debian:def:306894092531264964088929876178682846752
title: CVE-2007-1622 wordpress
description:
Cross-site scripting (XSS) vulnerability in wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in the 2.1 series, allows remote authenticated users with theme privileges to inject arbitrary web script or HTML via the PATH_INFO in the administration interface, related to loose regular expression processing of PHP_SELF.


definition_id: oval:org.debian:def:79371448433839967155260149737306050431
title: CVE-2007-1655 tinymux
description:
Buffer overflow in the fun_ladd function in funmath.cpp in TinyMUX before 20070126 might allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors related to lists of numbers.


definition_id: oval:org.debian:def:163513978540992744329634281651611887395
title: CVE-2007-1659 glib2.0
description:
Perl-Compatible Regular Expression (PCRE) library before 7.3 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via regex patterns containing unmatched "\Q\E" sequences with orphan "\E" codes.


definition_id: oval:org.debian:def:259674934344419087651636981076974862772
title: CVE-2007-1660 glib2.0
description:
Perl-Compatible Regular Expression (PCRE) library before 7.0 does not properly calculate sizes for unspecified "multiple forms of character class", which triggers a buffer overflow that allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code.


definition_id: oval:org.debian:def:229512164105568623586792113442611088714
title: CVE-2007-1661 glib2.0
description:
Perl-Compatible Regular Expression (PCRE) library before 7.3 backtracks too far when matching certain input bytes against some regex patterns in non-UTF-8 mode, which allows context-dependent attackers to obtain sensitive information or cause a denial of service (crash), as demonstrated by the "\X?\d" and "\P{L}?\d" patterns.


definition_id: oval:org.debian:def:278062374451124479475420681694658218734
title: CVE-2007-1662 glib2.0
description:
Perl-Compatible Regular Expression (PCRE) library before 7.3 reads past the end of the string when searching for unmatched brackets and parentheses, which allows context-dependent attackers to cause a denial of service (crash), possibly involving forward references.


definition_id: oval:org.debian:def:84088214756195806191973350546592266492
title: CVE-2007-1667 graphicsmagick
description:
Multiple integer overflows in (1) the XGetPixel function in ImUtil.c in X.Org libx11 before 1.0.3, and (2) XInitImage function in xwd.c for ImageMagick, allow user-assisted remote attackers to cause a denial of service (crash) or obtain sensitive information via crafted images with large or negative values that trigger a buffer overflow.


definition_id: oval:org.debian:def:72227254552017765599255675154507830033
title: CVE-2007-1732 wordpress
description:
** DISPUTED **  Cross-site scripting (XSS) vulnerability in an mt import in wp-admin/admin.php in WordPress 2.1.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the demo parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: another researcher disputes this issue, stating that this is legitimate functionality for administrators.  However, it has been patched by at least one vendor.


definition_id: oval:org.debian:def:204674015643407974398152320768164423339
title: CVE-2007-1741 apache2
description:
Multiple race conditions in suexec in Apache HTTP Server (httpd) 2.2.3 between directory and file validation, and their usage, allow local users to gain privileges and execute arbitrary code by renaming directories or performing symlink attacks. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root."


definition_id: oval:org.debian:def:84304393955578519216330209383741611740
title: CVE-2007-1742 apache2
description:
suexec in Apache HTTP Server (httpd) 2.2.3 uses a partial comparison for verifying whether the current directory is within the document root, which might allow local users to perform unauthorized operations on incorrect directories, as demonstrated using "html_backup" and "htmleditor" under an "html" directory.  NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root."


definition_id: oval:org.debian:def:72833347510283004493361997463543077370
title: CVE-2007-1745 clamav
description:
The chm_decompress_stream function in libclamav/chmunpack.c in Clam AntiVirus (ClamAV) before 0.90.2 leaks file descriptors, which has unknown impact and attack vectors involving a crafted CHM file, a different vulnerability than CVE-2007-0897.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:311362263434383001853096468040444828142
title: CVE-2007-1797 graphicsmagick
description:
Multiple integer overflows in ImageMagick before 6.3.3-5 allow remote attackers to execute arbitrary code via (1) a crafted DCM image, which results in a heap-based overflow in the ReadDCMImage function, or (2) the (a) colors or (b) comments field in a crafted XWD image, which results in a heap-based overflow in the ReadXWDImage function, different issues than CVE-2007-1667.


definition_id: oval:org.debian:def:63642386655722456070846387684574750228
title: CVE-2007-1799 ktorrent
description:
Directory traversal vulnerability in torrent.cpp in KTorrent before 2.1.3 only checks for the ".." string, which allows remote attackers to overwrite arbitrary files via modified ".." sequences in a torrent filename, as demonstrated by "../" sequences, due to an incomplete fix for CVE-2007-1384.


definition_id: oval:org.debian:def:260229549529919020871156387361715524278
title: CVE-2007-1804 pulseaudio
description:
PulseAudio 0.9.5 allows remote attackers to cause a denial of service (daemon crash) via (1) a PA_PSTREAM_DESCRIPTOR_LENGTH value of FRAME_SIZE_MAX_ALLOW sent on TCP port 9875, which triggers a p->export assertion failure in do_read; (2) a PA_PSTREAM_DESCRIPTOR_LENGTH value of 0 sent on TCP port 9875, which triggers a length assertion failure in pa_memblock_new; or (3) an empty packet on UDP port 9875, which triggers a t assertion failure in pa_sdp_parse; and allows remote authenticated users to cause a denial of service (daemon crash) via a crafted packet on TCP port 9875 that (4) triggers a maxlength assertion failure in pa_memblockq_new, (5) triggers a size assertion failure in pa_xmalloc, or (6) plays a certain sound file.


definition_id: oval:org.debian:def:5591147504313367638807040055998121144
title: CVE-2007-1859 xscreensaver
description:
XScreenSaver 4.10, when using a remote directory service for credentials, does not properly handle the results from the getpwuid function in drivers/lock.c when there is no network connectivity, which causes XScreenSaver to crash and unlock the screen and allows local users to bypass authentication.


definition_id: oval:org.debian:def:3769383703385014608485216914006435729
title: CVE-2007-1860 libapache-mod-jk
description:
mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.


definition_id: oval:org.debian:def:202409404733527928814244865819587805599
title: CVE-2007-1863 apache2
description:
cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage, (2) max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.


definition_id: oval:org.debian:def:237467682017212379647075233072262682086
title: CVE-2007-1869 lighttpd
description:
lighttpd 1.4.12 and 1.4.13 allows remote attackers to cause a denial of service (cpu and resource consumption) by disconnecting while lighttpd is parsing CRLF sequences, which triggers an infinite loop and file descriptor consumption.


definition_id: oval:org.debian:def:298828464229324425939279989854826981066
title: CVE-2007-1870 lighttpd
description:
lighttpd before 1.4.14 allows attackers to cause a denial of service (crash) via a request to a file whose mtime is 0, which results in a NULL pointer dereference.


definition_id: oval:org.debian:def:159013557063072300491890641195385590957
title: CVE-2007-1888 sqlite
description:
Buffer overflow in the sqlite_decode_binary function in src/encode.c in SQLite 2, as used by PHP 4.x through 5.x and other applications, allows context-dependent attackers to execute arbitrary code via an empty value of the in parameter.  NOTE: some PHP installations use a bundled version of sqlite without this vulnerability.  The SQLite developer has argued that this issue could be due to a misuse of the sqlite_decode_binary() API.


definition_id: oval:org.debian:def:303218702163950830296198531973725372027
title: CVE-2007-1893 wordpress
description:
xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictions and invoke the publish_posts functionality, which can be used to "publish a previously saved post."


definition_id: oval:org.debian:def:187148976194915911442464696780644267270
title: CVE-2007-1894 wordpress
description:
Cross-site scripting (XSS) vulnerability in wp-includes/general-template.php in WordPress before 20070309 allows remote attackers to inject arbitrary web script or HTML via the year parameter in the wp_title function.


definition_id: oval:org.debian:def:291593385363733499495518514941674333246
title: CVE-2007-1897 wordpress
description:
SQL injection vulnerability in xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users to execute arbitrary SQL commands via a string parameter value in an XML RPC mt.setPostCategories method call, related to the post_id variable.


definition_id: oval:org.debian:def:144710066964953517836594197494060146623
title: CVE-2007-1958 tinymux
description:
Buffer overflow in TinyMUX before 2.4 allows attackers to cause a denial of service via unspecified vectors related to "too many substring matches in a regexp $-command." NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:11276101662307731131524631525839589532
title: CVE-2007-1995 quagga
description:
bgpd/bgp_attr.c in Quagga 0.98.6 and earlier, and 0.99.6 and earlier 0.99 versions, does not validate length values in the MP_REACH_NLRI and MP_UNREACH_NLRI attributes, which allows remote attackers to cause a denial of service (daemon crash or exit) via crafted UPDATE messages that trigger an assertion error or out of bounds read.


definition_id: oval:org.debian:def:249858156393496777796917272401133745932
title: CVE-2007-1997 clamav
description:
Integer signedness error in the (1) cab_unstore and (2) cab_extract functions in libclamav/cab.c in Clam AntiVirus (ClamAV) before 0.90.2 allow remote attackers to execute arbitrary code via a crafted CHM file that contains a negative integer, which passes a signed comparison and leads to a stack-based buffer overflow.


definition_id: oval:org.debian:def:279643853631243031120847674714546994099
title: CVE-2007-2026 file
description:
The gnu regular expression code in file 4.20 allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted document with a large number of line feed characters, which is not well handled by OS/2 REXX regular expressions that use wildcards, as originally reported for AMaViS.


definition_id: oval:org.debian:def:223303324137317887043710365180444699344
title: CVE-2007-2027 elinks
description:
Untrusted search path vulnerability in the add_filename_to_string function in intl/gettext/loadmsgcat.c for Elinks 0.11.1 allows local users to cause Elinks to use an untrusted gettext message catalog (.po file) in a "../po" directory, which can be leveraged to conduct format string attacks.


definition_id: oval:org.debian:def:265836290885704761913161112792707873667
title: CVE-2007-2028 freeradius
description:
Memory leak in freeRADIUS 1.1.5 and earlier allows remote attackers to cause a denial of service (memory consumption) via a large number of EAP-TTLS tunnel connections using malformed Diameter format attributes, which causes the authentication request to be rejected but does not reclaim VALUE_PAIR data structures.


definition_id: oval:org.debian:def:239294066930828310545163111545728120044
title: CVE-2007-2029 clamav
description:
File descriptor leak in the PDF handler in Clam AntiVirus (ClamAV) allows remote attackers to cause a denial of service via a crafted PDF file.


definition_id: oval:org.debian:def:4679100714876686615910352225006229842
title: CVE-2007-2057 aircrack-ng
description:
Stack-based buffer overflow in aircrack-ng airodump-ng 0.7 allows remote attackers to execute arbitrary code via crafted 802.11 authentication packets.


definition_id: oval:org.debian:def:57777123021066490484383609129289634336
title: CVE-2007-2165 proftpd-dfsg
description:
The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as demonstrated by use of SQLAuthTypes Plaintext in mod_sql, with data retrieved from /etc/passwd.


definition_id: oval:org.debian:def:60094563095271705378297317053264456539
title: CVE-2007-2231 dovecot
description:
Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when using the zlib plugin, allows remote attackers to read arbitrary gzipped (.gz) mailboxes (mbox files) via a .. (dot dot) sequence in the mailbox name.


definition_id: oval:org.debian:def:148754391852090660190309177442798840977
title: CVE-2007-2241 bind9
description:
Unspecified vulnerability in query.c in ISC BIND 9.4.0, and 9.5.0a1 through 9.5.0a3, when recursion is enabled, allows remote attackers to cause a denial of service (daemon exit) via a sequence of queries processed by the query_addsoa function.


definition_id: oval:org.debian:def:62586394542608196246984661779823571043
title: CVE-2007-2293 asterisk
description:
Multiple stack-based buffer overflows in the process_sdp function in chan_sip.c of the SIP channel T.38 SDP parser in Asterisk before 1.4.3 allow remote attackers to execute arbitrary code via a long (1) T38FaxRateManagement or (2) T38FaxUdpEC SDP parameter in an SIP message, as demonstrated using SIP INVITE.


definition_id: oval:org.debian:def:179935979034281983891253544936421063991
title: CVE-2007-2294 asterisk
description:
The Manager Interface in Asterisk before 1.2.18 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (crash) by using MD5 authentication to authenticate a user that does not have a password defined in manager.conf, resulting in a NULL pointer dereference.


definition_id: oval:org.debian:def:70601208449725693354986831378737858274
title: CVE-2007-2297 asterisk
description:
The SIP channel driver (chan_sip) in Asterisk before 1.2.18 and 1.4.x before 1.4.3 does not properly parse SIP UDP packets that do not contain a valid response code, which allows remote attackers to cause a denial of service (crash).


definition_id: oval:org.debian:def:155810649679975681074224475735774822703
title: CVE-2007-2318 filezilla
description:
Multiple format string vulnerabilities in FileZilla before 2.2.32 allow remote attackers to execute arbitrary code via format string specifiers in (1) FTP server responses or (2) data sent by an FTP server.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:184992038385396616942915065232327636446
title: CVE-2007-2348 lftp
description:
mirror --script in lftp before 3.5.9 does not properly quote shell metacharacters, which might allow remote user-assisted attackers to execute shell commands via a malicious script.  NOTE: it is not clear whether this issue crosses security boundaries, since the script already supports commands such as "get" which could overwrite executable files.


definition_id: oval:org.debian:def:26648027884624292386111145738068938868
title: CVE-2007-2356 gimp
description:
Stack-based buffer overflow in the set_color_table function in sunras.c in the SUNRAS plugin in Gimp 2.2.14 allows user-assisted remote attackers to execute arbitrary code via a crafted RAS file.


definition_id: oval:org.debian:def:133936317642719273565160164715243132363
title: CVE-2007-2383 asterisk
description:
The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."


definition_id: oval:org.debian:def:253959886292341697106753494049640742609
title: CVE-2007-2423 moin
description:
Cross-site scripting (XSS) vulnerability in index.php in MoinMoin 1.5.7 allows remote attackers to inject arbitrary web script or HTML via the do parameter in an AttachFile action, a different vulnerability than CVE-2007-0857.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


definition_id: oval:org.debian:def:310439651463793370185533451717542003108
title: CVE-2007-2437 xorg-server
description:
The X render (Xrender) extension in X.org X Window System 7.0, 7.1, and 7.2, with Xserver 1.3.0 and earlier, allows remote authenticated users to cause a denial of service (daemon crash) via crafted values to the (1) XRenderCompositeTrapezoids and (2) XRenderAddTraps functions, which trigger a divide-by-zero error.


definition_id: oval:org.debian:def:117141762911159704480260877794268458806
title: CVE-2007-2438 vim
description:
The sandbox for vim allows dangerous functions such as (1) writefile, (2) feedkeys, and (3) system, which might allow user-assisted attackers to execute shell commands and write files via modelines.


definition_id: oval:org.debian:def:240938831636872242800516905719545342058
title: CVE-2007-2442 krb5
description:
The gssrpc__svcauth_gssapi function in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a zero-length RPC credential, which causes kadmind to free an uninitialized pointer during cleanup.


definition_id: oval:org.debian:def:102055269542847866571720413635194990386
title: CVE-2007-2443 krb5
description:
Integer signedness error in the gssrpc__svcauth_unix function in svc_auth_unix.c in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a negative length value.


definition_id: oval:org.debian:def:166658085875355162503372617302334935229
title: CVE-2007-2444 samba
description:
Logic error in the SID/Name translation functionality in smbd in Samba 3.0.23d through 3.0.25pre2 allows local users to gain temporary privileges and execute SMB/CIFS protocol operations via unspecified vectors that cause the daemon to transition to the root user.


definition_id: oval:org.debian:def:226135711668248237631485827778836174069
title: CVE-2007-2445 libgd2
description:
The png_handle_tRNS function in pngrutil.c in libpng before 1.0.25 and 1.2.x before 1.2.17 allows remote attackers to cause a denial of service (application crash) via a grayscale PNG image with a bad tRNS chunk CRC value.


definition_id: oval:org.debian:def:217913548969387750091210274719546773913
title: CVE-2007-2446 samba
description:
Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).


definition_id: oval:org.debian:def:274651069437501951885002295099957268795
title: CVE-2007-2447 samba
description:
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file share management.


definition_id: oval:org.debian:def:327207204933546996784083407525953581154
title: CVE-2007-2448 subversion
description:
Subversion 1.4.3 and earlier does not properly implement the "partial access" privilege for users who have access to changed paths but not copied paths, which allows remote authenticated users to obtain sensitive information (revision properties) via svn (1) propget, (2) proplist, or (3) propedit.


definition_id: oval:org.debian:def:239553520965307737506425528151871436883
title: CVE-2007-2452 findutils
description:
Heap-based buffer overflow in the visit_old_format function in locate/locate.c in locate in GNU findutils before 4.2.31 might allow context-dependent attackers to execute arbitrary code via a long pathname in a locate database that has the old format, a different vulnerability than CVE-2001-1036.


definition_id: oval:org.debian:def:314235714452495974698397970590474800149
title: CVE-2007-2459 libimager-perl
description:
Heap-based buffer overflow in the BMP reader (bmp.c) in Imager perl module (libimager-perl) 0.45 through 0.56 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted 8-bit/pixel compressed BMP files.


definition_id: oval:org.debian:def:251998569052632141471434940447581381646
title: CVE-2007-2488 asterisk
description:
The IAX2 channel driver (chan_iax2) in Asterisk before 20070504 does not properly null terminate data, which allows remote attackers to trigger loss of transmitted data, and possibly obtain sensitive information (memory contents) or cause a denial of service (application crash), by sending a frame that lacks a 0 byte.


definition_id: oval:org.debian:def:295755269503238997045542601313119183062
title: CVE-2007-2524 otrs2
description:
Cross-site scripting (XSS) vulnerability in index.pl in Open Ticket Request System (OTRS) 2.0.x allows remote attackers to inject arbitrary web script or HTML via the Subaction parameter in an AgentTicketMailbox Action.  NOTE: DEBIAN:DSA-1299 originally used this identifier for an ipsec-tools issue, but the proper identifier for the ipsec-tools issue is CVE-2007-1841.


definition_id: oval:org.debian:def:236433697913368645938907389905060819453
title: CVE-2007-2627 wordpress
description:
Cross-site scripting (XSS) vulnerability in sidebar.php in WordPress, when custom 404 pages that call get_sidebar are used, allows remote attackers to inject arbitrary web script or HTML via the query string (PHP_SELF), a different vulnerability than CVE-2007-1622.


definition_id: oval:org.debian:def:314640336059052177245259784532879756012
title: CVE-2007-2630 moin
description:
Incomplete blacklist vulnerability in filemanager/browser/default/connectors/php/config.php in the FCKeditor module, as used in ActiveCampaign 1-2-All (aka 12All) 4.50 through 4.53.13, and possibly other products, allows remote authenticated administrators to upload and possibly execute .php4 and .php5 files via unspecified vectors.  NOTE: this issue is reachable through filemanager/browser/default/browser.html.


definition_id: oval:org.debian:def:299387673473177914655575763903914227746
title: CVE-2007-2637 moin
description:
MoinMoin before 20070507 does not properly enforce ACLs for calendars and includes, which allows remote attackers to read certain pages via unspecified vectors.


definition_id: oval:org.debian:def:177030387038343752457674713149615405853
title: CVE-2007-2645 libexif
description:
Integer overflow in the exif_data_load_data_entry function in exif-data.c in libexif before 0.6.14 allows user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted EXIF data, involving the (1) doff or (2) s variable.


definition_id: oval:org.debian:def:315493339370834931008387239244052640952
title: CVE-2007-2650 clamav
description:
The OLE2 parser in Clam AntiVirus (ClamAV) allows remote attackers to cause a denial of service (resource consumption) via an OLE2 file with (1) a large property size or (2) a loop in the FAT file block chain that triggers an infinite loop, as demonstrated via a crafted DOC file.


definition_id: oval:org.debian:def:133000800468359876151402203642797453004
title: CVE-2007-2654 xfsdump
description:
xfs_fsr in xfsdump creates a .fsr temporary directory with insecure permissions, which allows local users to read or overwrite arbitrary files on xfs filesystems.


definition_id: oval:org.debian:def:335851813383176426632327361382577122716
title: CVE-2007-2683 mutt
description:
Buffer overflow in Mutt 1.4.2 might allow local users to execute arbitrary code via "&" characters in the GECOS field, which triggers the overflow during alias expansion.


definition_id: oval:org.debian:def:266413085418034343889466679336888903667
title: CVE-2007-2714 wordpress
description:
Unspecified vulnerability in akismet.php in Matt Mullenweg Akismet before 2.0.2, a WordPress plugin, has unknown impact and attack vectors.


definition_id: oval:org.debian:def:216030131813967379123231556805125738706
title: CVE-2007-2721 ghostscript
description:
The jpc_qcx_getcompparms function in jpc/jpc_cs.c for the JasPer JPEG-2000 library (libjasper) before 1.900 allows remote user-assisted attackers to cause a denial of service (crash) and possibly corrupt the heap via malformed image files, as originally demonstrated using imagemagick convert.


definition_id: oval:org.debian:def:45454368875944553365019890848116810662
title: CVE-2007-2739 php-xajax
description:
Cross-site scripting (XSS) vulnerability in xajax before 0.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:30276681087634723877117832248106549794
title: CVE-2007-2740 php-xajax
description:
Unspecified vulnerability in xajax before 0.2.5 has unknown impact and attack vectors, not related to XSS.


definition_id: oval:org.debian:def:167483961382733645878422253196854181042
title: CVE-2007-2756 libgd2
description:
The gdPngReadData function in libgd 2.0.34 allows user-assisted attackers to cause a denial of service (CPU consumption) via a crafted PNG image with truncated data, which causes an infinite loop in the png_read_info function in libpng.


definition_id: oval:org.debian:def:281166986691032715771953026167964628152
title: CVE-2007-2766 backup-manager
description:
lib/backup-methods.sh in Backup Manager before 0.7.6 provides the MySQL password as a plaintext command line argument, which allows local users to obtain this password by listing the process and its arguments, related to lib/backup-methods.sh.


definition_id: oval:org.debian:def:88899356057419815747345532812146274597
title: CVE-2007-2798 krb5
description:
Stack-based buffer overflow in the rename_principal_2_svc function in kadmind for MIT Kerberos 1.5.3, 1.6.1, and other versions allows remote authenticated users to execute arbitrary code via a crafted request to rename a principal.


definition_id: oval:org.debian:def:161493653297874473785469024973619375779
title: CVE-2007-2799 file
description:
Integer overflow in the "file" program 4.20, when running on 32-bit systems, as used in products including The Sleuth Kit, might allow user-assisted attackers to execute arbitrary code via a large file that triggers an overflow that bypasses an assert() statement.  NOTE: this issue is due to an incorrect patch for CVE-2007-1536.


definition_id: oval:org.debian:def:29334241456977307298419805538780013156
title: CVE-2007-2807 eggdrop
description:
Stack-based buffer overflow in mod/server.mod/servrmsg.c in Eggdrop 1.6.18, and possibly earlier, allows user-assisted, remote IRC servers to execute arbitrary code via a long private message.


definition_id: oval:org.debian:def:192965293378376865408345991546149094451
title: CVE-2007-2821 wordpress
description:
SQL injection vulnerability in wp-admin/admin-ajax.php in WordPress before 2.2 allows remote attackers to execute arbitrary SQL commands via the cookie parameter.


definition_id: oval:org.debian:def:76524250547257870407198189757503719744
title: CVE-2007-2835 unicon
description:
Multiple stack-based buffer overflows in (1) CCE_pinyin.c and (2) xl_pinyin.c in ImmModules/cce/ in unicon-imc2 3.0.4, as used by zhcon and other applications, allow local users to gain privileges via a long HOME environment variable.


