Buffer overflow in ldcconn in Hewlett-Packard (HP) Controller for Cisco Local Director on HP-UX 11.11i allows remote attackers to execute arbitrary code via a long string to TCP port 17781.


Heap-based buffer overflow in the QuickTime VR extension 7.2.0.240 in QuickTime.qts in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via a QTVR (QuickTime Virtual Reality) movie file containing a large size field in the atom header of a panorama sample atom.

buffer overflow
arbitrary code execution


Multiple buffer overflows in a certain ActiveX control in CryptoX.dll 2.0 and earlier in the Ultra Crypto Component allow remote attackers to execute arbitrary code via (1) a long string in the first argument to the AcquireContext method or (2) an unspecified vector to the DeleteContext method.


An \integer arithmetic\ error in Apple QuickTime 7.2 allows remote attackers to execute arbitrary code via a crafted movie file containing a movie atom with a large size value which triggers a stack-based buffer overflow.


Stack-based buffer overflow in a certain ActiveX control in VDT70.DLL in Microsoft Visual Database Tools Database Designer 7.0 for Microsoft Visual Studio 6 allows remote attackers to execute arbitrary code via a long argument to the NotSafe method. NOTE: this may overlap CVE-2007-2885 or CVE-2005-2127.


Stack consumption vulnerability in AkkyWareHOUSE 7-zip32.dll before 4.42.00.04 as derived from Igor Pavlov 7-Zip before 4.53 beta allows user-assisted remote attackers to execute arbitrary code via a long filename in an archive leading to a heap-based buffer overflow.


Buffer overflow in Microsoft Visual Basic 6.0 and Enterprise Edition 6.0 SP6 allows user-assisted remote attackers to execute arbitrary code via a Visual Basic project (vbp) file containing a long Reference line related to VBP_Open and OLE. NOTE: there are limited usage scenarios under which this would be a vulnerability.


Multiple stack-based buffer overflows in the IBM Lotus Domino Web Access ActiveX control as provided by inotes6.dll inotes6w.dll dwa7.dll and dwa7w.dll in Domino 6.x and 7.x allow remote attackers to execute arbitrary code as demonstrated by an overflow from a long General_ServerName property value when calling the InstallBrowserHelperDll function in the Upload Module in the dwa7.dwa7.1 control in dwa7w.dll 7.0.34.1.


Buffer overflow in a certain ActiveX control in officeviewer.ocx 5.2.218.1 in EDraw Office Viewer Component 5.2 allows remote attackers to execute arbitrary code via a long first argument to the HttpDownloadFileToTempDir method a different vulnerability than CVE-2007-3169.


Multiple stack-based buffer overflows in the Earth Resource Mapping NCSView ActiveX control before 3.4.0.242 in NCSView.dll as distributed in ER Mapper ECW JPEG 2000 Plug-in before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.


Buffer overflow in the TagAttributeListCopy function in nnotes.dll in IBM Lotus Notes before 7.0.3 allows user-assisted remote attackers to execute arbitrary code via a crafted HTML email related to duplicate RTF conversion when the recipient operates on this email.


Buffer overflow in Next Generation Software Virtual DJ (VDJ) 5.0 allows user-assisted remote attackers to execute arbitrary code via a long file path in an m3u file.


Buffer overflow in php_win32std.dll in the win32std extension for PHP 5.2.0 and earlier allows context-dependent attackers to execute arbitrary code via a long string in the filename argument to the win_browse_file function.


Buffer overflow in CrystalPlayer Pro 1.98 allows user-assisted remote attackers to execute arbitrary code via a long string in a .mls Playlist file.


Buffer overflow in the SQLServer ActiveX control in the Distributed Management Objects OLE DLL (sqldmo.dll) 2000.085.2004.00 in Microsoft SQL Server Enterprise Manager 8.05.2004 allows remote attackers to execute arbitrary code via a long second argument to the Start method.


Heap-based buffer overflow in the Client Trust application (clntrust.exe) in Novell BorderManager 3.8 before Update 1.5 allows remote attackers to execute arbitrary code via a validation request in which the Novell tree name is not properly delimited with a wide-character backslash or NULL character.


Stack-based buffer overflow in the SonicWall SSL-VPN NetExtender NELaunchCtrl ActiveX control before 2.1.0.51 and 2.5.x before 2.5.0.56 allows remote attackers to execute arbitrary code via a long string in the second argument to the AddRouteEntry method.


Heap-based buffer overflow in QEMU 0.8.2 as used in Xen and possibly other products allows local users to execute arbitrary code via crafted data in the \net socket listen\ option aka QEMU \net socket\ heap overflow. NOTE: some sources have used CVE-2007-1321 to refer to this issue as part of \NE2000 network driver and the socket code \ but this is the correct identifier for the individual net socket listen vulnerability.


Buffer overflow in the RegistryString function in the HPISDataManagerLib.Datamgr ActiveX control in HPISDataManager.dll in HP Instant Support before 1.0.0.24 allows remote attackers to execute arbitrary code via a long first argument a different vulnerability than CVE-2007-5604 CVE-2007-5605 and CVE-2007-5606.


Multiple stack-based buffer overflows in Firebird LI 1.5.3.4870 and 1.5.4.4910 and WI 1.5.3.4870 and 1.5.4.4910 allow remote attackers to execute arbitrary code via (1) a long service attach request on TCP port 3050 to the SVC_attach function or (2) unspecified vectors involving the INET_connect function.


Buffer overflow in a certain ActiveX control in Xunlei Web Thunder 5.6.9.344 possibly the DapPlayer ActiveX control in DapPlayer_Now.dll allows remote attackers to execute arbitrary code via a long first argument to the DownURL2 method. NOTE: some of these details are obtained from third party information.


Heap-based buffer overflow in the activePDF Server service (aka APServer.exe) in activePDF Server 3.8.4 and 3.8.5.14 and possibly other versions before 3.8.6.16 allows remote attackers to execute arbitrary code via a packet with a size field that is less than the actual size of the data.


Heap-based buffer overflow in TIBCO SmartSockets RTserver 6.8.0 and earlier RTworks before 4.0.4 and Enterprise Message Service (EMS) 4.0.0 through 4.4.1 allows remote attackers to execute arbitrary code via crafted requests containing size and copy-length values that trigger the overflow.


Buffer overflow in a certain ActiveX control in ScanObjectBrowser.DLL in G DATA Antivirus 2007 might allow remote attackers to execute arbitrary code via unspecified parameters to the SelectPath function. NOTE: this issue might not cross privilege boundaries in most environments since it is not marked as safe for scripting.


Stack-based buffer overflow in eIQNetworks Enterprise Security Analyzer (ESA) 2.5 allows remote attackers to execute arbitrary code via certain data on TCP port 10616 that results in a long argument to the SEARCHREPORT command a different vector than CVE-2007-2059.


Unspecified vulnerability in the Update Service ActiveX control in isusweb.dll before 6.0.100.65101 in MacroVision FLEXnet Connect and InstallShield 2008 allows remote attackers to execute arbitrary code via an unspecified \unsafe method \ possibly involving a buffer overflow.


Multiple stack-based buffer overflows in CA (Computer Associates) BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.5 allow remote attackers to execute arbitrary code via a long (1) username or (2) password to the rxrLogin command in rxRPC.dll or a long (3) username argument to the GetUserInfo function.


Multiple buffer overflows in the SonicWall SSL-VPN NetExtender NELaunchCtrl ActiveX control before 2.1.0.51 and 2.5.x before 2.5.0.56 allow remote attackers to execute arbitrary code via a long (1) serverAddress (2) sessionId (3) clientIPLower (4) clientIPHigher (5) userName (6) domainName or (7) dnsSuffix Unicode property value. NOTE: the AddRouteEntry vector is covered by CVE-2007-5603.


Multiple stack-based buffer overflows in SwiftView Viewer before 8.3.5 as used by SwiftView and SwiftSend allow remote attackers to execute arbitrary code via unspecified vectors to the (1) svocx.ocx ActiveX control or the (2) npsview.dll plugin for Mozilla and Firefox.


Heap-based buffer overflow in iaspam.dll in the SMTP Server in Ipswitch IMail Server 8.01 through 8.11 allows remote attackers to execute arbitrary code via a set of four different e-mail messages with a long boundary parameter in a certain malformed Content-Type header line the string \MIME\ by itself on a line in the header and a long Content-Transfer-Encoding header line.


Stack-based buffer overflow in the ADM4 ActiveX control in adm4.dll in Altnet Download Manager 4.0.0.6 as used in (1) Kazaa 3.2.7 and (2) Grokster allows remote attackers to execute arbitrary code via a long argument to the Install method. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


The NE2000 emulator in QEMU 0.8.2 allows local users to execute arbitrary code by writing Ethernet frames with a size larger than the MTU to the EN0_TCNT register which triggers a heap-based buffer overflow in the slirp library aka NE2000 \mtu\ heap overflow. NOTE: some sources have used CVE-2007-1321 to refer to this issue as part of \NE2000 network driver and the socket code \ but this is the correct identifier for the mtu overflow vulnerability.


Buffer overflow in the MoveFile function in the HPISDataManagerLib.Datamgr ActiveX control in HPISDataManager.dll in HP Instant Support before 1.0.0.24 allows remote attackers to execute arbitrary code via a long argument a different vulnerability than CVE-2007-5604 CVE-2007-5605 and CVE-2007-5607.


Stack-based buffer overflow in Borland InterBase LI 8.0.0.53 through 8.1.0.253 on Linux and possibly unspecified versions on Solaris allows remote attackers to execute arbitrary code via a long attach request on TCP port 3050 to the open_marker_file function.


Multiple stack-based buffer overflows in Computer Associates (CA) BrightStor Hierarchical Storage Manager (HSM) before r11.6 allow remote attackers to execute arbitrary code via unspecified CsAgent service commands with certain opcodes related to missing validation of a length parameter.


Buffer overflow in the redir function in check_http.c in Nagios Plugins before 1.4.10 when running with the -f (follow) option allows remote web servers to execute arbitrary code via Location header responses (redirects) with a large number of leading \L\ characters.


Multiple buffer overflows in eXtremail 2.1.1 and earlier allow remote attackers to (1) have an unknown impact by sending multiple long strings to the IMAP port (143/tcp); (2) execute arbitrary code via a long string in an IMAP AUTHENTICATE PLAIN action involving the ifParseAuthPlain function; (3) execute arbitrary code via a long LOGIN command to the admin interface port (4501/tcp); or (4) execute arbitrary code via a long string in an IMAP AUTHENTICATE LOGIN (aka CRAM-MD5 authentication) action involving the ifProcImapAuth1 function.


Off-by-one error in Cisco IOS allows remote attackers to execute arbitrary code via unspecified vectors that trigger a heap-based buffer overflow. NOTE: as of 20071016 the only disclosure is a vague pre-advisory with no actionable information. However since it is from a well-known researcher it is being assigned a CVE identifier for tracking purposes.


