Buffer overflow in swfformat.dll in multiple RealNetworks products and versions including RealPlayer 10.x RealOne Player Rhapsody 3 and Helix Player allows remote attackers to execute arbitrary code via a crafted SWF (Flash) file with (1) a size value that is less than the actual size or (2) other unspecified manipulations.


Buffer overflow in BlackBerry Attachment Service in Research in Motion (RIM) BlackBerry Enterprise Server 2.2 and 4.0 before SP3 Hotfix 4 for IBM Lotus Domino 3.6 before SP7 and 5.0 before SP3 Hotfix 3 for Microsoft Exchangem and 4.0 for Novell GroupWise before SP3 Hotfix 1 might allow user-assisted remote attackers to execute arbitrary code on the server via a crafted Microsoft Word document that is opened on a wireless device.

buffer overflow
arbitrary code execution


Stack-based buffer overflow in the create_named_pipe function in libmysql.c in PHP 4.3.10 and 4.4.x before 4.4.3 for Windows allows attackers to execute arbitrary code via a long (1) arg_host or (2) arg_unix_socket argument as demonstrated by a long named pipe variable in the host argument to the mysql_connect function.


Buffer overflow in git-checkout-index in GIT before 1.1.5 allows remote attackers to execute arbitrary code via an index file with a long symbolic link.


Buffer overflow in eStara Softphone 3.0.1.14 through 3.0.1.46 allows remote attackers to execute arbitrary code via a long attribute (aka \a\) field in the SDP data of a SIP packet on UDP port 5060.


Buffer overflow in YGPPicFinder.DLL in AOL You've Got Pictures (YGP) Picture Finder Tool ActiveX Control as used in AOL 8.0 8.0 Plus and 9.0 Classic allows remote attackers to execute arbitrary code via unspecified vectors.


Multiple stack-based buffer overflows in QNX Neutrino RTOS 6.3.0 allow local users to execute arbitrary code via long (1) ABLPATH or (2) ABLANG environment variables in the libAP library (libAp.so.2) or (3) a long PHOTON_PATH environment variable to the setitem function in the libph library.


Multiple buffer overflows in E-Post Mail Server 4.10 and SPA-PRO Mail @Solomon 4.00 allow remote attackers to execute arbitrary code via a long username to the (1) AUTH PLAIN or (2) AUTH LOGIN SMTP commands which is not properly handled by (a) EPSTRS.EXE or (b) SPA-RS.EXE; (3) a long username in the APOP POP3 command which is not properly handled by (c) EPSTPOP4S.EXE or (d) SPA-POP3S.EXE; (4) a long IMAP DELETE command which is not properly handled by (e) EPSTIMAP4S.EXE or (f) SPA-IMAP4S.EXE.


Heap-based buffer overflow in the CRpcIoManagerServer::BuildContext function in msdtcprx.dll for Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0 and Windows 2000 SP2 and SP3 allows remote attackers to execute arbitrary code via a long fifth argument to the BuildContextW or BuildContext opcode which triggers a bug in the NdrAllocate function aka the MSDTC Invalid Memory Access Vulnerability.


Buffer overflow in Nullsoft Winamp 5.12 allows remote attackers to execute arbitrary code via a playlist (pls) file with a long file name (File1 field).


Buffer overflow in the plug-in for Microsoft Windows Media Player (WMP) 9 and 10 when used in browsers other than Internet Explorer and set as the default application to handle media files allows remote attackers to execute arbitrary code via HTML with an EMBED element containing a long src attribute.


Buffer overflow in Library of Assorted Spiffy Things (LibAST) 0.6.1 and earlier as used in Eterm and possibly other software allows local users to execute arbitrary code as the utmp user via a long -X command line argument (alternative configuration file name).


Buffer overflow in Microsoft Office 2000 SP3 XP SP3 and other versions and packages allows user-assisted attackers to execute arbitrary code via a routing slip that is longer than specified by the provided length field as exploited by malware such as TROJ_MDROPPER.BH and Trojan.PPDropper.E in attacks against PowerPoint.


Buffer overflow in RITLabs The Bat! 3.60.07 allows remote attackers to execute arbitrary code via a long Subject field.


Stack-based buffer overflow in Microsoft HTML Help Workshop 4.74.8702.0 and possibly earlier versions and as included in the Microsoft HTML Help 1.4 SDK allows context-dependent attackers to execute arbitrary code via a .hhp file with a long Contents file field.


Stack-based buffer overflow in the fullpath function in misc.c for zoo 2.10 and earlier as used in products such as Barracuda Spam Firewall allows user-assisted attackers to execute arbitrary code via a crafted ZOO file that causes the combine function to return a longer string than expected.


Buffer overflow in qmailadmin.c in QmailAdmin before 1.2.10 allows remote attackers to execute arbitrary code via a long PATH_INFO environment variable.


Buffer overflow in pl_main.c in sail in BSDgames before 2.17-7 allows local users to execute arbitrary code via a long player name that is used in a scanf function call.


Stack-based buffer overflow in Microsoft Visual Studio 6.0 and Microsoft Visual InterDev 6.0 allows user-assisted attackers to execute arbitrary code via a long DataProject field in a (1) Visual Studio Database Project File (.dbp) or (2) Visual Studio Solution (.sln).


Multiple stack-based buffer overflows in the procConnectArgs function in servmgr.cpp in PeerCast before 0.1217 allow remote attackers to execute arbitrary code via an HTTP GET request with a long (1) parameter name or (2) value in a URL which triggers the overflow in the nextCGIarg function in servhs.cpp.


Integer signedness error in format_jpeg.c in Asterisk 1.2.6 and earlier allows remote attackers to execute arbitrary code via a length value that passes a length check as a negative number but triggers a buffer overflow when it is used as an unsigned length.


The configuration of NetHack 3.4.3-r1 and earlier Falcon's Eye 1.9.4a and earlier and Slash'EM 0.0.760 and earlier on Gentoo Linux allows local users in the games group to modify saved games files to execute arbitrary code via buffer overflows and overwrite arbitrary files via symlink attacks.


Multiple buffer overflows in World Wide Web Consortium (W3C) Amaya 9.4 and possibly other versions including 8.x before 8.8.5 allow remote attackers to execute arbitrary code via a long value in (1) the COMPACT attribute of the COLGROUP element (2) the ROWS attribute of the TEXTAREA element and (3) the COLOR attribute of the LEGEND element; and via other unspecified attack vectors consisting of \dozens of possible snippets.\


Heap-based buffer overflow in BOM BOMArchiveHelper 10.4 (6.3) Build 312 as used in Mac OS X 10.4.6 and earlier allows user-assisted attackers to execute arbitrary code via a crafted archive (such as ZIP) that contains long path names which triggers an error in the BOMStackPop function.


Buffer overflow in calloc.c in the Microsoft Windows XP SP2 ntdll.dll system library when used by the ILDASM disassembler in the Microsoft .NET 1.0 and 1.1 SDK might allow user-assisted attackers to execute arbitrary code via a crafted .dll file with a large static method.


Buffer overflow in xine_list_delete_current in libxine 1.14 and earlier as distributed in xine-lib 1.1.1 and earlier allows remote attackers to execute arbitrary code via a crafted MPEG stream.


Buffer overflow in the parse function in parse.c in zoo 2.10 might allow local users to execute arbitrary code via long filename command line arguments which are not properly handled during archive creation. NOTE: since this issue is local and not setuid the set of attack scenarios is limited although is reasonable to expect that there are some situations in which the zoo user might automatically list attacker-controlled filenames to add to the zoo archive.


Multiple buffer overflows in LISTSERV 14.3 and 14.4 including LISTSERV Lite and HPO with the web archive interface enabled allow remote attackers to execute arbitrary code via unknown attack vectors related to the WA CGI. NOTE: technical details will be released after the grace period has ended on 20060603.


Buffer overflow in RevilloC MailServer and Proxy 1.21 allows remote attackers to execute arbitrary code via a long USER command.


Buffer overflow in the IsComponentInstalled method in Internet Explorer 6.0 when used on Windows 2000 before SP4 or Windows XP before SP1 allows remote attackers to execute arbitrary code via JavaScript that calls IsComponentInstalled with a long first argument.


Buffer overflow in Ethereal 0.8.5 up to 0.10.14 allows remote attackers to execute arbitrary code via the telnet dissector.


Buffer overflow in eBay Enhanced Picture Services (aka EPUImageControl Class) in EUPWALcontrol.dll before 1.0.3.48 as used in Sell Your Item (SYI) Setup & Test eBay Enhanced Picture Services Picture Manager Enhanced Uploader and CARad.com Add Vehicle allows remote attackers to execute arbitrary code via a crafted HTML document.


Heap-based buffer overflow in zgv before 5.8 and xzgv before 0.8 might allow user-assisted attackers to execute arbitrary code via a JPEG image with more than 3 output components such as a CMYK or YCCK color space which causes less memory to be allocated than required.


Buffer overflow in NTLM authentication in MailEnable Professional 2.0 and Enterprise 2.0 allows remote attackers to execute arbitrary code via \the signature field of NTLM Type 1 messages\.


Stack-based buffer overflow in the RPC interface in Mediasvr.exe in Computer Associates (CA) Brightstor ARCserve Backup 9.01 through 11.5 Enterprise Backup 10.5 and CA Protection Suites r2 allows remote attackers to execute arbitrary code via crafted SUNRPC packets aka the \Mediasvr.exe String Handling Overflow \ a different vulnerability than CVE-2006-5171.


Buffer overflow in the AOL.PicDownloadCtrl.1 ActiveX control (YGPPicDownload.dll) 9.2.3.0 in America Online (AOL) 9.0 Security Edition allows remote attackers to execute arbitrary code via the downloadFileDirectory property a different vulnerability than CVE-2006-5502.


Buffer overflow in PHP before 5.2.0 allows remote attackers to execute arbitrary code via crafted UTF-8 inputs to the (1) htmlentities or (2) htmlspecialchars functions.


Multiple buffer overflows in CA BrightStor ARCserve Backup r11.5 SP1 and earlier r11.1 and 9.01; BrightStor ARCserve Backup for Windows r11; BrightStor Enterprise Backup 10.5; Server Protection Suite r2; and Business Protection Suite r2 allow remote attackers to execute arbitrary code via crafted data on TCP port 6071 to the Backup Agent RPC Server (DBASVR.exe) using the RPC routines with opcode (1) 0x01 (2) 0x02 or (3) 0x18; invalid stub data on TCP port 6503 to the RPC routines with opcode (4) 0x2b or (5) 0x2d in ASCORE.dll in the Message Engine RPC Server (msgeng.exe); (6) a long hostname on TCP port 41523 to ASBRDCST.DLL in the Discovery Service (casdscsvc.exe); or unspecified vectors related to the (7) Job Engine Service.


Buffer overflow in cfgmgr in IBM AIX 5.2.0 and 5.3.0 allows local users to execute arbitrary code via a long directory path argument.


Stack-based buffer overflow in the Broadcom BCMWL5.SYS wireless device driver 3.50.21.10 as used in Cisco Linksys WPC300N Wireless-N Notebook Adapter before 4.100.15.5 and other products allows remote attackers to execute arbitrary code via an 802.11 response frame containing a long SSID field.