definition_id: oval:org.debian:def:21696704668375125090360582688087771063
title: CVE-2007-2836 hiki
description:
Directory traversal vulnerability in session.rb in Hiki 0.8.0 through 0.8.6 allows remote attackers to delete arbitrary files via directory traversal sequences in the session ID, which is matched against an insufficiently restrictive regular expression before it is used to construct a filename that is marked for deletion at logout.


definition_id: oval:org.debian:def:93945293151428443002831810966820629243
title: CVE-2007-2865 phppgadmin
description:
Cross-site scripting (XSS) vulnerability in sqledit.php in phpPgAdmin 4.1.1 allows remote attackers to inject arbitrary web script or HTML via the server parameter.


definition_id: oval:org.debian:def:86041862126894168751662094087975755343
title: CVE-2007-2873 spamassassin
description:
SpamAssassin 3.1.x, 3.2.0, and 3.2.1 before 20070611, when running as root in unusual configurations using vpopmail or virtual users, allows local users to cause a denial of service (corrupt arbitrary files) via a symlink attack on a file that is used by spamd.


definition_id: oval:org.debian:def:206133272597259588873806131360546979891
title: CVE-2007-2893 bochs
description:
Heap-based buffer overflow in the bx_ne2k_c::rx_frame function in iodev/ne2k.cc in the emulated NE2000 device in Bochs 2.3 allows local users of the guest operating system to write to arbitrary memory locations and gain privileges on the host operating system via vectors that cause TXCNT register values to exceed the device memory size, aka "RX Frame heap overflow."


definition_id: oval:org.debian:def:91706910869767829638777085905072017353
title: CVE-2007-2925 bind9
description:
The default access control lists (ACL) in ISC BIND 9.4.0, 9.4.1, and 9.5.0a1 through 9.5.0a5 do not set the allow-recursion and allow-query-cache ACLs, which allows remote attackers to make recursive queries and query the cache.


definition_id: oval:org.debian:def:228292998426736299780644072644198498893
title: CVE-2007-2926 bind9
description:
ISC BIND 9 through 9.5.0a5 uses a weak random number generator during generation of DNS query ids when answering resolver questions or sending NOTIFY messages to slave name servers, which makes it easier for remote attackers to guess the next query id and perform DNS cache poisoning.


definition_id: oval:org.debian:def:90350605205100493508327318171655212613
title: CVE-2007-2948 mplayer
description:
Multiple stack-based buffer overflows in stream/stream_cddb.c in MPlayer before 1.0rc1try3 allow remote attackers to execute arbitrary code via a CDDB entry with a long (1) album title or (2) category.


definition_id: oval:org.debian:def:71821191821258355662864121268997514925
title: CVE-2007-2949 gimp
description:
Integer overflow in the seek_to_and_unpack_pixeldata function in the psd.c plugin in Gimp 2.2.15 allows remote attackers to execute arbitrary code via a crafted PSD file that contains a large (1) width or (2) height value.


definition_id: oval:org.debian:def:68894810542967212542775438402918813374
title: CVE-2007-2951 kvirc
description:
The parseIrcUrl function in src/kvirc/kernel/kvi_ircurl.cpp in KVIrc 3.2.0 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in an (1) irc:// or (2) irc6:// URI.


definition_id: oval:org.debian:def:243348180753506135445800310589205123154
title: CVE-2007-2953 vim
description:
Format string vulnerability in the helptags_one function in src/ex_cmds.c in Vim 6.4 and earlier, and 7.x up to 7.1, allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a help-tags tag in a help file, related to the helptags command.


definition_id: oval:org.debian:def:17788143092697847554408257171073929456
title: CVE-2007-2958 sylpheed
description:
Format string vulnerability in the inc_put_error function in src/inc.c in Sylpheed 2.4.4, and Sylpheed-Claws (Claws Mail) 1.9.100 and 2.10.0, allows remote POP3 servers to execute arbitrary code via format string specifiers in crafted replies.


definition_id: oval:org.debian:def:6520579761495205994790530572392481453
title: CVE-2007-3023 clamav
description:
unsp.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 does not properly calculate the end of a certain buffer, with unknown impact and remote attack vectors.


definition_id: oval:org.debian:def:199466755633078744911257430114418733846
title: CVE-2007-3024 clamav
description:
libclamav/others.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 uses insecure permissions for temporary files that are created by the cli_gentempstream function in clamd/clamdscan, which might allow local users to read sensitive files.


definition_id: oval:org.debian:def:280115778577400761488989588559416512224
title: CVE-2007-3099 open-iscsi
description:
usr/mgmt_ipc.c in iscsid in open-iscsi (iscsi-initiator-utils) before 2.0-865 checks the client's UID on the listening AF_LOCAL socket instead of the new connection, which allows remote attackers to access the management interface and cause a denial of service (iscsid exit or iSCSI connection loss).


definition_id: oval:org.debian:def:11002182902784335254331615878323647507
title: CVE-2007-3100 open-iscsi
description:
usr/log.c in iscsid in open-iscsi (iscsi-initiator-utils) before 2.0-865 uses a semaphore with insecure permissions (world-writable/world-readable) for managing log messages using shared memory, which allows local users to cause a denial of service (hang) by grabbing the semaphore.


definition_id: oval:org.debian:def:22688344036854319243611139367405655248
title: CVE-2007-3106 libvorbis
description:
lib/info.c in libvorbis 1.1.2, and possibly other versions before 1.2.0, allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via invalid (1) blocksize_0 and (2) blocksize_1 values, which trigger a "heap overwrite" in the _01inverse function in res0.c.  NOTE: this issue has been RECAST so that CVE-2007-4029 handles additional vectors.


definition_id: oval:org.debian:def:135773616716978211301689687270546077885
title: CVE-2007-3108 openssl
description:
The BN_from_montgomery function in crypto/bn/bn_mont.c in OpenSSL 0.9.8e and earlier does not properly perform Montgomery multiplication, which might allow local users to conduct a side-channel attack and retrieve RSA private keys.


definition_id: oval:org.debian:def:167120600503736505707132980571786887535
title: CVE-2007-3112 cacti
description:
graph_image.php in Cacti 0.8.6i, and possibly other versions, allows remote authenticated users to cause a denial of service (CPU consumption) via a large value of the (1) graph_start or (2) graph_end parameter, different vectors than CVE-2007-3113.


definition_id: oval:org.debian:def:11185686387154119799148911831533760276
title: CVE-2007-3113 cacti
description:
Cacti 0.8.6i, and possibly other versions, allows remote authenticated users to cause a denial of service (CPU consumption) via a large value of the (1) graph_height or (2) graph_width parameter, different vectors than CVE-2007-3112.


definition_id: oval:org.debian:def:159923075244310991126496978122594100760
title: CVE-2007-3114 maradns
description:
Memory leak in server/MaraDNS.c in MaraDNS before 1.2.12.05, and 1.3.x before 1.3.03, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, a different set of affected versions than CVE-2007-3115 and CVE-2007-3116.


definition_id: oval:org.debian:def:47843733425447601508836087760135179818
title: CVE-2007-3115 maradns
description:
Multiple memory leaks in server/MaraDNS.c in MaraDNS before 1.2.12.06, and 1.3.x before 1.3.05, allow remote attackers to cause a denial of service (memory consumption) via (1) reverse lookups or (2) requests for records in a class other than Internet (IN), a different set of affected versions than CVE-2007-3114 and CVE-2007-3116.


definition_id: oval:org.debian:def:240670637812317301827094444331119799513
title: CVE-2007-3116 maradns
description:
Memory leak in server/MaraDNS.c in MaraDNS 1.2.12.06 and 1.3.05 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, a different set of affected versions than CVE-2007-3114 and CVE-2007-3115.


definition_id: oval:org.debian:def:83950275074960161394411287956028827436
title: CVE-2007-3121 zvbi
description:
Buffer overflow in the CCdecode function in contrib/ntsc-cc.c in the zvbi-ntsc-cc tool in Zapping VBI Library (ZVBI) before 0.2.25 allows attackers to cause a denial of service (application crash) and possibly execute arbitrary code via long data during a reception error.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:248025294354717720362302283691224746485
title: CVE-2007-3122 clamav
description:
The parsing engine in ClamAV before 0.90.3 and 0.91 before 0.91rc1 allows remote attackers to bypass scanning via a RAR file with a header flag value of 10, which can be processed by WinRAR.


definition_id: oval:org.debian:def:43601718398623140522921431005287585629
title: CVE-2007-3123 clamav
description:
unrar.c in libclamav in ClamAV before 0.90.3 and 0.91 before 0.91rc1 allows remote attackers to cause a denial of service (core dump) via a crafted RAR file with a modified vm_codesize value, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:75501081677505726838529988399461673474
title: CVE-2007-3126 gimp
description:
Gimp before 2.8.22 allows context-dependent attackers to cause a denial of service (crash) via an ICO file with an InfoHeader containing a Height of zero, a similar issue to CVE-2007-2237.


definition_id: oval:org.debian:def:207566546983143539075540321667810920794
title: CVE-2007-3140 wordpress
description:
SQL injection vulnerability in xmlrpc.php in WordPress 2.2 allows remote authenticated users to execute arbitrary SQL commands via a parameter value in an XML RPC wp.suggestCategories methodCall, a different vector than CVE-2007-1897.


definition_id: oval:org.debian:def:204754674865347513208819715337561789495
title: CVE-2007-3163 moin
description:
Incomplete blacklist vulnerability in the filemanager in Frederico Caldeira Knabben FCKeditor 2.4.2 allows remote attackers to upload arbitrary .php files via an alternate data stream syntax, as demonstrated by .php::$DATA filenames, a related issue to CVE-2006-0658.


definition_id: oval:org.debian:def:175015822581415051344807409089811631841
title: CVE-2007-3165 tor
description:
Tor before 0.1.2.14 can construct circuits in which an entry guard is in the same family as the exit node, which might compromise the anonymity of traffic sources and destinations by exposing traffic to inappropriate remote observers.


definition_id: oval:org.debian:def:125591927777235836219816047433224093815
title: CVE-2007-3215 libphp-phpmailer
description:
PHPMailer 1.7, when configured to use sendmail, allows remote attackers to execute arbitrary shell commands via shell metacharacters in the SendmailSend function in class.phpmailer.php.


definition_id: oval:org.debian:def:26899712939327336266489428441841631743
title: CVE-2007-3227 rails
description:
Cross-site scripting (XSS) vulnerability in the to_json (ActiveRecord::Base#to_json) function in Ruby on Rails before edge 9606 allows remote attackers to inject arbitrary web script via the input values.


definition_id: oval:org.debian:def:99270192286235797124507004342058313853
title: CVE-2007-3238 wordpress
description:
Cross-site scripting (XSS) vulnerability in functions.php in the default theme in WordPress 2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the PATH_INFO (REQUEST_URI) to wp-admin/themes.php, a different vulnerability than CVE-2007-1622.  NOTE: this might not cross privilege boundaries in some configurations, since the Administrator role has the unfiltered_html capability.


definition_id: oval:org.debian:def:152268778873815635888741300377431222532
title: CVE-2007-3257 evolution
description:
Camel (camel-imap-folder.c) in the mailer component for Evolution Data Server 1.11 allows remote IMAP servers to execute arbitrary code via a negative SEQUENCE value in GData, which is used as an array index.


definition_id: oval:org.debian:def:38017488818649703570225304709398411933
title: CVE-2007-3299 awffull
description:
Cross-site scripting (XSS) vulnerability in AWFFull before 3.7.4, when AllSearchStr (aka the All Search Terms report) is enabled, allows remote attackers to inject arbitrary web script or HTML via a search string.


definition_id: oval:org.debian:def:317814044872468210616802770947291983613
title: CVE-2007-3304 apache2
description:
Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka "SIGUSR1 killer."


definition_id: oval:org.debian:def:197961286624022851405798367746510911350
title: CVE-2007-3316 vlc
description:
Multiple format string vulnerabilities in plugins in VideoLAN VLC Media Player before 0.8.6c allow remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in (1) an Ogg/Vorbis file, (2) an Ogg/Theora file, (3) a CDDB entry for a CD Digital Audio (CDDA) file, or (4) Service Announce Protocol (SAP) multicast packets.


definition_id: oval:org.debian:def:306317400096657955904464397040090591870
title: CVE-2007-3372 avahi
description:
The Avahi daemon in Avahi before 0.6.20 allows attackers to cause a denial of service (exit) via empty TXT data over D-Bus, which triggers an assert error.


definition_id: oval:org.debian:def:299701611155988868581078576197775305774
title: CVE-2007-3377 libnet-dns-perl
description:
Header.pm in Net::DNS before 0.60, a Perl module, (1) generates predictable sequence IDs with a fixed increment and (2) can use the same starting ID for all child processes of a forking server, which allows remote attackers to spoof DNS responses, as originally reported for qpsmtp and spamassassin.


definition_id: oval:org.debian:def:310449524276240650348867061379710957946
title: CVE-2007-3389 wireshark
description:
Wireshark before 0.99.6 allows remote attackers to cause a denial of service (crash) via a crafted chunked encoding in an HTTP response, possibly related to a zero-length payload.


definition_id: oval:org.debian:def:111254122066770309292712753160637377712
title: CVE-2007-3390 wireshark
description:
Wireshark 0.99.5 and 0.10.x up to 0.10.14, when running on certain systems, allows remote attackers to cause a denial of service (crash) via crafted iSeries capture files that trigger a SIGTRAP.


definition_id: oval:org.debian:def:248768937119194986369083714579854821494
title: CVE-2007-3391 wireshark
description:
Wireshark 0.99.5 allows remote attackers to cause a denial of service (memory consumption) via a malformed DCP ETSI packet that triggers an infinite loop.


definition_id: oval:org.debian:def:272463700491816304182724328321049707057
title: CVE-2007-3392 wireshark
description:
Wireshark before 0.99.6 allows remote attackers to cause a denial of service via malformed (1) SSL or (2) MMS packets that trigger an infinite loop.


definition_id: oval:org.debian:def:300728068621068952424077808495259625744
title: CVE-2007-3393 wireshark
description:
Off-by-one error in the DHCP/BOOTP dissector in Wireshark before 0.99.6 allows remote attackers to cause a denial of service (crash) via crafted DHCP-over-DOCSIS packets.


definition_id: oval:org.debian:def:137780158562312167520978804289695515855
title: CVE-2007-3409 libnet-dns-perl
description:
Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack consumption) via a malformed compressed DNS packet with self-referencing pointers, which triggers an infinite loop.


definition_id: oval:org.debian:def:152802240024273401311785783064514687394
title: CVE-2007-3467 vlc
description:
Integer overflow in the __status_Update function in stats.c VideoLAN VLC Media Player before 0.8.6c allows remote attackers to cause a denial of service (crash) via a WAV file with a large sample rate.


definition_id: oval:org.debian:def:89829170546055922101989674939763582170
title: CVE-2007-3468 vlc
description:
input.c in VideoLAN VLC Media Player before 0.8.6c allows remote attackers to cause a denial of service (crash) via a crafted WAV file that causes an uninitialized i_nb_resamplers variable to be used.


definition_id: oval:org.debian:def:184270962962193978245356809078845852299
title: CVE-2007-3472 libgd2
description:
Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to have unspecified attack vectors and impact.


definition_id: oval:org.debian:def:195473303772783316802399094793051523915
title: CVE-2007-3473 libgd2
description:
The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure.


definition_id: oval:org.debian:def:309184329545273407018744649294024729792
title: CVE-2007-3475 libgd2
description:
The GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via a GIF image that has no global color map.


definition_id: oval:org.debian:def:41948492435242367406096032376678421588
title: CVE-2007-3476 libgd2
description:
Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash and heap corruption) via large color index values in crafted image data, which results in a segmentation fault.


definition_id: oval:org.debian:def:185705469468831677344815510804325122447
title: CVE-2007-3477 libgd2
description:
The (a) imagearc and (b) imagefilledarc functions in GD Graphics Library (libgd) before 2.0.35 allow attackers to cause a denial of service (CPU consumption) via a large (1) start or (2) end angle degree value.


definition_id: oval:org.debian:def:16082441509197478135194273591947967476
title: CVE-2007-3478 libgd2
description:
Race condition in gdImageStringFTEx (gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors, possibly involving truetype font (TTF) support.


definition_id: oval:org.debian:def:71758421374280813603772867825584956685
title: CVE-2007-3506 freetype
description:
The ft_bitmap_assure_buffer function in src/base/ftbimap.c in FreeType 2.3.3 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors involving bitmap fonts, related to a "memory buffer overwrite bug."


definition_id: oval:org.debian:def:199156830314628480385582976876983072793
title: CVE-2007-3508 glibc
description:
** DISPUTED **  Integer overflow in the process_envvars function in elf/rtld.c in glibc before 2.5-rc4 might allow local users to execute arbitrary code via a large LD_HWCAP_MASK environment variable value.  NOTE: the glibc maintainers state that they do not believe that this issue is exploitable for code execution.


definition_id: oval:org.debian:def:194936625028237725668360138064254067796
title: CVE-2007-3528 dar
description:
The blowfish mode in DAR before 2.3.4 uses weak Blowfish-CBC cryptography by (1) discarding random bits by the blowfish::make_ivec function in libdar/crypto.cpp that results in predictable and repeating IV values, and (2) direct use of a password for keying, which makes it easier for context-dependent attackers to decrypt files.


definition_id: oval:org.debian:def:162091744201897187452403727653842216476
title: CVE-2007-3543 wordpress
description:
Unrestricted file upload vulnerability in WordPress before 2.2.1 and WordPress MU before 1.2.3 allows remote authenticated users to upload and execute arbitrary PHP code by making a post that specifies a .php filename in the _wp_attached_file metadata field; and then sending this file's content, along with its post_ID value, to (1) wp-app.php or (2) app.php.


definition_id: oval:org.debian:def:248113251194021208532206806965229595417
title: CVE-2007-3544 wordpress
description:
Unrestricted file upload vulnerability in (1) wp-app.php and (2) app.php in WordPress 2.2.1 and WordPress MU 1.2.3 allows remote authenticated users to upload and execute arbitrary PHP code via unspecified vectors, possibly related to the wp_postmeta table and the use of custom fields in normal (non-attachment) posts.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-3543.


definition_id: oval:org.debian:def:291818458326918658892569421912559036771
title: CVE-2007-3564 curl
description:
libcurl 7.14.0 through 7.16.3, when built with GnuTLS support, does not check SSL/TLS certificate expiration or activation dates, which allows remote attackers to bypass certain access restrictions.


definition_id: oval:org.debian:def:162927744619730891230144953829502948770
title: CVE-2007-3639 wordpress
description:
WordPress before 2.2.2 allows remote attackers to redirect visitors to other websites and potentially obtain sensitive information via (1) the _wp_http_referer parameter to wp-pass.php, related to the wp_get_referer function in wp-includes/functions.php; and possibly other vectors related to (2) wp-includes/pluggable.php and (3) the wp_nonce_ays function in wp-includes/functions.php.


definition_id: oval:org.debian:def:262736241824121161260266589340328079241
title: CVE-2007-3641 libarchive
description:
archive_read_support_format_tar.c in libarchive before 2.2.4 does not properly compute the length of a certain buffer when processing a malformed pax extension header, which allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) PAX or (2) TAR archive that triggers a buffer overflow.


definition_id: oval:org.debian:def:123529588390285591596598171393943076746
title: CVE-2007-3644 libarchive
description:
archive_read_support_format_tar.c in libarchive before 2.2.4 allows user-assisted remote attackers to cause a denial of service (infinite loop) via (1) an end-of-file condition within a pax extension header or (2) a malformed pax extension header in an (a) PAX or a (b) TAR archive.


definition_id: oval:org.debian:def:317204032979882438515319267217760559526
title: CVE-2007-3645 libarchive
description:
archive_read_support_format_tar.c in libarchive before 2.2.4 allows user-assisted remote attackers to cause a denial of service (crash) via (1) an end-of-file condition within a tar header that follows a pax extension header or (2) a malformed pax extension header in an (a) PAX or a (b) TAR archive, which results in a NULL pointer dereference, a different issue than CVE-2007-3644.


definition_id: oval:org.debian:def:179417607813916726217885865464031827550
title: CVE-2007-3725 clamav
description:
The RAR VM (unrarvm.c) in Clam Antivirus (ClamAV) before 0.91 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted RAR archive, resulting in a NULL pointer dereference.


definition_id: oval:org.debian:def:79234624390792076178254485972149814585
title: CVE-2007-3726 rar
description:
Integer signedness error in the SET_VALUE function in rarvm.cpp in unrar 3.70 beta 3, as used in products including WinRAR and RAR for OS X, allows user-assisted remote attackers to cause a denial of service (crash) via a crafted RAR archive that causes a negative signed number to be cast to a large unsigned number.


definition_id: oval:org.debian:def:247285317268517707688766010362503440757
title: CVE-2007-3762 asterisk
description:
Stack-based buffer overflow in the IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to execute arbitrary code by sending a long (1) voice or (2) video RTP frame.


definition_id: oval:org.debian:def:271330655429651923014437140344146380049
title: CVE-2007-3763 asterisk
description:
The IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted (1) LAGRQ or (2) LAGRP frame that contains information elements of IAX frames, which results in a NULL pointer dereference when Asterisk does not properly set an associated variable.


definition_id: oval:org.debian:def:159313347981323432114797408049483241429
title: CVE-2007-3764 asterisk
description:
The Skinny channel driver (chan_skinny) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a certain data length value in a crafted packet, which results in an "overly large memcpy."


definition_id: oval:org.debian:def:104416065243022305751066771652448030245
title: CVE-2007-3765 asterisk
description:
The STUN implementation in Asterisk 1.4.x before 1.4.8, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted STUN length attribute in a STUN packet sent on an RTP port.


definition_id: oval:org.debian:def:291049327603520491030530311518479142611
title: CVE-2007-3770 xfce4-terminal
description:
The terminal_helper_execute function in terminal/terminal.c in Xfce Terminal 0.2.6 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a crafted link, as demonstrated using the "Open Link" functionality.


definition_id: oval:org.debian:def:14542973834071946468030257357686429643
title: CVE-2007-3798 tcpdump
description:
Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet, related to an unchecked return value.


definition_id: oval:org.debian:def:36213420522875758276791220092041908478
title: CVE-2007-3905 zoph
description:
SQL injection vulnerability in Zoph before 0.7.0.1 might allow remote attackers to execute arbitrary SQL commands via the _order parameter to (1) photos.php and (2) edit_photos.php.


definition_id: oval:org.debian:def:215020906392938906225653728878103818260
title: CVE-2007-3912 debian-goodies
description:
checkrestart in debian-goodies before 0.34 allows local users to gain privileges via shell metacharacters in the name of the executable file for a running process.


definition_id: oval:org.debian:def:5591114253871985622232857590244371334
title: CVE-2007-3916 skktools
description:
The main function in skkdic-expr.c in SKK Tools 1.2 allows local users to overwrite or delete arbitrary files via a symlink attack on a skkdic$PID temporary file.


definition_id: oval:org.debian:def:210181839483923568632769289641905301539
title: CVE-2007-3920 gnome-screensaver
description:
GNOME screensaver 2.20 in Ubuntu 7.10, when used with Compiz, does not properly reserve input focus, which allows attackers with physical access to take control of the session after entering an Alt-Tab sequence, a related issue to CVE-2007-3069.


definition_id: oval:org.debian:def:30375056369209352896660116073274093478
title: CVE-2007-3946 lighttpd
description:
mod_auth (http_auth.c) in lighttpd before 1.4.16 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors involving (1) a memory leak, (2) use of md5-sess without a cnonce, (3) base64 encoded strings, and (4) trailing whitespace in the Auth-Digest header.