Multiple stack-based buffer overflows in FSD 2.052 d9 and earlier and FSFDT FSD 3.000 d9 and earlier allow (1) remote attackers to execute arbitrary code via a long HELP command on TCP port 3010 to the sysuser::exechelp function in sysuser.cc and (2) remote authenticated users to execute arbitrary code via long commands on TCP port 6809 to the servinterface::sendmulticast function in servinterface.cc as demonstrated by a PIcallsign command.


Heap-based buffer overflow in the Juniper HTTP Service allows remote attackers to execute arbitrary code via a crafted HTTP packet. NOTE: as of 20071016 the only disclosure is a vague pre-advisory with no actionable information. However since it is from a well-known researcher it is being assigned a CVE identifier for tracking purposes.


Multiple buffer overflows in the rich text processing functionality in JustSystems Ichitaro 2004 through 2007 11 through 13 and other versions allow remote attackers to execute arbitrary code via a long (1) pard field or (2) font name in the fcharset0 field which is not properly handled in (a) JSTARO4.OCX; or (3) a long title which is not properly handled by (b) TJSVDA.DLL.


Stack-based buffer overflow in Autonomy (formerly Verity) KeyView Viewer Filter and Export SDK before 9.2.0.12 as used by ActivePDF DocConverter wp6sr.dll in IBM Lotus Notes 8.0 and before 7.0.3 Symantec Mail Security and other products allows remote attackers to execute arbitrary code via a crafted WordPerfect (WPD) file.


Stack-based buffer overflow in the AskJeevesToolBar.SettingsPlugin.1 ActiveX control in askBar.dll in IAC Search & Media ask.com Ask Toolbar 4.0.2.53 and earlier allows remote attackers to execute arbitrary code via a long ShortFormat property value. NOTE: some of these details are obtained from third party information. NOTE: the researcher claims that this is the same as CVE-2007-5108 but there is insufficient detail for CVE-2007-5108 to be certain.


Stack-based buffer overflow in DriveLock.exe in CenterTools DriveLock 5.0 allows remote attackers to execute arbitrary code via a long HTTP request to TCP port 6061. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Heap-based buffer overflow in the IBM ThinkVantage TPM Service allows remote attackers to execute arbitrary code via a crafted HTTP packet. NOTE: as of 20071016 the only disclosure is a vague pre-advisory with no actionable information. However since it is from a well-known researcher it is being assigned a CVE identifier for tracking purposes.


Stack-based buffer overflow in the reply_netbios_packet function in nmbd/nmbd_packets.c in nmbd in Samba 3.0.0 through 3.0.26a when operating as a WINS server allows remote attackers to execute arbitrary code via crafted WINS Name Registration requests followed by a WINS Name Query request.


Buffer overflow in the ExtractCab function in the HPISDataManagerLib.Datamgr ActiveX control in HPISDataManager.dll in HP Instant Support before 1.0.0.24 allows remote attackers to execute arbitrary code via a long first argument a different vulnerability than CVE-2007-5605 CVE-2007-5606 and CVE-2007-5607.


Multiple buffer overflows in the voicemail functionality in Asterisk 1.4.x before 1.4.13 when using IMAP storage might allow (1) remote attackers to execute arbitrary code via a long combination of Content-type and Content-description headers or (2) local users to execute arbitrary code via a long combination of astspooldir voicemail context and voicemail mailbox fields. NOTE: vector 2 requires write access to Asterisk configuration files.


Multiple stack-based buffer overflows in Firebird LI 2.0.0.12748 and 2.0.1.12855 and WI 2.0.0.12748 and 2.0.1.12855 allow remote attackers to execute arbitrary code via (1) a long attach request on TCP port 3050 to the isc_attach_database function or (2) a long create request on TCP port 3050 to the isc_create_database function.


IceGUI.DLL in ICEOWS 4.20b invokes a function with incorrect arguments which allows user-assisted remote attackers to execute arbitrary code via a long filename in the header of an ACE archive which triggers a stack-based buffer overflow.


Multiple stack-based buffer overflows in the AxMetaStream ActiveX control in AxMetaStream.dll 3.3.2.26 in Viewpoint Media Player 3.2 allow remote attackers to execute arbitrary code via a long string argument to the (1) BroadcastKey (2) BroadcastKeyFileURL (3) Component (4) ComponentClassID (5) ComponentFileName (6) ExtraProperty (7) Properties (8) RequiredVersions (9) Source or (10) XMLText method.


Multiple stack-based buffer overflows in Autonomy (formerly Verity) KeyView Viewer Filter and Export SDK before 9.2.0.12 as used by ActivePDF DocConverter IBM Lotus Notes before 7.0.3 Symantec Mail Security and other products allow remote attackers to execute arbitrary code via a crafted (1) AG file to kpagrdr.dll (2) AW file to awsr.dll (3) DLL or (4) EXE file to exesr.dll (5) DOC file to mwsr.dll (6) MIF file to mifsr.dll (7) SAM file to lasr.dll or (8) RTF file to rtfsr.dll. NOTE: the WPD (wp6sr.dll) vector is covered by CVE-2007-5910.


Multiple stack-based buffer overflows in Borland InterBase LI 8.0.0.53 through 8.1.0.253 and WI 5.1.1.680 through 8.1.0.257 allow remote attackers to execute arbitrary code via (1) a long service attach request on TCP port 3050 to the (a) SVC_attach or (b) INET_connect function (2) a long create request on TCP port 3050 to the (c) isc_create_database or (d) jrd8_create_database function (3) a long attach request on TCP port 3050 to the (e) isc_attach_database or (f) PWD_db_aliased function or unspecified vectors involving the (4) jrd8_attach_database or (5) expand_filename2 function.


Stack-based buffer overflow in the RPC interface for the Message Engine (mediasvr.exe) in CA BrightStor ARCServe BackUp v9.01 through R11.5 and Enterprise Backup r10.5 allows remote attackers to execute arbitrary code via a long argument in the 0x10d opnum.


Stack-based buffer overflow in the Database Component in MPAMedia.dll in RealNetworks RealPlayer 10.5 and 11 beta and earlier versions including 10 RealOne Player and RealOne Player 2 allows remote attackers to execute arbitrary code via certain playlist names as demonstrated via the import method to the IERPCtl ActiveX control in ierpplug.dll.


Buffer overflow in the ReadImage function in generic/tkImgGIF.c in Tcl (Tcl/Tk) 8.4.13 through 8.4.15 allows remote attackers to execute arbitrary code via multi-frame interlaced GIF files in which later frames are smaller than the first. NOTE: this issue is due to an incorrect patch for CVE-2007-5378.


Buffer overflow in a certain driver in Cisco Security Agent 4.5.1 before 4.5.1.672 5.0 before 5.0.0.225 5.1 before 5.1.0.106 and 5.2 before 5.2.0.238 on Windows allows remote attackers to execute arbitrary code via a crafted SMB packet in a TCP session on port (1) 139 or (2) 445.


Multiple heap-based buffer overflows in emlsr.dll in the EML reader in Autonomy (formerly Verity) KeyView 10.3.0.0 as used by IBM Lotus Notes allow remote attackers to execute arbitrary code via a long (1) To (2) Cc (3) Bcc (4) From (5) Date (6) Subject (7) Priority (8) Importance or (9) X-MSMail-Priority header; (10) a long string at the beginning of an RFC2047 encoded-word in a header; (11) a long text string in an RFC2047 encoded-word in a header; or (12) a long Subject header related to creation of an associated filename.


Buffer overflow in the GetFileTime function in the HPISDataManagerLib.Datamgr ActiveX control in HPISDataManager.dll in HP Instant Support before 1.0.0.24 allows remote attackers to execute arbitrary code via a long argument a different vulnerability than CVE-2007-5604 CVE-2007-5606 and CVE-2007-5607.


Stack-based buffer overflow in the Line Printer Daemon (LPD) in Cisco IOS before 12.2(18)SXF11 12.4(16a) and 12.4(2)T6 allow remote attackers to execute arbitrary code by setting a long hostname on the target system then causing an error message to be printed as demonstrated by a telnet session to the LPD from a source port other than 515.


The RepliStor Server Service in EMC Replistor 6.1.3 allows remote attackers to execute arbitrary code via a size value that causes RepliStor to create a smaller buffer than expected which triggers a buffer overflow when that buffer is used in a recv function call.


Stack-based buffer overflow in the separate_word function in tokenize.c in Link Grammar 4.1b and possibly other versions as used in AbiWord Link Grammar 4.2.4 allows remote attackers to execute arbitrary code via a long word as reachable through the separate_sentence function.


Buffer overflow in the register function in Ultra Star Reader ActiveX control in SSReader allows remote attackers to execute arbitrary code via unspecified vectors as exploited in the wild. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Stack-based buffer overflow in a certain ActiveX control in GLChat.ocx 2.5.1.32 in GlobalLink 2.7.0.8 as used in Ourgame GLWorld and possibly other products allows remote attackers to execute arbitrary code via a long first argument to the ConnectAndEnterRoom method possibly involving the GLCHAT.GLChatCtrl.1 control as originally exploited in the wild in October 2007. NOTE: some of these details are obtained from third party information. NOTE: this was originally reported as a heap-based issue by some sources.


Stack-based buffer overflow in db2dasrrm in the DB2 Administration Server (DAS) in IBM DB2 Universal Database 9.5 before Fix Pack 1 9.1 before Fix Pack 4a and 8 before FixPak 16 allows local users to execute arbitrary code via a long DASPROF environment variable.


Multiple buffer overflows in Miranda before 0.7.1 allow remote attackers to execute arbitrary code via unspecified vectors involving (1) IRC options (2) Jabber forms and unspecified aspects of the (3) ICQ and (4) Yahoo! instant messaging functionality. NOTE: some of these details are obtained from third party information.


Buffer overflow in OpenPegasus Management server when compiled to use PAM and with PEGASUS_USE_PAM_STANDALONE_PROC defined as used in VMWare ESX Server 3.0.1 and 3.0.2 might allow remote attackers to execute arbitrary code via vectors related to PAM authentication a different vulnerability than CVE-2008-0003.


Buffer overflow in CUPS in Apple Mac OS X 10.4.11 allows local admin users to execute arbitrary code via a crafted URI to the CUPS service.


Stack-based buffer overflow in the EDraw.OfficeViewer ActiveX control in officeviewer.ocx in EDraw Office Viewer Component 5.3.220.1 and earlier allows remote attackers to execute arbitrary code via long strings in the first and second arguments to the FtpDownloadFile method a different vector than CVE-2007-4821 and CVE-2007-3169.


Multiple buffer overflows in kpagrdr.dll 2.0.0.2 and 10.3.0.0 in the Applix Presents reader in Autonomy (formerly Verity) KeyView as used by IBM Lotus Notes Symantec Mail Security and activePDF DocConverter allow remote attackers to execute arbitrary code via a .ag file with (1) a long ENCODING attribute in a *BEGIN tag (2) a long token or (3) the initial *BEGIN tag.