Buffer overflow in McAfee ePolicy Orchestrator before 3.5.0.720 and ProtectionPilot before 1.1.1.126 allows remote attackers to execute arbitrary code via a request to /spipe/pkg/ with a long source header.


Heap-based buffer overflow in the IMA_SECURE_DecryptData1 function in ImaSystem.dll for Citrix MetaFrame XP 1.0 and 2.0 and Presentation Server 3.0 and 4.0 allows remote attackers to execute arbitrary code via requests to the Independent Management Architecture (IMA) service (ImaSrv.exe) with invalid size values that trigger the overflow during decryption.


Buffer overflow in (1) Call of Duty 1.5b and earlier (2) Call of Duty United Offensive 1.51b and earlier and (3) Call of Duty 2 1.3 and earlier allows remote attackers to execute arbitrary code via a long map argument to the \callvote map\ command.


Stack-based buffer overflow in the (1) swpackage and (2) swmodify commands in HP-UX B.11.11 and possibly other versions allows local users to execute arbitrary code via a long -S argument. NOTE: this might be a duplicate of CVE-2006-2574 but the details relating to CVE-2006-2574 are too vague to be certain.


Multiple stack-based buffer overflows in Novell eDirectory 8.8.x before 8.8.1 FTF1 and 8.x up to 8.7.3.8 and Novell NetMail before 3.52e FTF2 allow remote attackers to execute arbitrary code via (1) a long HTTP Host header which triggers an overflow in the BuildRedirectURL function; or vectors related to a username containing a . (dot) character in the (2) SMTP (3) POP (4) IMAP (5) HTTP or (6) Networked Messaging Application Protocol (NMAP) Netmail services.


The Airport driver for certain Orinoco based Airport cards in Darwin kernel 8.8.0 in Apple Mac OS X 10.4.8 and possibly other versions allows remote attackers to execute arbitrary code via an 802.11 probe response frame without any valid information element (IE) fields after the header which triggers a heap-based buffer overflow.


Buffer overflow in Desknet's (niokeru) before 5.0J R1.0 might allow remote authenticated users to execute arbitrary code via unspecified vectors. NOTE: some of these details are obtained from third party information.


Off-by-one error in the Certificate Trust List (CTL) Provider service (CTLProvider.exe) in Cisco Unified Communications Manager (CUCM formerly CallManager) before 20070711 allow remote attackers to execute arbitrary code via a crafted packet that triggers a heap-based buffer overflow.


Stack-based buffer overflow in the ps_gettext function in ps.c for GNU gv 3.6.2 and possibly earlier versions allows user-assisted attackers to execute arbitrary code via a PostScript (PS) file with certain headers that contain long comments as demonstrated using the (1) DocumentMedia (2) DocumentPaperSizes and possibly (3) PageMedia and (4) PaperSize headers. NOTE: this issue can be exploited through other products that use gv such as evince.


Stack-based buffer overflow in the RPC interface in Mediasvr.exe in Computer Associates (CA) Brightstor ARCserve Backup 9.01 through 11.5 Enterprise Backup 10.5 and CA Protection Suites r2 allows remote attackers to execute arbitrary code via crafted SUNRPC packets aka the \Mediasvr.exe Overflow \ a different vulnerability than CVE-2006-5172.


Heap-based buffer overflow in the AOL.PicDownloadCtrl.1 ActiveX control (YGPPicDownload.dll) 9.2.3.0 in America Online (AOL) 9.0 Security Edition allows remote attackers to execute arbitrary code via the AddPictureNoAlbum method a different vulnerability than CVE-2006-5501.


Buffer overflow in dtmail on HP Tru64 UNIX 4.0F through 5.1B and HP-UX B.11.00 through B.11.23 allows local users to execute arbitrary code via a long -a (aka attachment) argument.


Buffer overflow in Microsoft Class Package Export Tool (aka clspack.exe) allows context-dependent attackers to execute arbitrary code via a long string. NOTE: the provenance of this information is unknown; the details are obtained from third party information.


Multiple buffer overflows in Microsoft Dynamics GP (formerly Great Plains) 9.0 and earlier allow remote attackers to execute arbitrary code via (1) a crafted Distributed Process Manager (DPM) message to the (a) DPM component or a (2) long string or (3) long IP address in a Distributed Process Server (DPS) message to the DPM or (b) DPS component.


Buffer overflow in InterVations NaviCOPA Web Server 2.01 allows remote attackers to execute arbitrary code via a long HTTP GET request.


Unspecified vulnerability in Justsystem Ichitaro 2006 2006 trial version and Government 2006 allows remote attackers to execute arbitrary code via a modified document possibly because of a buffer overflow a different vulnerability than CVE-2006-4326.


Stack-based buffer overflow in the NetBackup bpcd daemon (bpcd.exe) in Symantec Veritas NetBackup 5.0 before 5.0_MP7 5.1 before 5.1_MP6 and 6.0 before 6.0_MP4 allows remote attackers to execute arbitrary code via a long CONNECT_OPTIONS request a different issue than CVE-2006-6222.


Buffer overflow in SAP DB and MaxDB before 7.6.00.30 allows remote attackers to execute arbitrary code via a long database name when connecting via a WebDBM client.


Buffer overflow in man and mandb (man-db) 2.4.3 and earlier allows local users to execute arbitrary code via crafted arguments to the -H flag.


Buffer overflow in kextload in Apple OS X as used by TDIXSupport in Roxio Toast Titanium and possibly other products allows local users to execute arbitrary code via a long extension argument.


Buffer overflow in the (1) DWARF (dwarfread.c) and (2) DWARF2 (dwarf2read.c) debugging code in GNU Debugger (GDB) 6.5 allows user-assisted attackers or restricted users to execute arbitrary code via a crafted file with a location block (DW_FORM_block) that contains a large number of operations.


Buffer overflow in PPP on Apple Mac OS X 10.4.x up to 10.4.8 and 10.3.x up to 10.3.9 when PPPoE is enabled allows remote attackers to execute arbitrary code via unspecified vectors.


Heap-based buffer overflow in the ole_info_read_metabat function in Gnome Structured File library (libgsf) 1.14.0 and other versions before 1.14.2 allows context-dependent attackers to execute arbitrary code via a large num_metabat value in an OLE document which causes the ole_init_info function to allocate insufficient memory.


Multiple buffer overflows in MODPlug Tracker (OpenMPT) 1.17.02.43 and earlier and libmodplug 0.8 and earlier as used in GStreamer and possibly other products allow user-assisted remote attackers to execute arbitrary code via (1) long strings in ITP files used by the CSoundFile::ReadITProject function in soundlib/Load_it.cpp and (2) crafted modules used by the CSoundFile::ReadSample function in soundlib/Sndfile.cpp as demonstrated by crafted AMF files.


Buffer overflow in Ipswitch WS_FTP Limited Edition (LE) 5.08 allows remote FTP servers to execute arbitrary code via a long response to a PASV command.


Buffer overflow in Sony VAIO Media Server 2.x 3.x 4.x and 5.x before 20060626 allows remote attackers to execute arbitrary code via unspecified vectors.


Buffer overflow in PowerDNS Recursor 3.1.3 and earlier might allow remote attackers to execute arbitrary code via a malformed TCP DNS query that prevents Recursor from properly calculating the TCP DNS query length.


Heap-based buffer overflow in Microsoft DirectX SDK (February 2006) and probably earlier including 9.0c End User Runtimes allows context-dependent attackers to execute arbitrary code via a crafted Targa file with a run-length-encoding (RLE) compression that produces more data than expected when decoding.


Buffer overflow in WFTPD Server 3.23 allows remote attackers to execute arbitrary code via long SIZE commands.


Stack-based buffer overflow in the ReadFile function in the ZOO-processing exports in the BeCubed Compression Plus before 5.0.1.28 as used in products including (1) Tumbleweed EMF (2) VCOM/Ontrack PowerDesk Pro (3) Canyon Drag and Zip (4) Canyon Power File and (5) Canyon Power File Gold allow context-dependent attackers to execute arbitrary code via an inconsistent size parameter in a ZOO file header.


Multiple stack-based buffer overflows in Lhaz before 1.32 allow user-assisted attackers to execute arbitrary code via a long filename in (1) an LHZ archive when saving the filename during extraction; and (2) an LHZ archive with an invalid CRC checksum when constructing an error message.


Stack-based buffer overflow in the SMTP Daemon in Ipswitch Collaboration 2006 Suite Premium and Standard Editions IMail IMail Plus and IMail Secure allows remote attackers to execute arbitrary code via a long string located after an '@' character and before a ':' character.


Buffer overflow in ffmpeg for xine-lib before 1.1.2 might allow context-dependent attackers to execute arbitrary code via a crafted AVI file and \bad indexes\ a different vulnerability than CVE-2005-4048 and CVE-2006-2802.


Multiple stack-based buffer overflows in Open Cubic Player 2.6.0pre6 and earlier for Windows and 0.1.10_rc5 and earlier on Linux/BSD allow remote attackers to execute arbitrary code via (1) a large .S3M file handled by the mpLoadS3M function (2) a crafted .IT file handled by the itplayerclass::module::load function (3) a crafted .ULT file handled by the mpLoadULT function or (4) a crafted .AMS file handled by the mpLoadAMS function.


Stack-based buffer overflow in Justsystem Ichitaro 9.x through 13.x Ichitaro 2004 2005 2006 and Government 2006; Ichitaro for Linux; and FormLiner before 20060818 allows remote attackers to execute arbitrary code via long Unicode strings in a crafted document as being actively exploited by malware such as Trojan.Tarodrop. NOTE: some details are obtained from third party information.


Stack-based buffer overflow in the Vector Graphics Rendering engine (vgx.dll) as used in Microsoft Outlook and Internet Explorer 6.0 on Windows XP SP2 and possibly other versions allows remote attackers to execute arbitrary code via a Vector Markup Language (VML) file with a long fill parameter within a rect tag.


Buffer overflow in the BrightStor Backup Discovery Service in multiple CA products including ARCserve Backup r11.5 SP1 and earlier ARCserve Backup 9.01 up to 11.1 Enterprise Backup 10.5 and CA Server Protection Suite r2 allows remote attackers to execute arbitrary code via unspecified vectors.


Heap-based buffer overflow in the ask_outfile_name function in openfile.c for GnuPG (gpg) 1.4 and 2.0 when running interactively might allow attackers to execute arbitrary code via messages with \C-escape\ expansions which cause the make_printable_string function to return a longer string than expected while constructing a prompt.


Buffer overflow in the sendToMythTV function in MythControlServer.c in MythControl 1.0 and earlier allows remote attackers to execute arbitrary code via a crafted sendStr string to the Bluetooth interface. NOTE: some of these details are obtained from third party information.


Buffer overflow in the krbv4_ldap_auth function in servers/slapd/kerberos.c in OpenLDAP 2.4.3 and earlier when OpenLDAP is compiled with the --enable-kbind (Kerberos KBIND) option allows remote attackers to execute arbitrary code via an LDAP bind request using the LDAP_AUTH_KRBV41 authentication method and long credential data.


Buffer overflow in JustSystems Hanako 2004 through 2006 Hanako viewer 1.x Ichitaro 2004 Ichitaro 2005 Ichitaro Lite2 Ichitaro viewer 4.x and Sanshiro 2005 allows remote attackers to execute arbitrary code via the (1) Keyword and (2) Title fields related to string length fields.