definition_id: oval:org.debian:def:18504130733341423793104314814726692709
title: CVE-2007-3947 lighttpd
description:
request.c in lighttpd 1.4.15 allows remote attackers to cause a denial of service (daemon crash) by sending an HTTP request with duplicate headers, as demonstrated by a request containing two Location header lines, which results in a segmentation fault.


definition_id: oval:org.debian:def:16262791565069526926308215094401603453
title: CVE-2007-3948 lighttpd
description:
connections.c in lighttpd before 1.4.16 might accept more connections than the configured maximum, which allows remote attackers to cause a denial of service (failed assertion) via a large number of connection attempts.


definition_id: oval:org.debian:def:101743739581901994451748780619707560998
title: CVE-2007-3949 lighttpd
description:
mod_access.c in lighttpd 1.4.15 ignores trailing / (slash) characters in the URL, which allows remote attackers to bypass url.access-deny settings.


definition_id: oval:org.debian:def:2619408690339212915501840251697545306
title: CVE-2007-3950 lighttpd
description:
lighttpd 1.4.15, when run on 32 bit platforms, allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors involving the use of incompatible format specifiers in certain debugging messages in the (1) mod_scgi, (2) mod_fastcgi, and (3) mod_webdav modules.


definition_id: oval:org.debian:def:319048281766122291754179443246803539317
title: CVE-2007-3996 libgd2
description:
Multiple integer overflows in libgd in PHP before 5.2.4 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large (1) srcW or (2) srcH value to the (a) gdImageCopyResized function, or a large (3) sy (height) or (4) sx (width) value to the (b) gdImageCreate or the (c) gdImageCreateTrueColor function.


definition_id: oval:org.debian:def:50404831932865064040935118789889856480
title: CVE-2007-3999 krb5
description:
Stack-based buffer overflow in the svcauth_gss_validate function in lib/rpc/svc_auth_gss.c in the RPCSEC_GSS RPC library (librpcsecgss) in MIT Kerberos 5 (krb5) 1.4 through 1.6.2, as used by the Kerberos administration daemon (kadmind) and some third-party applications that use krb5, allows remote attackers to cause a denial of service (daemon crash) and probably execute arbitrary code via a long string in an RPC message.


definition_id: oval:org.debian:def:232489663176633123731644708454590527033
title: CVE-2007-4000 krb5
description:
The kadm5_modify_policy_internal function in lib/kadm5/srv/svr_policy.c in the Kerberos administration daemon (kadmind) in MIT Kerberos 5 (krb5) 1.5 through 1.6.2 does not properly check return values when the policy does not exist, which might allow remote authenticated users with the "modify policy" privilege to execute arbitrary code via unspecified vectors that trigger a write to an uninitialized pointer.


definition_id: oval:org.debian:def:324091651163492483149446876192315199118
title: CVE-2007-4029 libvorbis
description:
libvorbis 1.1.2, and possibly other versions before 1.2.0, allows context-dependent attackers to cause a denial of service via (1) an invalid mapping type, which triggers an out-of-bounds read in the vorbis_info_clear function in info.c, and (2) invalid blocksize values that trigger a segmentation fault in the read function in block.c.


definition_id: oval:org.debian:def:195366546004067539893705454411732078787
title: CVE-2007-4045 cups
description:
The CUPS service, as used in SUSE Linux before 20070720 and other Linux distributions, allows remote attackers to cause a denial of service via unspecified vectors related to an incomplete fix for CVE-2007-0720 that introduced a different denial of service problem in SSL negotiation.


definition_id: oval:org.debian:def:248154330593066695092647023009229143023
title: CVE-2007-4065 libvorbis
description:
lib/vorbisfile.c in libvorbisfile in Xiph.Org libvorbis before 1.2.0 allows context-dependent attackers to cause a denial of service (infinite loop) via a crafted OGG file, aka trac Changeset 13217.


definition_id: oval:org.debian:def:109568091825476949157760637019521573913
title: CVE-2007-4066 libvorbis
description:
Multiple buffer overflows in Xiph.Org libvorbis before 1.2.0 allow context-dependent attackers to cause a denial of service or have other unspecified impact via a crafted OGG file, aka trac Changesets 13162, 13168, 13169, 13170, 13172, 13211, and 13215, as demonstrated by an overflow in oggenc.exe related to the _psy_noiseguards_8 array.


definition_id: oval:org.debian:def:284243609532741946123330129111470430810
title: CVE-2007-4074 festival
description:
The default configuration of Centre for Speech Technology Research (CSTR) Festival 1.95 beta (aka 2.0 beta) on Gentoo Linux, SUSE Linux, and possibly other distributions, is run locally with elevated privileges without requiring authentication, which allows local and remote attackers to execute arbitrary commands via the local daemon on port 1314, a different vulnerability than CVE-2001-0956.  NOTE: this issue is local in some environments, but remote on others.


definition_id: oval:org.debian:def:189066850170688433124482868731538183057
title: CVE-2007-4091 rsync
description:
Multiple off-by-one errors in the sender.c in rsync 2.6.9 might allow remote attackers to execute arbitrary code via directory names that are not properly handled when calling the f_name function.


definition_id: oval:org.debian:def:3431788678059942841536349001646767985
title: CVE-2007-4096 tor
description:
Buffer overflow in Tor before 0.1.2.15, when using BSD natd support, allows remote attackers to cause a denial of service via unspecified vectors.


definition_id: oval:org.debian:def:52088345219505087035591961834893431885
title: CVE-2007-4097 tor
description:
Tor before 0.1.2.15 sends "destroy cells" containing the reason for tearing down a circuit, which allows remote attackers to obtain sensitive information, contrary to specifications.


definition_id: oval:org.debian:def:141302810179563902027312031279874522594
title: CVE-2007-4098 tor
description:
Tor before 0.1.2.15 does not properly distinguish "streamids from different exits," which might allow remote attackers with control over Tor routers to inject cells into arbitrary streams.


definition_id: oval:org.debian:def:197672645651068234977712296270299178175
title: CVE-2007-4099 tor
description:
Tor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to guard node, which allows remote attackers with control of certain guard nodes to obtain sensitive information and possibly leverage further attacks.


definition_id: oval:org.debian:def:315845291212956670529218357417735226846
title: CVE-2007-4100 mldonkey
description:
MLDonkey before 2.9.0 does not load certain code from $MLDONKEY/web_infos/ before the network modules become active, which allows remote attackers to bypass the IP blocklist.


definition_id: oval:org.debian:def:208831270101945576909545474656544565077
title: CVE-2007-4103 asterisk
description:
The IAX2 channel driver (chan_iax2) in Asterisk Open 1.2.x before 1.2.23, 1.4.x before 1.4.9, and Asterisk Appliance Developer Kit before 0.6.0, when configured to allow unauthenticated calls, allows remote attackers to cause a denial of service (resource exhaustion) via a flood of calls that do not complete a 3-way handshake, which causes an ast_channel to be allocated but not released.


definition_id: oval:org.debian:def:227244403302290783380037769687082078978
title: CVE-2007-4129 coolkey
description:
CoolKey 1.1.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files in the /tmp/.pk11ipc1/ directory.


definition_id: oval:org.debian:def:113705510077594454647283315690125372428
title: CVE-2007-4131 tar
description:
Directory traversal vulnerability in the contains_dot_dot function in src/names.c in GNU tar allows user-assisted remote attackers to overwrite arbitrary files via certain //.. (slash slash dot dot) sequences in directory symlinks in a TAR archive.


definition_id: oval:org.debian:def:79238528527362601655933832400262160466
title: CVE-2007-4135 libnfsidmap
description:
The NFSv4 ID mapper (nfsidmap) before 0.17 does not properly handle return values from the getpwnam_r function when performing a username lookup, which can cause it to report a file as being owned by "root" instead of "nobody" if the file exists on the server but not on the client.


definition_id: oval:org.debian:def:180604495348120384630084377976023369375
title: CVE-2007-4138 samba
description:
The Winbind nss_info extension (nsswitch/idmap_ad.c) in idmap_ad.so in Samba 3.0.25 through 3.0.25c, when the "winbind nss info" option is set to rfc2307 or sfu, grants all local users the privileges of gid 0 when the (1) RFC2307 or (2) Services for UNIX (SFU) primary group attribute is not defined.


definition_id: oval:org.debian:def:318938486874161133620254900883802052467
title: CVE-2007-4153 wordpress
description:
Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via (1) the Options Database Table in the Admin Panel, accessed through options.php; or (2) the opml_url parameter to link-import.php.  NOTE: this might not cross privilege boundaries in some configurations, since the Administrator role has the unfiltered_html capability.


definition_id: oval:org.debian:def:127087663020877584099445015237613502461
title: CVE-2007-4154 wordpress
description:
SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated administrators to execute arbitrary SQL commands via the page_options parameter to (1) options-general.php, (2) options-writing.php, (3) options-reading.php, (4) options-discussion.php, (5) options-privacy.php, (6) options-permalink.php, (7) options-misc.php, and possibly other unspecified components.


definition_id: oval:org.debian:def:153823703966510700314184699100207183362
title: CVE-2007-4174 tor
description:
Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allows remote attackers to modify the torrc configuration file, compromise anonymity, and have other unspecified impact via HTTP POST data containing commands without valid authentication, as demonstrated by an HTML form (1) hosted on a web site or (2) injected by a Tor exit node.


definition_id: oval:org.debian:def:279350251111660668074252513063032271952
title: CVE-2007-4195 sleuthkit
description:
Use-after-free vulnerability in ext2fs.c in Brian Carrier The Sleuth Kit (TSK) before 2.09 allows user-assisted remote attackers to cause a denial of service (application crash) and prevent examination of certain ext2fs files via a malformed ext2fs image.


definition_id: oval:org.debian:def:77346241902228984733078307470602262549
title: CVE-2007-4196 sleuthkit
description:
icat in Brian Carrier The Sleuth Kit (TSK) before 2.09 misinterprets a certain memory location as the holder of a loop iteration count, which allows user-assisted remote attackers to cause a denial of service (long loop) and prevent examination of certain NTFS files via a malformed NTFS image.


definition_id: oval:org.debian:def:74357258358880636514319349414181954961
title: CVE-2007-4197 sleuthkit
description:
icat in Brian Carrier The Sleuth Kit (TSK) before 2.09 omits NULL pointer checks in certain code paths, which allows user-assisted remote attackers to cause a denial of service (NULL dereference and application crash) and prevent examination of certain NTFS files via a malformed NTFS image.


definition_id: oval:org.debian:def:92355259336621434556445045132061662565
title: CVE-2007-4198 sleuthkit
description:
The fs_data_put_str function in ntfs.c in fls in Brian Carrier The Sleuth Kit (TSK) before 2.09 does not validate a certain length value, which allows user-assisted remote attackers to cause a denial of service (application crash) and prevent examination of certain NTFS files via a malformed NTFS image, which triggers a buffer over-read.


definition_id: oval:org.debian:def:124741302688010132017684444261499303243
title: CVE-2007-4199 sleuthkit
description:
Brian Carrier The Sleuth Kit (TSK) before 2.09 allows user-assisted remote attackers to cause a denial of service (application crash) and prevent examination of certain NTFS files via a malformed NTFS image that triggers (1) dereference of a certain integer value by ntfs_dent.c in fls, or (2) dereference of a certain other integer value by ntfs.c in fsstat.


definition_id: oval:org.debian:def:148210704732384138086169214314648741489
title: CVE-2007-4200 sleuthkit
description:
ntfs.c in fsstat in Brian Carrier The Sleuth Kit (TSK) before 2.09 interprets a certain variable as a byte count rather than a count of 32-bit integers, which allows user-assisted remote attackers to cause a denial of service (application crash) and prevent examination of certain NTFS files via a malformed NTFS image.


definition_id: oval:org.debian:def:107711949160563494187187345481931205797
title: CVE-2007-4211 dovecot
description:
The ACL plugin in Dovecot before 1.0.3 allows remote authenticated users with the insert right to save certain flags via a (1) COPY or (2) APPEND command.


definition_id: oval:org.debian:def:310080439875605482558277969335106100791
title: CVE-2007-4280 asterisk
description:
The Skinny channel driver (chan_skinny) in Asterisk Open Source before 1.4.10, AsteriskNOW before beta7, Appliance Developer Kit before 0.7.0, and Appliance s800i before 1.0.3 allows remote authenticated users to cause a denial of service (application crash) via a CAPABILITIES_RES_MESSAGE packet with a capabilities count larger than the capabilities_res_message array population.


definition_id: oval:org.debian:def:268570079392286773302922869563090780417
title: CVE-2007-4321 fail2ban
description:
fail2ban 0.8 and earlier does not properly parse sshd log files, which allows remote attackers to add arbitrary hosts to the /etc/hosts.deny file and cause a denial of service by adding arbitrary IP addresses to the sshd log file, as demonstrated by logging in via ssh with a client protocol version identification containing an IP address string, a different vector than CVE-2006-6302.


definition_id: oval:org.debian:def:77688318388174049416312407471910982990
title: CVE-2007-4337 streamripper
description:
Multiple buffer overflows in the httplib_parse_sc_header function in lib/http.c in Streamripper before 1.62.2 allow remote attackers to execute arbitrary code via long (1) Location and (2) Server HTTP headers, a different vulnerability than CVE-2006-3124.


definition_id: oval:org.debian:def:330287586467081525931713142432634897990
title: CVE-2007-4351 cups
description:
Off-by-one error in the ippReadIO function in cups/ipp.c in CUPS 1.3.3 allows remote attackers to cause a denial of service (crash) via a crafted (1) textWithLanguage or (2) nameWithLanguage Internet Printing Protocol (IPP) tag, leading to a stack-based buffer overflow.


definition_id: oval:org.debian:def:191232010886340112774625830930230656778
title: CVE-2007-4352 cups
description:
Array index error in the DCTStream::readProgressiveDataUnit method in xpdf/Stream.cc in Xpdf 3.02pl1, as used in poppler, teTeX, KDE, KOffice, CUPS, and other products, allows remote attackers to trigger memory corruption and execute arbitrary code via a crafted PDF file.


definition_id: oval:org.debian:def:198562835254633025275913029275786318683
title: CVE-2007-4396 irssi-scripts
description:
Multiple CRLF injection vulnerabilities in (1) ixmmsa.pl 0.3, (2) l33tmusic.pl 2.00, (3) mpg123.pl 0.01, (4) ogg123.pl 0.01, (5) xmms.pl 2.0, (6) xmms2.pl 1.1.3, and (7) xmmsinfo.pl 1.1.1.1 scripts for irssi before 0.8.11 allow user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences in the name of the song in a .mp3 file.


definition_id: oval:org.debian:def:208294108248569936460405879187578305099
title: CVE-2007-4398 irssi-scripts
description:
Multiple CRLF injection vulnerabilities in the (1) now-playing.rb and (2) xmms.pl 1.1 scripts for WeeChat allow user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences in the name of the song in a .mp3 file.


definition_id: oval:org.debian:def:117208252728597206409973395554245238116
title: CVE-2007-4400 konversation
description:
CRLF injection vulnerability in the included media script in Konversation allows user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences in the name of the song in a .mp3 file.


definition_id: oval:org.debian:def:304573965285999361523376332460094440667
title: CVE-2007-4408 ircd-ircu
description:
ircu 2.10.12.05 and earlier ignores timestamps in bounces, which allows remote attackers to take over a channel during a netjoin by causing a bounce while a server with an older version of the channel is linking.


definition_id: oval:org.debian:def:11344478548788058360801983233775689055
title: CVE-2007-4410 ircd-ircu
description:
ircu 2.10.12.05 and earlier does not properly synchronize a kick action in certain cross scenarios, which allows remote authenticated operators to prevent later kick or de-op actions from non-local ops.


definition_id: oval:org.debian:def:145433578957012779716319302895183792099
title: CVE-2007-4411 ircd-ircu
description:
ircu 2.10.12.05 and earlier allows remote attackers to discover the hidden IP address of arbitrary +x users via a series of /silence commands with (1) CIDR mask arguments or (2) certain other arguments that represent groups of IP addresses, then monitoring CTCP ping replies.


definition_id: oval:org.debian:def:191246866101062655499572547738501988207
title: CVE-2007-4455 asterisk
description:
The SIP channel driver (chan_sip) in Asterisk Open Source 1.4.x before 1.4.11, AsteriskNOW before beta7, Asterisk Appliance Developer Kit 0.x before 0.8.0, and s800i (Asterisk Appliance) 1.x before 1.0.3 allows remote attackers to cause a denial of service (memory exhaustion) via a SIP dialog that causes a large number of history entries to be created.


definition_id: oval:org.debian:def:286092406987322346758109186202290274950
title: CVE-2007-4460 id3lib3.8.3
description:
The RenderV2ToFile function in tag_file.cpp in id3lib (aka libid3) 3.8.3 allows local users to overwrite arbitrary files via a symlink attack on a temporary file whose name is constructed from the name of a file being tagged.


definition_id: oval:org.debian:def:83891229712304843287029194489485253809
title: CVE-2007-4462 po4a
description:
lib/Locale/Po4a/Po.pm in po4a before 0.32 allows local users to overwrite arbitrary files via a symlink attack on the gettextization.failed.po temporary file.


definition_id: oval:org.debian:def:110048111104915591609907993324179680806
title: CVE-2007-4465 apache2
description:
Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset.  NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.


definition_id: oval:org.debian:def:212919233159027207763196663289151871294
title: CVE-2007-4476 cpio
description:
Buffer overflow in the safer_name_suffix function in GNU tar has unspecified attack vectors and impact, resulting in a "crashing stack."


definition_id: oval:org.debian:def:117853900195361537558743305549463134175
title: CVE-2007-4483 wordpress
description:
Cross-site scripting (XSS) vulnerability in index.php in the WordPress Classic 1.5 theme in WordPress before 2.1.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO (PHP_SELF).


definition_id: oval:org.debian:def:167018194399286995299205417860788016604
title: CVE-2007-4510 clamav
description:
ClamAV before 0.91.2, as used in Kolab Server 2.0 through 2.2beta1 and other products, allows remote attackers to cause a denial of service (application crash) via (1) a crafted RTF file, which triggers a NULL dereference in the cli_scanrtf function in libclamav/rtf.c; or (2) a crafted HTML document with a data: URI, which triggers a NULL dereference in the cli_html_normalise function in libclamav/htmlnorm.c.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:198888446183745026134016328370177222563
title: CVE-2007-4525 spip
description:
** DISPUTED **  PHP remote file inclusion vulnerability in inc-calcul.php3 in SPIP 1.7.2 allows remote attackers to execute arbitrary PHP code via a URL in the squelette_cache parameter, a different vector than CVE-2006-1702. NOTE: this issue has been disputed by third party researchers, stating that the squelette_cache variable is initialized before use, and is only used within the scope of a function.


definition_id: oval:org.debian:def:323186642242212199489431602347462405312
title: CVE-2007-4542 mapserver
description:
Multiple cross-site scripting (XSS) vulnerabilities in MapServer before 4.10.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the (1) processLine function in maptemplate.c and the (2) writeError function in mapserv.c in the mapserv CGI program.


definition_id: oval:org.debian:def:280274626345482214378189887705163148282
title: CVE-2007-4560 clamav
description:
clamav-milter in ClamAV before 0.91.2, when run in black hole mode, allows remote attackers to execute arbitrary commands via shell metacharacters that are used in a certain popen call, involving the "recipient field of sendmail."


definition_id: oval:org.debian:def:199321323758442251848003681463168575396
title: CVE-2007-4565 fetchmail
description:
sink.c in fetchmail before 6.3.9 allows context-dependent attackers to cause a denial of service (NULL dereference and application crash) by refusing certain warning messages that are sent over SMTP.


definition_id: oval:org.debian:def:254166089973589798060934035015486384834
title: CVE-2007-4572 samba
description:
Stack-based buffer overflow in nmbd in Samba 3.0.0 through 3.0.26a, when configured as a Primary or Backup Domain controller, allows remote attackers to have an unknown impact via crafted GETDC mailslot requests, related to handling of GETDC logon server requests.


definition_id: oval:org.debian:def:261289960356381425403206172057109174857
title: CVE-2007-4575 hsqldb
description:
HSQLDB before 1.8.0.9, as used in OpenOffice.org (OOo) 2 before 2.3.1, allows user-assisted remote attackers to execute arbitrary Java code via crafted database documents, related to "exposing static java methods."


definition_id: oval:org.debian:def:26130851819677896709521971435820014517
title: CVE-2007-4601 tcp-wrappers
description:
A regression error in tcp-wrappers 7.6.dbs-10 and 7.6.dbs-11 might allow remote attackers to bypass intended access restrictions when a service uses libwrap but does not specify server connection information.


definition_id: oval:org.debian:def:164573637041198631205896894947993979308
title: CVE-2007-4619 flac
description:
Multiple integer overflows in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1, as used in Winamp before 5.5 and other products, allow user-assisted remote attackers to execute arbitrary code via a malformed FLAC file that triggers improper memory allocation, resulting in a heap-based buffer overflow.


definition_id: oval:org.debian:def:22129733862032937639126470761222239410
title: CVE-2007-4625 polipo
description:
Polipo before 1.0.2 allows remote HTTP servers to cause a denial of service (daemon crash) by aborting the response to a POST request.


definition_id: oval:org.debian:def:171378889652007628642555934893093548110
title: CVE-2007-4626 polipo
description:
Unspecified vulnerability in Polipo before 1.0.2 allows remote attackers to cause a denial of service (daemon crash) via certain network traffic associated with entities larger than 2 Gb.


definition_id: oval:org.debian:def:145965436556068394327396052071849525207
title: CVE-2007-4629 mapserver
description:
Buffer overflow in the processLine function in maptemplate.c in MapServer before 4.10.3 allows attackers to cause a denial of service and possibly execute arbitrary code via a mapfile with a long layer name, group name, or metadata entry name.


definition_id: oval:org.debian:def:31565055164450350529311713815435670120
title: CVE-2007-4631 qgit
description:
The DataLoader::doStart function in dataloader.cpp in QGit 1.5.6 and other versions up to 2pre1 allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on temporary files with predictable filenames.


definition_id: oval:org.debian:def:79405669429149647089160921281810743023
title: CVE-2007-4656 backup-manager
description:
backup-manager-upload in Backup Manager before 0.6.3 provides the FTP server hostname, username, and password as plaintext command line arguments during FTP uploads, which allows local users to obtain sensitive information by listing the process and its arguments, a different vulnerability than CVE-2007-2766.


definition_id: oval:org.debian:def:267392833959445768312099219850009427015
title: CVE-2007-4727 lighttpd
description:
Buffer overflow in the fcgi_env_add function in mod_proxy_backend_fastcgi.c in the mod_fastcgi extension in lighttpd before 1.4.18 allows remote attackers to overwrite arbitrary CGI variables and execute arbitrary code via an HTTP request with a long content length, as demonstrated by overwriting the SCRIPT_FILENAME variable, aka a "header overflow."


definition_id: oval:org.debian:def:178700826737978569479127248464820772114
title: CVE-2007-4730 xorg-server
description:
Buffer overflow in the compNewPixmap function in compalloc.c in the Composite extension for the X.org X11 server before 1.4 allows local users to execute arbitrary code by copying data from a large pixel depth pixmap into a smaller pixel depth pixmap.


definition_id: oval:org.debian:def:15109366230392795824127718806297510373
title: CVE-2007-4739 reprepro
description:
reprepro 1.3.0 through 2.2.3 does not properly verify signatures when updating repositories, which allows remote attackers to construct and distribute an ostensibly valid Release.gpg file by signing it with an unknown key, related to the update command.


definition_id: oval:org.debian:def:169944270843935073589547966061552435116
title: CVE-2007-4743 krb5
description:
The original patch for CVE-2007-3999 in svc_auth_gss.c in the RPCSEC_GSS RPC library in MIT Kerberos 5 (krb5) 1.4 through 1.6.2, as used by the Kerberos administration daemon (kadmind) and other applications that use krb5, does not correctly check the buffer length in some environments and architectures, which might allow remote attackers to conduct a buffer overflow attack.