Stack-based buffer overflow in AldFs32.dll in Adobe PageMaker 7.0.1 and 7.0.2 allows user-assisted remote attackers to execute arbitrary code via a malformed .PMD file related to \Key Strings \ a different vulnerability than CVE-2007-5169 and CVE-2007-5394.


Stack-based buffer overflow in Nullsoft Winamp 5.32 allows user-assisted remote attackers to execute arbitrary code via crafted unicode in a .mp4 file with crafted tags contained in a certain .rar archive a related issue to CVE-2007-2498. NOTE: for exploitation the victim must select a certain menu option at the time of the attack.


Stack-based buffer overflow in Microsoft Office Access allows remote user-assisted attackers to execute arbitrary code via a crafted Microsoft Access Database (.mdb) file. NOTE: due to the lack of details as of 20071210 it is not clear whether this issue is the same as CVE-2007-6026 or CVE-2005-0944.


Multiple buffer overflows in the RTSP_valid_response_msg function in RTSP_state_machine.c in LScube Feng 0.1.15 and earlier allow remote attackers to execute arbitrary code via (1) a long first line of a response as demonstrated by a long VER line; or (2) a long second line of a response as demonstrated by a message that follows a RETURN line.


Stack-based buffer overflow in JSGCI.DLL in JustSystems Ichitaro 2005 2006 and 2007 allows user-assisted remote attackers to execute arbitrary code via a crafted document as actively exploited in December 2007 by the Tarodrop.F trojan. NOTE: some of these details are obtained from third party information.


Buffer overflow in the XUpload.ocx ActiveX control in Persits Software XUpload 2.1.0.1 and probably other versions before 3.0 as used by HP Mercury LoadRunner and Groove Virtual Office allows remote attackers to execute arbitrary code via a long argument to the AddFolder function.


Multiple

stack-based

buffer

overflows

in

the

ActiveX

control

in

pvcalendar.ocx

in

the

scheduler

component

in

the

Media

Server

in

Symantec

Backup

Exec

for

Windows

Server

(BEWS)

and

and

allow

remote

attackers

to

execute

arbitrary

code

via

a

long

or

property

value

when

executing

the

Save

method.

NOTE:

the

vendor

states

\Authenticated

user

involvement

required

but

authentication

is

not

needed

to

attack

a

client

machine

that

loads

this

control.


Multiple stack-based buffer overflows in the awApi4.AnswerWorks.1 ActiveX control in awApi4.dll 4.0.0.42 as used by Vantage Linguistics AnswerWorks and Intuit Clearly Bookkeeping ProSeries QuickBooks Quicken QuickTax and TurboTax allow remote attackers to execute arbitrary code via long arguments to the (1) GetHistory (2) GetSeedQuery (3) SetSeedQuery and possibly other methods. NOTE: some of these details are obtained from third party information.


Stack-based buffer overflow in Apple QuickTime before 7.3.1 as used in QuickTime Player on Windows XP and Safari on Mac OS X allows remote Real Time Streaming Protocol (RTSP) servers to execute arbitrary code via an RTSP response with a long Content-Type header.


Multiple stack-based buffer overflows in the Spooler service (nwspool.dll) in Novell Client 4.91 SP4 for Windows allow remote attackers to execute arbitrary code via long arguments to multiple unspecified RPC functions aka Novell bug 287919 a different vulnerability than CVE-2007-2954.


Buffer overflow in a certain ActiveX control in Macrovision InstallShield Update Service Web Agent 5.1.100.47363 allows remote attackers to execute arbitrary code via a long string in the ProductCode argument (second argument) to the DownloadAndExecute method a different vulnerability than CVE-2007-0321 CVE-2007-2419 and CVE-2007-5660.


Extended Module Player (XMP) 2.5.1 and earlier allow remote attackers to execute arbitrary code via an OXM file with a negative value which bypasses a check in (1) test_oxm and (2) decrunch_oxm functions in misc/oxm.c leading to a buffer overflow.


Multiple stack-based buffer overflows in ProWizard 4 PC (prowiz) 1.62 and earlier allow remote attackers to execute arbitrary code via a crafted file to the (1) AMOS-MusicBank (2) FuzzacPacker and (3) QuadraComposer rippers; and (4) have an unknown impact via a crafted file to the SkytPacker ripper.


Multiple stack-based buffer overflows in l123sr.dll in Autonomy (formerly Verity) KeyView SDK as used by IBM Lotus Notes 5.x through 8.x allow user-assisted remote attackers to execute arbitrary code via the (1) Length and (2) Value fields for certain Types in a Lotus 1-2-3 (.123) file in the Worksheet File (WKS) format as demonstrated by a file with a crafted SRANGE record a different vulnerability than CVE-2007-5909.


Stack-based buffer overflow in Microsoft msjet40.dll 4.0.8618.0 (aka Microsoft Jet Engine) as used by Access 2003 in Microsoft Office 2003 SP3 allows user-assisted attackers to execute arbitrary code via a crafted MDB file database file containing a column structure with a modified column count. NOTE: this might be the same issue as CVE-2005-0944.


Stack-based buffer overflow in the Panel (xfce4-panel) component in Xfce before 4.4.2 might allow remote attackers to execute arbitrary code via Launcher tooltips. NOTE: a second buffer overflow (over-read) in the xfce_mkdirhier function was also reported but it might not be exploitable for a crash or code execution so it is not a vulnerability.


Multiple buffer overflows in LScube libnemesi 0.6.4-rc1 and earlier allow remote attackers to execute arbitrary code via (1) a reply that begins with a long version string which triggers an overflow in handle_rtsp_pkt in rtsp_handlers.c; long headers that trigger overflows in (2) send_pause_request (3) send_play_request (4) send_setup_request or (5) send_teardown_request in rtsp_send.c as demonstrated by the Content-Base header; or a long Transport header which triggers an overflow in (6) get_transport_str_sctp (7) get_transport_str_tcp or (8) get_transport_str_udp in rtsp_transport.c.


Buffer overflow in RavWare Software MAS Flic ActiveX Control (masflc.ocx) 1.0.0.1 allows remote attackers to execute arbitrary code via a long FileName property.


Multiple buffer overflows in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allow user-assisted remote attackers to execute arbitrary code via large (1) Metadata Block Size (2) VORBIS Comment String Size (3) Picture Metadata MIME-TYPE Size (4) Picture Description Size (5) Picture Data Length (6) Padding Length and (7) PICTURE Metadata width and height values in a .FLAC file which result in a heap-based overflow; and large (8) VORBIS Comment String Size Length (9) Picture MIME-Type (10) Picture MIME-Type URL and (11) Picture Description Length values in a .FLAC file which result in a stack-based overflow. NOTE: some of these issues may overlap CVE-2007-4619.


Buffer overflow in Lhaplus 1.55 and earlier allows remote attackers to execute arbitrary code via a crafted LZH archive a different vector than CVE-2007-5048.


Stack-based buffer overflow in the zfile_gunzip function in zfile.c in WinUAE 1.4.4 and earlier allows user-assisted remote attackers to execute arbitrary code via a long filename in a gzipped archive such as a (1) gz (2) adz (3) roz or (4) hdz archive in a compressed floppy disk image.


Multiple stack-based buffer overflows in foliosr.dll in the Folio Flat File speed reader in Autonomy (formerly Verity) KeyView 10.3.0.0 as used by IBM Lotus Notes Symantec Mail Security and activePDF DocConverter allow remote attackers to execute arbitrary code via a long attribute value in a (1) DI (2) FD (3) FT (4) JD (5) JL (6) LE (7) OB (8) OD (9) OL (10) PN (11) PS (12) PW (13) RD (14) QL or (15) TS tag in a .fff file.


Heap-based buffer overflow in the PPlayer.XPPlayer.1 ActiveX control in pplayer.dll_1_work in Xunlei Thunder 5.7.4.401 allows remote attackers to execute arbitrary code via a long string in a FlvPlayerUrl property value. NOTE: some of these details are obtained from third party information.


Stack-based buffer overflow in Novell GroupWise before 6.5.7 when HTML preview of e-mail is enabled allows user-assisted remote attackers to execute arbitrary code via a long SRC attribute in an IMG element when forwarding or replying to a crafted e-mail.


Buffer overflow in Zoom Player 6.00 beta 2 and earlier allows user-assisted remote attackers to execute arbitrary code via an HTTP link to a PLS file in a crafted ZPL file which causes an overflow in Unicode handling when generating an error message.


Stack-based buffer overflow in the send_mailslot function in nmbd in Samba 3.0.0 through 3.0.27a when the \domain logons\ option is enabled allows remote attackers to execute arbitrary code via a GETDC mailslot request composed of a long GETDC string following an offset username in a SAMLOGON logon request.


Heap-based buffer overflow in emlsr.dll before 2.0.0.4 in Autonomy (formerly Verity) KeyView Viewer Filter and Export SDK allows remote attackers to execute arbitrary code via a long Content-Type header line in an EML file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple buffer overflows in Adobe Form Designer 5.0 and Form Client 5.0 allow remote attackers to execute arbitrary code via unknown vectors in the (1) Adobe File Dialog Button (FileDlg.dll) and the (2) Adobe Copy to Server Object (SvrCopy.dll) ActiveX controls.


Multiple stack-based buffer overflows in PDFLib allow user-assisted remote attackers to execute arbitrary code via a long filename argument to the PDF_load_image function that results in an overflow in the pdc_fsearch_fopen function and possibly other vectors.


Heap-based buffer overflow in cygwin1.dll in Cygwin 1.5.7 and earlier allows context-dependent attackers to execute arbitrary code via a filename with a certain length as demonstrated by a remote authenticated user who uses the SCP protocol to send a file to the Cygwin machine and thereby causes scp.exe on this machine to execute and then overwrite heap memory with characters from the filename. NOTE: it is also reported that a related issue might exist in 1.5.7 through 1.5.19.


Multiple heap-based buffer overflows in avirus.exe in Novell NetMail 3.5.2 before Messaging Architects M+NetMail 3.52f (aka 3.5.2F) allows remote attackers to execute arbitrary code via unspecified ASCII integers used as memory allocation arguments aka \ZDI-CAN-162.\


Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 6.41 7.01 and 7.51 allow remote attackers to execute arbitrary code via unspecified long arguments to (1) ovlogin.exe (2) OpenView5.exe (3) snmpviewer.exe and (4) webappmon.exe as demonstrated via a long Action parameter to OpenView5.exe.


Multiple buffer overflows in the dtt_load function in loaders/dtt_load.c Extended Module Player (XMP) 2.5.1 and earlier allow remote attackers to execute arbitrary code via unspecified vectors related to an untrusted length value and the (1) pofs and (2) plen arrays.


A certain ActiveX control in (1) OScan8.ocx and (2) Oscan81.ocx in BitDefender Online Anti-Virus Scanner 8.0 allows remote attackers to execute arbitrary code via a long argument to the InitX method that begins with a \%%\ sequence which is misinterpreted as a Unicode string and decoded twice leading to improper memory allocation and a heap-based buffer overflow.