Multiple stack-based buffer overflows in the (1) LoadTree (2) ReadHeader and (3) LoadXBOXTree functions in the ISO (iso_wincmd) plugin 1.7.3.3 and earlier for Total Commander allow user-assisted remote attackers to execute arbitrary code via a long pathname in an ISO image.


Heap-based buffer overflow in Borland idsql32.dll 5.1.0.4 as used by RevilloC MailServer; 5.2.0.2 as used by Borland Developer Studio 2006; and possibly other versions allows remote attackers to execute arbitrary code via a long SQL statement related to use of the DbiQExec function.


Buffer

overflow

in

for

Trend

Micro

OfficeScan

before

build

allows

remote

attackers

to

execute

arbitrary

code

via

unknown

attack

vectors.


Stack-based buffer overflow in the POP service in MailEnable Standard 1.98 and earlier; Professional 1.84 and 2.35 and earlier; and Enterprise 1.41 and 2.35 and earlier before ME-10026 allows remote attackers to execute arbitrary code via a long argument to the PASS command.


Stack-based buffer overflow in Visual Studio Crystal Reports for Microsoft Visual Studio .NET 2002 and 2002 SP1 .NET 2003 and 2003 SP1 and 2005 and 2005 SP1 (formerly Business Objects Crystal Reports XI Professional) allows user-assisted remote attackers to execute arbitrary code via a crafted RPT file.


Multiple buffer overflows in Novell NetMail before 3.52e FTF2 allow remote attackers to execute arbitrary code (1) by appending literals to certain IMAP verbs when specifying command continuation requests to IMAPD resulting in a heap overflow; and (2) via crafted arguments to the STOR command to the Network Messaging Application Protocol (NMAP) daemon resulting in a stack overflow.


Stack-based buffer overflow in Intel PRO 10/100 PRO/1000 and PRO/10GbE PCI PCI-X and PCIe network adapter drivers (aka NDIS miniport drivers) before 20061205 allows local users to execute arbitrary code with \kernel-level\ privileges via an incorrect function call in certain OID handlers.


Stack-based buffer overflow in http.c in Karl Dahlke Edbrowse (aka Command line editor browser) 3.1.3 allows remote attackers to execute arbitrary code by operating an FTP server that sends directory listings with (1) long user names or (2) long group names.


Buffer overflow in the WZFILEVIEW.FileViewCtrl.61 ActiveX control (aka Sky Software \FileView\ ActiveX control) for WinZip 10.0 Build 6667 allows remote attackers to execute arbitrary code via a long argument to the CreateNewFolderFromName method a different vulnerability than CVE-2006-5198.


Buffer overflow in the glob implementation (glob.c) in libc in NetBSD-current before 20050914 NetBSD 2.* and 3.* before 20061203 and Apple Mac OS X before 2007-004 as used by the FTP daemon and tnftpd allows remote authenticated users to execute arbitrary code via a long pathname that results from path expansion.


Stack-based buffer overflow in the NeoTraceExplorer.NeoTraceLoader ActiveX control (NeoTraceExplorer.dll) in NeoTrace Express 3.25 and NeoTrace Pro (aka McAfee Visual Trace) 3.25 allows remote attackers to execute arbitrary code via a long argument string to the TraceTarget method. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


Stack-based buffer overflow in the SetClientInfo function in the CDDBControlAOL.CDDBAOLControl ActiveX control (cddbcontrol.dll) as used in America Online (AOL) 7.0 4114.563 8.0 4129.230 and 9.0 Security Edition 4156.910 and possibly other products allows remote attackers to execute arbitrary code via a long ClientId argument.


Buffer overflow in Hitachi Directory Server 2 P-2444-A124 before 02-11-/K on Windows and P-1B44-A121 before 02-10-/V on HP-UX allows remote attackers to execute arbitrary code via crafted LDAP requests.


Buffer overflow in the tls_x509_name_oneline function in the mod_tls module as used in ProFTPD 1.3.0a and earlier and possibly other products allows remote attackers to execute arbitrary code via a large data length argument a different vulnerability than CVE-2006-5815.


Stack-based buffer overflow in Nostra DivX Player 2.1 2.2.00.0 and possibly earlier allows remote attackers to execute arbitrary code via a long string in an M3U file. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


Multiple buffer overflows in Computer Associates (CA) BrightStor ARCserve Backup R11.5 Server before SP2 allows remote attackers to execute arbitrary code in the Tape Engine (tapeeng.exe) via a crafted RPC request with (1) opnum 38 which is not properly handled in TAPEUTIL.dll 11.5.3884.0 or (2) opnum 37 which is not properly handled in TAPEENG.dll 11.5.3884.0.


Buffer overflow in Astonsoft DeepBurner Pro and Free 1.8.0 and earlier allows user-assisted remote attackers to execute arbitrary code via a long file name tag in a dbr file.


Multiple buffer overflows in the SupportSoft (1) SmartIssue (tgctlsi.dll) and (2) ScriptRunner (tgctlsr.dll) ActiveX controls as used by Symantec Automated Support Assistant and Norton AntiVirus Internet Security and System Works 2006 allows remote attackers to execute arbitrary code via a crafted HTML message.


Multiple buffer overflows in Sophos Anti-Virus scanning engine before 2.40 allow remote attackers to execute arbitrary code via (1) a SIT archive with a long filename that is not null-terminated which triggers a heap-based overflow in veex.dll due to improper length calculation and (2) a CPIO archive with a long filename that is not null-terminated which triggers a stack-based overflow in veex.dll.


Multiple heap-based buffer overflows in Mozilla Thunderbird before 1.5.0.9 and SeaMonkey before 1.0.7 allow remote attackers to execute arbitrary code via (1) external message modies with long Content-Type headers or (2) long RFC2047-encoded (MIME non-ASCII) headers.


Stack-based buffer overflow in the DoModal function in the Dialog Wrapper Module ActiveX control (DlgWrapper.dll) before 8.4.166.0 as used by ICONICS OPC Enabled Gauge Switch and Vessel ActiveX allows remote attackers to execute arbitrary code via a long (1) FileName or (2) Filter argument.


Stack-based buffer overflow in ld.so.1 in Sun Solaris 8 9 and 10 allows local users to execute arbitrary code via large precision padding values in a format string specifier in the format parameter of the doprf function. NOTE: this issue normally does not cross privilege boundaries except in cases of external introduction of malicious message files or if it is leveraged with other vulnerabilities such as CVE-2006-6494.


Buffer overflow in Durian Web Application Server 3.02 freeware on Windows allows remote attackers to execute arbitrary code via a long string in a crafted packet to TCP port 4002.


Buffer overflow in the shared_region_make_private_np function in vm/vm_unix.c in Mac OS X 10.4.6 and earlier allows local users to execute arbitrary code via (1) a small range count which causes insufficient memory allocation or (2) a large number of ranges in the shared_region_make_private_np_args parameter.


Multiple buffer overflows in Niek Albers CoolPlayer 216 and earlier allow remote attackers to execute arbitrary code via (1) a playlist file with long song names because of an overflow in the CPL_AddPrefixedFile function in CPI_Playlist.c; (2) a skin file with long button names because of an overflow in the main_skin_check_ini_value function in skin.c; and (3) a skin file with long bitmap filenames because of an overflow in the main_skin_open function in skin.c.


Stack-based buffer overflow in BlazeVideo HDTV Player 2.1 and possibly earlier allows remote attackers to execute arbitrary code via a long filename in a PLF playlist a different product than CVE-2006-6199. NOTE: it was later reported that 3.5 is also affected.


Heap-based buffer overflow in the SendChannelData function in wfica.ocx in Citrix Presentation Server Client before 9.230 for Windows allows remote malicious web sites to execute arbitrary code via a DataSize parameter that is less than the length of the Data buffer.


Stack-based buffer overflow in the IMAP service for MailEnable Professional and Enterprise Edition 2.0 through 2.35 Professional Edition 1.6 through 1.84 and Enterprise Edition 1.1 through 1.41 allows remote attackers to execute arbitrary code via a pre-authentication command followed by a crafted parameter and a long string as addressed by the ME-10025 hotfix.


Stack-based buffer overflow in the NetBackup bpcd daemon (bpcd.exe) in Symantec Veritas NetBackup 5.0 before 5.0_MP7 5.1 before 5.1_MP6 and 6.0 before 6.0_MP4 allows remote attackers to execute arbitrary code via a long request with a malformed length prefix.


Buffer overflow in TrollFTPD 1.26 and earlier allows local users to execute arbitrary code by creating a series of deeply nested directories with long names then running the ls -R (recursive) command.


Buffer overflows in Linux CUPS before 1.1.6 may allow remote attackers to execute arbitrary code.


Buffer overflow in CrazyWWWBoard 2000p4 and 2000LEp5 allows remote attackers to execute arbitrary code via a long HTTP_USER_AGENT CGI environment variable.


Buffer overflow in VanDyke SecureCRT before 3.4.2 when using the SSH-1 protocol allows remote attackers to execute arbitrary code via a long (1) username or (2) password.


Buffer overflow in wmcube-gdk for WMCube/GDK 0.98 allows local users to execute arbitrary code via long lines in the object description file.


Buffer overflow in libmysqlclient.so in MySQL 3.23.33 and earlier allows remote attackers to execute arbitrary code via a long host parameter.


Buffer overflow in Unix-to-Unix Copy Protocol (UUCP) in BSDI BSD/OS 3.0 through 4.2 allows local users to execute arbitrary code via a long command line argument.


Buffer overflow in (1) HttpSaveCVP.dll and (2) HttpSaveCSP.dll in Trend Micro InterScan VirusWall 3.5.1 allows remote attackers to execute arbitrary code.


Buffer overflow in Web Calendar in Ipswitch IMail 7.04 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.


Buffer overflow in mana in OpenServer 5.0.6a and earlier allows local users to execute arbitrary code.


Buffer overflow in uucp utilities in UnixWare 7 allows local users to execute arbitrary code via long command line arguments to (1) uucp (2) uux (3) bnuconvert (4) uucico (5) uuxcmd or (6) uuxqt.


Buffer overflow in msgchk in Digital UNIX 4.0G and earlier allows local users to execute arbitrary code via a long command line argument.


Buffer overflow in Xvt 2.1 in Debian Linux 2.2 allows local users to execute arbitrary code via long (1) -name and (2) -T arguments.


Buffer overflow in whodo in Solaris SunOS 5.5.1 through 5.8 allows local users to execute arbitrary code via a long (1) SOR or (2) CFIME environment variable.


Buffer overflow in EFTP 2.0.7.337 allows remote attackers to execute arbitrary code by uploading a .lnk file containing a large number of characters.


Vulnerability in Network Node Manager (NNM) 6.2 and earlier in HP OpenView allows a local user to execute arbitrary code possibly via a buffer overflow in a long hostname or object ID.


Buffer

overflow

in

Progress

database

and

could

allow

a

local

user

to

execute

arbitrary

code

via

orarx

sqlcpp

and


Buffer overflow in Elm 2.5.5 and earlier allows remote attackers to execute arbitrary code via a long Message-ID header.