definition_id: oval:org.debian:def:59546472003029462623023229519347942697
title: CVE-2007-4752 openssh
description:
ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted.


definition_id: oval:org.debian:def:286036752848783712948542998923990543986
title: CVE-2007-4754 alien-arena
description:
Format string vulnerability in the safe_bprintf function in acesrc/acebot_cmds.c in Alien Arena 2007 6.10 and earlier allows remote attackers to cause a denial of service (daemon crash) via format string specifiers in a nickname.


definition_id: oval:org.debian:def:113515384034327167954350927371428831293
title: CVE-2007-4755 alien-arena
description:
Alien Arena 2007 6.10 and earlier allows remote attackers to cause a denial of service (client disconnect) by sending a client_connect command in a forged packet from the server to a client.  NOTE: client IP addresses are available via product-specific queries.


definition_id: oval:org.debian:def:161205857800748684122040388775986695707
title: CVE-2007-4766 glib2.0
description:
Multiple integer overflows in Perl-Compatible Regular Expression (PCRE) library before 7.3 allow context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via unspecified escape (backslash) sequences.


definition_id: oval:org.debian:def:206238027580361810087275260851670352470
title: CVE-2007-4767 glib2.0
description:
Perl-Compatible Regular Expression (PCRE) library before 7.3 does not properly compute the length of (1) a \p sequence, (2) a \P sequence, or (3) a \P{x} sequence, which allows context-dependent attackers to cause a denial of service (infinite loop or crash) or execute arbitrary code.


definition_id: oval:org.debian:def:219293969551847444728211770892181076784
title: CVE-2007-4768 glib2.0
description:
Heap-based buffer overflow in Perl-Compatible Regular Expression (PCRE) library before 7.3 allows context-dependent attackers to execute arbitrary code via a singleton Unicode sequence in a character class in a regex pattern, which is incorrectly optimized.


definition_id: oval:org.debian:def:137684397362191500249376362372103722527
title: CVE-2007-4770 icu
description:
libicu in International Components for Unicode (ICU) 3.8.1 and earlier attempts to process backreferences to the nonexistent capture group zero (aka \0), which might allow context-dependent attackers to read from, or write to, out-of-bounds memory locations, related to corruption of REStackFrames.


definition_id: oval:org.debian:def:26275750055660791052748362517866374561
title: CVE-2007-4771 icu
description:
Heap-based buffer overflow in the doInterval function in regexcmp.cpp in libicu in International Components for Unicode (ICU) 3.8.1 and earlier allows context-dependent attackers to cause a denial of service (memory consumption) and possibly have unspecified other impact via a regular expression that writes a large amount of data to the backtracking stack.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:166071955592122748579186723515987756801
title: CVE-2007-4826 quagga
description:
bgpd in Quagga before 0.99.9 allows explicitly configured BGP peers to cause a denial of service (crash) via a malformed (1) OPEN message or (2) a COMMUNITY attribute, which triggers a NULL pointer dereference. NOTE: vector 2 only exists when debugging is enabled.


definition_id: oval:org.debian:def:248777023729297514455021336099739815538
title: CVE-2007-4828 mediawiki
description:
Cross-site scripting (XSS) vulnerability in the API pretty-printing mode in MediaWiki 1.8.0 through 1.8.4, 1.9.0 through 1.9.3, 1.10.0 through 1.10.1, and the 1.11 development versions before 1.11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:260112949252493159348395889993695261505
title: CVE-2007-4829 perl
description:
Directory traversal vulnerability in the Archive::Tar Perl module 1.36 and earlier allows user-assisted remote attackers to overwrite arbitrary files via a TAR archive that contains a file whose name is an absolute path or has ".." sequences.


definition_id: oval:org.debian:def:188705467974101929301142268310239020434
title: CVE-2007-4840 glibc
description:
PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service (application crash) via (1) a long string in the out_charset parameter to the iconv function; or a long string in the charset parameter to the (2) iconv_mime_decode_headers, (3) iconv_mime_decode, or (4) iconv_strlen function.  NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless these issues can be demonstrated for code execution.


definition_id: oval:org.debian:def:308915401221482202650859437727973049414
title: CVE-2007-4893 wordpress
description:
wp-admin/admin-functions.php in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a does not properly verify the unfiltered_html privilege, which allows remote attackers to conduct cross-site scripting (XSS) attacks via modified data to (1) post.php or (2) page.php with a no_filter field.


definition_id: oval:org.debian:def:174744507845865496761806351237282871161
title: CVE-2007-4894 wordpress
description:
Multiple SQL injection vulnerabilities in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a allow remote attackers to execute arbitrary SQL commands via the post_type parameter to the pingback.extensions.getPingbacks method in the XMLRPC interface, and other unspecified parameters related to "early database escaping" and missing validation of "query string like parameters."


definition_id: oval:org.debian:def:187720190657293752688520809221247206575
title: CVE-2007-4938 mplayer
description:
Heap-based buffer overflow in libmpdemux/aviheader.c in MPlayer 1.0rc1 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a .avi file with certain large "indx truck size" and nEntriesInuse values, and a certain wLongsPerEntry value.


definition_id: oval:org.debian:def:208623169276136481859154837401069757355
title: CVE-2007-4974 ardour
description:
Heap-based buffer overflow in the flac_buffer_copy function in libsndfile 1.0.17 and earlier might allow remote attackers to execute arbitrary code via a FLAC file with crafted PCM data containing a block with a size that exceeds the previous block size.


definition_id: oval:org.debian:def:40418312594786822454695412285193569732
title: CVE-2007-4985 graphicsmagick
description:
ImageMagick before 6.3.5-9 allows context-dependent attackers to cause a denial of service via a crafted image file that triggers (1) an infinite loop in the ReadDCMImage function, related to ReadBlobByte function calls; or (2) an infinite loop in the ReadXCFImage function, related to ReadBlobMSBLong function calls.


definition_id: oval:org.debian:def:206600463214255076272185166284037420591
title: CVE-2007-4986 graphicsmagick
description:
Multiple integer overflows in ImageMagick before 6.3.5-9 allow context-dependent attackers to execute arbitrary code via a crafted (1) .dcm, (2) .dib, (3) .xbm, (4) .xcf, or (5) .xwd image file, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:33859635859752106795263600720956158609
title: CVE-2007-4987 imagemagick
description:
Off-by-one error in the ReadBlobString function in blob.c in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted image file, which triggers the writing of a '\0' character to an out-of-bounds address.


definition_id: oval:org.debian:def:224660917124201976782082452176781808856
title: CVE-2007-4988 graphicsmagick
description:
Sign extension error in the ReadDIBImage function in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted width value in an image file, which triggers an integer overflow and a heap-based buffer overflow.


definition_id: oval:org.debian:def:23360227096774928303867222826966646145
title: CVE-2007-4995 openssl
description:
Off-by-one error in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8f allows remote attackers to execute arbitrary code via unspecified vectors.


definition_id: oval:org.debian:def:234542420191681879332340029237786636269
title: CVE-2007-4996 pidgin
description:
libpurple in Pidgin before 2.2.1 does not properly handle MSN nudge messages from users who are not on the receiver's buddy list, which allows remote attackers to cause a denial of service (crash) via a nudge message that triggers an access of "an invalid memory location."


definition_id: oval:org.debian:def:7436166240132860123070573435995658215
title: CVE-2007-4998 coreutils
description:
cp, when running with an option to preserve symlinks on multiple OSes, allows local, user-assisted attackers to overwrite arbitrary files via a symlink attack using crafted directories containing multiple source files that are copied to the same destination.


definition_id: oval:org.debian:def:140077879280603566653832680983453845137
title: CVE-2007-4999 pidgin
description:
libpurple in Pidgin 2.1.0 through 2.2.1, when using HTML logging, allows remote attackers to cause a denial of service (NULL dereference and application crash) via a message that contains invalid HTML data, a different vector than CVE-2007-4996.


definition_id: oval:org.debian:def:136050802768038783398779389894134084029
title: CVE-2007-5000 apache2
description:
Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:23797203854352628262637523074686559803
title: CVE-2007-5007 balsa
description:
Stack-based buffer overflow in the ir_fetch_seq function in balsa before 2.3.20 might allow remote IMAP servers to execute arbitrary code via a long response to a FETCH command.


definition_id: oval:org.debian:def:172176115384072938947897904528182542166
title: CVE-2007-5028 dibbler
description:
Dibbler 0.6.0 on Linux uses weak world-writable permissions for unspecified files in /var/lib/dibbler, which has unknown impact and local attack vectors.


definition_id: oval:org.debian:def:136084461573496785983746371061058042852
title: CVE-2007-5029 dibbler
description:
Dibbler 0.6.0 does not verify that certain length parameters are appropriate for buffer sizes, which allows remote attackers to trigger a buffer over-read and cause a denial of service (daemon crash), as demonstrated by incorrect behavior of the TSrvMsg constructor in SrvMessages/SrvMsg.cpp when (1) reading the option code and option length and (2) parsing options.


definition_id: oval:org.debian:def:42576102421635069210196815176180437757
title: CVE-2007-5030 dibbler
description:
Multiple integer overflows in Dibbler 0.6.0 allow remote attackers to cause a denial of service (daemon crash) via packets containing options with large lengths, which trigger attempts at excessive memory allocation, as demonstrated by (1) the TSrvMsg constructor in SrvMessages/SrvMsg.cpp; the (2) TClntMsg, (3) TClntOptIAAddress, (4) TClntOptIAPrefix, (5) TOptVendorSpecInfo, and (6) TOptOptionRequest constructors; and the (7) TRelIfaceMgr::decodeRelayRepl, (8) TRelMsg::decodeOpts, and (9) TSrvIfaceMgr::decodeRelayForw methods.


definition_id: oval:org.debian:def:223350212977659049992281107544068310628
title: CVE-2007-5031 dibbler
description:
The TSrvOptIA_NA::rebind method in SrvOptions/SrvOptIA_NA.cpp in Dibbler 0.6.0 allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via an invalid IA_NA option in a REBIND message.


definition_id: oval:org.debian:def:312170958147164603531311438365787956150
title: CVE-2007-5034 elinks
description:
ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS.  NOTE: this issue only occurs when a proxy is defined for https.


definition_id: oval:org.debian:def:167925253834374798048036538077208699517
title: CVE-2007-5037 inotify-tools
description:
Buffer overflow in the inotifytools_snprintf function in src/inotifytools.c in the inotify-tools library before 3.11 allows context-dependent attackers to execute arbitrary code via a long filename.


definition_id: oval:org.debian:def:190426497676796346827515353293576760971
title: CVE-2007-5105 wordpress
description:
Cross-site scripting (XSS) vulnerability in wp-register.php in WordPress 2.0 and 2.0.1 allows remote attackers to inject arbitrary web script or HTML via the user_email parameter.


definition_id: oval:org.debian:def:88137883488024278849327376702239025681
title: CVE-2007-5106 wordpress
description:
Cross-site scripting (XSS) vulnerability in wp-register.php in WordPress 2.0 allows remote attackers to inject arbitrary web script or HTML via the user_login parameter.


definition_id: oval:org.debian:def:185647188638939538368321318806741961512
title: CVE-2007-5116 perl
description:
Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 allows context-dependent attackers to execute arbitrary code by switching from byte to Unicode (UTF) characters in a regular expression.


definition_id: oval:org.debian:def:197573466817465552928615771340986252697
title: CVE-2007-5135 openssl
description:
Off-by-one error in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 up to 0.9.7l, and 0.9.8 up to 0.9.8f, might allow remote attackers to execute arbitrary code via a crafted packet that triggers a one-byte buffer underflow.  NOTE: this issue was introduced as a result of a fix for CVE-2006-3738.  As of 20071012, it is unknown whether code execution is possible.


definition_id: oval:org.debian:def:20520456958897850036330726886713842719
title: CVE-2007-5137 libtk-img
description:
Buffer overflow in the ReadImage function in generic/tkImgGIF.c in Tcl (Tcl/Tk) 8.4.13 through 8.4.15 allows remote attackers to execute arbitrary code via multi-frame interlaced GIF files in which later frames are smaller than the first.  NOTE: this issue is due to an incorrect patch for CVE-2007-5378.


definition_id: oval:org.debian:def:59796647813862431214925366666331468145
title: CVE-2007-5156 moin
description:
Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.beta, La-Nai CMS, Syntax CMS, Cardinal Cms, and probably other products, allows remote attackers to upload and execute arbitrary PHP code via a file whose name contains ".php." and has an unknown extension, which is recognized as a .php file by the Apache HTTP server, a different vulnerability than CVE-2006-0658 and CVE-2006-2529.


definition_id: oval:org.debian:def:72033912696977294619978642653480085928
title: CVE-2007-5159 ntfs-3g
description:
The ntfs-3g package before 1.913-2.fc7 in Fedora 7, and an ntfs-3g package in Ubuntu 7.10/Gutsy, assign incorrect permissions (setuid root) to mount.ntfs-3g, which allows local users with fuse group membership to read from and write to arbitrary block devices, possibly involving a file descriptor leak.


definition_id: oval:org.debian:def:238369997470899668919205529384032774628
title: CVE-2007-5191 util-linux
description:
mount and umount in util-linux and loop-aes-utils call the setuid and setgid functions in the wrong order and do not check the return values, which might allow attackers to gain privileges via helpers such as mount.nfs.


definition_id: oval:org.debian:def:319965465470307052133985870329803847103
title: CVE-2007-5197 mono
description:
Buffer overflow in the Mono.Math.BigInteger class in Mono 1.2.5.1 and earlier allows context-dependent attackers to execute arbitrary code via unspecified vectors related to Reduce in Montgomery-based Pow methods.


definition_id: oval:org.debian:def:191510532850342910415609378165829988714
title: CVE-2007-5199 libxfont
description:
A single byte overflow in catalogue.c in X.Org libXfont 1.3.1 allows remote attackers to have unspecified impact.


definition_id: oval:org.debian:def:160841071814432243000058765576202719352
title: CVE-2007-5200 hugin
description:
hugin, as used on various operating systems including SUSE openSUSE 10.2 and 10.3, allows local users to overwrite arbitrary files via a symlink attack on the hugin_debug_optim_results.txt temporary file.


definition_id: oval:org.debian:def:71176274719942232465103767086486731806
title: CVE-2007-5201 duplicity
description:
The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments.


definition_id: oval:org.debian:def:85305325964303559403298162807376774730
title: CVE-2007-5207 guilt
description:
guilt 0.27 allows local users to overwrite arbitrary files via a symlink attack on a guilt.log.[PID] temporary file.


definition_id: oval:org.debian:def:231156340267544119028668266698466368926
title: CVE-2007-5208 hplip
description:
hpssd in Hewlett-Packard Linux Imaging and Printing Project (hplip) 1.x and 2.x before 2.7.10 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a from address, which is not properly handled when invoking sendmail.


definition_id: oval:org.debian:def:76047574334874654717771452147506761747
title: CVE-2007-5226 dircproxy
description:
irc_server.c in dircproxy 1.2.0 and earlier allows remote attackers to cause a denial of service (segmentation fault) via an ACTION command without a parameter, which triggers a NULL pointer dereference, as demonstrated using a blank /me message from irssi.


definition_id: oval:org.debian:def:329730719408079013716723321593472881660
title: CVE-2007-5301 alsaplayer
description:
Buffer overflow in the vorbis_stream_info function in input/vorbis/vorbis_engine.c (aka the vorbis input plugin) in AlsaPlayer before 0.99.80-rc3 allows remote attackers to execute arbitrary code via a .OGG file with long comments.


definition_id: oval:org.debian:def:162052079941556092392811395283332487384
title: CVE-2007-5358 asterisk
description:
Multiple buffer overflows in the voicemail functionality in Asterisk 1.4.x before 1.4.13, when using IMAP storage, might allow (1) remote attackers to execute arbitrary code via a long combination of Content-type and Content-description headers, or (2) local users to execute arbitrary code via a long combination of astspooldir, voicemail context, and voicemail mailbox fields.  NOTE: vector 2 requires write access to Asterisk configuration files.


definition_id: oval:org.debian:def:275313230244526769041247215213615897564
title: CVE-2007-5373 ldapscripts
description:
ldapscripts 1.4 and 1.7 sends a password as a command line argument when calling some LDAP programs, which might allow local users to read the password by listing the process and its arguments, as demonstrated by a call to ldappasswd in the _changepassword function.


definition_id: oval:org.debian:def:144959024775864108258808125237805566971
title: CVE-2007-5378 libtk-img
description:
Buffer overflow in the FileReadGIF function in tkImgGIF.c for Tk Toolkit 8.4.12 and earlier, and 8.3.5 and earlier, allows user-assisted attackers to cause a denial of service (segmentation fault) via an animated GIF in which the first subimage is smaller than a subsequent subimage, which triggers the overflow in the ReadImage function, a different vulnerability than CVE-2007-5137.


definition_id: oval:org.debian:def:284667821459207252673548706806344194619
title: CVE-2007-5379 rails
description:
Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.


definition_id: oval:org.debian:def:137103082797866266491520101753005192324
title: CVE-2007-5380 rails
description:
Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."


definition_id: oval:org.debian:def:282588255149473497583820009038447011254
title: CVE-2007-5392 cups
description:
Integer overflow in the DCTStream::reset method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a crafted PDF file, resulting in a heap-based buffer overflow.


definition_id: oval:org.debian:def:303834413920655324848765853930030766867
title: CVE-2007-5393 cups
description:
Heap-based buffer overflow in the CCITTFaxStream::lookChar method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a PDF file that contains a crafted CCITTFaxDecode filter.


definition_id: oval:org.debian:def:113109858011276109531984694559954568927
title: CVE-2007-5395 link-grammar
description:
Stack-based buffer overflow in the separate_word function in tokenize.c in Link Grammar 4.1b and possibly other versions, as used in AbiWord Link Grammar 4.2.4, allows remote attackers to execute arbitrary code via a long word, as reachable through the separate_sentence function.


definition_id: oval:org.debian:def:115133788978971445177351483792493290276
title: CVE-2007-5398 samba
description:
Stack-based buffer overflow in the reply_netbios_packet function in nmbd/nmbd_packets.c in nmbd in Samba 3.0.0 through 3.0.26a, when operating as a WINS server, allows remote attackers to execute arbitrary code via crafted WINS Name Registration requests followed by a WINS Name Query request.


definition_id: oval:org.debian:def:127392017534154594239905059009321769277
title: CVE-2007-5585 xscreensaver
description:
xscreensaver 5.03 and earlier, when running without xscreensaver-gl-extras (GL extras) installed, crashes when /usr/bin/xscreensaver-gl-helper does not exist and a user attempts to unlock the screen, which allows attackers with physical access to gain access to the locked session.


definition_id: oval:org.debian:def:311538031783835259519075620955214242091
title: CVE-2007-5626 bacula
description:
make_catalog_backup in Bacula 2.2.5, and probably earlier, sends a MySQL password as a command line argument, and sometimes transmits cleartext e-mail containing this command line, which allows context-dependent attackers to obtain the password by listing the process and its arguments, or by sniffing the network.


definition_id: oval:org.debian:def:174002947068016363643451931695109335539
title: CVE-2007-5710 wordpress
description:
Cross-site scripting (XSS) vulnerability in wp-admin/edit-post-rows.php in WordPress 2.3 allows remote attackers to inject arbitrary web script or HTML via the posts_columns array parameter.


definition_id: oval:org.debian:def:224488060200033559410538570508063021468
title: CVE-2007-5712 python-django
description:
The internationalization (i18n) framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USE_I18N option and the i18n component are enabled, allows remote attackers to cause a denial of service (memory consumption) via many HTTP requests with large Accept-Language headers.


definition_id: oval:org.debian:def:96305210533418307445224205361060596641
title: CVE-2007-5718 vobcopy
description:
vobcopy 0.5.14 allows local users to append data to an arbitrary file, or create an arbitrary new file, via a symlink attack on the (1) /tmp/vobcopy.bla or (2) /tmp/vobcopy_0.5.14.log temporary file.


definition_id: oval:org.debian:def:46475229541642123450744635929031512635
title: CVE-2007-5728 phppgadmin
description:
Cross-site scripting (XSS) vulnerability in phpPgAdmin 3.5 to 4.1.1, and possibly 4.1.2, allows remote attackers to inject arbitrary web script or HTML via certain input available in PHP_SELF in (1) redirect.php, possibly related to (2) login.php, different vectors than CVE-2007-2865.


definition_id: oval:org.debian:def:123907454904862247815151043336382257990
title: CVE-2007-5729 qemu
description:
The NE2000 emulator in QEMU 0.8.2 allows local users to execute arbitrary code by writing Ethernet frames with a size larger than the MTU to the EN0_TCNT register, which triggers a heap-based buffer overflow in the slirp library, aka NE2000 "mtu" heap overflow.  NOTE: some sources have used CVE-2007-1321 to refer to this issue as part of "NE2000 network driver and the socket code," but this is the correct identifier for the mtu overflow vulnerability.


definition_id: oval:org.debian:def:294432361677370694902179494388027909566
title: CVE-2007-5730 qemu
description:
Heap-based buffer overflow in QEMU 0.8.2, as used in Xen and possibly other products, allows local users to execute arbitrary code via crafted data in the "net socket listen" option, aka QEMU "net socket" heap overflow.  NOTE: some sources have used CVE-2007-1321 to refer to this issue as part of "NE2000 network driver and the socket code," but this is the correct identifier for the individual net socket listen vulnerability.


definition_id: oval:org.debian:def:215147802939899572284823113560413061782
title: CVE-2007-5740 perdition
description:
The format string protection mechanism in IMAPD for Perdition Mail Retrieval Proxy 1.17 and earlier allows remote attackers to execute arbitrary code via an IMAP tag with a null byte followed by a format string specifier, which is not counted by the mechanism.


definition_id: oval:org.debian:def:69019010752607240537712919955520174554
title: CVE-2007-5743 viewvc
description:
viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option.


definition_id: oval:org.debian:def:34976982947982995773135561778819223058
title: CVE-2007-5751 liferea
description:
Liferea before 1.4.6 uses weak permissions (0644) for the feedlist.opml backup file, which allows local users to obtain credentials.


definition_id: oval:org.debian:def:305621513076843349514156983655047301508
title: CVE-2007-5760 xorg-server
description:
Array index error in the XFree86-Misc extension in X.Org Xserver before 1.4.1 allows context-dependent attackers to execute arbitrary code via a PassMessage request containing a large array index.


definition_id: oval:org.debian:def:173651797843987797993830136922732583750
title: CVE-2007-5794 libnss-ldap
description:
Race condition in nss_ldap, when used in applications that are linked against the pthread library and fork after a call to nss_ldap, might send user data to the wrong process because of improper handling of the LDAP connection. NOTE: this issue was originally reported for Dovecot with the wrong mailboxes being returned, but other applications might also be affected.


definition_id: oval:org.debian:def:75096549144480008951225376333480725973
title: CVE-2007-5828 python-django
description:
** DISPUTED **  Cross-site request forgery (CSRF) vulnerability in the admin panel in Django 0.96 allows remote attackers to change passwords of arbitrary users via a request to admin/auth/user/1/password/.  NOTE: this issue has been disputed by Debian, since product documentation includes a recommendation for a CSRF protection module that is included with the product.  However, CVE considers this an issue because the default configuration does not use this module.


definition_id: oval:org.debian:def:300798390276402137629120847284172363897
title: CVE-2007-5846 net-snmp
description:
The SNMP agent (snmp_agent.c) in net-snmp before 5.4.1 allows remote attackers to cause a denial of service (CPU and memory consumption) via a GETBULK request with a large max-repeaters value.