Buffer overflow in Mutt 1.4.2 might allow local users to execute arbitrary code via \&\ characters in the GECOS field which triggers the overflow during alias expansion.


Heap-based buffer overflow in Microsoft MSN Messenger 6.2 7.0 and 7.5 and Live Messenger 8.0 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors involving video conversation handling in Web Cam and video chat sessions.


Buffer overflow in a certain ActiveX control in DartZipLite.dll 1.8.5.3 in Dart ZipLite Compression for ActiveX allows user-assisted remote attackers to execute arbitrary code via a long first argument to the QuickZip function a related issue to CVE-2007-2856.


Heap-based buffer overflow in the Rendezvous / Extensible Messaging and Presence Protocol (XMPP) component (plugins\\rendezvous.dll) for Cerulean Studios Trillian Pro before 3.1.5.1 allows remote attackers to execute arbitrary code via a message that triggers the overflow from expansion that occurs during encoding.


Multiple buffer overflows in Trend Micro ServerProtect 5.58 before Security Patch 2- Build 1174 allow remote attackers to execute arbitrary code via a crafted RPC message processed by the (1) the RPCFN_ActiveRollback function in (a) stcommon.dll or the (2) ENG_SetRealTimeScanConfigInfo or (3) ENG_SendEmail functions in (b) eng50.dll.


Buffer overflow in Hitachi Groupmax Mobile Option for Mobile-Phone 07-00 through 07-30 5 for i-mode 05-11 through 05-23 and 6 for EZweb 06-00 through 06-04 allows remote attackers to execute arbitrary code via unspecified vectors.


Multiple stack-based buffer overflows in the Whale Client Components ActiveX control (WhlMgr.dll) as used in Microsoft Intelligent Application Gateway (IAG) before 3.7 SP2 allow remote attackers to execute arbitrary code via long arguments to the (1) CheckForUpdates or (2) UpdateComponents methods.


Buffer overflow in igcore15d.dll 15.1.2.0 and 15.2.0.0 for AccuSoft ImageGear as used in Corel Paint Shop Pro Photo 11.20 and possibly other products allows user-assisted remote attackers to execute arbitrary code via a crafted .CLP file. NOTE: some details were obtained from third party sources.


Multiple buffer overflows in Ipswitch IMail before 2006.21 allow remote attackers or authenticated users to execute arbitrary code via (1) the authentication feature in IMailsec.dll which triggers heap corruption in the IMail Server or (2) a long SUBSCRIBE IMAP command which triggers a stack-based buffer overflow in the IMAP Daemon.


Buffer overflow in the wpa_printf function in the debugging code in wpa_supplicant in the Fedora NetworkManager package before 0.6.5-3.fc7 allows user-assisted remote attackers to execute arbitrary code via malformed frames on a WPA2 network. NOTE: some of these details are obtained from third party information.


Stack-based buffer overflow in LexRuby.cxx (SciLexer.dll) in Scintilla 1.73 as used by notepad++ 4.1.1 and earlier allows user-assisted remote attackers to execute arbitrary code via certain Ruby (.rb) files with long lines. NOTE: this was originally reported as a vulnerability in notepad++.


Buffer overflow in the BaseRunner ActiveX control in the Ademco ATNBaseLoader100 Module (ATNBaseLoader100.dll) 5.4.0.6 when Internet Explorer 6 is used allows remote attackers to execute arbitrary code via a long argument to the (1) Send485CMD method and possibly the (2) SetLoginID (3) AddSite (4) SetScreen and (5) SetVideoServer methods.


Heap-based buffer overflow in kde.dll in IBM Tivoli Monitoring Express 6.1.0 before Fix Pack 2 as used in Tivoli Universal Agent Windows OS Monitoring agent and Enterprise Portal Server allows remote attackers to execute arbitrary code by sending a long string to a certain TCP port.


Multiple unspecified vulnerabilities in Free-SA before 1.2.2 allow remote attackers to execute arbitrary code via unspecified vectors involving certain (1) sprintf and (2) vsprintf calls in (a) r_index.c (b) r_reports.c (c) r_topsites.c (d) r_topuser.c (e) r_typical.c (f) r_userdatetime.c and (g) r_users.c in reports/; and (h) w_fs.c (i) w_internal.c and (j) w_log_operations.c in work/ probably related to buffer overflows. NOTE: some of these details are obtained from third party information.


Buffer overflow in Fresh View 7.15 allows user-assisted remote attackers to execute arbitrary code via a crafted .PSP file.


Buffer overflow in the IsOldAppInstalled function in the McSubMgr.McSubMgr Subscription Manager ActiveX control (MCSUBMGR.DLL) in McAfee SecurityCenter before 6.0.25 and 7.x before 7.2.147 allows remote attackers to execute arbitrary code via a crafted argument.


Multiple buffer overflows in the WinDVDX ActiveX control in InterVideo Home Theater 2.1.13.0 and 2.5.13.58 allow remote attackers to execute arbitrary code via a long string argument to the (1) GetDiscType or (2) AddFileList method. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d) (2) RFNPCNEX (smb_io_notify_option_type_data) (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set) (4) NetSetFileSecurity (sec_io_acl) or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).


Stack-based buffer overflow in the inoweb Console Server in CA Anti-Virus for the Enterprise r8 Threat Manager r8 Anti-Spyware for the Enterprise r8 and Protection Suites r3 allows remote attackers to execute arbitrary code via a long (1) username or (2) password.


Multiple stack-based buffer overflows in the process_sdp function in chan_sip.c of the SIP channel T.38 SDP parser in Asterisk before 1.4.3 allow remote attackers to execute arbitrary code via a long (1) T38FaxRateManagement or (2) T38FaxUdpEC SDP parameter in an SIP message as demonstrated using SIP INVITE.


Multiple buffer overflows in an ActiveX control (boisweb.dll) in Macrovision FLEXnet Connect 6.0 and Update Service 3.x to 5.x allow remote attackers to execute arbitrary code via the (1) the second parameter to the DownloadAndExecute method and (2) third parameter to the AddFileEx method a different vulnerability than CVE-2007-0328.


Heap-based buffer overflow in the visit_old_format function in locate/locate.c in locate in GNU findutils before 4.2.31 might allow context-dependent attackers to execute arbitrary code via a long pathname in a locate database that has the old format a different vulnerability than CVE-2001-1036.


Stack-based buffer overflow in the readRadianceHeader function in (1) src/fileformat/rgbeio.cpp in pfstools 1.6.2 and (2) src/Fileformat/rgbeio.cpp in Qtpfsgui 1.8.11 allows remote attackers to execute arbitrary code via a crafted Radiance RGBE (.hdr) file.


Stack-based buffer overflow in the SetPath function in the shComboBox ActiveX control (shcmb80.ocx) in Sky Software Shell MegaPack ActiveX 8.0 allows remote attackers to execute arbitrary code via a long argument. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Stack-based buffer overflow in UltraISO 8.6.2.2011 and earlier allows user-assisted remote attackers to execute arbitrary code via a long FILE string (filename) in a .cue file a related issue to CVE-2007-2761. NOTE: some details are obtained from third party information.


Multiple buffer overflows in WinImage 8.0.8000 allow user-assisted remote attackers to execute arbitrary code via a FAT image that contains long directory names in a deeply nested directory structure which triggers (1) a stack-based buffer overflow during extraction or (2) a heap-based buffer overflow during traversal.


Heap-based buffer overflow in _mprosrv.exe in Progress Software Progress 9.1E and OpenEdge 10.1x as used by the RSA Authentication Manager 6.0 and 6.1 SecurID Appliance 2.0 ACE/Server 5.2 and possibly other products allows remote attackers to execute arbitrary code via crafted packets. NOTE: this issue might overlap CVE-2007-3491.


Multiple stack-based buffer overflows in the KSign KSignSWAT ActiveX Control (AxKSignSWAT.dll) 2.0.3.3 allow remote attackers to execute arbitrary code via long arguments to the (1) SWAT_Init (2) SWAT_InitEx (3) SWAT_InitEx2 (4) SWAT_InitEx3 and (5) SWAT_Login functions.


Buffer overflow in the UnlockSupport function in the LockModules subsystem in a certain ActiveX control in ltmm15.dll in Sienzo Digital Music Mentor (DMM) 2.6.0.4 allows remote attackers to execute arbitrary code via a long string in the second argument a different issue than CVE-2007-2564.


Stack-based buffer overflow in the ID_X.apl plugin in ACDSee 9.0 Build 108 Pro 8.1 Build 99 and Photo Editor 4.0 Build 195 allows user-assisted remote attackers to execute arbitrary code via a crafted XPM file with a long section string. NOTE: some of these details are obtained from third party information.


Buffer overflow in the transfer manager in Opera before 9.21 for Windows allows user-assisted remote attackers to execute arbitrary code via a crafted torrent file. NOTE: due to the lack of details it is not clear if this is the same issue as CVE-2007-2274.


Stack-based buffer overflow in InterVations MailCOPA 8.01 20070323 allows user-assisted remote attackers to execute arbitrary code via a long command line argument as demonstrated by a long string in the subject field in a mailto URI. NOTE: some of these details are obtained from third party information.


Buffer overflow in the Dart Communications PowerTCP ZIP Compression ActiveX control in DartZip.dll 1.8.5.3 when Internet Explorer 6 is used allows user-assisted remote attackers to execute arbitrary code via a long first argument to the QuickZip function a related issue to CVE-2007-2855.


Multiple buffer overflows in the ESA protocol implementation in eIQnetworks Enterprise Security Analyzer (ESA) 2.5 allow remote attackers to execute arbitrary code via a long parameter to the (1) DELETESEARCHFOLDER (2) DELTASK (3) HMGR_CHECKHOSTSCSV (4) TASKUPDATEDUSER (5) VERIFYUSERKEY or (6) VERIFYPWD command.


Buffer overflow in Corel Paint Shop Pro 11.20 allows user-assisted remote attackers to execute arbitrary code via a crafted .PNG file.


Buffer overflow in AgRpcCln.dll for Trend Micro ServerProtect 5.58 for Windows before Security Patch 3 Build 1176 allows remote attackers to execute arbitrary code via unknown vectors related to RPC requests. NOTE: this is probably a different vulnerability than CVE-2007-2508.


Multiple stack-based buffer overflows in the Spooler service (nwspool.dll) in Novell Client 4.91 SP2 through SP4 for Windows allow remote attackers to execute arbitrary code via certain long arguments to the (1) RpcAddPrinterDriver (2) RpcGetPrinterDriverDirectory and other unspecified RPC requests aka Novell bug 300870 a different vulnerability than CVE-2006-5854.


Heap-based buffer overflow in RealNetworks RealPlayer 8 10 10.1 and possibly 10.5; RealOne Player 1 and 2; and RealPlayer Enterprise allows remote attackers to execute arbitrary code via a RAM (.ra or .ram) file with a large size value in the RA header.