Buffer overflows in NetWin Authentication Module (NWAuth) 3.0b and earlier as implemented in DMail SurgeFTP and possibly other packages could allow attackers to execute arbitrary code via long arguments to (1) the -del command or (2) the -lookup command.


Buffer overflows in WS_FTP 2.02 allow remote attackers to execute arbitrary code via long arguments to (1) DELE (2) MDTM (3) MLST (4) MKD (5) RMD (6) RNFR (7) RNTO (8) SIZE (9) STAT (10) XMKD or (11) XRMD.


Buffer overflow in smtpscan.dll for Trend Micro InterScan VirusWall 3.51 for Windows NT has allows remote attackers to execute arbitrary code via a certain configuration parameter.


Buffer overflow in PL/SQL Apache module in Oracle 9i Application Server allows remote attackers to execute arbitrary code via a long request for a help page.


Buffer overflow in uuq in AIX 4 could allow local users to execute arbitrary code via a long -r parameter.


Buffer overflow in MySQL before 3.23.33 allows remote attackers to execute arbitrary code via a long drop database request.


Buffer overflow in WindowMaker (aka wmaker) 0.64 and earlier allows remote attackers to execute arbitrary code via a long window title.


Buffer overflow in setiathome for SETI@home 3.03 if installed setuid could allow local users to execute arbitrary code via long command line options (1) socks_server (2) socks_user and (3) socks_passwd. NOTE: since the default configuration of setiathome is not setuid perhaps this issue should not be included in CVE.


Buffer overflows in DayDream BBS 2.9 through 2.13 allow remote attackers to possibly execute arbitrary code via the control codes (1) ~#MC (2) ~#TF or (3) ~#RA.


Buffer overflow in ypbind daemon in Solaris 5.4 through 8 allows remote attackers to execute arbitrary code.


Buffer overflow in xlock in UnixWare 7.1.0 and 7.1.1 and Open Unix 8.0.0 allows local users to execute arbitrary code.


Buffer overflow in lpstat in SCO OpenServer 5.0 through 5.0.6a allows local users to execute arbitrary code as group bin via a long command line argument.


Buffer overflow in Progress database 8.3D and 9.1C allows local users to execute arbitrary code via long entries in files that are specified by the (1) PROMSGS or (2) PROTERMCAP environment variables.


Buffer overflow in Munica Corporation NetSQL 1.0 allows remote attackers to execute arbitrary code via a long CONNECT argument to port 6500.


Buffer overflow in cron in Caldera UnixWare 7 allows local users to execute arbitrary code via a command line argument.


Buffer overflow in helpctr.exe program in Microsoft Help Center for Windows XP allows remote attackers to execute arbitrary code via a long hcp: URL.


Buffer overflow in HttpSave.dll in Trend Micro InterScan WebManager 1.2 allows remote attackers to execute arbitrary code via a long value to a certain parameter.


Buffer overflow in Compaq Insight Manager XE 2.1b and earlier allows remote attackers to execute arbitrary code via (1) SNMP and (2) DMI.


Buffer overflow in Oracle9iAS Web Cache 2.0.0.1 allows remote attackers to execute arbitrary code via a long HTTP GET request.


Buffer overflow in xloadimage 4.1 (aka xli 1.16 and 1.17) in Linux allows remote attackers to execute arbitrary code via a FACES format image containing a long (1) Firstname or (2) Lastname field.


Buffer overflow in GuildFTPd Server 0.97 allows remote attacker to execute arbitrary code via a long SITE command.


Buffer overflow in otrcrep in Oracle 8.0.x through 9.0.1 allows local users to execute arbitrary code via a long ORACLE_HOME environment variable aka the \Oracle Trace Collection Security Vulnerability.\


Buffer overflow in SpoonFTP 1.0.0.12 allows remote attackers to execute arbitrary code via a long argument to the commands (1) CWD or (2) LIST.


Buffer overflow in bctool in Jetico BestCrypt 0.8.1 and earlier allows local users to execute arbitrary code via a file or directory with a long pathname which is processed during an unmount.


Buffer overflow in ntping in scotty 2.1.0 allows local users to execute arbitrary code via a long hostname as a command line argument.


Buffer overflows in Sierra Half-Life build 1573 and earlier allow remote attackers to execute arbitrary code via (1) a long map command (2) a long exec command or (3) long input in a configuration file.


Buffer overflow in cb_reset in the System Service Processor (SSP) package of SunOS 5.8 allows a local user to execute arbitrary code via a long argument.


Buffer overflows in forms.exe CGI program in ValiCert Enterprise Validation Authority (EVA) Administration Server 3.3 through 4.2.1 allows remote attackers to execute arbitrary code via long arguments to the parameters (1) Mode (2) Certificate_File (3) useExpiredCRLs (4) listenLength (5) maxThread (6) maxConnPerSite (7) maxMsgLen (8) exitTime (9) blockTime (10) nextUpdatePeriod (11) buildLocal (12) maxOCSPValidityPeriod (13) extension and (14) a particular combination of parameters associated with private key generation that form a string of a certain length.


Buffer overflow in BSD line printer daemon (in.lpd or lpd) in various BSD-based operating systems allows remote attackers to execute arbitrary code via an incomplete print job followed by a request to display the printer queue.


Buffer overflow in man program in various distributions of Linux allows local user to execute arbitrary code as group man via a long -S option.


Buffer overflow in client for Half-Life 1.1.0.8 and earlier allows malicious remote servers to execute arbitrary code via a long console command.


Buffer overflow in dbsnmp in Oracle 8.0.6 through 9.0.1 allows local users to execute arbitrary code via a long ORACLE_HOME environment variable.


Buffer overflow in ipcs in Solaris 7 x86 allows local users to execute arbitrary code via a long TZ (timezone) environmental variable a different vulnerability than CAN-2002-0093.


Buffer overflow in Universal Plug and Play (UPnP) on Windows 98 98SE ME and XP allows remote attackers to execute arbitrary code via a NOTIFY directive with a long Location URL.


Buffer overflow in cfingerd 1.4.3 and earlier with the ALLOW_LINE_PARSING option enabled allows local users to execute arbitrary code via a long line in the .nofinger file.


Buffer overflow in su-wrapper 1.1.1 allows local users to execute arbitrary code via a long first argument.


Buffer overflow in w3m 0.2.1 and earlier allows a remote attacker to execute arbitrary code via a long base64 encoded MIME header.


Buffer overflow in PerlIS.dll in Activestate ActivePerl 5.6.1.629 and earlier allows remote attackers to execute arbitrary code via an HTTP request for a long filename that ends in a .pl extension.


Buffer

overflows

in

eManager

plugin

for

Trend

Micro

InterScan

VirusWall

for

NT

and

allow

remote

attackers

to

execute

arbitrary

code

via

long

arguments

to

the

CGI

programs

register.dll

ContentFilter.dll

SFNofitication.dll

register.dll

SpamExcp.dll

and

spamrule.dll.


Buffer overflow vulnerabilities in Oracle Internet Directory Server (LDAP) 2.1.1.x and 3.0.1 allow remote attackers to execute arbitrary code as demonstrated by the PROTOS LDAPv3 test suite.


Buffer overflows in Microsoft SQL Server 7.0 and 2000 allow attackers with access to SQL Server to execute arbitrary code through the functions (1) raiserror (2) formatmessage or (3) xp_sprintf. NOTE: the C runtime format string vulnerability reported in MS01-060 is identified by CVE-2001-0879.


Buffer overflows in GazTek ghttpd 1.4 allows a remote attacker to execute arbitrary code via long arguments that are passed to (1) the Log function in util.c or (2) serveconnection in protocol.c.


Buffer overflow in tab expansion capability of the most program allows local or remote attackers to execute arbitrary code via a malformed file that is viewed with most.


Buffer overflow in WINAMP 2.6x and 2.7x allows attackers to execute arbitrary code via a long string in an AIP file.


Buffer overflow in Lotus Domino Mail Server 5.0.5 and earlier allows a remote attacker to crash the server or execute arbitrary code via a long \RCPT TO\ command.


Buffer overflow in IPSwitch IMail SMTP server 6.06 and possibly prior versions allows remote attackers to execute arbitrary code via a long From: header.


Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26 T27 LB through SP21 EP10 T27 LC before SP25 EP10 and T27 LD before SP32 CP1 allows remote attackers to execute arbitrary code via a crafted WRF file a different vulnerability than CVE-2012-1336 and CVE-2012-1337.


Heap-based buffer overflow in the Remote Administration Protocol (RAP) implementation in the LanmanWorkstation service in Microsoft Windows XP SP2 and SP3 allows remote attackers to execute arbitrary code via crafted RAP response packets aka \Remote Administration Protocol Heap Overflow Vulnerability.\


Multiple stack-based buffer overflows in (1) COM and (2) ActiveX controls in ABB WebWare Server WebWare SDK Interlink Module S4 OPC Server QuickTeach RobotStudio S4 and RobotStudio Lite allow remote attackers to execute arbitrary code via crafted input data.


Stack-based buffer overflow in the Remote Administration Protocol (RAP) implementation in the LanmanWorkstation service in Microsoft Windows XP SP3 allows remote attackers to execute arbitrary code via crafted RAP response packets aka \Remote Administration Protocol Stack Overflow Vulnerability.\


Heap-based

buffer

overflow

in

the

nsHTMLReflowState::CalculateHypotheticalBox

function

in

Mozilla

Firefox

through

Firefox

ESR

before

Thunderbird

through

Thunderbird

ESR

before

and

SeaMonkey

before

allows

remote

attackers

to

execute

arbitrary

code

by

resizing

a

window

displaying

absolutely

positioned

and

relatively

positioned

elements

in

nested

columns.


Heap-based buffer overflow in DirectPlay in DirectX 9.0 through 11.1 in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 Windows 7 Gold and SP1 Windows 8 and Windows Server 2012 allows remote attackers to execute arbitrary code via a crafted Office document aka \DirectPlay Heap Overflow Vulnerability.\


Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26 T27 LB through SP21 EP10 T27 LC before SP25 EP10 and T27 LD before SP32 CP1 allows remote attackers to execute arbitrary code via a crafted WRF file a different vulnerability than CVE-2012-1335 and CVE-2012-1337.


Heap-based buffer overflow in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2 and Windows Data Access Components (WDAC) 6.0 allows remote attackers to execute arbitrary code via crafted XML data that triggers access to an uninitialized object in memory aka \ADO Cachesize Heap Overflow RCE Vulnerability.\


Heap-based buffer overflow in Microsoft Excel 2003 SP3 2007 SP2 and SP3 and 2010 SP1; Office 2008 and 2011 for Mac; and Office Compatibility Pack SP2 and SP3 allows remote attackers to execute arbitrary code via a crafted spreadsheet aka \Excel SerAuxErrBar Heap Overflow Vulnerability.\


Buffer overflow in IvanView 1.2.15 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment.


Heap-based buffer overflow in the utf16_to_isolatin1 function in Mozilla Firefox 4.x through 12.0 Firefox ESR 10.x before 10.0.5 Thunderbird 5.0 through 12.0 Thunderbird ESR 10.x before 10.0.5 and SeaMonkey before 2.10 allows remote attackers to execute arbitrary code via vectors that trigger a character-set conversion failure.