definition_id: oval:org.debian:def:220814412244847229608100124480274794337
title: CVE-2007-5848 cups
description:
Buffer overflow in CUPS in Apple Mac OS X 10.4.11 allows local admin users to execute arbitrary code via a crafted URI to the CUPS service.


definition_id: oval:org.debian:def:261948362947352649600138703348045321781
title: CVE-2007-5849 cups
description:
Integer underflow in the asn1_get_string function in the SNMP back end (backend/snmp.c) for CUPS 1.2 through 1.3.4 allows remote attackers to execute arbitrary code via a crafted SNMP response that triggers a stack-based buffer overflow.


definition_id: oval:org.debian:def:254407820233066536588770981574780584409
title: CVE-2007-5894 krb5
description:
** DISPUTED **  The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when auth_type has a certain value, which has unknown impact and remote authenticated attack vectors.  NOTE: the original disclosure misidentifies the conditions under which the uninitialized variable is used.  NOTE: the vendor disputes this issue, stating " The 'length' variable is only uninitialized if 'auth_type' is neither the 'KERBEROS_V4' nor 'GSSAPI'; this condition cannot occur in the unmodified source code."


definition_id: oval:org.debian:def:309602011171977628252209594127045841683
title: CVE-2007-5901 krb5
description:
Use-after-free vulnerability in the gss_indicate_mechs function in lib/gssapi/mechglue/g_initialize.c in MIT Kerberos 5 (krb5) has unknown impact and attack vectors.  NOTE: this might be the result of a typo in the source code.


definition_id: oval:org.debian:def:133888687582981214124624304468682123497
title: CVE-2007-5902 krb5
description:
Integer overflow in the svcauth_gss_get_principal function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (krb5) allows remote attackers to have an unknown impact via a large length value for a GSS client name in an RPC request.


definition_id: oval:org.debian:def:293032223261961519563423626347199249984
title: CVE-2007-5933 pioneers
description:
Pioneers (formerly gnocatan) before 0.11.3 allows remote attackers to cause a denial of service (crash) by triggering a delete operation while the Session object is still being used, as demonstrated by causing a "Broken pipe" error.


definition_id: oval:org.debian:def:114861087024235281580990041341947006865
title: CVE-2007-5934 php-mdb2
description:
The LOB functionality in PEAR MDB2 before 2.5.0a1 interprets a request to store a URL string as a request to retrieve and store the contents of the URL, which might allow remote attackers to use MDB2 as an indirect proxy or obtain sensitive information via a URL into a form field in an MDB2 application, as demonstrated by a file:// URL or a URL for an intranet web site.


definition_id: oval:org.debian:def:149870859982200217377538378332967813547
title: CVE-2007-5935 texlive-bin
description:
Stack-based buffer overflow in hpc.c in dvips in teTeX and TeXlive 2007 and earlier allows user-assisted attackers to execute arbitrary code via a DVI file with a long href tag.


definition_id: oval:org.debian:def:55964216220089430892863136726855101758
title: CVE-2007-5936 texlive-bin
description:
dvips in teTeX and TeXlive 2007 and earlier allows local users to obtain sensitive information and modify certain data by creating certain temporary files before they are processed by dviljk, which can then be read or modified in place.


definition_id: oval:org.debian:def:312715426668256991394183465068594950711
title: CVE-2007-5937 texlive-bin
description:
Multiple buffer overflows in dvi2xx.c in dviljk in teTeX and TeXlive 2007 and earlier might allow user-assisted attackers to execute arbitrary code via a crafted DVI input file.


definition_id: oval:org.debian:def:110807060045088100371112508402655208005
title: CVE-2007-5940 feynmf
description:
feynmf.pl in feynmf 1.08, as used in TeXLive 2007, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the feynmf$$.pl temporary file.


definition_id: oval:org.debian:def:87265386916161750025649565429000016868
title: CVE-2007-5958 xorg-server
description:
X.Org Xserver before 1.4.1 allows local users to determine the existence of arbitrary files via a filename argument in the -sp option to the X program, which produces different error messages depending on whether the filename exists.


definition_id: oval:org.debian:def:227398430411714145132848162646888108247
title: CVE-2007-5964 autofs
description:
The default configuration of autofs 5 in some Linux distributions, such as Red Hat Enterprise Linux (RHEL) 5, omits the nosuid option for the hosts (/net filesystem) map, which allows local users to gain privileges via a setuid program on a remote NFS server.


definition_id: oval:org.debian:def:11845930083782626116140190627216959457
title: CVE-2007-5965 qt4-x11
description:
QSslSocket in Trolltech Qt 4.3.0 through 4.3.2 does not properly verify SSL certificates, which might make it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service, or trick a service into accepting an invalid client certificate for a user.


definition_id: oval:org.debian:def:331884524487837890451906065224092656082
title: CVE-2007-5971 krb5
description:
Double free vulnerability in the gss_krb5int_make_seal_token_v3 function in lib/gssapi/krb5/k5sealv3.c in MIT Kerberos 5 (krb5) has unknown impact and attack vectors.


definition_id: oval:org.debian:def:179980011507138313164539063295829162750
title: CVE-2007-5972 krb5
description:
Double free vulnerability in the krb5_def_store_mkey function in lib/kdb/kdb_default.c in MIT Kerberos 5 (krb5) 1.5 has unknown impact and remote authenticated attack vectors.  NOTE: the free operations occur in code that stores the krb5kdc master key, and so the attacker must have privileges to store this key.


definition_id: oval:org.debian:def:312535296627296144975733202395904845591
title: CVE-2007-6010 pioneers
description:
Unspecified vulnerability in pioneers (formerly gnocatan) 0.11.3 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors that trigger an assert error.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-5933.


definition_id: oval:org.debian:def:37706834338957820705117744692061849127
title: CVE-2007-6013 wordpress
description:
Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MD5 hash from the user database, then generating the authentication cookie from that hash.


definition_id: oval:org.debian:def:318235024996361388718092036689371109724
title: CVE-2007-6015 samba
description:
Stack-based buffer overflow in the send_mailslot function in nmbd in Samba 3.0.0 through 3.0.27a, when the "domain logons" option is enabled, allows remote attackers to execute arbitrary code via a GETDC mailslot request composed of a long GETDC string following an offset username in a SAMLOGON logon request.


definition_id: oval:org.debian:def:195430550768448205297932372838009982176
title: CVE-2007-6035 cacti
description:
SQL injection vulnerability in graph.php in Cacti before 0.8.7a allows remote attackers to execute arbitrary SQL commands via the local_graph_id parameter.


definition_id: oval:org.debian:def:30037674515314967635737153182591189076
title: CVE-2007-6061 audacity
description:
Audacity 1.3.2 creates a temporary directory with a predictable name without checking for previous existence of that directory, which allows local users to cause a denial of service (recording deadlock) by creating the directory before Audacity is run.  NOTE: this issue can be leveraged to delete arbitrary files or directories via a symlink attack.


definition_id: oval:org.debian:def:310038288325200488172384351912359819152
title: CVE-2007-6062 ngircd
description:
irc-channel.c in ngIRCd before 0.10.3 allows remote attackers to cause a denial of service (crash) via a JOIN command without a channel argument.


definition_id: oval:org.debian:def:178252911106017867848664336963716301675
title: CVE-2007-6077 rails
description:
The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks.  NOTE: this is due to an incomplete fix for CVE-2007-5380.


definition_id: oval:org.debian:def:201038813790320424984952475149846834103
title: CVE-2007-6109 xemacs21
description:
Stack-based buffer overflow in emacs allows user-assisted attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a large precision value in an integer format string specifier to the format function, as demonstrated via a certain "emacs -batch -eval" command line.


definition_id: oval:org.debian:def:174131040326565550608560492110827096078
title: CVE-2007-6110 htdig
description:
Cross-site scripting (XSS) vulnerability in htsearch in htdig 3.2.0b6 allows remote attackers to inject arbitrary web script or HTML via the sort parameter.


definition_id: oval:org.debian:def:159201815045539062277403993856482691301
title: CVE-2007-6111 wireshark
description:
Multiple unspecified vulnerabilities in Wireshark (formerly Ethereal) allow remote attackers to cause a denial of service (crash) via (1) a crafted MP3 file or (2) unspecified vectors to the NCP dissector.


definition_id: oval:org.debian:def:277916091097110805119128856891760979732
title: CVE-2007-6112 wireshark
description:
Buffer overflow in the PPP dissector Wireshark (formerly Ethereal) 0.99.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors.


definition_id: oval:org.debian:def:333494589368730073028433121191955686781
title: CVE-2007-6113 wireshark
description:
Integer signedness error in the DNP3 dissector in Wireshark (formerly Ethereal) 0.10.12 to 0.99.6 allows remote attackers to cause a denial of service (long loop) via a malformed DNP3 packet.


definition_id: oval:org.debian:def:74986640737269838438446679525978335140
title: CVE-2007-6114 wireshark
description:
Multiple buffer overflows in Wireshark (formerly Ethereal) 0.99.0 through 0.99.6 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) the SSL dissector or (2) the iSeries (OS/400) Communication trace file parser.


definition_id: oval:org.debian:def:101430493700482208193027863777906962876
title: CVE-2007-6115 wireshark
description:
Buffer overflow in the ANSI MAP dissector for Wireshark (formerly Ethereal) 0.99.5 to 0.99.6, when running on unspecified platforms, allows remote attackers to cause a denial of service and possibly execute arbitrary code via unknown vectors.


definition_id: oval:org.debian:def:109641964948510527389726091978911221560
title: CVE-2007-6116 wireshark
description:
The Firebird/Interbase dissector in Wireshark (formerly Ethereal) 0.99.6 allows remote attackers to cause a denial of service (infinite loop or crash) via unknown vectors.


definition_id: oval:org.debian:def:6590476766685036155104981874118133475
title: CVE-2007-6117 wireshark
description:
Unspecified vulnerability in the HTTP dissector for Wireshark (formerly Ethereal) 0.10.14 to 0.99.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted chunked messages.


definition_id: oval:org.debian:def:271458464171040576873957802003930435870
title: CVE-2007-6118 wireshark
description:
The MEGACO dissector in Wireshark (formerly Ethereal) 0.9.14 to 0.99.6 allows remote attackers to cause a denial of service (long loop and resource consumption) via unknown vectors.


definition_id: oval:org.debian:def:193057856162911960185440779811133631913
title: CVE-2007-6119 wireshark
description:
The DCP ETSI dissector in Wireshark (formerly Ethereal) 0.99.6 allows remote attackers to cause a denial of service (long loop and resource consumption) via unknown vectors.


definition_id: oval:org.debian:def:249708188073181353820289938629538086169
title: CVE-2007-6120 wireshark
description:
The Bluetooth SDP dissector Wireshark (formerly Ethereal) 0.99.2 to 0.99.6 allows remote attackers to cause a denial of service (infinite loop) via unknown vectors.


definition_id: oval:org.debian:def:242239698619081296728479545548356142091
title: CVE-2007-6121 wireshark
description:
Wireshark (formerly Ethereal) 0.8.16 to 0.99.6 allows remote attackers to cause a denial of service (crash) via a malformed RPC Portmap packet.


definition_id: oval:org.debian:def:62991439627548648618118025212786646791
title: CVE-2007-6170 asterisk
description:
SQL injection vulnerability in the Call Detail Record Postgres logging engine (cdr_pgsql) in Asterisk 1.4.x before 1.4.15, 1.2.x before 1.2.25, B.x before B.2.3.4, and C.x before C.1.0-beta6 allows remote authenticated users to execute arbitrary SQL commands via (1) ANI and (2) DNIS arguments.


definition_id: oval:org.debian:def:158999293252817130392054502770124281691
title: CVE-2007-6171 asterisk
description:
SQL injection vulnerability in the Postgres Realtime Engine (res_config_pgsql) in Asterisk 1.4.x before 1.4.15 and C.x before C.1.0-beta6 allows remote attackers to execute arbitrary SQL commands via unknown vectors.


definition_id: oval:org.debian:def:108751639667092154593793518206902599668
title: CVE-2007-6183 ruby-gnome2
description:
Format string vulnerability in the mdiag_initialize function in gtk/src/rbgtkmessagedialog.c in Ruby-GNOME 2 (aka Ruby/Gnome2) 0.16.0, and SVN versions before 20071127, allows context-dependent attackers to execute arbitrary code via format string specifiers in the message parameter.


definition_id: oval:org.debian:def:278889554837071106553532622624834438272
title: CVE-2007-6199 rsync
description:
rsync before 3.0.0pre6, when running a writable rsync daemon that is not using chroot, allows remote attackers to access restricted files via unknown vectors that cause rsync to create a symlink that points outside of the module's hierarchy.


definition_id: oval:org.debian:def:32578102475404528670143756916473366818
title: CVE-2007-6200 rsync
description:
Unspecified vulnerability in rsync before 3.0.0pre6, when running a writable rsync daemon, allows remote attackers to bypass exclude, exclude_from, and filter and read or write hidden files via (1) symlink, (2) partial-dir, (3) backup-dir, and unspecified (4) dest options.


definition_id: oval:org.debian:def:147087930078994122529911330731385483180
title: CVE-2007-6203 apache2
description:
Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "413 Request Entity Too Large" error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated via an HTTP request containing an invalid Content-length value, a similar issue to CVE-2006-3918.


definition_id: oval:org.debian:def:268923958083710997236131571932178110400
title: CVE-2007-6208 claws-mail
description:
sylprint.pl in claws mail tools (claws-mail-tools) allows local users to overwrite arbitrary files via a symlink attack on the sylprint.[USER].[PID] temporary file.


definition_id: oval:org.debian:def:228531091149238531436600136610566656169
title: CVE-2007-6209 zsh
description:
Util/difflog.pl in zsh 4.3.4 allows local users to overwrite arbitrary files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:103563819883232028594864779170398021348
title: CVE-2007-6210 zabbix
description:
zabbix_agentd 1.1.4 in ZABBIX before 1.4.3 runs "UserParameter" scripts with gid 0, which might allow local users to gain privileges.


definition_id: oval:org.debian:def:320460898895746067780819994804606779627
title: CVE-2007-6220 typespeed
description:
typespeed before 0.6.4 allows remote attackers to cause a denial of service (application crash) via unspecified network behavior that triggers a divide-by-zero error.


definition_id: oval:org.debian:def:327786597938077692642043327082684110225
title: CVE-2007-6239 squid
description:
The "cache update reply processing" functionality in Squid 2.x before 2.6.STABLE17 and Squid 3.0 allows remote attackers to cause a denial of service (crash) via unknown vectors related to HTTP headers and an Array memory leak during requests for cached objects.


definition_id: oval:org.debian:def:221952715384321769070750626630613860474
title: CVE-2007-6277 flac
description:
Multiple buffer overflows in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allow user-assisted remote attackers to execute arbitrary code via large (1) Metadata Block Size, (2) VORBIS Comment String Size, (3) Picture Metadata MIME-TYPE Size, (4) Picture Description Size, (5) Picture Data Length, (6) Padding Length, and (7) PICTURE Metadata width and height values in a .FLAC file, which result in a heap-based overflow; and large (8) VORBIS Comment String Size Length, (9) Picture MIME-Type, (10) Picture MIME-Type URL, and (11) Picture Description Length values in a .FLAC file, which result in a stack-based overflow.  NOTE: some of these issues may overlap CVE-2007-4619.


definition_id: oval:org.debian:def:209483358808858367525381594305056020441
title: CVE-2007-6278 flac
description:
Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allows user-assisted remote attackers to force a client to download arbitrary files via the MIME-Type URL flag (-->) for the FLAC image file in a crafted .FLAC file.


definition_id: oval:org.debian:def:304565905707411013203438892302056285242
title: CVE-2007-6279 flac
description:
Multiple double free vulnerabilities in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allow user-assisted remote attackers to execute arbitrary code via malformed (1) Seektable values or (2) Seektable Data Offsets in a .FLAC file.


definition_id: oval:org.debian:def:99624515163619485112678501326120982853
title: CVE-2007-6306 libjfreechart-java
description:
Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) chart name or (2) chart tool tip text; or the (3) href, (4) shape, or (5) coords attribute of a chart area.


definition_id: oval:org.debian:def:164799550302249025363503926613422698022
title: CVE-2007-6318 wordpress
description:
SQL injection vulnerability in wp-includes/query.php in WordPress 2.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the s parameter, when DB_CHARSET is set to (1) Big5, (2) GBK, or possibly other character set encodings that support a "\" in a multibyte character.


definition_id: oval:org.debian:def:151835729275584751855896911247676278071
title: CVE-2007-6321 roundcube
description:
Cross-site scripting (XSS) vulnerability in RoundCube webmail 0.1rc2, 2007-12-09, and earlier versions, when using Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via style sheets containing expression commands.


definition_id: oval:org.debian:def:125499008350726039133030581754524330229
title: CVE-2007-6328 dosbox
description:
** DISPUTED **  DOSBox 0.72 and earlier allows local users to obtain access to the filesystem on the host operating system via the mount command.  NOTE: the researcher reports a vendor response stating that this is not a security problem.


definition_id: oval:org.debian:def:215953958707707292151049885953368633351
title: CVE-2007-6335 clamav
description:
Integer overflow in libclamav in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MEW packed PE file, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:190559880118583972084881350515802181232
title: CVE-2007-6336 clamav
description:
Off-by-one error in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MS-ZIP compressed CAB file.


definition_id: oval:org.debian:def:74829937892604154286678334954755181739
title: CVE-2007-6337 clamav
description:
Unspecified vulnerability in the bzip2 decompression algorithm in nsis/bzlib_private.h in ClamAV before 0.92 has unknown impact and remote attack vectors.


definition_id: oval:org.debian:def:33998784389164392194527856882467135887
title: CVE-2007-6341 libnet-dns-perl
description:
Net/DNS/RR/A.pm in Net::DNS 0.60 build 654, as used in packages such as SpamAssassin and OTRS, allows remote attackers to cause a denial of service (program "croak") via a crafted DNS response.


definition_id: oval:org.debian:def:119889829600227818917494123706984280316
title: CVE-2007-6351 libexif
description:
libexif 0.6.16 and earlier allows context-dependent attackers to cause a denial of service (infinite recursion) via an image file with crafted EXIF tags, possibly involving the exif_loader_write function in exif_loader.c.


definition_id: oval:org.debian:def:194288583599404422294912750506328197814
title: CVE-2007-6352 libexif
description:
Integer overflow in libexif 0.6.16 and earlier allows context-dependent attackers to execute arbitrary code via an image with crafted EXIF tags, possibly involving the exif_data_load_data_thumbnail function in exif-data.c.


definition_id: oval:org.debian:def:186743204596626577443253528683545188799
title: CVE-2007-6353 exiv2
description:
Integer overflow in exif.cpp in exiv2 library allows context-dependent attackers to execute arbitrary code via a crafted EXIF file that triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:13090239030168590048935199479894584238
title: CVE-2007-6354 exiftags
description:
Unspecified vulnerability in exiftags before 1.01 has unknown impact and attack vectors, resulting from a "field offset overflow" that triggers an "illegal memory access," a different vulnerability than CVE-2007-6355.


definition_id: oval:org.debian:def:98221829128561847964583238506016620332
title: CVE-2007-6355 exiftags
description:
Integer overflow in exiftags before 1.01 has unknown impact and attack vectors, resulting from a "field offset overflow" that triggers an "illegal memory access," a different vulnerability than CVE-2007-6354.


definition_id: oval:org.debian:def:138044849769675918492350665438954423769
title: CVE-2007-6356 exiftags
description:
exiftags before 1.01 allows attackers to cause a denial of service (infinite loop) via recursive IFD references in the EXIF data in a JPEG image.


definition_id: oval:org.debian:def:163500616457334541533581751824717524671
title: CVE-2007-6358 cups
description:
pdftops.pl before 1.20 in alternate pdftops filter allows local users to overwrite arbitrary files via a symlink attack on the pdfin.[PID].tmp temporary file, which is created when pdftops reads a PDF file from stdin, such as when pdftops is invoked by CUPS.


definition_id: oval:org.debian:def:209828370875806198847190061020572723529
title: CVE-2007-6388 apache2
description:
Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:154405194034141712578858381254478995151
title: CVE-2007-6389 gnome-screensaver
description:
The notify feature in GNOME screensaver (gnome-screensaver) 2.20.0 might allow local users to read the clipboard contents and X selection data for a locked session by using ctrl-V.


definition_id: oval:org.debian:def:14253710411063961653291138234940060665
title: CVE-2007-6420 apache2
description:
Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via unspecified vectors.


definition_id: oval:org.debian:def:252010413250393254093593096120725074214
title: CVE-2007-6421 apache2
description:
Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) ss, (2) wr, or (3) rr parameters, or (4) the URL.


definition_id: oval:org.debian:def:185032503404610730823296485531820050241
title: CVE-2007-6422 apache2
description:
The balancer_handler function in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6, when a threaded Multi-Processing Module is used, allows remote authenticated users to cause a denial of service (child process crash) via an invalid bb variable.


definition_id: oval:org.debian:def:205115264050652411093798969424805419667
title: CVE-2007-6427 xorg-server
description:
The XInput extension in X.Org Xserver before 1.4.1 allows context-dependent attackers to execute arbitrary code via requests related to byte swapping and heap corruption within multiple functions, a different vulnerability than CVE-2007-4990.


definition_id: oval:org.debian:def:33756469715014774132808884458680263183
title: CVE-2007-6428 xorg-server
description:
The ProcGetReservedColormapEntries function in the TOG-CUP extension in X.Org Xserver before 1.4.1 allows context-dependent attackers to read the contents of arbitrary memory locations via a request containing a 32-bit value that is improperly used as an array index.


definition_id: oval:org.debian:def:320372451670323298650634356073073227835
title: CVE-2007-6429 xorg-server
description:
Multiple integer overflows in X.Org Xserver before 1.4.1 allow context-dependent attackers to execute arbitrary code via (1) a GetVisualInfo request containing a 32-bit value that is improperly used to calculate an amount of memory for allocation by the EVI extension, or (2) a request containing values related to pixmap size that are improperly used in management of shared memory by the MIT-SHM extension.


definition_id: oval:org.debian:def:75866649116402287692644858369820909659
title: CVE-2007-6430 asterisk
description:
Asterisk Open Source 1.2.x before 1.2.26 and 1.4.x before 1.4.16, and Business Edition B.x.x before B.2.3.6 and C.x.x before C.1.0-beta8, when using database-based registrations ("realtime") and host-based authentication, does not check the IP address when the username is correct and there is no password, which allows remote attackers to bypass authentication using a valid username.


definition_id: oval:org.debian:def:146137761124964808871598599129659816035
title: CVE-2007-6437 syslog-ng
description:
Balabit syslog-ng 2.0.x before 2.0.6 and 2.1.x before 2.1.8 allows remote attackers to cause a denial of service (crash) via a message with a timestamp that does not contain a trailing space, which triggers a NULL pointer dereference.


definition_id: oval:org.debian:def:285519046970632812729679588073077820123
title: CVE-2007-6438 wireshark
description:
Unspecified vulnerability in the SMB dissector in Wireshark (formerly Ethereal) 0.99.6 allows remote attackers to cause a denial of service via unknown vectors.  NOTE: this identifier originally included MP3 and NCP, but those issues are already covered by CVE-2007-6111.


definition_id: oval:org.debian:def:33968770486639440149460067692277019563
title: CVE-2007-6439 wireshark
description:
Wireshark (formerly Ethereal) 0.99.6 allows remote attackers to cause a denial of service (infinite or large loop) via the (1) IPv6 or (2) USB dissector, which can trigger resource consumption or a crash. NOTE: this identifier originally included Firebird/Interbase, but it is already covered by CVE-2007-6116.  The DCP ETSI issue is already covered by CVE-2007-6119.


definition_id: oval:org.debian:def:276091711015568534335105929800444672975
title: CVE-2007-6441 wireshark
description:
The WiMAX dissector in Wireshark (formerly Ethereal) 0.99.6 allows remote attackers to cause a denial of service (crash) via unknown vectors related to "unaligned access on some platforms."