Heap-based buffer overflow in the VGA device in Parallels allows local users with root access to the guest operating system to terminate the virtual machine and possibly execute arbitrary code in the host operating system via unspecified vectors related to bitblt operations.


Multiple stack-based buffer overflows in the SUN RPC service in CA (formerly Computer Associates) BrightStor ARCserve Media Server as used in BrightStor ARCserve Backup 9.01 through 11.5 SP2 BrightStor Enterprise Backup 10.5 Server Protection Suite 2 and Business Protection Suite 2 allow remote attackers to execute arbitrary code via malformed RPC strings a different vulnerability than CVE-2006-5171 CVE-2006-5172 and CVE-2007-1785.


Multiple heap-based buffer overflows in the IRC component in Cerulean Studios Trillian Pro before 3.1.5.1 allow remote attackers to corrupt memory and possibly execute arbitrary code via (1) a URL with a long UTF-8 string which triggers the overflow when the user highlights it or (2) a font HTML tag with a face attribute containing a long UTF-8 string.


Buffer overflow in webdesproxy 0.0.1 allows remote attackers to execute arbitrary code via a long URL possibly involving the process_connection_request function in webdesproxy.c.


Buffer overflow in IrfanView 4.00 and earlier allows user-assisted remote attackers to execute arbitrary code via a crafted .IFF file.


Multiple stack-based buffer overflows in the Pegasus ImagN' ActiveX control (IMW32O40.OCX) 4.00.041 allow remote attackers to execute arbitrary code via (1) a long FileName parameter or unspecified vectors involving the (2) BeginReport (3) CreatePictureExA (4) DefineImage (5) DefineImageEx (6) DefineImageFox (7) CopyBufToClipExA (8) LoadEx (9) LoadFox and other functions.


Stack-based buffer overflow in OmniInet.exe (aka the backup client service daemon) in the Application Recovery Manager component in HP OpenView Storage Data Protector 5.50 and 6.0 allows remote attackers to execute arbitrary code via an MSG_PROTOCOL command with long arguments a different vulnerability than CVE-2009-3844.


Stack-based buffer overflow in XferWan.exe as used in multiple products including (1) Symantec Discovery 6.5 (2) Numara Asset Manager 8.0 and (3) Centennial UK Ltd Discovery 2006 Feature Pack allows remote attackers to execute arbitrary code via a long request. NOTE: this might be a reservation duplicate of CVE-2007-1173.


The ADONewConnection Connect function in adodb.php in XAMPP 1.6.0a and earlier for Windows uses untrusted input for the database server hostname which allows remote attackers to trigger a library buffer overflow and execute arbitrary code via a long host parameter or have other unspecified impact. NOTE: it could be argued that this is an issue in mssql_connect (CVE-2007-1411.1) in PHP or an issue in the ADOdb Library and the proper fix should be in one of these products; if so then this should not be treated as a vulnerability in XAMPP.


Buffer overflow in Photofiltre Studio 8.1.1 allows user-assisted remote attackers to execute arbitrary code via a crafted .tif file.


Multiple stack-based buffer overflows in Trend Micro ServerProtect 5.58 before Security Patch 2 Build 1174 allow remote attackers to execute arbitrary code via crafted data to (1) TCP port 5168 which triggers an overflow in the CAgRpcClient::CreateBinding function in the AgRpcCln.dll library in SpntSvc.exe; or (2) TCP port 3628 which triggers an overflow in EarthAgent.exe. NOTE: both issues are reachable via TmRpcSrv.dll.


Buffer overflow in ABC-View Manager 1.42 allows user-assisted remote attackers to execute arbitrary code via a crafted .PSP file.


Stack-based buffer overflow in peviewer.spl in Altap Servant Salamander 2.5 with Portable Executable Viewer 2.02 (English Trial) and 2.0 with Portable Executable Viewer 1.00 (English Trial) allows remote attackers to execute arbitrary code via a long PDB debug filename in a PE file.


Buffer overflow in Qualcomm Eudora 7.1.0.9 allows user-assisted remote IMAP servers to execute arbitrary code via a long FLAGS response to a SELECT INBOX command.


Buffer overflow in Panda Antivirus before 20070720 allows remote attackers to execute arbitrary code via a crafted EXE file resulting from an \Integer Cast Around.\


Multiple heap-based buffer overflows in the Perl Compatible Regular Expressions (PCRE) library in the JavaScript engine in WebKit in Apple Safari 3 Beta before Update 3.0.3 and iPhone before 1.0.1 allow remote attackers to execute arbitrary code via certain JavaScript regular expressions. NOTE: this issue was originally reported only for MobileSafari on the iPhone. NOTE: it is not clear whether this stems from an issue in the original distribution of PCRE which might already have a separate CVE identifier.


Multiple

buffer

overflows

in

the

LGServer

component

of

CA

(Computer

Associates)

BrightStor

ARCserve

Backup

for

Laptops

and

Desktops

allow

remote

attackers

to

execute

arbitrary

code

via

crafted

arguments

to

the

rxsAddNewUser

rxsSetUserInfo

rxsRenameUser

rxsSetMessageLogSettings

rxsExportData

rxsSetServerOptions

rxsRenameFile

rxsACIManageSend

rxsExportUser

rxsImportUser

rxsMoveUserData

rxsUseLicenseIni

rxsLicGetSiteId

rxsGetLogFileNames

rxsGetBackupLog

rxsBackupComplete

rxsSetDataProtectionSecurityData

rxsSetDefaultConfigName

rxsGetMessageLogSettings

rxsHWDiskGetTotal

rxsHWDiskGetFree

rxsGetSubDirs

rxsGetServerDBPathName

rxsSetServerOptions

rxsDeleteFile

rxsACIManageSend

rxcReadBackupSetList

rxcWriteConfigInfo

rxcSetAssetManagement

rxcWriteFileListForRestore

rxcReadSaveSetProfile

rxcInitSaveSetProfile

rxcAddSaveSetNextAppList

rxcAddSaveSetNextFilesPathList

rxcAddNextBackupSetIncWildCard

rxcGetRevisions

rxrAddMovedUser

rxrSetClientVersion

or

rxsSetDataGrowthScheduleAndFilter

commands.


Microsoft Windows Media Player 7.1 9 10 and 11 allows remote attackers to execute arbitrary code via a skin file (WMZ or WMD) with crafted header information that causes a size mismatch between compressed and decompressed data and triggers a heap-based buffer overflow aka \Windows Media Player Code Execution Vulnerability Parsing Skins.\


Buffer overflow in Acoustica MP3 CD Burner 4.32 allows user-assisted remote attackers to execute arbitrary code via a .asx playlist file with a REF element containing a long string in the HREF attribute. NOTE: it was later claimed that 4.51 Build 147 is also affected.


Buffer overflow in a certain ActiveX control in the NixonMyPrograms class in sasatl.dll 1.5.0.531 in Zenturi ProgramChecker allows remote attackers to execute arbitrary code via a long argument to the Scan method. NOTE: this is probably a different issue than CVE-2007-2987.


Heap-based

buffer

overflow

in

the

viewer

ActiveX

control

in

Sony

Network

Camera

before

and

before

and

before

and

before

and

before

and

before

and

and

and

before

allows

remote

attackers

to

execute

arbitrary

code

via

a

long

first

argument

to

the

PrmSetNetworkParam

method.


Buffer overflow in the Yahoo! Webcam Upload ActiveX control in ywcupl.dll 2.0.1.4 for Yahoo! Messenger 8.1.0.249 allows remote attackers to execute arbitrary code via a long server property value to the send method. NOTE: some of these details are obtained from third party information.


Stack-based buffer overflow in CGIOCommon.dll before 8.0.0.1042 in Trend Micro OfficeScan Corporate Edition 8.0 allows remote attackers to execute arbitrary code via long crafted requests as demonstrated using a long session cookie to unspecified CGI programs that use this library.


Multiple format string vulnerabilities in the kavwebscan.CKAVWebScan ActiveX control (kavwebscan.dll) in Kaspersky Online Scanner before 5.0.98 allow remote attackers to execute arbitrary code via format string specifiers in \various string formatting functions \ which trigger heap-based buffer overflows.


Stack-based buffer overflow in agentdpv.dll 2.0.0.3425 in Microsoft Agent on Windows 2000 SP4 allows remote attackers to execute arbitrary code via a crafted URL to the Agent (Agent.Control) ActiveX control which triggers an overflow within the Agent Service (agentsrv.exe) process a different issue than CVE-2007-1205.


Heap-based buffer overflow in Cerulean Studios Trillian 3.x before 3.1.6.0 allows remote attackers to execute arbitrary code via a message sent through the MSN protocol or possibly other protocols with a crafted UTF-8 string which triggers improper memory allocation for word wrapping when a window width is used as a buffer size a different vulnerability than CVE-2007-2478.


Multiple heap-based buffer overflows in the (1) Communications Server (iigcc.exe) and (2) Data Access Server (iigcd.exe) components for Ingres Database Server 3.0.3 as used in CA (Computer Associates) products including eTrust Secure Content Manager r8 on Windows allow remote attackers to execute arbitrary code via unknown vectors.


Stack-based buffer overflow in smtpdll.dll in the SMTP service in 602Pro LAN SUITE 2003 2003.0.03.0828 allows remote attackers to execute arbitrary code via an e-mail message with a long address. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Buffer overflow in the IEToolbar.IEContextMenu.1 ActiveX control in LinkedInIEToolbar.dll in the LinkedIn Toolbar 3.0.2.1098 allows remote attackers to execute arbitrary code via a long second argument (varBrowser argument) to the search method. NOTE: some of these details are obtained from third party information.


Multiple stack-based buffer overflows in (a) InterActual Player 2.60.12.0717 and (b) Roxio CinePlayer 3.2 allow remote attackers to execute arbitrary code via a (1) long FailURL attribute in the IAMCE ActiveX Control (IAMCE.dll) or a (2) long URLCode attribute in the IAKey ActiveX Control (IAKey.dll). NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple buffer overflows in libtidy as used in the Tidy extension for PHP 5.2.3 and possibly other products allow context-dependent attackers to execute arbitrary code via (1) a long second argument to the tidy_parse_string function or (2) an unspecified vector to the tidy_repair_string function. NOTE: this might only be an issue in environments where vsnprintf is implemented as a wrapper for vsprintf.


Multiple stack-based buffer overflows in the RPC implementation in alert.exe before 8.0.255.0 in CA (formerly Computer Associates) Alert Notification Server as used in Threat Manager for the Enterprise Protection Suites certain BrightStor ARCserve products and BrightStor Enterprise Backup allow remote attackers to execute arbitrary code by sending certain data to unspecified RPC procedures.


Stack-based buffer overflow in the MSWord text-import extension (Word 6-2000 Filter.xnt) in QuarkXPress 7.2 for Windows when using the Rectangle Text Box tool for importing text allows user-assisted remote attackers to execute arbitrary code via a long font name.