Stack-based buffer overflow in modules/graphic/ssgraph/grsound.cpp in The Open Racing Car Simulator (TORCS) before 1.3.3 and Speed Dreams allows user-assisted remote attackers to execute arbitrary code via a long file name in an engine sample attribute in an xml configuration file.


Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26 T27 LB through SP21 EP10 T27 LC before SP25 EP10 and T27 LD before SP32 CP1 allows remote attackers to execute arbitrary code via a crafted WRF file a different vulnerability than CVE-2012-1335 and CVE-2012-1336.


Stack-based buffer overflow in the RunAndUploadFile method in the Isig.isigCtl.1 ActiveX control in IBM Tivoli Provisioning Manager Express for Software Distribution 4.1.1 allows remote attackers to execute arbitrary code via vectors related to an Asset Information file.


Buffer overflow in Bip 0.8.8 and earlier might allow remote authenticated users to execute arbitrary code via vectors involving a series of TCP connections that triggers use of many open file descriptors.


Buffer overflow in the Cisco Port Forwarder ActiveX control in cscopf.ocx as distributed through the Clientless VPN feature on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 7.0 through 7.2 before 7.2(5.6) 8.0 before 8.0(5.26) 8.1 before 8.1(2.53) 8.2 before 8.2(5.18) 8.3 before 8.3(2.28) 8.2 before 8.4(2.16) and 8.6 before 8.6(1.1) allows remote attackers to execute arbitrary code via unspecified vectors aka Bug ID CSCtr00165.


Buffer overflow in msvcrt.dll in Microsoft Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted media file aka \Msvcrt.dll Buffer Overflow Vulnerability.\


Multiple stack-based buffer overflows in MinaliC 2.0.0 allow remote attackers to execute arbitrary code via a (1) session_id cookie in a request to the get_cookie_value function in response.c (2) directory name in a request to the add_default_file function in response.c or (3) file name in a request to the retrieve_physical_file_name_or_brows function in response.c.


Buffer overflow in rn5auth.dll in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to execute arbitrary code via crafted authentication credentials.


Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier Foxboro Control Software 3.1 and earlier InFusion CE/FE/SCADA 2.5 and earlier Wonderware Information Server 4.5 and earlier ArchestrA Application Object Toolkit 3.2 and earlier and InTouch 10.0 through 10.5 might allow remote attackers to execute arbitrary code via a long string to the Open member leading to a function-pointer overwrite.


Multiple stack-based buffer overflows in the NTR ActiveX control before 2.0.4.8 allow remote attackers to execute arbitrary code via (1) a long bstrUrl parameter to the StartModule method (2) a long bstrParams parameter to the Check method a long bstrUrl parameter to the (3) Download or (4) DownloadModule method during construction of a .ntr pathname or a long bstrUrl parameter to the (5) Download or (6) DownloadModule method during construction of a URL.


Stack-based buffer overflow in the suhosin_encrypt_single_cookie function in the transparent cookie-encryption feature in the Suhosin extension before 0.9.33 for PHP when suhosin.cookie.encrypt and suhosin.multiheader are enabled might allow remote attackers to execute arbitrary code via a long string that is used in a Set-Cookie HTTP header.


Heap-based buffer overflow in Microsoft Excel 2007 SP2 and SP3 and 2010 Gold and SP1 Excel Viewer and Office Compatibility Pack SP2 and SP3 allows remote attackers to execute arbitrary code via a crafted spreadsheet that triggers incorrect handling of memory during opening aka \Excel MergeCells Record Heap Overflow Vulnerability.\


Multiple stack-based buffer overflows in RobNetScanHost.exe in ABB Robot Communications Runtime before 5.14.02 as used in ABB Interlink Module IRC5 OPC Server PC SDK PickMaster 3 and 5 RobView 5 RobotStudio WebWare SDK and WebWare Server allow remote attackers to execute arbitrary code via a crafted (1) 0xA or (2) 0xE Netscan packet.


Buffer overflow in yaSSL as used in MySQL 5.5.20 and possibly other versions including 5.5.x before 5.5.22 and 5.1.x before 5.1.62 allows remote attackers to execute arbitrary code via unspecified vectors as demonstrated by VulnDisco Pack Professional 9.17. NOTE: as of 20120224 this disclosure has no actionable information. However because the module author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes. NOTE: due to lack of details it is not clear whether this issue is a duplicate of CVE-2012-0492 or another CVE.


Integer signedness error in the db2dasrrm process in the DB2 Administration Server (DAS) in IBM DB2 9.1 through FP11 9.5 before FP9 and 9.7 through FP5 on UNIX platforms allows remote attackers to execute arbitrary code via a crafted request that triggers a heap-based buffer overflow.


Heap-based buffer overflow in the Ole API in the CQOle ActiveX control in cqole.dll in IBM Rational ClearQuest 7.1.1 before 7.1.1.9 7.1.2 before 7.1.2.6 and 8.0.0 before 8.0.0.2 allows remote attackers to execute arbitrary code via a crafted web page that leverages a RegisterSchemaRepoFromFileByDbSet function-prototype mismatch.


Stack-based buffer overflow in the HMIWeb Browser HSCDSPRenderDLL ActiveX control in Honeywell Process Solutions (HPS) Experion R2xx R30x R31x and R400.x; Honeywell Building Solutions (HBS) Enterprise Building Manager R400 and R410.1; and Honeywell Environmental Combustion and Controls (ECC) SymmetrE R410.1 allows remote attackers to execute arbitrary code via unspecified vectors.


Heap-based buffer overflow in the Office Works File Converter in Microsoft Office 2007 SP2 Works 9 and Works 6-9 File Converter allows remote attackers to execute arbitrary code via a crafted Works (aka .wps) file aka \Office WPS Converter Heap Overflow Vulnerability.\


Stack-based buffer overflow in the SetSource method in the Cisco Linksys PlayerPT ActiveX control 1.0.0.15 in PlayerPT.ocx on the Cisco WVC200 Wireless-G PTZ Internet video camera allows remote attackers to execute arbitrary code via a long URL in the first argument (aka the sURL argument).


Buffer overflow in JustSystems Ichitaro 2011 Sou Ichitaro 2006 through 2011 Ichitaro Government 2006 through 2010 Ichitaro Portable with oreplug Ichitaro Viewer JUST School JUST School 2009 and 2010 JUST Jump 4 JUST Frontier oreplug Shuriken Pro4 Shuriken 2007 through 2010 Shuriken Pro4 Corporate Edition Shuriken CE/2007 through CE/2009 Corporate Edition Shuriken 2010 Corporate Edition Rekishimail Sengokubusho no missho and Bakumatsushishi no missho allows remote attackers to execute arbitrary code via a crafted image file.


Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier Foxboro Control Software 3.1 and earlier InFusion CE/FE/SCADA 2.5 and earlier Wonderware Information Server 4.5 and earlier ArchestrA Application Object Toolkit 3.2 and earlier and InTouch 10.0 through 10.5 might allow remote attackers to execute arbitrary code via a long string to the AddFile member.


Integer underflow in the exif_entry_get_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) 0.6.20 might allow remote attackers to execute arbitrary code via vectors involving a crafted buffer-size parameter during the formatting of an EXIF tag leading to a heap-based buffer overflow.


Stack-based buffer overflow in the U3D.8BI library plugin in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote attackers to execute arbitrary code via a long Collada asset element in a DAE file as demonstrated by the cameraYFov value in the contributor comments element.


Stack-based buffer overflow in Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x and Adobe AIR before 3.3.0.3610 allows attackers to execute arbitrary code via unspecified vectors.


Multiple stack-based buffer overflows in a certain ActiveX control in qp2.cab in IBM Lotus Quickr 8.2 before 8.2.0.27-002a for Domino allow remote attackers to execute arbitrary code via a long argument to the (1) Attachment_Times or (2) Import_Times method.


Stack-based buffer overflow in the Java Stored Procedure infrastructure in IBM DB2 9.1 before FP12 9.5 through FP9 9.7 through FP6 9.8 through FP5 and 10.1 allows remote authenticated users to execute arbitrary code by leveraging certain CONNECT and EXECUTE privileges.


Buffer overflow in the com_print_typeinfo function in PHP 5.4.3 and earlier on Windows allows remote attackers to execute arbitrary code via crafted arguments that trigger incorrect handling of COM object VARIANT types as exploited in the wild in May 2012.


Multiple stack-based buffer overflows in the KeyHelp.KeyCtrl.1 ActiveX control in KeyHelp.ocx 1.2.312 in KeyWorks KeyHelp Module (aka the HTML Help component) as used in EMC Documentum ApplicationXtender Desktop 5.4; EMC Captiva Quickscan Pro 4.6 SP1; GE Intelligent Platforms Proficy Historian 3.1 3.5 4.0 and 4.5; GE Intelligent Platforms Proficy HMI/SCADA iFIX 5.0 and 5.1; GE Intelligent Platforms Proficy Pulse 1.0; GE Intelligent Platforms Proficy Batch Execution 5.6; GE Intelligent Platforms SI7 I/O Driver 7.20 through 7.42; and other products allow remote attackers to execute arbitrary code via a long string in the second argument to the (1) JumpMappedID or (2) JumpURL method.


Stack-based buffer overflow in Microsoft Excel 2007 SP2 and SP3 and 2010 SP1; Office 2011 for Mac; Excel Viewer; and Office Compatibility Pack SP2 and SP3 allows remote attackers to execute arbitrary code via a crafted spreadsheet aka \Excel Stack Overflow Vulnerability.\


Heap-based buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26 T27 LB through SP21 EP10 T27 LC before SP25 EP11 T27 LD before SP32 CP2 and T28 L10N before SP1 allows remote attackers to execute arbitrary code via a crafted WRF file aka Bug ID CSCtz72977.


Multiple unspecified vulnerabilities in HP iNode Management Center before iNode PC 5.1 E0304 allow remote attackers to execute arbitrary code via crafted input as demonstrated by a stack-based buffer overflow in iNodeMngChecker.exe for a crafted 0x0A0BF007 packet.


Stack-based buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26 T27 LB through SP21 EP10 T27 LC before SP25 EP11 T27 LD before SP32 CP2 and T28 L10N before SP1 allows remote attackers to execute arbitrary code via a crafted DHT chunk in a JPEG image within a WRF file aka Bug ID CSCtz72953.


Buffer overflow in RunTime.exe in Sielco Sistemi Winlog Pro SCADA before 2.07.18 and Winlog Lite SCADA before 2.07.18 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 46824. NOTE: some of these details are obtained from third party information.


Heap-based buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26 T27 LB through SP21 EP10 T27 LC before SP25 EP11 T27 LD before SP32 CP2 and T28 L10N before SP1 allows remote attackers to execute arbitrary code via a crafted size field in audio data within a WRF file aka Bug ID CSCtz00755.


Buffer overflow in markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.5 allows remote attackers to execute arbitrary code via a crafted inline image in a message.


Buffer overflow in the Cisco WebEx Advanced Recording Format (ARF) player T27 L through SP11 EP26 T27 LB through SP21 EP10 T27 LC before SP25 EP11 T27 LD before SP32 CP2 and T28 L10N before SP1 allows remote attackers to execute arbitrary code via a crafted ARF file aka Bug ID CSCtz72985.