definition_id: oval:org.debian:def:321458561296283405004437405429295221995
title: CVE-2007-6450 wireshark
description:
The RPL dissector in Wireshark (formerly Ethereal) 0.9.8 to 0.99.6 allows remote attackers to cause a denial of service (infinite loop) via unknown vectors.


definition_id: oval:org.debian:def:325643664443899649194620562739556280082
title: CVE-2007-6451 wireshark
description:
Unspecified vulnerability in the CIP dissector in Wireshark (formerly Ethereal) 0.9.14 to 0.99.6 allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger allocation of large amounts of memory.


definition_id: oval:org.debian:def:244939327783014548059207190389410460746
title: CVE-2007-6531 xfce4-panel
description:
Stack-based buffer overflow in the Panel (xfce4-panel) component in Xfce before 4.4.2 might allow remote attackers to execute arbitrary code via Launcher tooltips.  NOTE: a second buffer overflow (over-read) in the xfce_mkdirhier function was also reported, but it might not be exploitable for a crash or code execution, so it is not a vulnerability.


definition_id: oval:org.debian:def:100598617370604379655837341367550464133
title: CVE-2007-6562 tcpreen
description:
Multiple stack-based buffer overflows in the use of FD_SET in TCPreen before 1.4.4 allow remote attackers to cause a denial of service via multiple concurrent connections, which result in overflows in the (1) SocketAddress::Connect function in libsolve/sockprot.cpp and (2) monitor_bridge function in src/bridge.cpp.


definition_id: oval:org.debian:def:310950272342779710017210386377562081467
title: CVE-2007-6595 clamav
description:
ClamAV 0.92 allows local users to overwrite arbitrary files via a symlink attack on (1) temporary files used by the cli_gentempfd function in libclamav/others.c or on (2) .ascii files used by sigtool, when utf16-decode is enabled.


definition_id: oval:org.debian:def:307024767834561778152791739696569003840
title: CVE-2007-6596 clamav
description:
ClamAV 0.92 does not recognize Base64 UUEncoded archives, which allows remote attackers to bypass the scanner via a Base64-UUEncoded file.


definition_id: oval:org.debian:def:150829395318564292654263940975851163233
title: CVE-2007-6598 dovecot
description:
Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password.


definition_id: oval:org.debian:def:252006605446505706495766937510566724227
title: CVE-2007-6599 openafs
description:
Race condition in fileserver in OpenAFS 1.3.50 through 1.4.5 and 1.5.0 through 1.5.27 allows remote attackers to cause a denial of service (daemon crash) by simultaneously acquiring and giving back file callbacks, which causes the handler for the GiveUpAllCallBacks RPC to perform linked-list operations without the host_glock lock.


definition_id: oval:org.debian:def:99320365965775932133034897715892430518
title: CVE-2007-6610 unp
description:
unp 1.0.12, and other versions before 1.0.14, does not properly escape file names, which might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument. NOTE: this might only be a vulnerability when unp is invoked by a third party product.


definition_id: oval:org.debian:def:187552688008486944804655090293939418030
title: CVE-2007-6613 libcdio
description:
Stack-based buffer overflow in the print_iso9660_recurse function in iso-info (src/iso-info.c) in GNU Compact Disc Input and Control Library (libcdio) 0.79 and earlier allows context-dependent attackers to cause a denial of service (core dump) and possibly execute arbitrary code via a disk or image that contains a long joilet file name.


definition_id: oval:org.debian:def:9935818781540902985096026566858836852
title: CVE-2007-6681 vlc
description:
Stack-based buffer overflow in modules/demux/subtitle.c in VideoLAN VLC 0.8.6d allows remote attackers to execute arbitrary code via a long subtitle in a (1) MicroDvd, (2) SSA, and (3) Vplayer file.


definition_id: oval:org.debian:def:30327112572257996379890448602924304260
title: CVE-2007-6682 vlc
description:
Format string vulnerability in the httpd_FileCallBack function (network/httpd.c) in VideoLAN VLC 0.8.6d allows remote attackers to execute arbitrary code via format string specifiers in the Connection parameter.


definition_id: oval:org.debian:def:190344243613679469259132525969939857205
title: CVE-2007-6683 vlc
description:
The browser plugin in VideoLAN VLC 0.8.6d allows remote attackers to overwrite arbitrary files via (1) the :demuxdump-file option in a filename in a playlist, or (2) a EXTVLCOPT statement in an MP3 file, possibly an argument injection vulnerability.


definition_id: oval:org.debian:def:28747327409922012547355449608892432263
title: CVE-2007-6684 vlc
description:
The RTSP module in VideoLAN VLC 0.8.6d allows remote attackers to cause a denial of service (crash) via a request without a Transport parameter, which triggers a NULL pointer dereference.


definition_id: oval:org.debian:def:27303041539539240904884554214658017180
title: CVE-2007-6697 sdl-image1.2
description:
Buffer overflow in the LWZReadByte function in IMG_gif.c in SDL_image before 1.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted GIF file, a similar issue to CVE-2006-4484.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:17220081617541839668027601987266629899
title: CVE-2007-6718 mplayer
description:
MPlayer, possibly 1.0rc1, allows remote attackers to cause a denial of service (SIGSEGV and application crash) via (1) a malformed MP3 file, as demonstrated by lol-mplayer.mp3; (2) a malformed Ogg Vorbis file, as demonstrated by lol-mplayer.ogg; (3) a malformed MPEG-1 file, as demonstrated by lol-mplayer.mpg; (4) a malformed MPEG-2 file, as demonstrated by lol-mplayer.m2v; (5) a malformed MPEG-4 AVI file, as demonstrated by lol-mplayer.avi; (6) a malformed FLAC file, as demonstrated by lol-mplayer.flac; (7) a malformed Ogg Theora file, as demonstrated by lol-mplayer.ogm; (8) a malformed WMV file, as demonstrated by lol-mplayer.wmv; or (9) a malformed AAC file, as demonstrated by lol-mplayer.aac.  NOTE: vector 5 might overlap CVE-2007-4938, and vector 6 might overlap CVE-2008-0486.


definition_id: oval:org.debian:def:103524359699538152275383888385924298603
title: CVE-2007-6720 libmikmod
description:
libmikmod 3.1.9 through 3.2.0, as used by MikMod, SDL-mixer, and possibly other products, relies on the channel count of the last loaded song, rather than the currently playing song, for certain playback calculations, which allows user-assisted attackers to cause a denial of service (application crash) by loading multiple songs (aka MOD files) with different numbers of channels.


definition_id: oval:org.debian:def:201064291385887422634418815384127531598
title: CVE-2007-6721 bouncycastle
description:
The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."


definition_id: oval:org.debian:def:245510635111309665805496418800848686787
title: CVE-2007-6725 ghostscript
description:
The CCITTFax decoding filter in Ghostscript 8.60, 8.61, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PDF file that triggers a buffer underflow in the cf_decode_2d function.


definition_id: oval:org.debian:def:256677686673392239747573618037467829709
title: CVE-2007-6731 xmp
description:
Extended Module Player (XMP) 2.5.1 and earlier allow remote attackers to execute arbitrary code via an OXM file with a negative value, which bypasses a check in (1) test_oxm and (2) decrunch_oxm functions in misc/oxm.c, leading to a buffer overflow.


definition_id: oval:org.debian:def:84476365089289329614066385525694828360
title: CVE-2007-6732 xmp
description:
Multiple buffer overflows in the dtt_load function in loaders/dtt_load.c Extended Module Player (XMP) 2.5.1 and earlier allow remote attackers to execute arbitrary code via unspecified vectors related to an untrusted length value and the (1) pofs and (2) plen arrays.


definition_id: oval:org.debian:def:104212072485958632058238159431207479025
title: CVE-2007-6746 telepathy-idle
description:
telepathy-idle before 0.1.15 does not verify (1) that the issuer is a trusted CA, (2) that the server hostname matches a domain name in the subject's Common Name (CN), or (3) the expiration date of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


definition_id: oval:org.debian:def:304974585964862860067820783339542167453
title: CVE-2007-6750 apache2
description:
The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris, related to the lack of the mod_reqtimeout module in versions before 2.2.15.


definition_id: oval:org.debian:def:36573009682336393465609813965689923142
title: CVE-2008-0005 apache2
description:
mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding.


definition_id: oval:org.debian:def:260336755373866265705543268648438980692
title: CVE-2008-0006 libxfont
description:
Buffer overflow in (1) X.Org Xserver before 1.4.1, and (2) the libfont and libXfont libraries on some platforms including Sun Solaris, allows context-dependent attackers to execute arbitrary code via a PCF font with a large difference between the last col and first col values in the PCF_BDF_ENCODINGS table.


definition_id: oval:org.debian:def:225756723478871939929257807509335895423
title: CVE-2008-0008 pulseaudio
description:
The pa_drop_root function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from (1) setresuid, (2) setreuid, (3) setuid, and (4) seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail via attacks such as resource exhaustion.


definition_id: oval:org.debian:def:207585800486243608585125074803822097407
title: CVE-2008-0047 cups
description:
Heap-based buffer overflow in the cgiCompileSearch function in CUPS 1.3.5, and other versions including the version bundled with Apple Mac OS X 10.5.2, when printer sharing is enabled, allows remote attackers to execute arbitrary code via crafted search expressions.


definition_id: oval:org.debian:def:54618545381367669056549743310473843807
title: CVE-2008-0053 cups
description:
Multiple buffer overflows in the HP-GL/2-to-PostScript filter in CUPS before 1.3.6 might allow remote attackers to execute arbitrary code via a crafted HP-GL/2 file.


definition_id: oval:org.debian:def:54285407598161854919447641373609551794
title: CVE-2008-0061 maradns
description:
MaraDNS 1.0 before 1.0.41, 1.2 before 1.2.12.08, and 1.3 before 1.3.07.04 allows remote attackers to cause a denial of service via a crafted DNS packet that prevents an authoritative name (CNAME) record from resolving, aka "improper rotation of resource records."


definition_id: oval:org.debian:def:52201759095398587983427682860227906082
title: CVE-2008-0062 krb5
description:
KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted messages that trigger a NULL pointer dereference or double-free.


definition_id: oval:org.debian:def:167851177814830435380460320204876950865
title: CVE-2008-0063 krb5
description:
The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might allow remote attackers to obtain sensitive information, aka "Uninitialized stack values."


definition_id: oval:org.debian:def:328348440440179984704584845049796011139
title: CVE-2008-0072 evolution
description:
Format string vulnerability in the emf_multipart_encrypted function in mail/em-format.c in Evolution 2.12.3 and earlier allows remote attackers to execute arbitrary code via a crafted encrypted message, as demonstrated using the Version field.


definition_id: oval:org.debian:def:339827566169902406776255884421097418361
title: CVE-2008-0073 vlc
description:
Array index error in the sdpplin_parse function in input/libreal/sdpplin.c in xine-lib 1.1.10.1 allows remote RTSP servers to execute arbitrary code via a large streamid SDP parameter.


definition_id: oval:org.debian:def:267655575035618632248877147918104285206
title: CVE-2008-0095 asterisk
description:
The SIP channel driver in Asterisk Open Source 1.4.x before 1.4.17, Business Edition before C.1.0-beta8, AsteriskNOW before beta7, Appliance Developer Kit before Asterisk 1.4 revision 95946, and Appliance s800i 1.0.x before 1.0.3.4 allows remote attackers to cause a denial of service (daemon crash) via a BYE message with an Also (Also transfer) header, which triggers a NULL pointer dereference.


definition_id: oval:org.debian:def:198460996370649289955173447015397801859
title: CVE-2008-0100 whitedune
description:
Stack-based buffer overflow in the Scene::errorf function in Scene.cpp in White_Dune 0.29 beta791 and earlier allows remote attackers to execute arbitrary code via a long string in a .WRL file.


definition_id: oval:org.debian:def:285213521095785203334969464209638058894
title: CVE-2008-0101 whitedune
description:
Format string vulnerability in the swDebugf function in DuneApp.cpp in White_Dune 0.29 beta791 and earlier allows remote attackers to execute arbitrary code via format string specifiers in a .WRL file.


definition_id: oval:org.debian:def:15358865904170012362456556883697055296
title: CVE-2008-0122 glibc
description:
Off-by-one error in the inet_network function in libbind in ISC BIND 9.4.2 and earlier, as used in libc in FreeBSD 6.2 through 7.0-PRERELEASE, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted input that triggers memory corruption.


definition_id: oval:org.debian:def:95461907692875848477956540932105018116
title: CVE-2008-0162 splitvt
description:
misc.c in splitvt 1.6.6 and earlier does not drop group privileges before executing xprop, which allows local users to gain privileges.


definition_id: oval:org.debian:def:294469167886633222887433160202174984001
title: CVE-2008-0165 ikiwiki
description:
Cross-site request forgery (CSRF) vulnerability in Ikiwiki before 2.42 allows remote attackers to modify user preferences, including passwords, via the (1) preferences and (2) edit forms.


definition_id: oval:org.debian:def:225506743630013585298501362206643956425
title: CVE-2008-0166 openssh
description:
OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.


definition_id: oval:org.debian:def:28785317393096856055740578685640845794
title: CVE-2008-0169 ikiwiki
description:
Plugin/passwordauth.pm (aka the passwordauth plugin) in ikiwiki 1.34 through 2.47 allows remote attackers to bypass authentication, and login to any account for which an OpenID identity is configured and a password is not configured, by specifying an empty password during the login sequence.


definition_id: oval:org.debian:def:214138830505449061983265723227071301021
title: CVE-2008-0192 wordpress
description:
Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the popuptitle parameter to (1) wp-admin/post.php or (2) wp-admin/page-new.php.


definition_id: oval:org.debian:def:302917945510652755237687157517704957357
title: CVE-2008-0193 wordpress
description:
Cross-site scripting (XSS) vulnerability in wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x, allows remote attackers to inject arbitrary web script or HTML via the backup parameter in a wp-db-backup.php action to wp-admin/edit.php.


definition_id: oval:org.debian:def:86404205793956950999426380780887311023
title: CVE-2008-0194 wordpress
description:
Directory traversal vulnerability in wp-db-backup.php in WordPress 2.0.3 and earlier allows remote attackers to read arbitrary files, delete arbitrary files, and cause a denial of service via a .. (dot dot) in the backup parameter in a wp-db-backup.php action to wp-admin/edit.php.  NOTE: this might be the same as CVE-2006-5705.1.


definition_id: oval:org.debian:def:169535636195636487181441520491383219408
title: CVE-2008-0195 wordpress
description:
WordPress 2.0.11 and earlier allows remote attackers to obtain sensitive information via an empty value of the page parameter to certain PHP scripts under wp-admin/, which reveals the path in various error messages.


definition_id: oval:org.debian:def:20950407006382006835030682494324434076
title: CVE-2008-0196 wordpress
description:
Multiple directory traversal vulnerabilities in WordPress 2.0.11 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the page parameter to certain PHP scripts under wp-admin/ or (2) the import parameter to wp-admin/admin.php, as demonstrated by discovering the full path via a request for the \..\..\wp-config pathname; and allow remote attackers to modify arbitrary files via a .. (dot dot) in the file parameter to wp-admin/templates.php.


definition_id: oval:org.debian:def:56973540989665953334143402304346192532
title: CVE-2008-0252 cherrypy3
description:
Directory traversal vulnerability in the _get_file_path function in (1) lib/sessions.py in CherryPy 3.0.x up to 3.0.2, (2) filter/sessionfilter.py in CherryPy 2.1, and (3) filter/sessionfilter.py in CherryPy 2.x allows remote attackers to create or delete arbitrary files, and possibly read and write portions of arbitrary files, via a crafted session id in a cookie.


definition_id: oval:org.debian:def:221277807447635792279198798441156819183
title: CVE-2008-0285 ngircd
description:
ngIRCd 0.10.x before 0.10.4 and 0.11.0 before 0.11.0-pre2 allows remote attackers to cause a denial of service (crash) via crafted IRC PART message, which triggers an invalid dereference.


definition_id: oval:org.debian:def:105895085268013175022812260776165895251
title: CVE-2008-0295 vlc
description:
Heap-based buffer overflow in modules/access/rtsp/real_sdpplin.c in the Xine library, as used in VideoLAN VLC Media Player 0.8.6d and earlier, allows user-assisted remote attackers to cause a denial of service (crash) or execute arbitrary code via long Session Description Protocol (SDP) data.


definition_id: oval:org.debian:def:152623294827828906908811506465404430332
title: CVE-2008-0296 vlc
description:
Heap-based buffer overflow in the libaccess_realrtsp plugin in VideoLAN VLC Media Player 0.8.6d and earlier on Windows might allow remote RTSP servers to cause a denial of service (application crash) or execute arbitrary code via a long string.


definition_id: oval:org.debian:def:300365816310312438385959254589638892855
title: CVE-2008-0299 paramiko
description:
common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session to obtain sensitive information from another session by predicting the state of the pool.


definition_id: oval:org.debian:def:279531497488098805959763188902826519109
title: CVE-2008-0302 apt-listchanges
description:
Untrusted search path vulnerability in apt-listchanges.py in apt-listchanges before 2.82 allows local users to execute arbitrary code via a malicious apt-listchanges program in the current working directory.


definition_id: oval:org.debian:def:142584549614805671330170616014411416184
title: CVE-2008-0314 clamav
description:
Heap-based buffer overflow in spin.c in libclamav in ClamAV 0.92.1 allows remote attackers to execute arbitrary code via a crafted PeSpin packed PE binary with a modified length value.


definition_id: oval:org.debian:def:256201382964878314523067003070071503900
title: CVE-2008-0318 clamav
description:
Integer overflow in the cli_scanpe function in libclamav in ClamAV before 0.92.1, as used in clamd, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Petite packed PE file, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:10133497522667089036200373788255165879
title: CVE-2008-0411 ghostscript
description:
Stack-based buffer overflow in the zseticcspace function in zicc.c in Ghostscript 8.61 and earlier allows remote attackers to execute arbitrary code via a postscript (.ps) file containing a long Range array in a .seticcspace operator.


definition_id: oval:org.debian:def:96326377912348818961896174083274645255
title: CVE-2008-0455 apache2
description:
Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.


definition_id: oval:org.debian:def:101979959491951163320312701062449040867
title: CVE-2008-0460 mediawiki
description:
Cross-site scripting (XSS) vulnerability in api.php in (1) MediaWiki 1.11 through 1.11.0rc1, 1.10 through 1.10.2, 1.9 through 1.9.4, and 1.8; and (2) the BotQuery extension for MediaWiki 1.7 and earlier; when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:237302877603829777693033318348875936898
title: CVE-2008-0485 mplayer
description:
Array index error in libmpdemux/demux_mov.c in MPlayer 1.0 rc2 and earlier might allow remote attackers to execute arbitrary code via a QuickTime MOV file with a crafted stsc atom tag.


definition_id: oval:org.debian:def:324293796961347363347298004131273018665
title: CVE-2008-0486 mplayer
description:
Array index vulnerability in libmpdemux/demux_audio.c in MPlayer 1.0rc2 and SVN before r25917, and possibly earlier versions, as used in Xine-lib 1.1.10, might allow remote attackers to execute arbitrary code via a crafted FLAC tag, which triggers a buffer overflow.


definition_id: oval:org.debian:def:143363376105752278725941809034596955289
title: CVE-2008-0544 sdl-image1.2
description:
Heap-based buffer overflow in the IMG_LoadLBM_RW function in IMG_lbm.c in SDL_image before 1.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted IFF ILBM file.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:215388875488210162122567508710769116696
title: CVE-2008-0553 libtk-img
description:
Stack-based buffer overflow in the ReadImage function in tkImgGIF.c in Tk (Tcl/Tk) before 8.5.1 allows remote attackers to execute arbitrary code via a crafted GIF image, a similar issue to CVE-2006-4484.


definition_id: oval:org.debian:def:117003700234651803355294766588844149040
title: CVE-2008-0554 netpbm-free
description:
Buffer overflow in the readImageData function in giftopnm.c in netpbm before 10.27 in netpbm before 10.27 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted GIF image, a similar issue to CVE-2006-4484.


definition_id: oval:org.debian:def:96003599241553597701759816513341105188
title: CVE-2008-0564 mailman
description:
Multiple cross-site scripting (XSS) vulnerabilities in Mailman before 2.1.10b1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) editing templates and (2) the list's "info attribute" in the web administrator interface, a different vulnerability than CVE-2006-3636.


definition_id: oval:org.debian:def:103166890590477128847542626399125565177
title: CVE-2008-0595 dbus
description:
dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.


definition_id: oval:org.debian:def:236760936564830232431004287704336406070
title: CVE-2008-0629 mplayer
description:
Buffer overflow in stream_cddb.c in MPlayer 1.0rc2 and SVN before r25824 allows remote user-assisted attackers to execute arbitrary code via a CDDB database entry containing a long album title.


definition_id: oval:org.debian:def:240257844594003575406680971491725949137
title: CVE-2008-0630 mplayer
description:
Buffer overflow in url.c in MPlayer 1.0rc2 and SVN before r25823 allows remote attackers to execute arbitrary code via a crafted URL that prevents the IPv6 parsing code from setting a pointer to NULL, which causes the buffer to be reused by the unescape code.


definition_id: oval:org.debian:def:221028777293471242876995179430634709729
title: CVE-2008-0664 wordpress
description:
The XML-RPC implementation (xmlrpc.php) in WordPress before 2.3.3, when registration is enabled, allows remote attackers to edit posts of other blog users via unknown vectors.


definition_id: oval:org.debian:def:100226161361545871870232914340896763285
title: CVE-2008-0665 wml
description:
wml_backend/p1_ipp/ipp.src in Website META Language (WML) 2.0.11 allows local users to overwrite arbitrary files via a symlink attack on the ipp.$$.tmp temporary file.


definition_id: oval:org.debian:def:331521497631957898852656669501326333912
title: CVE-2008-0666 wml
description:
Website META Language (WML) 2.0.11 allows local users to overwrite arbitrary files via a symlink attack on (1) the /tmp/pe.tmp.$$ temporary file used by wml_contrib/wmg.cgi and (2) temporary files used by wml_backend/p3_eperl/eperl_sys.c.


definition_id: oval:org.debian:def:161343173970277646783259512489509052614
title: CVE-2008-0668 gnumeric
description:
The excel_read_HLINK function in plugins/excel/ms-excel-read.c in Gnome Office Gnumeric before 1.8.1 allows user-assisted remote attackers to execute arbitrary code via a crafted XLS file containing XLS HLINK opcodes, possibly because of an integer signedness error that leads to an integer overflow.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:206460722988605738430927693474256867487
title: CVE-2008-0671 tintin++
description:
Stack-based buffer overflow in the add_line_buffer function in TinTin++ 1.97.9 and WinTin++ 1.97.9 allows remote attackers to execute arbitrary code via a long chat message, related to conversion from LF to CRLF.


definition_id: oval:org.debian:def:66728486220032058548022964397326847461
title: CVE-2008-0672 tintin++
description:
The process_chat_input function in TinTin++ 1.97.9 and WinTin++ 1.97.9 allows remote attackers to cause a denial of service (application crash) via a YES message without a newline character, which triggers a NULL dereference.


definition_id: oval:org.debian:def:15235919707365814335482410608824216474
title: CVE-2008-0673 tintin++
description:
TinTin++ 1.97.9 and WinTin++ 1.97.9 open files on the basis of an inbound file-transfer request, before the user has an opportunity to decline the request, which allows remote attackers to truncate arbitrary files in the top level of a home directory.


definition_id: oval:org.debian:def:74972339761354555631963098787433733424
title: CVE-2008-0674 pcre3
description:
Buffer overflow in PCRE before 7.6 allows remote attackers to execute arbitrary code via a regular expression containing a character class with a large number of characters with Unicode code points greater than 255.