Buffer overflow in LICRCMD.EXE in CA ERwin Process Modeler (formerly AllFusion Process Modeler) 7.1 allows attackers to execute arbitrary code via a long filename. NOTE: the researcher does not suggest any circumstances in which the filename would come from an untrusted source and therefore perhaps the issue does not cross privilege boundaries and should not be included in CVE.


Stack-based buffer overflow in the IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8 Business Edition before B.2.2.1 AsteriskNOW before beta7 Appliance Developer Kit before 0.5.0 and s800i before 1.0.2 allows remote attackers to execute arbitrary code by sending a long (1) voice or (2) video RTP frame.


Multiple stack-based buffer overflows in Ingres database server 2006 9.0.4 r3 2.6 and 2.5 as used in multiple CA (Computer Associates) products allow remote attackers to execute arbitrary code via the (1) uuid_from_char or (2) duve_get_args functions.


Multiple buffer overflows in Ipswitch IMail Server 2006 before 2006.21 (1) allow remote attackers to execute arbitrary code via unspecified vectors in Imailsec and (2) allow attackers to have an unknown impact via an unspecified vector related to \subscribe.\


Multiple stack-based buffer overflows in fsplib.c in fsplib before 0.9 might allow remote attackers to execute arbitrary code via (1) a long filename that is not properly handled by the fsp_readdir_native function when MAXNAMLEN is greater than 255 or (2) a long d_name directory (dirent) field in the fsp_readdir function.


Multiple stack-based buffer overflows in waHTTP.exe (aka the SAP DB Web Server) in SAP DB possibly 7.3 through 7.5 allow remote attackers to execute arbitrary code via (1) a certain cookie value; (2) a certain additional parameter related to sapdbwa_GetQueryString; and other unspecified vectors related to \numerous other fields.\


Stack-based buffer overflow in the SmilTimeValue::parseWallClockValue function in smlprstime.cpp in RealNetworks RealPlayer 10 10.1 and possibly 10.5 RealOne Player RealPlayer Enterprise and Helix Player 10.5-GOLD and 10.0.5 through 10.0.8 allows remote attackers to execute arbitrary code via an SMIL (SMIL2) file with a long wallclock value.


Buffer overflow in RemoteCommand.DLL in Symantec Norton Ghost 12.0 allows remote attackers to execute arbitrary code via the Connect function.


Buffer overflow in Ace-FTP Client 1.24a allows user-assisted remote FTP servers to execute arbitrary code via a long response.


Multiple heap-based buffer overflows in (1) clsscheduler.exe (aka scheduler client) and (2) srvscheduler.exe (aka scheduler server) in BakBone NetVault Reporter 3.5 before Update4 allow remote attackers to execute arbitrary code via long filename arguments in HTTP requests.


Stack-based buffer overflow in nptoken.mox in the Cellosoft Tokens Object 2.0.0.6 extension for Vitalize! allows remote attackers to execute arbitrary code via a long string argument to the RemoveChr method. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Stack-based buffer overflow in a certain ActiveX control in sasatl.dll 1.5.0.531 in Zenturi Program Checker (ProgramChecker) Pro allows remote attackers to execute arbitrary code via a long argument to the Fill method. NOTE: this is probably a different issue than CVE-2007-2987.


Stack-based buffer overflow in the Microsoft Message Queuing (MSMQ) service in Microsoft Windows 2000 Server SP4 Windows 2000 Professional SP4 and Windows XP SP2 allows attackers to execute arbitrary code via a long string in an opnum 0x06 RPC call to port 2103. NOTE: this is remotely exploitable on Windows 2000 Server.


Heap-based buffer overflow in the UPnP IGD (Internet Gateway Device Standardized Device Control Protocol) implementation in mDNSResponder on Apple Mac OS X 10.4.10 before 20070731 allows network-adjacent remote attackers to execute arbitrary code via a crafted packet.


Buffer overflow in Yahoo! Messenger 8.1 allows user-assisted remote authenticated users who are listed in an address book to execute arbitrary code via unspecified vectors aka ZD-00000005. NOTE: this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release actionable advisories. A CVE has been assigned for tracking purposes but duplicates with other CVEs are difficult to determine.


Buffer overflow in the AOL Instant Messenger (AIM) protocol handler in AIM.DLL in Cerulean Studios Trillian allows remote attackers to execute arbitrary code via a malformed aim: URI as demonstrated by a long URI beginning with the aim:///#1111111/ substring.


Buffer overflow in fbserver.exe in Firebird SQL 2 before 2.0.1 allows remote attackers to execute arbitrary code via a large p_cnct_count value in a p_cnct structure in a connect (0x01) request to port 3050/tcp related to \an InterBase version of gds32.dll.\


Multiple buffer overflows in Konst CenterICQ 4.9.11 through 4.21 allow remote attackers to execute arbitrary code via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this might overlap CVE-2007-0160.


Buffer overflow in eject.c in Jason W. Bacon mcweject 0.9 on FreeBSD and possibly other versions allows local users to execute arbitrary code via a long command line argument possibly involving the device name.


Stack-based buffer overflow in News File Grabber 4.1.0.1 and earlier allows remote attackers to execute arbitrary code via a .nzb file with a long subject field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Buffer overflow in the SYSTEM_CREATE_INSTANCE function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended.


Buffer overflow in FrontBase Relational Database Server 4.2.7 and earlier allows remote authenticated users with privileges for creating a stored procedure to execute arbitrary code via a CREATE PROCEDURE request with a long procedure name.


The DirectShow loader (loader/dshow/DS_VideoDecoder.c) in MPlayer 1.0rc1 and earlier as used in xine-lib does not set the biSize before use in a memcpy which allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code a different vulnerability than CVE-2007-1246.


Multiple stack-based buffer overflows in the SiteManager.SiteMgr.1 ActiveX control (SiteManager.dll) in the ePO management console in McAfee ePolicy Orchestrator (ePO) before 3.6.1 Patch 1 and ProtectionPilot (PRP) before 1.5.0 HotFix allow remote attackers to execute arbitrary code via a long argument to the (1) ExportSiteList and (2) VerifyPackageCatalog functions and (3) unspecified vectors involving a swprintf function call.


Stack-based buffer overflow in the SPIDERLib.Loader ActiveX control (Spider90.ocx) 9.1.0.4353 in TestDirector (TD) for Mercury Quality Center 9.0 before Patch 12.1 and 8.2 SP1 before Patch 32 allows remote attackers to execute arbitrary code via a long ProgColor property.


Stack-based buffer overflow in the createAndJoinConference function in the AudioConf ActiveX control (yacscom.dll) in Yahoo! Messenger before 20070313 allows remote attackers to execute arbitrary code via long (1) socksHostname and (2) hostname properties.


Multiple stack-based buffer overflows in Trend Micro ServerProtect for Windows and EMC 5.58 and for Network Appliance Filer 5.61 and 5.62 allow remote attackers to execute arbitrary code via crafted RPC requests to TmRpcSrv.dll that trigger overflows when calling the (1) CMON_NetTestConnection (2) CMON_ActiveUpdate and (3) CMON_ActiveRollback functions in (a) StCommon.dll and (4) ENG_SetRealTimeScanConfigInfo and (5) ENG_SendEMail functions in (b) eng50.dll.


Buffer overflow in IrfanView 3.99 allows remote attackers to execute arbitrary code via a crafted animated cursor (ANI) file.


Multiple stack-based buffer overflows in the SignKorea SKCrypAX ActiveX control module 5.4.1.2 allow remote attackers to execute arbitrary code via a long string in unspecified arguments to the (1) DownloadCert (2) DecryptFileByKey and (3) EncryptFileByKey functions a different module and vectors than CVE-2007-1722. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Stack-based buffer overflow in the IMAP service in MailEnable Enterprise and Professional Editions 2.37 and earlier allows remote authenticated users to execute arbitrary code via a long argument to the APPEND command. NOTE: this is probably different than CVE-2006-6423.


Buffer overflow in FutureSoft TFTP Server 2000 on Microsoft Windows 2000 SP4 allows remote attackers to execute arbitrary code via a long request on UDP port 69. NOTE: this issue might overlap CVE-2006-4781 or CVE-2005-1812.


Multiple buffer overflows in the CentennialIPTransferServer service (XFERWAN.EXE) as used by (1) Centennial Discovery 2006 Feature Pack 1 (2) Numara Asset Manager 8.0 and (3) Symantec Discovery 6.5 allow remote attackers to execute arbitrary code via long strings in a crafted TCP packet.


Multiple buffer overflows in the IMAILAPILib ActiveX control (IMailAPI.dll) in Ipswitch IMail Server before 2006.2 allow remote attackers to execute arbitrary code via the (1) WebConnect and (2) Connect members in the (a) IMailServer control; (3) Sync3 and (4) Init3 members in the (b) IMailLDAPService control; and the (5) SetReplyTo member in the (c) IMailUserCollection control.


Multiple heap-based buffer overflows in the cirrus_invalidate_region function in the Cirrus VGA extension in QEMU 0.8.2 as used in Xen and possibly other products might allow local users to execute arbitrary code via unspecified vectors related to \attempting to mark non-existent regions as dirty \ aka the \bitblt\ heap overflow.


** DISPUTED ** Buffer overflow in the set_umask function in QFTP in LIBFtp 3.1-1 allows local users to execute arbitrary code via a long -m argument. NOTE: CVE disputes this issue because QFTP is not setuid and it is unlikely that there are web interfaces to QFTP that would accept untrusted command line arguments.


Buffer overflow in the RFC_START_GUI function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended.


Multiple stack-based buffer overflows in High Performance Anonymous FTP Server (hpaftpd) 1.01 allow remote attackers to execute arbitrary code via long arguments to the (1) USER (2) PASS (3) CWD (4) MKD (5) RMD (6) DELE (7) RNFR or (8) RNTO FTP command.


Buffer overflow in the imap_mail_compose function in PHP 5 before 5.2.1 and PHP 4 before 4.4.5 allows remote attackers to execute arbitrary code via a long boundary string in a type.parameters field. NOTE: as of 20070411 it appears that this issue might be subsumed by CVE-2007-0906.3.


Buffer overflow in the sqlite_decode_binary function in the bundled sqlite library in PHP 4 before 4.4.5 and PHP 5 before 5.2.1 allows context-dependent attackers to execute arbitrary code via an empty value of the in parameter as demonstrated by calling the sqlite_udf_decode_binary function with a 0x01 character.


Stack-based buffer overflow in the GetPrivateProfileSectionW function in Akamai Technologies Download Manager ActiveX Control (DownloadManagerV2.ocx) after 2.0.4.4 but before 2.2.1.0 allows remote attackers to execute arbitrary code related to misinterpretation of the nSize parameter as a byte count instead of a wide character count.