Heap-based buffer overflow in the nsBlockFrame::MarkLineDirty function in Mozilla Firefox before 15.0 Firefox ESR 10.x before 10.0.7 Thunderbird before 15.0 Thunderbird ESR 10.x before 10.0.7 and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via unspecified vectors.


Multiple stack-based buffer overflows in the get_history function in history.cgi in Nagios Core before 3.4.4 and Icinga 1.6.x before 1.6.2 1.7.x before 1.7.4 and 1.8.x before 1.8.4 might allow remote attackers to execute arbitrary code via a long (1) host_name variable (host parameter) or (2) svc_description variable.


The HTTP module in the (1) Branch Intelligent Management System (BIMS) and (2) web management components on Huawei AR routers and S2000 S3000 S3500 S3900 S5100 S5600 S7800 and S8500 switches does not check whether HTTP data is longer than the value of the Content-Length field which allows remote HTTP servers to conduct heap-based buffer overflow attacks and execute arbitrary code via a crafted response.


Stack-based buffer overflow in the HTTP module in the (1) Branch Intelligent Management System (BIMS) and (2) web management components on Huawei AR routers and S2000 S3000 S3500 S3900 S5100 S5600 S7800 and S8500 switches allows remote attackers to execute arbitrary code via a long URI.


Integer signedness error in the vwr_read_rec_data_ethernet function in wiretap/vwr.c in the Ixia IxVeriWave file parser in Wireshark 1.8.x before 1.8.2 allows user-assisted remote attackers to execute arbitrary code via a crafted packet-trace file that triggers a buffer overflow.


Heap-based buffer overflow in the nsWaveReader::DecodeAudioData function in Mozilla Firefox before 16.0 Firefox ESR 10.x before 10.0.8 Thunderbird before 16.0 Thunderbird ESR 10.x before 10.0.8 and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.


Multiple heap-based buffer overflows in bmp.w5s in Winamp before 5.63 build 3235 allow remote attackers to execute arbitrary code via the (1) strf chunk in BI_RGB or (2) UYVY video data in an AVI file or (3) decompressed TechSmith Screen Capture Codec (TSCC) data in an AVI file.


Stack-based buffer overflow in RunTime.exe in Sielco Sistemi Winlog Pro SCADA before 2.07.17 and Winlog Lite SCADA before 2.07.17 allows remote attackers to execute arbitrary code via a crafted port-46824 TCP packet that triggers an incorrect file-open attempt by the _TCPIPS_BinOpenFileFP function a different vulnerability than CVE-2012-3815. NOTE: some of these details are obtained from third party information.


Heap-based buffer overflow in the image::RasterImage::DrawFrameTo function in Mozilla Firefox before 17.0 Firefox ESR 10.x before 10.0.11 Thunderbird before 17.0 Thunderbird ESR 10.x before 10.0.11 and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code via a crafted GIF image.


Buffer overflow in nsrindexd in EMC NetWorker 7.5.x and 7.6.x before 7.6.5 and 8.x before 8.0.0.6 allows remote attackers to execute arbitrary code via crafted SunRPC data.


Stack-based buffer overflow in the DCERPC inspection engine on Cisco Adaptive Security Appliances (ASA) 5500 series devices and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices with software 8.3 before 8.3(2.34) 8.4 before 8.4(4.4) 8.5 before 8.5(1.13) and 8.6 before 8.6(1.3) and the Firewall Services Module (FWSM) 4.1 before 4.1(9) in Cisco Catalyst 6500 series switches and 7600 series routers might allow remote attackers to execute arbitrary code via a crafted DCERPC packet aka Bug IDs CSCtr21359 and CSCtr27522.


Multiple stack-based buffer overflows in the BackupToAvi method in the (1) UMS_Ctrl 1.5.1.1 and (2) UMS_Ctrl_STW 2.0.1.0 ActiveX controls in Samsung NET-i viewer 1.37.120316 allow remote attackers to execute arbitrary code via a long string in the fname parameter. NOTE: some of these details are obtained from third party information.


Buffer overflow in the dissect_gsm_rlcmac_downlink function in epan/dissectors/packet-gsm_rlcmac.c in the GSM RLC MAC dissector in Wireshark 1.6.x before 1.6.10 and 1.8.x before 1.8.2 allows remote attackers to execute arbitrary code via a malformed packet.


TCPIPS_Story.dll in Sielco Sistemi Winlog Pro SCADA before 2.07.18 and Winlog Lite SCADA before 2.07.18 allows remote attackers to execute arbitrary code via a port-46824 TCP packet with a crafted negative integer after the opcode triggering incorrect function-pointer processing that can lead to a buffer overflow. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-4354.


Buffer overflow in Oreans Themida 2.1.8.0 allows remote attackers to execute arbitrary code via a crafted .TMD file.


Stack-based buffer overflow in the SQL/PSM (aka SQL Persistent Stored Module) Stored Procedure (SP) infrastructure in IBM DB2 9.1 9.5 9.7 before FP7 9.8 and 10.1 might allow remote authenticated users to execute arbitrary code by debugging a stored procedure.


Stack-based buffer overflow in the check_file_head function in extra.c in mcrypt 2.6.8 and earlier allows user-assisted remote attackers to execute arbitrary code via an encrypted file with a crafted header containing long salt data that is not properly handled during decryption.


** DISPUTED ** Heap-based buffer overflow in gdevwpr2.c in Ghostscript 9.04 when processing the OutputFile device parameter allows user-assisted remote attackers to execute arbitrary code via a long file name in a PostScript document. NOTE: as of 20120314 the developer was not able to reproduce the issue and disputed it.


Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0 Firefox ESR 10.x before 10.0.8 Thunderbird before 16.0 Thunderbird ESR 10.x before 10.0.8 and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.


Heap-based

buffer

overflow

in

the

nsHTMLEditor::IsPrevCharInNodeWhitespace

function

in

Mozilla

Firefox

before

Firefox

ESR

before

Thunderbird

before

Thunderbird

ESR

before

and

SeaMonkey

before

allows

remote

attackers

to

execute

arbitrary

code

via

unspecified

vectors.


Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: probably in most cases the list file is a trusted file constructed by the program's user; however there are some realistic situations in which a list file would be obtained from an untrusted remote source.


TCPIPS_Story.dll in Sielco Sistemi Winlog Pro SCADA before 2.07.17 and Winlog Lite SCADA before 2.07.17 allows remote attackers to execute arbitrary code via a port-46824 TCP packet with a crafted positive integer after the opcode triggering incorrect function-pointer processing that can lead to a buffer overflow. NOTE: some of these details are obtained from third party information.


Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp formerly the Intel SDK for UPnP devices) before 1.6.18 allows remote attackers to execute arbitrary code via a long UDN (aka uuid) field within a string that contains a :: (colon colon) in a UDP packet.


Buffer overflow in Adobe Flash Player before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X before 10.3.183.43 and 11.x before 11.2.202.251 on Linux before 11.1.111.24 on Android 2.x and 3.x and before 11.1.115.27 on Android 4.x; Adobe AIR before 3.5.0.600; and Adobe AIR SDK before 3.5.0.600 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2012-5274 CVE-2012-5275 CVE-2012-5276 and CVE-2012-5277.


Multiple buffer overflows in the Pdf Printer Preferences ActiveX Control in pdfxctrl.dll in Tracker Software PDF-XChange 3.60.0128 allow remote attackers to execute arbitrary code via a long string in the (1) sub_path parameter to the StoreInRegistry function or (2) sub_key parameter to the InitFromRegistry function.


Heap-based

buffer

overflow

in

the

gfxShapedWord::CompressedGlyph::IsClusterStart

function

in

Mozilla

Firefox

before

Firefox

ESR

before

Thunderbird

before

Thunderbird

ESR

before

and

SeaMonkey

before

allows

remote

attackers

to

execute

arbitrary

code

via

unspecified

vectors.


Buffer overflow in Adobe Flash Player before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X before 10.3.183.43 and 11.x before 11.2.202.251 on Linux before 11.1.111.24 on Android 2.x and 3.x and before 11.1.115.27 on Android 4.x; Adobe AIR before 3.5.0.600; and Adobe AIR SDK before 3.5.0.600 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2012-5274 CVE-2012-5276 CVE-2012-5277 and CVE-2012-5280.


Buffer overflow in Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X before 10.3.183.29 and 11.x before 11.2.202.243 on Linux before 11.1.111.19 on Android 2.x and 3.x and before 11.1.115.20 on Android 4.x; Adobe AIR before 3.4.0.2710; and Adobe AIR SDK before 3.4.0.2710 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than other Flash Player buffer overflow CVEs listed in APSB12-22.


Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp formerly the Intel SDK for UPnP devices) before 1.6.18 allows remote attackers to execute arbitrary code via a long UDN (aka upnp:rootdevice) field in a UDP packet.


Heap-based buffer overflow in the nsWindow::OnExposeEvent function in Mozilla Firefox before 17.0 Firefox ESR 10.x before 10.0.11 Thunderbird before 17.0 Thunderbird ESR 10.x before 10.0.11 and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code via unspecified vectors.


Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp formerly the Intel SDK for UPnP devices) 1.3.1 allows remote attackers to execute arbitrary code via a long ServiceType (aka urn service) field in a UDP packet.


Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80 when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to \warn control = dkim_disable_verify \ allows remote attackers to execute arbitrary code via an email from a malicious DNS server.


Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp formerly the Intel SDK for UPnP devices) 1.3.1 allows remote attackers to execute arbitrary code via a long UDN (aka device) field in a UDP packet.


Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp formerly the Intel SDK for UPnP devices) 1.3.1 allows remote attackers to execute arbitrary code via a long DeviceType (aka urn device) field in a UDP packet.


Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp formerly the Intel SDK for UPnP devices) before 1.6.18 allows remote attackers to execute arbitrary code via a UDP packet with a crafted string that is not properly handled after a certain pointer subtraction.


Buffer overflow in Adobe Flash Player before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X before 10.3.183.43 and 11.x before 11.2.202.251 on Linux before 11.1.111.24 on Android 2.x and 3.x and before 11.1.115.27 on Android 4.x; Adobe AIR before 3.5.0.600; and Adobe AIR SDK before 3.5.0.600 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2012-5275 CVE-2012-5276 CVE-2012-5277 and CVE-2012-5280.


Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp formerly the Intel SDK for UPnP devices) 1.3.1 allows remote attackers to execute arbitrary code via a long UDN (aka uuid) field within a string that lacks a :: (colon colon) in a UDP packet.


Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28 and 5.1.53 and other versions through 5.1.66 and MariaDB 5.5.2.x before 5.5.28a 5.3.x before 5.3.11 5.2.x before 5.2.13 and 5.1.x before 5.1.66 allows remote authenticated users to execute arbitrary code via a long argument to the GRANT FILE command.


AscoServer.exe in the server in Siemens SiPass integrated MP2.6 and earlier does not properly handle IOCP RPC messages received over an Ethernet network which allows remote attackers to write data to any memory location and consequently execute arbitrary code via crafted messages as demonstrated by an arbitrary pointer dereference attack or a buffer overflow attack.