definition_id: oval:org.debian:def:240906705007262066697246205926119301058
title: CVE-2008-0728 clamav
description:
The unmew11 function in libclamav/mew.c in libclamav in ClamAV before 0.92.1 has unknown impact and attack vectors that trigger "heap corruption."


definition_id: oval:org.debian:def:322258002313741594535407535829688716934
title: CVE-2008-0780 moin
description:
Cross-site scripting (XSS) vulnerability in MoinMoin 1.5.x through 1.5.8 and 1.6.x before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the login action.


definition_id: oval:org.debian:def:91120698328689706468175065984207482215
title: CVE-2008-0781 moin
description:
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin 1.5.8 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) message, (2) pagename, and (3) target filenames.


definition_id: oval:org.debian:def:268467650473250253807912865792117260778
title: CVE-2008-0782 moin
description:
Directory traversal vulnerability in MoinMoin 1.5.8 and earlier allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the MOIN_ID user ID in a cookie for a userform action.  NOTE: this issue can be leveraged for PHP code execution via the quicklinks parameter.


definition_id: oval:org.debian:def:1444096282381270731554451021872472673
title: CVE-2008-0783 cacti
description:
Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote attackers to inject arbitrary web script or HTML via (1) the view_type parameter to graph.php; (2) the filter parameter to graph_view.php; (3) the action parameter to the draw_navigation_text function in lib/functions.php, reachable through index.php (aka the login page) or data_input.php; or (4) the login_username parameter to index.php.


definition_id: oval:org.debian:def:58179728451578380538254814414778794462
title: CVE-2008-0784 cacti
description:
graph.php in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allows remote attackers to obtain the full path via an invalid local_graph_id parameter and other unspecified vectors.


definition_id: oval:org.debian:def:313930571001491857194110979635818140410
title: CVE-2008-0785 cacti
description:
Multiple SQL injection vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote authenticated users to execute arbitrary SQL commands via the (1) graph_list parameter to graph_view.php, (2) leaf_id and id parameters to tree.php, (3) local_graph_id parameter to graph_xport.php, and (4) login_username parameter to index.php/login.


definition_id: oval:org.debian:def:317923946035305406783392267787287555550
title: CVE-2008-0786 cacti
description:
CRLF injection vulnerability in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k, when running on older PHP interpreters, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.


definition_id: oval:org.debian:def:304164623212760026806262989731742833807
title: CVE-2008-0806 wyrd
description:
wyrd 1.4.3b allows local users to overwrite arbitrary files via a symlink attack on the wyrd-tmp.[USERID] temporary file.


definition_id: oval:org.debian:def:272259087735345689951522792679413103912
title: CVE-2008-0808 ikiwiki
description:
Cross-site scripting (XSS) vulnerability in the meta plugin in Ikiwiki before 1.1.47 allows remote attackers to inject arbitrary web script or HTML via meta tags.


definition_id: oval:org.debian:def:290741200609084146519187455456283845951
title: CVE-2008-0809 ikiwiki
description:
Cross-site scripting (XSS) vulnerability in the htmlscrubber in Ikiwiki before 1.1.46 allows remote attackers to inject arbitrary web script or HTML via title contents.


definition_id: oval:org.debian:def:334187927613280695180116315104121330666
title: CVE-2008-0882 cups
description:
Double free vulnerability in the process_browse_data function in CUPS 1.3.5 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via crafted UDP Browse packets to the cupsd port (631/udp), related to an unspecified manipulation of a remote printer.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:96287173950740962570720248237716892909
title: CVE-2008-0887 gnome-screensaver
description:
gnome-screensaver before 2.22.1, when a remote authentication server is enabled, crashes upon an unlock attempt during a network outage, which allows physically proximate attackers to gain access to the locked session, a related issue to CVE-2007-1859.


definition_id: oval:org.debian:def:103709922410581551244914518076260520400
title: CVE-2008-0888 unzip
description:
The NEEDBITS macro in the inflate_dynamic function in inflate.c for unzip can be invoked using invalid buffers, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger a free of uninitialized or previously-freed data.


definition_id: oval:org.debian:def:194719165538419460118078973295885696549
title: CVE-2008-0891 openssl
description:
Double free vulnerability in OpenSSL 0.9.8f and 0.9.8g, when the TLS server name extensions are enabled, allows remote attackers to cause a denial of service (crash) via a malformed Client Hello packet.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:118573619474825850542650312553510254164
title: CVE-2008-0928 qemu
description:
Qemu 0.9.1 and earlier does not perform range checks for block device read or write requests, which allows guest host users with root privileges to access arbitrary memory and escape the virtual machine.


definition_id: oval:org.debian:def:94343403278785960471113201018152674148
title: CVE-2008-0932 sword
description:
diatheke.pl in The SWORD Project Diatheke 1.5.9 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the range parameter.


definition_id: oval:org.debian:def:149810634892566822067754582836268276363
title: CVE-2008-0947 krb5
description:
Buffer overflow in the RPC library used by libgssrpc and kadmind in MIT Kerberos 5 (krb5) 1.4 through 1.6.3 allows remote attackers to execute arbitrary code by triggering a large number of open file descriptors.


definition_id: oval:org.debian:def:66132676850901125789952346072461325682
title: CVE-2008-0948 krb5
description:
Buffer overflow in the RPC library (lib/rpc/rpc_dtablesize.c) used by libgssrpc and kadmind in MIT Kerberos 5 (krb5) 1.2.2, and probably other versions before 1.3, when running on systems whose unistd.h does not define the FD_SETSIZE macro, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering a large number of open file descriptors.


definition_id: oval:org.debian:def:28213999878814345344636024179145525474
title: CVE-2008-0960 net-snmp
description:
SNMPv3 HMAC verification in (1) Net-SNMP 5.2.x before 5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1; (2) UCD-SNMP; (3) eCos; (4) Juniper Session and Resource Control (SRC) C-series 1.0.0 through 2.0.0; (5) NetApp (aka Network Appliance) Data ONTAP 7.3RC1 and 7.3RC2; (6) SNMP Research before 16.2; (7) multiple Cisco IOS, CatOS, ACE, and Nexus products; (8) Ingate Firewall 3.1.0 and later and SIParator 3.1.0 and later; (9) HP OpenView SNMP Emanate Master Agent 15.x; and possibly other products relies on the client to specify the HMAC length, which makes it easier for remote attackers to bypass SNMP authentication via a length value of 1, which only checks the first byte.


definition_id: oval:org.debian:def:93360546551394534776802658080354537854
title: CVE-2008-0983 lighttpd
description:
lighttpd 1.4.18, and possibly other versions before 1.5.0, does not properly calculate the size of a file descriptor array, which allows remote attackers to cause a denial of service (crash) via a large number of connections, which triggers an out-of-bounds access.


definition_id: oval:org.debian:def:35851483132639035532843478763840536296
title: CVE-2008-0984 vlc
description:
The MP4 demuxer (mp4.c) for VLC media player 0.8.6d and earlier, as used in Miro Player 1.1 and earlier, allows remote attackers to overwrite arbitrary memory and execute arbitrary code via a malformed MP4 file.


definition_id: oval:org.debian:def:45636175895243905084374051556235218432
title: CVE-2008-1033 cups
description:
The scheduler in CUPS in Apple Mac OS X 10.5 before 10.5.3, when debug logging is enabled and a printer requires a password, allows attackers to obtain sensitive information (credentials) by reading the log data, related to "authentication environment variables."


definition_id: oval:org.debian:def:47836452631732069245838270853208571295
title: CVE-2008-1036 icu
description:
The International Components for Unicode (ICU) library in Apple Mac OS X before 10.5.3, Red Hat Enterprise Linux 5, and other operating systems omits some invalid character sequences during conversion of some character encodings, which might allow remote attackers to conduct cross-site scripting (XSS) attacks.


definition_id: oval:org.debian:def:162626724717168768078371029881372536717
title: CVE-2008-1070 wireshark
description:
The SCTP dissector in Wireshark (formerly Ethereal) 0.99.5 through 0.99.7 allows remote attackers to cause a denial of service (crash) via a malformed packet.


definition_id: oval:org.debian:def:296286950903362685902770014840526093794
title: CVE-2008-1071 wireshark
description:
The SNMP dissector in Wireshark (formerly Ethereal) 0.99.6 through 0.99.7 allows remote attackers to cause a denial of service (crash) via a malformed packet.


definition_id: oval:org.debian:def:200556435791138991241522155333938280474
title: CVE-2008-1072 wireshark
description:
The TFTP dissector in Wireshark (formerly Ethereal) 0.6.0 through 0.99.7, when running on Ubuntu 7.10, allows remote attackers to cause a denial of service (crash or memory consumption) via a malformed packet, possibly related to a Cairo library bug.


definition_id: oval:org.debian:def:71565468700010407101372123402201932394
title: CVE-2008-1096 graphicsmagick
description:
The load_tile function in the XCF coder in coders/xcf.c in (1) ImageMagick 6.2.8-0 and (2) GraphicsMagick (aka gm) 1.1.7 allows user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted .xcf file that triggers an out-of-bounds heap write, possibly related to the ScaleCharToQuantum function.


definition_id: oval:org.debian:def:16323985336249559231650117911485282190
title: CVE-2008-1097 graphicsmagick
description:
Heap-based buffer overflow in the ReadPCXImage function in the PCX coder in coders/pcx.c in (1) ImageMagick 6.2.4-5 and 6.2.8-0 and (2) GraphicsMagick (aka gm) 1.1.7 allows user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted .pcx file that triggers incorrect memory allocation for the scanline array, leading to memory corruption.


definition_id: oval:org.debian:def:194352315155019454683137678380901362176
title: CVE-2008-1098 moin
description:
Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.5.8 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) certain input processed by formatter/text_gedit.py (aka the gui editor formatter); (2) a page name, which triggers an injection in PageEditor.py when the page is successfully deleted by a victim in a DeletePage action; or (3) the destination page name for a RenamePage action, which triggers an injection in PageEditor.py when a victim's rename attempt fails because of a duplicate name.  NOTE: the AttachFile XSS issue is already covered by CVE-2008-0781, and the login XSS issue is already covered by CVE-2008-0780.


definition_id: oval:org.debian:def:320074804392742912771524546490713494032
title: CVE-2008-1099 moin
description:
_macro_Getval in wikimacro.py in MoinMoin 1.5.8 and earlier does not properly enforce ACLs, which allows remote attackers to read protected pages.


definition_id: oval:org.debian:def:32038437891241871075371967264066100892
title: CVE-2008-1100 clamav
description:
Buffer overflow in the cli_scanpe function in libclamav (libclamav/pe.c) for ClamAV 0.92 and 0.92.1 allows remote attackers to execute arbitrary code via a crafted Upack PE file.


definition_id: oval:org.debian:def:695158619268560116347272985020240686
title: CVE-2008-1102 blender
description:
Stack-based buffer overflow in the imb_loadhdr function in Blender 2.45 allows user-assisted remote attackers to execute arbitrary code via a .blend file that contains a crafted Radiance RGBE image.


definition_id: oval:org.debian:def:256077038109161542770003890119423741989
title: CVE-2008-1103 blender
description:
Multiple unspecified vulnerabilities in Blender have unknown impact and attack vectors, related to "temporary file issues."


definition_id: oval:org.debian:def:12319837755350731778515392458315316706
title: CVE-2008-1105 samba
description:
Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29 allows remote attackers to execute arbitrary code via a crafted SMB response.


definition_id: oval:org.debian:def:110027949981245271213372399655839918866
title: CVE-2008-1108 evolution
description:
Buffer overflow in Evolution 2.22.1, when the ITip Formatter plugin is disabled, allows remote attackers to execute arbitrary code via a long timezone string in an iCalendar attachment.


definition_id: oval:org.debian:def:191247199716369836897712591550675114144
title: CVE-2008-1109 evolution
description:
Heap-based buffer overflow in Evolution 2.22.1 allows user-assisted remote attackers to execute arbitrary code via a long DESCRIPTION property in an iCalendar attachment, which is not properly handled during a reply in the calendar view (aka the Calendars window).


definition_id: oval:org.debian:def:111412822334210332822514879210389148321
title: CVE-2008-1111 lighttpd
description:
mod_cgi in lighttpd 1.4.18 sends the source code of CGI scripts instead of a 500 error when a fork failure occurs, which might allow remote attackers to obtain sensitive information.


definition_id: oval:org.debian:def:221239124298737903016248373432941949504
title: CVE-2008-1199 dovecot
description:
Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify files or directories that are writable by group, via a symlink attack.


definition_id: oval:org.debian:def:255457452239080937660502390506072403861
title: CVE-2008-1218 dovecot
description:
Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using blocking passdbs, allows remote attackers to bypass the password check via a password containing TAB characters, which are treated as argument delimiters that enable the skip_password_check field to be specified.


definition_id: oval:org.debian:def:333345318442645842580316264278342639575
title: CVE-2008-1270 lighttpd
description:
mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the ~nobody directory.


definition_id: oval:org.debian:def:294951512414587888311647858053450543194
title: CVE-2008-1289 asterisk
description:
Multiple buffer overflows in Asterisk Open Source 1.4.x before 1.4.18.1 and 1.4.19-rc3, Open Source 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6.1, AsteriskNOW 1.0.x before 1.0.2, Appliance Developer Kit before 1.4 revision 109386, and s800i 1.1.x before 1.1.0.2 allow remote attackers to (1) write a zero to an arbitrary memory location via a large RTP payload number, related to the ast_rtp_unset_m_type function in main/rtp.c; or (2) write certain integers to an arbitrary memory location via a large number of RTP payloads, related to the process_sdp function in channels/chan_sip.c.


definition_id: oval:org.debian:def:269182641079177645283884657632699753073
title: CVE-2008-1290 viewvc
description:
ViewVC before 1.0.5 includes "all-forbidden" files within search results that list CVS or Subversion (SVN) commits, which allows remote attackers to obtain sensitive information.


definition_id: oval:org.debian:def:68787941292617870390337663431475045836
title: CVE-2008-1291 viewvc
description:
ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read files and list folders under the hidden CVSROOT folder.


definition_id: oval:org.debian:def:78235248309500854682055212645376122679
title: CVE-2008-1292 viewvc
description:
ViewVC before 1.0.5 provides revision metadata without properly checking whether access was intended, which allows remote attackers to obtain sensitive information by reading (1) forbidden pathnames in the revision view, (2) log history that can only be reached by traversing a forbidden object, or (3) forbidden diff view path parameters.


definition_id: oval:org.debian:def:94962582260233789118093324921981533448
title: CVE-2008-1293 ldm
description:
ldm in Linux Terminal Server Project (LTSP) 0.99 and 2 passes the -ac option to the X server on each LTSP client, which allows remote attackers to connect to this server via TCP port 6006 (aka display :6).


definition_id: oval:org.debian:def:230494924520218006054510827657932910520
title: CVE-2008-1318 mediawiki
description:
Unspecified vulnerability in MediaWiki 1.11 before 1.11.2 allows remote attackers to obtain sensitive "cross-site" information via the callback parameter in an API call for JavaScript Object Notation (JSON) formatted results.


definition_id: oval:org.debian:def:295435480196637210713470815831710019979
title: CVE-2008-1332 asterisk
description:
Unspecified vulnerability in Asterisk Open Source 1.2.x before 1.2.27, 1.4.x before 1.4.18.1 and 1.4.19-rc3; Business Edition A.x.x, B.x.x before B.2.5.1, and C.x.x before C.1.6.2; AsteriskNOW 1.0.x before 1.0.2; Appliance Developer Kit before 1.4 revision 109393; and s800i 1.0.x before 1.1.0.2; allows remote attackers to access the SIP channel driver via a crafted From header.


definition_id: oval:org.debian:def:314213817853367286775165867776133856979
title: CVE-2008-1333 asterisk
description:
Format string vulnerability in Asterisk Open Source 1.6.x before 1.6.0-beta6 might allow remote attackers to execute arbitrary code via logging messages that are not properly handled by (1) the ast_verbose logging API call, or (2) the astman_append function.


definition_id: oval:org.debian:def:73571738859146353268884906297813558999
title: CVE-2008-1353 zabbix
description:
zabbix_agentd in ZABBIX 1.4.4 allows remote attackers to cause a denial of service (CPU and connection consumption) via multiple vfs.file.cksum commands with a special device node such as /dev/urandom or /dev/zero.


definition_id: oval:org.debian:def:178504158977049386656897711328093955531
title: CVE-2008-1367 glibc
description:
gcc 4.3.x does not generate a cld instruction while compiling functions used for string manipulation such as memcpy and memmove on x86 and i386, which can prevent the direction flag (DF) from being reset in violation of ABI conventions and cause data to be copied in the wrong direction during signal handling in the Linux kernel, which might allow context-dependent attackers to trigger memory corruption. NOTE: this issue was originally reported for CPU consumption in SBCL.


definition_id: oval:org.debian:def:211441755592979758459795783697070087667
title: CVE-2008-1372 bzip2
description:
bzlib.c in bzip2 before 1.0.5 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted file that triggers a buffer over-read, as demonstrated by the PROTOS GENOME test suite for Archive Formats.


definition_id: oval:org.debian:def:134972417862565367682277981432218807620
title: CVE-2008-1373 cups
description:
Buffer overflow in the gif_read_lzw function in CUPS 1.3.6 allows remote attackers to have an unknown impact via a GIF file with a large code_size value, a similar issue to CVE-2006-4484.


definition_id: oval:org.debian:def:261624026502906147484914138132294624622
title: CVE-2008-1377 xorg-server
description:
The (1) SProcRecordCreateContext and (2) SProcRecordRegisterClients functions in the Record extension and the (3) SProcSecurityGenerateAuthorization function in the Security extension in the X server 1.4 in X.Org X11R7.3 allow context-dependent attackers to execute arbitrary code via requests with crafted length values that specify an arbitrary number of bytes to be swapped on the heap, which triggers heap corruption.


definition_id: oval:org.debian:def:305155861207869195494834554353871306152
title: CVE-2008-1379 xorg-server
description:
Integer overflow in the fbShmPutImage function in the MIT-SHM extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to read arbitrary process memory via crafted values for a Pixmap width and height.


definition_id: oval:org.debian:def:81699646572151005108532698068183063412
title: CVE-2008-1387 clamav
description:
ClamAV before 0.93 allows remote attackers to cause a denial of service (CPU consumption) via a crafted ARJ archive, as demonstrated by the PROTOS GENOME test suite for Archive Formats.


definition_id: oval:org.debian:def:298597598046167804129259477324793207749
title: CVE-2008-1389 clamav
description:
libclamav/chmunpack.c in the chm-parser in ClamAV before 0.94 allows remote attackers to cause a denial of service (application crash) via a malformed CHM file, related to an "invalid memory access."


definition_id: oval:org.debian:def:56378213479278733303000910782101941620
title: CVE-2008-1390 asterisk
description:
The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before revision 104704, and s800i 1.0.x before 1.1.0.2 generates insufficiently random manager ID values, which makes it easier for remote attackers to hijack a manager session via a series of ID guesses.


definition_id: oval:org.debian:def:160659422628337994366250449668752204817
title: CVE-2008-1391 glibc
description:
Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to (1) the strfmon function in lib/libc/stdlib/strfmon.c, related to the GET_NUMBER macro; and (2) the printf function, related to left_prec and right_prec.


definition_id: oval:org.debian:def:68569476289551594395378702940630567864
title: CVE-2008-1419 libvorbis
description:
Xiph.org libvorbis 1.2.0 and earlier does not properly handle a zero value for codebook.dim, which allows remote attackers to cause a denial of service (crash or infinite loop) or trigger an integer overflow.


definition_id: oval:org.debian:def:196600320073642524274837484444469733888
title: CVE-2008-1420 libvorbis
description:
Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow.


definition_id: oval:org.debian:def:268832003794817145368917307025125531366
title: CVE-2008-1423 libvorbis
description:
Integer overflow in a certain quantvals and quantlist calculation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted OGG file with a large virtual space for its codebook, which triggers a heap overflow.


definition_id: oval:org.debian:def:289266962377061646030168137592800171135
title: CVE-2008-1447 adns
description:
The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka "DNS Insufficient Socket Entropy Vulnerability" or "the Kaminsky bug."


definition_id: oval:org.debian:def:195930425836652064692120903951482067892
title: CVE-2008-1468 namazu2
description:
Cross-site scripting (XSS) vulnerability in namazu.cgi in Namazu before 2.0.18 allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded input, related to failure to set the charset, a different vector than CVE-2004-1318 and CVE-2001-1350. NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:293720993098478610861109461302412466996
title: CVE-2008-1483 openssh
description:
OpenSSH 4.3p2, and probably other versions, allows local users to hijack forwarded X connections by causing ssh to set DISPLAY to :10, even when another process is listening on the associated port, as demonstrated by opening TCP port 6010 (IPv4) and sniffing a cookie sent by Emacs.


definition_id: oval:org.debian:def:104530766287469189713202503380132840930
title: CVE-2008-1489 vlc
description:
Integer overflow in the MP4_ReadBox_rdrf function in libmp4.c for VLC 0.8.6e allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MP4 RDRF box that triggers a heap-based buffer overflow, a different vulnerability than CVE-2008-0984.


definition_id: oval:org.debian:def:59237326188976368412586349434639564817
title: CVE-2008-1502 wordpress
description:
The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting (XSS) attacks via a string containing crafted URL protocols.


definition_id: oval:org.debian:def:176614566322136801498393870895368842408
title: CVE-2008-1515 otrs2
description:
The SOAP interface in OTRS 2.1.x before 2.1.8 and 2.2.x before 2.2.6 allows remote attackers to "read and modify objects" via SOAP requests, related to "Missing security checks."


definition_id: oval:org.debian:def:32454693758503964033495709877983749639
title: CVE-2008-1530 gnupg2
description:
GnuPG (gpg) 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted duplicate keys that are imported from key servers, which triggers "memory corruption around deduplication of user IDs."


definition_id: oval:org.debian:def:114096089062319765238849866731074486196
title: CVE-2008-1531 lighttpd
description:
The connection_state_machine function (connections.c) in lighttpd 1.4.19 and earlier, and 1.5.x before 1.5.0, allows remote attackers to cause a denial of service (active SSL connection loss) by triggering an SSL error, such as disconnecting before a download has finished, which causes all active SSL connections to be lost.


definition_id: oval:org.debian:def:239798559060823197176582560514176811981
title: CVE-2008-1558 mplayer
description:
Uncontrolled array index in the sdpplin_parse function in stream/realrtsp/sdpplin.c in MPlayer 1.0 rc2 allows remote attackers to overwrite memory and execute arbitrary code via a large streamid SDP parameter.  NOTE: this issue has been referred to as an integer overflow.


definition_id: oval:org.debian:def:138713872673117603374961938234191927134
title: CVE-2008-1561 wireshark
description:
Multiple unspecified vulnerabilities in Wireshark (formerly Ethereal) 0.99.5 through 0.99.8 allow remote attackers to cause a denial of service (application crash) via a malformed packet to the (1) X.509sat or (2) Roofnet dissectors.  NOTE: Vector 2 might also lead to a hang.


definition_id: oval:org.debian:def:331478455575096805333613878012399379186
title: CVE-2008-1563 wireshark
description:
The "decode as" feature in packet-bssap.c in the SCCP dissector in Wireshark (formerly Ethereal) 0.99.6 through 0.99.8 allows remote attackers to cause a denial of service (application crash) via a malformed packet.


definition_id: oval:org.debian:def:309021027661066548762385694395646244567
title: CVE-2008-1569 policyd-weight
description:
policyd-weight 0.1.14 beta-16 and earlier allows local users to modify or delete arbitrary files via a symlink attack on temporary files that are used when creating a socket.