Multiple buffer overflows in Rhapsody IRC 0.28b allow remote attackers to execute arbitrary code via a (1) long command (2) long server argument to the (a) connect or (b) server commands (3) long nick argument to the (c) nick command or a long (4) nick or (5) message argument to the (d) ctcp (e) chat (f) notice (g) message (msg) or (h) query commands.


Integer signedness error in the (1) cab_unstore and (2) cab_extract functions in libclamav/cab.c in Clam AntiVirus (ClamAV) before 0.90.2 allow remote attackers to execute arbitrary code via a crafted CHM file that contains a negative integer which passes a signed comparison and leads to a stack-based buffer overflow.


The DMO_VideoDecoder_Open function in loader/dmo/DMO_VideoDecoder.c in MPlayer 1.0rc1 and earlier as used in xine-lib does not set the biSize before use in a memcpy which allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code a different vulnerability than CVE-2007-1387.


Integer underflow in the CDownloadSink class code in the Vector Markup Language (VML) component (VGX.DLL) as used in Internet Explorer 5.01 6 and 7 allows remote attackers to execute arbitrary code via compressed content with an invalid buffer size which triggers a heap-based buffer overflow.


Multiple buffer overflows in Conquest 8.2a and earlier (1) allow local users to gain privileges by querying a metaserver that sends a long server entry processed by metaGetServerList and allow remote metaservers to execute arbitrary code via a long server entry processed by metaGetServerList; (2) allow attackers to have an unknown impact by exceeding the configured number of metaservers; and allow remote attackers to corrupt memory via a SP_CLIENTSTAT packet with certain values of (3) unum or (4) snum different vulnerabilities than CVE-2003-0933.


Buffer overflow in InterVations NaviCOPA HTTP Server 2.01 allows remote attackers to execute arbitrary code via a long (1) /cgi-bin/ or (2) /cgi/ pathname in an HTTP GET request probably a different issue than CVE-2006-5112.


Multiple stack-based buffer overflows in SonicDVDDashVRNav.dll in Roxio CinePlayer 3.2 allow remote attackers to execute arbitrary code via (1) unspecified long property values to SonicMediaPlayer.dll or (2) long arguments to unspecified methods in SonicMediaPlayer.dll.


Multiple buffer overflows in src/ezstream.c in Ezstream before 0.3.0 allow remote attackers to execute arbitrary code via a crafted XML configuration file processed by the (1) urlParse function which causes a stack-based overflow and the (2) ReplaceString function which causes a heap-based overflow. NOTE: some of these details are obtained from third party information.


Stack-based buffer overflow in InterVations FileCOPA FTP Server 1.01 allows remote attackers to execute arbitrary code via unspecified vectors as demonstrated by filecopa.tar by Immunity. NOTE: some of these details are obtained from third party information. NOTE: As of 20070322 this disclosure has no actionable information. However since it is from a reliable researcher it is being assigned a CVE identifier for tracking purposes.


The wddx_deserialize function in wddx.c 1.119.2.10.2.12 and 1.119.2.10.2.13 in PHP 5 as modified in CVS on 20070224 and fixed on 20070304 calls strlcpy where strlcat was intended and uses improper arguments which allows context-dependent attackers to execute arbitrary code via a WDDX packet with a malformed overlap of a STRING element which triggers a buffer overflow.


Buffer overflow in the RFC_START_PROGRAM function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended.


Stack-based buffer overflow in the zip:// URL wrapper in PECL ZIP 1.8.3 and earlier as bundled with PHP 5.2.0 and 5.2.1 allows remote attackers to execute arbitrary code via a long zip:// URL as demonstrated by actively triggering URL access from a remote PHP interpreter via avatar upload or blog pingback.


Stack-based buffer overflow in the RPC interface in the Domain Name System (DNS) Server Service in Microsoft Windows 2000 Server SP 4 Server 2003 SP 1 and Server 2003 SP 2 allows remote attackers to execute arbitrary code via a long zone name containing character constants represented by escape sequences.


Buffer overflow in PHP 4.4.6 and earlier and unspecified PHP 5 versions allows local and possibly remote attackers to execute arbitrary code via long server name arguments to the (1) mssql_connect and (2) mssql_pconnect functions.


IBM DB2 8.x before 8.1 FixPak 15 and 9.1 before Fix Pack 2 does not properly terminate certain input strings which allows local users to execute arbitrary code via unspecified environment variables that trigger a heap-based buffer overflow.


Buffer overflow in the sqlite_decode_binary function in src/encode.c in SQLite 2 as used by PHP 4.x through 5.x and other applications allows context-dependent attackers to execute arbitrary code via an empty value of the in parameter. NOTE: some PHP installations use a bundled version of sqlite without this vulnerability. The SQLite developer has argued that this issue could be due to a misuse of the sqlite_decode_binary() API.


Multiple buffer overflows in the ISO network protocol support in the NetBSD kernel 2.0 through 4.0_BETA2 and NetBSD-current before 20070329 allow local users to execute arbitrary code via long parameters to certain functions as demonstrated by a long sockaddr structure argument to the clnp_route function.


Multiple stack-based buffer overflows in the FileManager ActiveX control in SAFmgPws.dll in SoftArtisans XFile before 2.4.0 allow remote attackers to execute arbitrary code via unspecified calls to the (1) BuildPath (2) GetDriveName (3) DriveExists or (4) DeleteFile method.


Buffer overflow in the Configuration Checker (ConfigChk) ActiveX control in VSCnfChk.dll 2.0.0.2 for Verisign Managed PKI Service Secure Messaging for Microsoft Exchange and Go Secure! allows remote attackers to execute arbitrary code via long arguments to the VerCompare method.


Stack-based buffer overflow in the NCTAudioFile2.AudioFile ActiveX control (NCTAudioFile2.dll) as used by multiple products allows remote attackers to execute arbitrary code via a long argument to the SetFormatLikeSample function. NOTE: the products include (1) NCTsoft NCTAudioStudio NCTAudioEditor and NCTDialogicVoice; (2) Magic Audio Recorder Music Editor and Audio Converter; (3) Aurora Media Workshop; DB Audio Mixer And Editor; (4) J. Hepple Products including Fx Audio Editor and others; (5) EXPStudio Audio Editor; (6) iMesh; (7) Quikscribe; (8) RMBSoft AudioConvert and SoundEdit Pro 2.1; (9) CDBurnerXP; (10) Code-it Software Wave MP3 Editor and aBasic Editor; (11) Movavi VideoMessage DVD to iPod and others; (12) SoftDiv Software Dexster iVideoMAX and others; (13) Sienzo Digital Music Mentor (DMM); (14) MP3 Normalizer; (15) Roemer Software FREE and Easy Hi-Q Recorder and Easy Hi-Q Converter; (16) Audio Edit Magic; (17) Joshua Video and Audio Converter; (18) Virtual CD; (19) Cheetah CD and DVD Burner; (20) Mystik Media AudioEdit Deluxe Blaze Media and others; (21) Power Audio Editor; (22) DanDans Digital Media Full Audio Converter Music Editing Master and others; (23) Xrlly Software Text to Speech Makerand Arial Sound Recorder / Audio Converter; (24) Absolute Sound Recorder Video to Audio Converter and MP3 Splitter; (25) Easy Ringtone Maker; (26) RecordNRip; (27) McFunSoft iPod Audio Studio Audio Recorder for Free and others; (28) MP3 WAV Converter; (29) BearShare 6.0.2.26789; and (30) Oracle Siebel SimBuilder and CRM 7.x.


Heap-based buffer overflow in Microsoft Excel 2000 SP3 2002 SP3 2003 SP2 2004 for Mac and v.X for Mac allows user-assisted remote attackers to execute arbitrary code via a BIFF8 spreadsheet with a PALETTE record that contains a large number of entries.


Stack-based buffer overflow in GOM Player 2.0.12.3375 allows user-assisted remote attackers to execute arbitrary code via a .ASX file with a long URI in the \ref href\ tag. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


Stack-based buffer overflow in magentproc.exe for Hewlett-Packard Mercury LoadRunner Agent 8.0 and 8.1 Performance Center Agent 8.0 and 8.1 and Monitor over Firewall 8.1 allows remote attackers to execute arbitrary code via a packet with a long server_ip_name field to TCP port 54345 which triggers the overflow in mchan.dll.


Multiple stack-based buffer overflows in the (1) LoadTree and (2) ReadHeader functions in PAISO.DLL 1.7.3.0 (1.7.3 beta) in ConeXware PowerArchiver 2006 9.64.02 allow user-assisted attackers to execute arbitrary code via a crafted ISO file containing a file within several nested directories.


The Just In Time (JIT) Compiler service in Microsoft .NET Framework 1.0 1.1 and 2.0 for Windows 2000 XP Server 2003 and Vista allows user-assisted remote attackers to execute arbitrary code via unspecified vectors involving an \unchecked buffer \ probably a buffer overflow aka \.NET JIT Compiler Vulnerability\.


Multiple stack-based multiple buffer overflows in the BRWOSSRE2UC.dll ActiveX Control in Sina UC2006 and earlier allow remote attackers to execute arbitrary code via a long string in the (1) astrVerion parameter to the SendChatRoomOpt function or (2) the astrDownDir parameter to the SendDownLoadFile function.


Buffer overflow in the Apple Minimal SLP v2 Service Agent (slpd) in Mac OS X 10.4.11 and earlier including 10.4.8 allows local users and possibly remote attackers to gain privileges and possibly execute arbitrary code via a registration request with an invalid attr-list field.


Buffer overflow in SmidgeonSoft PEBrowse Professional 8.2.1.0 allows user-assisted remote attackers to execute arbitrary code via certain executable files in PE format. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Stack-based buffer overflow in the map_uri_to_worker function (native/common/jk_uri_worker_map.c) in mod_jk.so for Apache Tomcat JK Web Server Connector 1.2.19 and 1.2.20 as used in Tomcat 4.1.34 and 5.5.20 allows remote attackers to execute arbitrary code via a long URL that triggers the overflow in a URI worker map routine.


Stack-based buffer overflow in the SSLv2 support in Mozilla Network Security Services (NSS) before 3.11.5 as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2 Thunderbird before 1.5.0.10 SeaMonkey before 1.0.8 and certain Sun Java System server products before 20070611 allows remote attackers to execute arbitrary code via invalid \Client Master Key\ length values.


Stack-based buffer overflow in the IASystemInfo.dll ActiveX control in (1) InterActual Player 2.60.12.0717 (2) Roxio CinePlayer 3.2 (3) WinDVD 7.0.27.172 and possibly other products allows remote attackers to execute arbitrary code via a long ApplicationType property.


Multiple buffer overflows in Computer Associates (CA) BrightStor ARCserve Backup 9.01 through 11.5 Enterprise Backup 10.5 and CA Server/Business Protection Suite r2 allow remote attackers to execute arbitrary code via RPC requests with crafted data for opnums (1) 0x2F and (2) 0x75 in the (a) Message Engine RPC service or opnum (3) 0xCF in the Tape Engine service.