Buffer overflow in Adobe Flash Player before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X before 10.3.183.43 and 11.x before 11.2.202.251 on Linux before 11.1.111.24 on Android 2.x and 3.x and before 11.1.115.27 on Android 4.x; Adobe AIR before 3.5.0.600; and Adobe AIR SDK before 3.5.0.600 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2012-5274 CVE-2012-5275 CVE-2012-5277 and CVE-2012-5280.


Buffer overflow in Adobe Flash Player before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X before 10.3.183.43 and 11.x before 11.2.202.251 on Linux before 11.1.111.24 on Android 2.x and 3.x and before 11.1.115.27 on Android 4.x; Adobe AIR before 3.5.0.600; and Adobe AIR SDK before 3.5.0.600 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2012-5274 CVE-2012-5275 CVE-2012-5276 and CVE-2012-5280.


Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp formerly the Intel SDK for UPnP devices) 1.3.1 allows remote attackers to execute arbitrary code via a long DeviceType (aka urn) field in a UDP packet.


Buffer overflow in Adobe Flash Player before 10.3.183.48 and 11.x before 11.5.502.135 on Windows before 10.3.183.48 and 11.x before 11.5.502.136 on Mac OS X before 10.3.183.48 and 11.x before 11.2.202.258 on Linux before 11.1.111.29 on Android 2.x and 3.x and before 11.1.115.34 on Android 4.x; Adobe AIR before 3.5.0.880 on Windows and before 3.5.0.890 on Mac OS X; and Adobe AIR SDK before 3.5.0.880 on Windows and before 3.5.0.890 on Mac OS X allows attackers to execute arbitrary code via unspecified vectors.


Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP HEAD request. NOTE: this product is discontinued.


A

Buffer

Overflow

in

Network::AuthenticationClient::VerifySignature

in

in

Neato

Botvac

Connected

allows

a

remote

attacker

to

execute

arbitrary

code

with

root

privileges

via

a

crafted

POST

request

to

a

vendors/neato/robots/robot_serial/messages

Neato

cloud

URI

on

the

nucleo.neatocloud.com

web

site

(port


Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP POST request. NOTE: this product is discontinued.


Diagnostics functionality on D-Link DSL-3782 devices with firmware EU v. 1.01 has a buffer overflow allowing authenticated remote attackers to execute arbitrary code via a long Addr value to the 'set Diagnostics_Entry' function in an HTTP request related to /userfs/bin/tcapi.


Google TensorFlow 1.7 and below is affected by: Buffer Overflow. The impact is: execute arbitrary code (local).


In Advantech WebAccess versions V8.2_20170817 and prior WebAccess versions V8.3.0 and prior WebAccess Dashboard versions V.2.0.15 and prior WebAccess Scada Node versions prior to 8.3.1 and WebAccess/NMS 2.0.3 and prior a heap-based buffer overflow vulnerability has been identified which may allow an attacker to execute arbitrary code.


In PoDoFo 0.9.5 there exists a heap-based buffer overflow vulnerability in PoDoFo::PdfTokenizer::GetNextToken() in PdfTokenizer.cpp a related issue to CVE-2017-5886. Remote attackers could leverage this vulnerability to cause a denial-of-service or potentially execute arbitrary code via a crafted pdf file.


Stack-based buffer overflow in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to execute arbitrary code by providing a long string to the blocking.asp page via a GET or POST request. Vulnerable parameters are flag mac and cat_id.


An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. There is a stack-based buffer overflow allowing remote attackers to execute arbitrary code without authentication via the goform/formLanguageChange currTime parameter.


An issue was discovered in Easy File Sharing (EFS) Web Server 7.2. A stack-based buffer overflow vulnerability occurs when a malicious POST request has been made to forum.ghp upon creating a new topic in the forums which allows remote attackers to execute arbitrary code.


Driver module in Intel Smart Sound Technology before version 9.21.00.3541 potentially allows a local attacker to execute arbitrary code as administrator via a buffer overflow.


Buffer overflow in ETWS processing module Intel XMM71xx XMM72xx XMM73xx XMM74xx and Sofia 3G/R allows remote attacker to potentially execute arbitrary code via an adjacent network.


Buffer overflow in HTTP handler in Intel Active Management Technology in Intel Converged Security Manageability Engine Firmware 3.x 4.x 5.x 6.x 7.x 8.x 9.x 10.x and 11.x may allow an attacker to execute arbitrary code via the same subnet.


Buffer overflow in HECI subsystem in Intel(R) CSME before versions 11.8.60 11.11.60 11.22.60 or 12.0.20 and Intel(R) TXE version before 3.1.60 or 4.0.10 or Intel(R) Server Platform Services before version 5.00.04.012 may allow an unauthenticated user to potentially execute arbitrary code via physical access.


Buffer overflow vulnerability in Platform Sample / Silicon Reference firmware for 8th Generation Intel(R) Core Processor 7th Generation Intel(R) Core Processor Intel(R) Pentium(R) Silver J5005 Processor Intel(R) Pentium(R) Silver N5000 Processor Intel(R) Celeron(R) J4105 Processor Intel(R) Celeron(R) J4005 Processor Intel Celeron(R) N4100 Processor and Intel(R) Celeron N4000 Processor may allow privileged user to potentially execute arbitrary code via local access.


Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via submit-url parameter.


Buffer overflow in BN-SDWBP3 firmware version 1.0.9 and earlier allows an attacker on the same network segment to execute arbitrary code via unspecified vectors.


A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated remote attacker to craft a packet to the management interface on an affected system causing a buffer overflow. The vulnerability is due to incorrect input validation in the authentication module of the NX-API subsystem. An attacker could exploit this vulnerability by sending a crafted HTTP or HTTPS packet to the management interface of an affected system with the NX-API feature enabled. An exploit could allow the attacker to execute arbitrary code as root. Note: NX-API is disabled by default. This vulnerability affects: MDS 9000 Series Multilayer Switches Nexus 2000 Series Fabric Extenders Nexus 3000 Series Switches Nexus 3500 Platform Switches Nexus 5500 Platform Switches Nexus 5600 Platform Switches Nexus 6000 Series Switches Nexus 7000 Series Switches Nexus 7700 Series Switches Nexus 9000 Series Switches in standalone NX-OS mode Nexus 9500 R-Series Line Cards and Fabric Modules. Cisco Bug IDs: CSCvd45804 CSCve02322 CSCve02412.


Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary code via tools_system.cgi date parameter time parameter and offset parameter.


Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary code via netWizard.cgi date parameter time parameter and offset parameter.


A vulnerability in the Cisco Fabric Services (CFS) component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated remote attacker to execute arbitrary code on an affected device. The vulnerability exists because the affected software insufficiently validates Cisco Fabric Services packet headers when the software processes packet data. An attacker could exploit this vulnerability by sending a maliciously crafted Cisco Fabric Services packet to an affected device. A successful exploit could allow the attacker to cause a buffer overflow condition on the device which could allow the attacker to execute arbitrary code on the device. This vulnerability affects the following if configured to use Cisco Fabric Services: Firepower 4100 Series Next-Generation Firewalls Firepower 9300 Security Appliance MDS 9000 Series Multilayer Switches Nexus 2000 Series Fabric Extenders Nexus 3000 Series Switches Nexus 3500 Platform Switches Nexus 5500 Platform Switches Nexus 5600 Platform Switches Nexus 6000 Series Switches Nexus 7000 Series Switches Nexus 7700 Series Switches Nexus 9000 Series Switches in standalone NX-OS mode Nexus 9500 R-Series Line Cards and Fabric Modules UCS 6100 Series Fabric Interconnects UCS 6200 Series Fabric Interconnects UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCvd69943 CSCve02429 CSCve02433 CSCve02435 CSCve02445 CSCve04859.


Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via HTTP request and response.


A vulnerability in the CLI parser of Cisco FXOS Software and Cisco UCS Fabric Interconnect Software could allow an authenticated local attacker to cause a buffer overflow on an affected device. The vulnerability is due to incorrect input validation in the CLI parser subsystem. An attacker could exploit this vulnerability by exceeding the expected length of user input. A successful exploit could allow the attacker to execute arbitrary code with root privileges on the affected system. This vulnerability affects Firepower 4100 Series Next-Generation Firewall Firepower 9300 Security Appliance UCS 6100 Series Fabric Interconnects UCS 6200 Series Fabric Interconnects UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCvb61099 CSCvb86743.


Buffer overflow in Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to execute arbitrary code via a specially crafted file.


A Buffer Overflow vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow a local attacker to execute arbitrary code on the system of a user. The attacker could exploit this vulnerability by sending the user a link or email attachment with a malicious ARF file and persuading the user to follow the link or launch the file. Successful exploitation could allow the attacker to execute arbitrary code on the user's system. This vulnerability affects Cisco WebEx Business Suite meeting sites Cisco WebEx Meetings sites Cisco WebEx Meetings Server and Cisco WebEx ARF players. Cisco Bug IDs: CSCvg78835 CSCvg78837 CSCvg78839.


Buffer overflow in Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to execute arbitrary code via a specially crafted file.


The remote management interface of cgminer 4.10.0 and bfgminer 5.5.0 allows an authenticated remote attacker to execute arbitrary code due to a stack-based buffer overflow in the addpool failover-only poolquota and save command handlers.


A maliciously crafted project file may cause a buffer overflow which may allow the attacker to execute arbitrary code that affects Fuji Electric V-Server Lite 4.0.3.0 and prior.


IBM DB2 9.7 10.1 10.5 and 11.1 libdb2e.so.1 is vulnerable to a stack based buffer overflow caused by improper bounds checking which could allow an attacker to execute arbitrary code. IBM X-Force ID: 153316.


zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the utils.c:checkmailpath function. A local attacker could exploit this to execute arbitrary code in the context of another user.


Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface. This vulnerability could theoretically allow a remote authenticated attacker execute arbitrary code on the system.


In MuPDF 1.12.0 and earlier a stack buffer overflow in function pdf_lookup_cmap_full in pdf/pdf-cmap.c could allow an attacker to execute arbitrary code via a crafted file.


Advantech WebAccess 8.3.1 and earlier has several stack-based buffer overflow vulnerabilities that have been identified which may allow an attacker to execute arbitrary code.


Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. This vulnerability may allow a remote threat actor to intentionally send a malformed CIP packet to Port 44818 causing the software application to stop responding and crash. This vulnerability also has the potential to exploit a buffer overflow condition which may allow the threat actor to remotely execute arbitrary code.


A Stack-based Buffer Overflow issue was discovered in 3S-Smart CODESYS Web Server. Specifically: all Microsoft Windows (also WinCE) based CODESYS web servers running stand-alone Version 2.3 or as part of the CODESYS runtime system running prior to Version V1.1.9.19. A crafted request may cause a buffer overflow and could therefore execute arbitrary code on the web server or lead to a denial-of-service condition due to a crash in the web server.


A Stack-based Buffer Overflow issue was discovered in Delta Electronics Delta Industrial Automation DOPSoft Version 4.00.01 or prior. Stack-based buffer overflow vulnerabilities caused by processing specially crafted .dop or .dpb files may allow an attacker to remotely execute arbitrary code.


An Improper Restriction of Operations within the Bounds of a Memory Buffer issue was discovered in GE D60 Line Distance Relay devices running firmware Version 7.11 and prior. The SSH functions of the device are vulnerable to buffer overflow conditions that may allow a remote attacker to execute arbitrary code on the device.