definition_id: oval:org.debian:def:42395278074360355827223905238685391547
title: CVE-2008-1570 policyd-weight
description:
Race condition in the create_lockpath function in policyd-weight 0.1.14 beta-16 allows local users to modify or delete arbitrary files by creating the LOCKPATH directory, then modifying it after the symbolic link check occurs.  NOTE: this is due to an incomplete fix for CVE-2008-1569.


definition_id: oval:org.debian:def:62167861931604595457744134148988121573
title: CVE-2008-1612 squid
description:
The arrayShrink function (lib/Array.c) in Squid 2.6.STABLE17 allows attackers to cause a denial of service (process exit) via unknown vectors that cause an array to shrink to 0 entries, which triggers an assert error.  NOTE: this issue is due to an incorrect fix for CVE-2007-6239.


definition_id: oval:org.debian:def:94793123170345840361049206080927869646
title: CVE-2008-1628 audit
description:
Stack-based buffer overflow in the audit_log_user_command function in lib/audit_logging.c in Linux Audit before 1.7 might allow remote attackers to execute arbitrary code via a long command argument. NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:270367301351496406977178280212256678179
title: CVE-2008-1637 pdns-recursor
description:
PowerDNS Recursor before 3.1.5 uses insufficient randomness to calculate (1) TRXID values and (2) UDP source port numbers, which makes it easier for remote attackers to poison a DNS cache, related to (a) algorithmic deficiencies in rand and random functions in external libraries, (b) use of a 32-bit seed value, and (c) choice of the time of day as the sole seeding information.


definition_id: oval:org.debian:def:223258796224532296584234385117558358627
title: CVE-2008-1648 sympa
description:
Sympa before 5.4 allows remote attackers to cause a denial of service (daemon crash) via an e-mail message with a malformed value of the Content-Type header and unspecified other headers.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:284014271577931213922932262193529205953
title: CVE-2008-1657 openssh
description:
OpenSSH 4.4 up to versions before 4.9 allows remote authenticated users to bypass the sshd_config ForceCommand directive by modifying the .ssh/rc session file.


definition_id: oval:org.debian:def:8137121853023856443878465688731164939
title: CVE-2008-1658 policykit-1
description:
Format string vulnerability in the grant helper (polkit-grant-helper.c) in PolicyKit 0.7 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in a password.


definition_id: oval:org.debian:def:226369128983473375875639558115879035667
title: CVE-2008-1670 kde4libs
description:
Heap-based buffer overflow in the progressive PNG Image loader (decoders/pngloader.cpp) in KHTML in KDE 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted image.


definition_id: oval:org.debian:def:18916738837878495303566293047488632684
title: CVE-2008-1672 openssl
description:
OpenSSL 0.9.8f and 0.9.8g allows remote attackers to cause a denial of service (crash) via a TLS handshake that omits the Server Key Exchange message and uses "particular cipher suites," which triggers a NULL pointer dereference.


definition_id: oval:org.debian:def:322914124386933850931911101502221584418
title: CVE-2008-1686 libfishsound
description:
Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier, including Illiminable DirectShow Filters and Annodex Plugins for Firefox, xine-lib before 1.1.12, and many other products, allows remote attackers to execute arbitrary code via a header structure containing a negative offset, which is used to dereference a function pointer.


definition_id: oval:org.debian:def:163451147993199032682208192827854165215
title: CVE-2008-1692 eterm
description:
Eterm 0.9.4 opens a terminal window on :0 if -display is not specified and the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections.  NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine.


definition_id: oval:org.debian:def:333690944834749894592374087697998363762
title: CVE-2008-1693 poppler
description:
The CairoFont::create function in CairoFontEngine.cc in Poppler, possibly before 0.8.0, as used in Xpdf, Evince, ePDFview, KWord, and other applications, does not properly handle embedded fonts in PDF files, which allows remote attackers to execute arbitrary code via a crafted font object, related to dereferencing a function pointer associated with the type of this font object.


definition_id: oval:org.debian:def:130882625416023646950679531374089079147
title: CVE-2008-1694 xemacs21
description:
vcdiff in Emacs 20.7 to 22.1.50, when used with SCCS, allows local users to overwrite arbitrary files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:62451253695308786017081022020227376907
title: CVE-2008-1722 cups
description:
Multiple integer overflows in (1) filter/image-png.c and (2) filter/image-zoom.c in CUPS 1.3 allow attackers to cause a denial of service (crash) and trigger memory corruption, as demonstrated via a crafted PNG image.


definition_id: oval:org.debian:def:213344914469161217343087999976656530634
title: CVE-2008-1767 libxslt
description:
Buffer overflow in pattern.c in libxslt before 1.1.24 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via an XSL style sheet file with a long XSLT "transformation match" condition that triggers a large number of steps.


definition_id: oval:org.debian:def:203316399861068267746745454894989562766
title: CVE-2008-1768 vlc
description:
Multiple integer overflows in VLC before 0.8.6f allow remote attackers to cause a denial of service (crash) via the (1) MP4 demuxer, (2) Real demuxer, and (3) Cinepak codec, which triggers a buffer overflow.


definition_id: oval:org.debian:def:315744750179942148415984400406323386152
title: CVE-2008-1769 vlc
description:
VLC before 0.8.6f allow remote attackers to cause a denial of service (crash) via a crafted Cinepak file that triggers an out-of-bounds array access and memory corruption.


definition_id: oval:org.debian:def:259238902320351072796223941709404931416
title: CVE-2008-1801 rdesktop
description:
Integer underflow in the iso_recv_msg function (iso.c) in rdesktop 1.5.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Remote Desktop Protocol (RDP) request with a small length field.


definition_id: oval:org.debian:def:147571600552388792327777940001041426315
title: CVE-2008-1802 rdesktop
description:
Buffer overflow in the process_redirect_pdu (rdp.c) function in rdesktop 1.5.0 allows remote attackers to execute arbitrary code via a Remote Desktop Protocol (RDP) redirect request with modified length fields.


definition_id: oval:org.debian:def:116346821010797615422511541249425307670
title: CVE-2008-1803 rdesktop
description:
Integer signedness error in the xrealloc function (rdesktop.c) in RDesktop 1.5.0 allows remote attackers to execute arbitrary code via unknown parameters that trigger a heap-based overflow.  NOTE: the role of the channel_process function was not specified by the original researcher.


definition_id: oval:org.debian:def:320453429403206401422259021743644012326
title: CVE-2008-1804 snort
description:
preprocessors/spp_frag3.c in Sourcefire Snort before 2.8.1 does not properly identify packet fragments that have dissimilar TTL values, which allows remote attackers to bypass detection rules by using a different TTL for each fragment.


definition_id: oval:org.debian:def:87115729928595409514679618594565950136
title: CVE-2008-1806 freetype
description:
Integer overflow in FreeType2 before 2.3.6 allows context-dependent attackers to execute arbitrary code via a crafted set of 16-bit length values within the Private dictionary table in a Printer Font Binary (PFB) file, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:190617206854530450357257983972211514105
title: CVE-2008-1807 freetype
description:
FreeType2 before 2.3.6 allow context-dependent attackers to execute arbitrary code via an invalid "number of axes" field in a Printer Font Binary (PFB) file, which triggers a free of arbitrary memory locations, leading to memory corruption.


definition_id: oval:org.debian:def:74268082359927659349302739106561813823
title: CVE-2008-1808 freetype
description:
Multiple off-by-one errors in FreeType2 before 2.3.6 allow context-dependent attackers to execute arbitrary code via (1) a crafted table in a Printer Font Binary (PFB) file or (2) a crafted SHC instruction in a TrueType Font (TTF) file, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:189908014672667095068567603575796210323
title: CVE-2008-1832 cecilia
description:
lib/prefs.tcl in Cecilia 2.0.5 allows local users to overwrite arbitrary files via a symlink attack on the csvers temporary file.


definition_id: oval:org.debian:def:328870143073114545768813734141375541635
title: CVE-2008-1833 clamav
description:
Heap-based buffer overflow in pe.c in libclamav in ClamAV 0.92.1 allows remote attackers to execute arbitrary code via a crafted WWPack compressed PE binary.


definition_id: oval:org.debian:def:140603723166861311183611936146500552643
title: CVE-2008-1845 mksh
description:
The Korn shell (aka mksh) before R33d on MirOS (aka MirBSD) does not flush the tty's I/O when invoking mksh in a new terminal, which allows local users to gain privileges by opening a virtual terminal and entering command sequences, which might later be executed in opportunistic circumstances by a different user who launches mksh and specifies that terminal with the -T option.


definition_id: oval:org.debian:def:217148330897671907933506131809053455021
title: CVE-2008-1881 vlc
description:
Stack-based buffer overflow in the ParseSSA function (modules/demux/subtitle.c) in VLC 0.8.6e allows remote attackers to execute arbitrary code via a long subtitle in an SSA file.  NOTE: this issue is due to an incomplete fix for CVE-2007-6681.


definition_id: oval:org.debian:def:37073775860203414997040753171074852053
title: CVE-2008-1897 asterisk
description:
The IAX2 channel driver (chan_iax2) in Asterisk Open Source 1.0.x, 1.2.x before 1.2.28, and 1.4.x before 1.4.19.1; Business Edition A.x.x, B.x.x before B.2.5.2, and C.x.x before C.1.8.1; AsteriskNOW before 1.0.3; Appliance Developer Kit 0.x.x; and s800i before 1.1.0.3, when configured to allow unauthenticated calls, does not verify that an ACK response contains a call number matching the server's reply to a NEW message, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed ACK response that does not complete a 3-way handshake.  NOTE: this issue exists because of an incomplete fix for CVE-2008-1923.


definition_id: oval:org.debian:def:188756616260285023010793613828571252597
title: CVE-2008-1923 asterisk
description:
The IAX2 channel driver (chan_iax2) in Asterisk 1.2 before revision 72630 and 1.4 before revision 65679, when configured to allow unauthenticated calls, sends "early audio" to an unverified source IP address of a NEW message, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed NEW message.


definition_id: oval:org.debian:def:255598749163939101349153556579127370483
title: CVE-2008-1925 inspircd
description:
Buffer overflow in InspIRCd before 1.1.18, when using the namesx and uhnames modules, allows remote attackers to cause a denial of service (daemon crash) via a large number of channel users with crafted nicknames, idents, and long hostnames.


definition_id: oval:org.debian:def:125819448699980501332035997478576001578
title: CVE-2008-1926 util-linux
description:
Argument injection vulnerability in login (login-utils/login.c) in util-linux-ng 2.14 and earlier makes it easier for remote attackers to hide activities by modifying portions of log events, as demonstrated by appending an "addr=" statement to the login name, aka "audit log injection."


definition_id: oval:org.debian:def:64959185032835095659165423149501474163
title: CVE-2008-1927 perl
description:
Double free vulnerability in Perl 5.8.8 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a crafted regular expression containing UTF8 characters.  NOTE: this issue might only be present on certain operating systems.


definition_id: oval:org.debian:def:243507450460105584875596446882848568034
title: CVE-2008-1928 libimager-perl
description:
Buffer overflow in Imager 0.42 through 0.63 allows attackers to cause a denial of service (crash) via an image based fill in which the number of input channels is different from the number of output channels.


definition_id: oval:org.debian:def:150583369625794973038394982785337092053
title: CVE-2008-1930 wordpress
description:
The cookie authentication method in WordPress 2.5 relies on a hash of a concatenated string containing USERNAME and EXPIRY_TIME, which allows remote attackers to forge cookies by registering a username that results in the same concatenated string, as demonstrated by registering usernames beginning with "admin" to obtain administrator privileges, aka a "cryptographic splicing" issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2007-6013.


definition_id: oval:org.debian:def:81112136981174542616441760556425840638
title: CVE-2008-1937 moin
description:
The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges.


definition_id: oval:org.debian:def:176160367333000308569777613385458240978
title: CVE-2008-1945 qemu
description:
QEMU 0.9.0 does not properly handle changes to removable media, which allows guest OS users to read arbitrary files on the host OS by using the diskformat: parameter in the -usbdevice option to modify the disk-image header to identify a different format, a related issue to CVE-2008-2004.


definition_id: oval:org.debian:def:56149048604872981692368133432646607402
title: CVE-2008-1946 coreutils
description:
The default configuration of su in /etc/pam.d/su in GNU coreutils 5.2.1 allows local users to gain the privileges of a (1) locked or (2) expired account by entering the account name on the command line, related to improper use of the pam_succeed_if.so module.


definition_id: oval:org.debian:def:267010492749097671683942986698711415914
title: CVE-2008-1959 sip-tester
description:
Stack-based buffer overflow in the get_remote_video_port_media function in call.cpp in SIPp 3.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted SIP message.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:85329005770684137847393102671565015583
title: CVE-2008-2004 qemu
description:
The drive_init function in QEMU 0.9.1 determines the format of a raw disk image based on the header, which allows local guest users to read arbitrary files on the host by modifying the header to identify a different format, which is used when the guest is restarted.


definition_id: oval:org.debian:def:18713294733928487511309914897764270638
title: CVE-2008-2009 libvorbis
description:
Xiph.org libvorbis before 1.0 does not properly check for underpopulated Huffman trees, which allows remote attackers to cause a denial of service (crash) via a crafted OGG file that triggers memory corruption during execution of the _make_decode_tree function.


definition_id: oval:org.debian:def:82739321334254984461584472432279179412
title: CVE-2008-2068 wordpress
description:
Cross-site scripting (XSS) vulnerability in WordPress 2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:272490208473732667025850431338749948919
title: CVE-2008-2078 robocode
description:
Robocode before 1.6.0 allows user-assisted remote attackers to "access the internals of the Robocode game" via unspecified vectors related to the AWT Event Queue.


definition_id: oval:org.debian:def:145685541273163947902061252931350852494
title: CVE-2008-2085 sip-tester
description:
Multiple stack-based buffer overflows in the (1) get_remote_ip_media and (2) get_remote_ipv6_media functions in call.cpp in SIPp 3.1 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted SIP message.


definition_id: oval:org.debian:def:234711867720357149497962411403256212396
title: CVE-2008-2119 asterisk
description:
Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing (aka pedanticsipchecking) is enabled, allows remote attackers to cause a denial of service (daemon crash) via a SIP INVITE message that lacks a From header, related to invocations of the ast_uri_decode function, and improper handling of (1) an empty const string and (2) a NULL pointer.


definition_id: oval:org.debian:def:210191550856704191281674406675492650992
title: CVE-2008-2142 xemacs21-packages
description:
Emacs 21 and XEmacs automatically load and execute .flc (fast lock) files that are associated with other files that are edited within Emacs, which allows user-assisted attackers to execute arbitrary code.


definition_id: oval:org.debian:def:128325721015078218372460704896005895775
title: CVE-2008-2146 wordpress
description:
wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATH_INFO ($PHP_SELF), which allows remote attackers to bypass intended access restrictions for certain pages.


definition_id: oval:org.debian:def:101825555288907877952881367617834264244
title: CVE-2008-2147 vlc
description:
Untrusted search path vulnerability in VideoLAN VLC before 0.9.0 allows local users to execute arbitrary code via a malicious library under the modules/ or plugins/ subdirectories of the current working directory.


definition_id: oval:org.debian:def:66019281990828414308397917782917579884
title: CVE-2008-2149 wordnet
description:
Stack-based buffer overflow in the searchwn function in Wordnet 2.0, 2.1, and 3.0 might allow context-dependent attackers to execute arbitrary code via a long command line option.  NOTE: this issue probably does not cross privilege boundaries except in cases in which Wordnet is used as a back end.


definition_id: oval:org.debian:def:118927175280172912380211203988136486095
title: CVE-2008-2168 apache2
description:
Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page.


definition_id: oval:org.debian:def:145682616191163821665182948635322594101
title: CVE-2008-2230 reportbug
description:
Untrusted search path vulnerability in (1) reportbug 3.8 and 3.31, and (2) reportbug-ng before 0.2008.06.04, allows local users to execute arbitrary code via a malicious module file in the current working directory.


definition_id: oval:org.debian:def:225645754689687508863285402807592307084
title: CVE-2008-2232 afuse
description:
The expand_template function in afuse.c in afuse 0.2 allows local users to gain privileges via shell metacharacters in a pathname.


definition_id: oval:org.debian:def:325918169649300890981581559767117256476
title: CVE-2008-2235 opensc
description:
OpenSC before 0.11.5 uses weak permissions (ADMIN file control information of 00) for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4, which allows physically proximate attackers to change the PIN.


definition_id: oval:org.debian:def:53077830855909640905807454947927332351
title: CVE-2008-2236 blosxom
description:
Cross-site scripting (XSS) vulnerability in blosxom.cgi in Blosxom before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the flav parameter (flavour variable).  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:131399321992198266303918146893819890708
title: CVE-2008-2266 uudeview
description:
uulib/uunconc.c in UUDeview 0.5.20, as used in nzbget before 0.3.0 and possibly other products, allows local users to overwrite arbitrary files via a symlink attack on a temporary filename generated by the tempnam function.  NOTE: this may be a CVE-2004-2265 regression.


definition_id: oval:org.debian:def:244350278147368577881275255052719461481
title: CVE-2008-2285 openssh
description:
The ssh-vulnkey tool on Ubuntu Linux 7.04, 7.10, and 8.04 LTS does not recognize authorized_keys lines that contain options, which makes it easier for remote attackers to exploit CVE-2008-0166 by guessing a key that was not identified by this tool.


definition_id: oval:org.debian:def:242596677964395576844402365051690067707
title: CVE-2008-2292 net-snmp
description:
Buffer overflow in the __snprint_value function in snmp_get in Net-SNMP 5.1.4, 5.2.4, and 5.4.1, as used in SNMP.xs for Perl, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large OCTETSTRING in an attribute value pair (AVP).


definition_id: oval:org.debian:def:103818520009432835820822787475993758764
title: CVE-2008-2302 python-django
description:
Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request.


definition_id: oval:org.debian:def:241281304923450659011198447439835176948
title: CVE-2008-2307 qt4-x11
description:
Unspecified vulnerability in WebKit in Apple Safari before 3.1.2, as distributed in Mac OS X before 10.5.4, and standalone for Windows and Mac OS X 10.4, allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors involving JavaScript arrays that trigger memory corruption.


definition_id: oval:org.debian:def:137709626747476045977429739138750423933
title: CVE-2008-2310 binutils
description:
Format string vulnerability in c++filt in Apple Mac OS X 10.5 before 10.5.4 allows user-assisted attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string in (1) C++ or (2) Java source code.


definition_id: oval:org.debian:def:302940977944154951117361990713223101522
title: CVE-2008-2327 tiff
description:
Multiple buffer underflows in the (1) LZWDecode, (2) LZWDecodeCompat, and (3) LZWDecodeVector functions in tif_lzw.c in the LZW decoder in LibTIFF 3.8.2 and earlier allow context-dependent attackers to execute arbitrary code via a crafted TIFF file, related to improper handling of the CODE_CLEAR code.


definition_id: oval:org.debian:def:174727507796473146620281723860868451760
title: CVE-2008-2357 mtr
description:
Stack-based buffer overflow in the split_redraw function in split.c in mtr before 0.73, when invoked with the -p (aka --split) option, allows remote attackers to execute arbitrary code via a crafted DNS PTR record.  NOTE: it could be argued that this is a vulnerability in the ns_name_ntop function in resolv/ns_name.c in glibc and the proper fix should be in glibc; if so, then this should not be treated as a vulnerability in mtr.


definition_id: oval:org.debian:def:438676282551243346008818631091646484
title: CVE-2008-2360 xorg-server
description:
Integer overflow in the AllocateGlyph function in the Render extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to execute arbitrary code via unspecified request fields that are used to calculate a heap buffer size, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:18460861029891991324780161104388209164
title: CVE-2008-2361 xorg-server
description:
Integer overflow in the ProcRenderCreateCursor function in the Render extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to cause a denial of service (daemon crash) via unspecified request fields that are used to calculate a glyph buffer size, which triggers a dereference of unmapped memory.


definition_id: oval:org.debian:def:218708207832581980201687731482005160704
title: CVE-2008-2362 xorg-server
description:
Multiple integer overflows in the Render extension in the X server 1.4 in X.Org X11R7.3 allow context-dependent attackers to execute arbitrary code via a (1) SProcRenderCreateLinearGradient, (2) SProcRenderCreateRadialGradient, or (3) SProcRenderCreateConicalGradient request with an invalid field specifying the number of bytes to swap in the request data, which triggers heap memory corruption.


definition_id: oval:org.debian:def:218096252060261293500494543826337984588
title: CVE-2008-2363 pan
description:
The PartsBatch class in Pan 0.132 and earlier does not properly manage the data structures for Parts batches, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted .nzb file that triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:85897582043580127715739924725787292750
title: CVE-2008-2364 apache2
description:
The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.


definition_id: oval:org.debian:def:166890667689265415446361651574109146137
title: CVE-2008-2371 pcre3
description:
Heap-based buffer overflow in pcre_compile.c in the Perl-Compatible Regular Expression (PCRE) library 7.7 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a regular expression that begins with an option and contains multiple branches.


definition_id: oval:org.debian:def:56592277381700805445100614146018096730
title: CVE-2008-2380 courier-authlib
description:
SQL injection vulnerability in authpgsqllib.c in Courier-Authlib before 0.62.0, when a non-Latin locale Postgres database is used, allows remote attackers to execute arbitrary SQL commands via query parameters containing apostrophes.


definition_id: oval:org.debian:def:210267296363146310177000400366379755190
title: CVE-2008-2382 qemu
description:
The protocol_client_msg function in vnc.c in the VNC server in (1) Qemu 0.9.1 and earlier and (2) KVM kvm-79 and earlier allows remote attackers to cause a denial of service (infinite loop) via a certain message.


definition_id: oval:org.debian:def:63907823328104774127515003727167267542
title: CVE-2008-2383 xterm
description:
CRLF injection vulnerability in xterm allows user-assisted attackers to execute arbitrary commands via LF (aka \n) characters surrounding a command name within a Device Control Request Status String (DECRQSS) escape sequence in a text file, a related issue to CVE-2003-0063 and CVE-2003-0071.


definition_id: oval:org.debian:def:195343266256649532118713923197325680505
title: CVE-2008-2392 wordpress
description:
Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files via the Upload section in the Write Tabs area of the dashboard.


definition_id: oval:org.debian:def:61155693527304905880049720928288494738
title: CVE-2008-2420 stunnel4
description:
The OCSP functionality in stunnel before 4.24 does not properly search certificate revocation lists (CRL), which allows remote attackers to bypass intended access restrictions by using revoked certificates.


definition_id: oval:org.debian:def:332627548136857708717612090661171219448
title: CVE-2008-2426 imlib2
description:
Multiple stack-based buffer overflows in Imlib 2 (aka imlib2) 1.4.0 allow user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via (1) a PNM image with a crafted header, related to the load function in src/modules/loaders/loader_pnm.c; or (2) a crafted XPM image, related to the load function in src/modules/loader_xpm.c.


definition_id: oval:org.debian:def:63002932488191546526299451922932898904
title: CVE-2008-2430 vlc
description:
Integer overflow in the Open function in modules/demux/wav.c in VLC Media Player 0.8.6h on Windows allows remote attackers to execute arbitrary code via a large fmt chunk in a WAV file.


definition_id: oval:org.debian:def:288642035090531068353524983862590409562
title: CVE-2008-2469 libspf2
description:
Heap-based buffer overflow in the SPF_dns_resolv_lookup function in Spf_dns_resolv.c in libspf2 before 1.2.8 allows remote attackers to execute arbitrary code via a long DNS TXT record with a modified length field.


definition_id: oval:org.debian:def:318371334880324469730096055958087886095
title: CVE-2008-2654 motion
description:
Off-by-one error in the read_client function in webhttpd.c in Motion 3.2.10 and earlier might allow remote attackers to execute arbitrary code via a long request to a Motion HTTP Control interface, which triggers a stack-based buffer overflow with some combinations of processor architecture and compiler.