An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the \Telephony\ component. A buffer overflow allows remote attackers to execute arbitrary code.


An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the \Security\ component. A buffer overflow allows attackers to execute arbitrary code in a privileged context via a crafted app.


An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the \Kernel\ component. A buffer overflow in getvolattrlist allows attackers to execute arbitrary code in a privileged context via a crafted app.


An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the \Kernel\ component. A buffer overflow in mptcp_usr_connectx allows attackers to execute arbitrary code in a privileged context via a crafted app.


Stack-based buffer overflows in Zahir Accounting Enterprise Plus 6 through build 10b allow remote attackers to execute arbitrary code via a crafted CSV file that is accessed through the Import CSV File menu.


In Delta Industrial Automation TPEditor TPEditor Versions 1.90 and prior multiple stack-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files lacking user input validation before copying data from project files onto the stack and may allow an attacker to remotely execute arbitrary code.


gpsd versions 2.90 to 3.17 and microjson versions 1.0 to 1.3 an open source project allow a stack-based buffer overflow which may allow remote attackers to execute arbitrary code on embedded platforms via traffic on Port 2947/TCP or crafted JSON inputs.


In Advantech WebAccess versions V8.2_20170817 and prior WebAccess versions V8.3.0 and prior WebAccess Dashboard versions V.2.0.15 and prior WebAccess Scada Node versions prior to 8.3.1 and WebAccess/NMS 2.0.3 and prior several stack-based buffer overflow vulnerabilities have been identified which may allow an attacker to execute arbitrary code.


Amazon Web Services (AWS) FreeRTOS through 1.3.1 FreeRTOS up to V10.0.1 (with FreeRTOS+TCP) and WITTENSTEIN WHIS Connect middleware TCP/IP component allow remote attackers to leak information or execute arbitrary code because of a Buffer Overflow during generation of a protocol checksum in usGenerateProtocolChecksum and prvProcessIPPacket.


Texas Instruments BLE-STACK v2.2.1 for SimpleLink CC2640 and CC2650 devices allows remote attackers to execute arbitrary code via a malformed packet that triggers a buffer overflow.


Amazon Web Services (AWS) FreeRTOS through 1.3.1 FreeRTOS up to V10.0.1 (with FreeRTOS+TCP) and WITTENSTEIN WHIS Connect middleware TCP/IP component allow remote attackers to execute arbitrary code or leak information because of a Buffer Overflow during parsing of DNS\\LLMNR packets in prvParseDNSReply.


Buffer overflow in readDataVar in hdf/dataobject.c in Symonics libmysofa 0.5 - 1.1 allows attackers to execute arbitrary code via a crafted SOFA.


The daemon in GENIVI diagnostic log and trace (DLT) is vulnerable to a heap-based buffer overflow that could allow an attacker to remotely execute arbitrary code on the DLT-Daemon (versions prior to 2.18.6).


CA Unified Infrastructure Management (Nimsoft/UIM) 20.1 20.3.x and 9.20 and below contains a buffer overflow vulnerability in the robot (controller) component. A remote attacker can execute arbitrary code.


Buffer overflow in FinalWire Ltd AIDA64 Engineer 6.00.5100 allows attackers to execute arbitrary code by creating a crafted input that will overwrite the SEH handler.


Buffer overflow in pdf2json 0.69 allows local users to execute arbitrary code by converting a crafted PDF file.


NCR SelfServ ATMs running APTRA XFS 05.01.00 or earlier do not authenticate or protect the integrity of USB HID communications between the currency dispenser and the host computer permitting an attacker with physical access to internal ATM components the ability to inject a malicious payload and execute arbitrary code with SYSTEM privileges on the host computer by causing a buffer overflow on the host.


Firmware developed by Shenzhen Hichip Vision Technology (V6 through V20 after 2018-08-09 through 2020) as used by many different vendors in millions of Internet of Things devices suffers from buffer overflow vulnerability that allows unauthenticated remote attackers to execute arbitrary code via the peer-to-peer (P2P) service. This affects products marketed under the following brand names: Accfly Alptop Anlink Besdersec BOAVISION COOAU CPVAN Ctronics D3D Security Dericam Elex System Elite Security ENSTER ePGes Escam FLOUREON GENBOLT Hongjingtian (HJT) ICAMI Iegeek Jecurity Jennov KKMoon LEFTEK Loosafe Luowice Nesuniq Nettoly ProElite QZT Royallite SDETER SV3C SY2L Tenvis ThinkValue TOMLOV TPTEK WGCC and ZILINK.


A buffer overflow in the RTSP service of the Ambarella Oryx RTSP Server 2020-01-07 allows an unauthenticated attacker to send a crafted RTSP request with a long digest authentication header to execute arbitrary code in parse_authentication_header() in libamprotocol-rtsp.so.1 in rtsp_svc (or cause a crash). This allows remote takeover of a Furbo Dog Camera for example.


Buffer overflow in Yz1 0.30 and 0.32 as used in IZArc 4.4 ZipGenius 6.3.2.3116 and Explzh (extension) 8.14 allows attackers to execute arbitrary code via a crafted archive file related to filename handling.


The Omron CX-One Version 4.60 and prior is vulnerable to a stack-based buffer overflow which may allow an attacker to remotely execute arbitrary code.


A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could use this flaw to cause an application crash or in some cases execute arbitrary code with the permission of the user running such an application.


clickhouse-driver before 0.1.5 allows a malicious clickhouse server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response due to a buffer overflow.


Delta Industrial Automation CNCSoft ScreenEditor Versions 1.01.23 and prior. Multiple stack-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files which may allow an attacker to read/modify information execute arbitrary code and/or crash the application.


Delta Electronics TPEditor Versions 1.97 and prior. A stack-based buffer overflow may be exploited by processing a specially crafted project file. Successful exploitation of this vulnerability may allow an attacker to read/modify information execute arbitrary code and/or crash the application.


In PLC WinProladder Version 3.28 and prior a stack-based buffer overflow vulnerability can be exploited when a valid user opens a specially crafted file which may allow an attacker to remotely execute arbitrary code.


Delta Electronics TPEditor Versions 1.97 and prior. A heap-based buffer overflow may be exploited by processing a specially crafted project file. Successful exploitation of this vulnerability may allow an attacker to read/modify information execute arbitrary code and/or crash the application.


A local authenticated buffer overflow vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5 6.8.8-HF1 6.7.14-HF1. A vulnerability in ClearPass OnGuard could allow local authenticated users to cause a buffer overflow condition. A successful exploit could allow a local attacker to execute arbitrary code within the context the binary is running in which is a lower privileged account.


Spamsniper 5.0 ~ 5.2.7 contain a stack-based buffer overflow vulnerability caused by improper boundary checks when parsing MAIL FROM command. It leads remote attacker to execute arbitrary code via crafted packet.


TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an unauthenticated user to execute arbitrary code by POSTing to apply_sec.cgi via the action ping_test with a sufficiently long ping_ipaddr key.


TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action auto_up_fw (or auto_up_lp) with a sufficiently long update_file_name key.


TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action wifi_captive_portal_login with a sufficiently long REMOTE_ADDR key.


Softing Industrial Automation all versions prior to the latest build of version 4.47.0 The affected product is vulnerable to a heap-based buffer overflow which may allow an attacker to remotely execute arbitrary code.


HMS Industrial Networks AB eCatcher all versions prior to 6.5.5. The affected product is vulnerable to a stack-based buffer overflow which may allow an attacker to remotely execute arbitrary code.


TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action kick_ban_wifi_mac_allow with a sufficiently long qcawifi.wifi0_vap0.maclist key.


TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action st_dev_connect st_dev_disconnect or st_dev_rconnect with a sufficiently long wan_type key.


TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action set_sta_enrollee_pin_wifi1 (or set_sta_enrollee_pin_wifi0) with a sufficiently long wps_sta_enrollee_pin key.


Dell EMC iDRAC7 iDRAC8 and iDRAC9 versions prior to 2.65.65.65 2.70.70.70 4.00.00.00 contain a stack-based buffer overflow vulnerability. An unauthenticated remote attacker may exploit this vulnerability to crash the affected process or execute arbitrary code on the system by sending specially crafted input data.


IBM DB2 for Linux UNIX and Windows (includes DB2 Connect Server) 9.7 10.1 10.5 11.1 and 11.5 db2fm is vulnerable to a buffer overflow caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with root privileges. IBM X-Force ID: 193661.


Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacker can abuse this issue to crash the device and possibly execute arbitrary code.


Certain IBM Aspera applications are vulnerable to buffer overflow after valid authentication which could allow an attacker with intimate knowledge of the system to execute arbitrary code through a service. IBM X-Force ID: 180902.


IBM DB2 for Linux UNIX and Windows (includes DB2 Connect Server) 9.7 10.1 10.5 11.1 and 11.5 is vulnerable to a buffer overflow caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with root privileges. IBM X-Force ID: 178960.


Certain IBM Aspera applications are vulnerable to a stack-based buffer overflow caused by improper bounds checking. This could allow a remote attacker with intimate knowledge of the server to execute arbitrary code on the system with the privileges of root or cause server to crash. IBM X-Force ID: 180814.


IBM DB2 for Linux UNIX and Windows (includes DB2 Connect Server) 9.7 10.1 10.5 11.1 and 11.5 is vulnerable to a buffer overflow caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with root privileges. IBM X-Force ID: 174960.


IBM Security Sevret Server (IBM Security Verify Privilege Manager 10.8.2) is vulnerable to a buffer overflow caused by improper bounds checking. A local attacker could overflow a buffer and execute arbitrary code on the system or cause the system to crash. IBM X-Force ID: 184917.


IBM Spectrum Protect 7.1 and 8.1 server is vulnerable to a stack-based buffer overflow caused by improper bounds checking. This could allow a remote attacker to execute arbitrary code on the system with the privileges of an administrator or user associated with the Spectrum Protect server or cause the Spectrum Protect server to crash. IBM X-Force ID: 179990.


The Zscaler Client Connector for Windows prior to 2.1.2.74 had a stack based buffer overflow when connecting to misconfigured TLS servers. An adversary would potentially have been able to execute arbitrary code with system privileges.


A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.5 and version before 6.2.4 may allow an unauthenticated remote attacker to overwrite the content of the stack and potentially execute arbitrary code by sending a crafted request with a large certname.


An issue was discovered on Samsung mobile devices with Q(10.0) (Exynos990 chipsets) software. The S3K250AF Secure Element CC EAL 5+ chip allows attackers to execute arbitrary code and obtain sensitive information via a buffer overflow. The Samsung ID is SVE-2020-18632 (November 2020).


upnpd

on

certain

NETGEAR

devices

allows

remote

(LAN)

attackers

to

execute

arbitrary

code

via

a

stack-based

buffer

overflow.

This

affects

and


An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is a stack-based buffer overflow in the httpd binary. It allows an authenticated user to execute arbitrary code via a POST to ntp_sync.cgi with a sufficiently long parameter ntp_server.


utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data because of a buffer overflow involving the netclear and nextitem functions.


A vulnerability has been identified in SICAM MMU (All versions < V2.05) SICAM SGU (All versions) SICAM T (All versions < V2.18). A buffer overflow in various positions of the web application might enable an attacker with access to the web application to execute arbitrary code over the network.