Stack-based buffer overflow in the krb5_klog_syslog function in the kadm5 library as used by the Kerberos administration daemon (kadmind) and Key Distribution Center (KDC) in MIT krb5 before 1.6.1 allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via crafted arguments possibly involving certain format string specifiers.


Buffer overflow in natd in network_cmds in Apple Mac OS X 10.3.9 through 10.4.9 when Internet Sharing is enabled allows remote attackers to execute arbitrary code via malformed RTSP packets.


Buffer overflow in the Trend Micro Scan Engine 8.000 and 8.300 before virus pattern file 4.245.00 as used in other products such as Cyber Clean Center (CCC) Cleaner allows remote attackers to execute arbitrary code via a malformed UPX compressed executable.


Integer underflow in the DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017 Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017 ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017 and Server before 1.0.4 Build 56528 allows remote attackers to execute arbitrary code via a malformed DHCP packet that triggers a stack-based buffer overflow.


Multiple heap-based buffer overflows in rumpusd in Rumpus 5.1 and earlier (1) allow remote authenticated users to execute arbitrary code via a long LIST command and other unspecified requests to the FTP service and (2) allow remote attackers to execute arbitrary code via unspecified requests to the HTTP service.


Multiple stack-based buffer overflows in the is_command function in proxy.c in Apple Darwin Streaming Proxy when using Darwin Streaming Server before 5.5.5 allow remote attackers to execute arbitrary code via a long (1) cmd or (2) server value in an RTSP request.


Multiple buffer overflows in LGSERVER.EXE in CA BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.1 SP1 Mobile Backup r4.0 Desktop and Business Protection Suite r2 and Desktop Management Suite (DMS) r11.0 and r11.1 allow remote attackers to execute arbitrary code via crafted packets to TCP port (1) 1900 or (2) 2200.


Heap-based buffer overflow in the _cairo_pen_init function in Mozilla Firefox 2.x before 2.0.0.2 Thunderbird before 1.5.0.10 and SeaMonkey before 1.0.8 allows remote attackers to execute arbitrary code via a large stroke-width attribute in the clipPath element in an SVG file.


Stack-based buffer overflow in iTinySoft Studio Total Video Player 1.03 and possibly earlier allows remote attackers to execute arbitrary code via a M3U playlist file that contains a long file name. NOTE: it was later reported that 1.20 and 1.30 are also affected.


** DISPUTED ** Buffer overflow in the SMB_Connect_Server function in FreeRadius 1.1.3 and earlier allows attackers to execute arbitrary code related to the server desthost field of an SMB_Handle_Type instance. NOTE: the impact of this issue has been disputed by a reliable third party and the vendor who states that exploitation is limited \only to local administrators who have write access to the server configuration files.\ CVE concurs with the dispute.


Buffer overflow in bos.rte.libc in IBM AIX 5.2 and 5.3 allows local users to execute arbitrary code via the \r-commands\ possibly including (1) rdist (2) rsh (3) rcp (4) rsync and (5) rlogin.


Buffer overflow in Resco Photo Viewer for PocketPC 4.11 and 6.01 as used in mobile devices running Windows Mobile 5.0 2003 and 2003SE allows remote attackers to execute arbitrary code via a crafted PNG image.


Multiple stack-based buffer overflows in the Motive ActiveEmailTest.EmailData (ActiveUtils EmailData) ActiveX control in ActiveUtils.dll in Motive Service Activation Manager 5.1 and Self Service Manager 5.1 and earlier allow remote attackers to execute arbitrary code via unspecified vectors.


Heap-based buffer overflow in Object Linking and Embedding (OLE) Automation in Microsoft Windows 2000 SP4 XP SP2 Server 2003 SP1 and SP2 Vista Office 2004 for Mac and Visual basic 6.0 SP6 allows remote attackers to execute arbitrary code via a crafted script request.


Heap-based buffer overflow in the arj.ppl module in the OnDemand Scanner in Kaspersky Anti-Virus Anti-Virus for Workstations and Anti-Virus for File Servers 6.0 and Internet Security 6.0 before Maintenance Pack 2 build 6.0.2.614 allows remote attackers to execute arbitrary code via crafted ARJ archives.


Stack-based buffer overflow in the Message Queuing Server (Cam.exe) in CA (formerly Computer Associates) Message Queuing (CAM / CAFT) software before 1.11 Build 54_4 on Windows and NetWare as used in CA Advantage Data Transport eTrust Admin certain BrightStor products certain CleverPath products and certain Unicenter products allows remote attackers to execute arbitrary code via a crafted message to TCP port 3104.


Multiple buffer overflows in the Trend Micro OfficeScan Web-Deployment SetupINICtrl ActiveX control in OfficeScanSetupINI.dll as used in OfficeScan 7.0 before Build 1344 OfficeScan 7.3 before Build 1241 and Client / Server / Messaging Security 3.0 before Build 1197 allow remote attackers to execute arbitrary code via a crafted HTML document.


Buffer overflow in the open_sty function in mkind.c for makeindex 2.14 in teTeX might allow user-assisted remote attackers to overwrite files and possibly execute arbitrary code via a long filename. NOTE: other overflows exist but might not be exploitable such as a heap-based overflow in the check_idx function.


Heap-based buffer overflow in Windows Media Format Runtime 7.1 9 9.5 9.5 x64 Edition 11 and Windows Media Services 9.1 for Microsoft Windows 2000 XP Server 2003 and Vista allows user-assisted remote attackers to execute arbitrary code via a crafted Advanced Systems Format (ASF) file.


Integer underflow in X MultiMedia System (xmms) 1.2.10 allows user-assisted remote attackers to execute arbitrary code via crafted header information in a skin bitmap image which results in a stack-based buffer overflow.


Stack-based buffer overflow in the print provider library (cpprov.dll) in Citrix Presentation Server 4.0 MetaFrame Presentation Server 3.0 and MetaFrame XP 1.0 allows local users and remote attackers to execute arbitrary code via long arguments to the (1) EnumPrintersW and (2) OpenPrinter functions.


The PE Loader service in Microsoft .NET Framework 1.0 1.1 and 2.0 for Windows 2000 XP Server 2003 and Vista allows remote attackers to execute arbitrary code via unspecified vectors involving an \unchecked buffer\ and unvalidated message lengths probably a buffer overflow.


Heap-based buffer overflow in Microsoft Virtual PC 2004 and PC for Mac 7.1 and 7 and Virtual Server 2005 and 2005 R2 allows local guest OS administrators to execute arbitrary code on the host OS via unspecified vectors related to \interaction and initialization of components.\


Stack-based buffer overflow in the PmBase64Decode function in an unspecified demonstration application in MICROSYS PROMOTIC stable before 8.2.19 and PROMOTIC development before 8.3.2 allows remote attackers to execute arbitrary code by providing a large amount of data.


The GetUpdateFile function in misc/update.c in the Updater in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation from a 64-bit integer to a 32-bit integer which allows remote attackers to conduct buffer overflow attacks and execute arbitrary code via a crafted update status file aka an \integer truncation\ vulnerability.


Multiple

buffer

overflows

in

the

PocketNetNVRMediaClientAxCtrl.NVRMediaViewer.1

control

in

Pocketnet

Tech

VMS

allow

remote

attackers

to

execute

arbitrary

code

via

a

crafted

string

to

the

StartRecord

StartRecordEx

StartScheduledRecord

SetDisplayText

GetONVIFDeviceInformation

GetONVIFProfiles

or

GetONVIFStreamUri

method

or

a

crafted

filename

to

the

SaveCurrentImage

or

SaveCurrentImageEx

method.


Buffer overflow in an ActiveX control in MDraw30.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2014-8513 and CVE-2014-8514. NOTE: this may be clarified later based on details provided by researchers.


The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote attackers to trigger an unintended zero-size malloc and conduct buffer overflow attacks and consequently execute arbitrary code via a box size of 7.


Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn functions in jpc/jpc_dec.c in JasPer 1.900.1 and earlier allow remote attackers to execute arbitrary code via a crafted jp2 file which triggers a heap-based buffer overflow.


Stack-based buffer overflow in an unspecified DLL file in a DTM development kit in Schneider Electric Unity Pro SoMachine SoMove SoMove Lite Modbus Communication Library 2.2.6 and earlier CANopen Communication Library 1.0.2 and earlier EtherNet/IP Communication Library 1.0.0 and earlier EM X80 Gateway DTM (MB TCP/SL) Advantys DTM for OTB Advantys DTM for STB KINOS DTM SOLO DTM and Xantrex DTMs allows remote attackers to execute arbitrary code via unspecified vectors.


Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38 5.5.x before 5.5.22 and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.


Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet related to (1) the crypto_recv function when the Autokey Authentication feature is used (2) the ctl_putdata function and (3) the configure function.


Buffer overflow in CORE/SYS/legacy/src/utils/src/dot11f.c in the Qualcomm Wi-Fi driver in Android before 2016-08-05 on Nexus 7 (2013) devices allows remote attackers to execute arbitrary code via a crafted Information Element (IE) in an 802.11 management frame aka Android internal bug 28668638 and Qualcomm internal bugs CR553937 and CR553941.


Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors as exploited in the wild in December 2014.


Stack-based buffer overflow in UltraCamLib in the UltraCam ActiveX Control (UltraCamX.ocx) for the TRENDnet SecurView camera TV-IP422WN allows remote attackers to execute arbitrary code via a long string to the (1) CGI_ParamSet (2) OpenFileDlg (3) SnapFileName (4) Password (5) SetCGIAPNAME (6) AccountCode or (7) RemoteHost function.


Multiple integer signedness errors in DirectShowDemuxFilter as used in Divx Web Player Divx Player and other Divx plugins allow remote attackers to execute arbitrary code via a (1) negative or (2) large value in a Stream Format (STRF) chunk in an AVI file which triggers a heap-based buffer overflow.


Buffer overflow in an ActiveX control in MDraw30.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2014-8513 and CVE-2014-9188. NOTE: this may be clarified later based on details provided by researchers.


Buffer overflow in an ActiveX control in Atx45.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2014-8512. NOTE: this may be clarified later based on details provided by researchers.


Buffer overflow in an ActiveX control in MDraw30.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2014-8514 and CVE-2014-9188. NOTE: this may be clarified later based on details provided by researchers.


Heap-based buffer overflow in the Cirrus VGA emulator (hw/display/cirrus_vga.c) in QEMU before 2.2.0 allows local guest users to execute arbitrary code via vectors related to blit regions. NOTE: this vulnerability exists because an incomplete fix for CVE-2007-1320.


Buffer overflow on Advantech EKI-1200 gateways with firmware before 1.63 allows remote attackers to execute arbitrary code via unspecified vectors.


A vulnerability was found in liblouis versions 2.5.x before 2.5.4. A stack-based buffer overflow was found in findTable() in liblouis. An attacker could create a malicious file that would cause applications that use liblouis (such as Orca) to crash or potentially execute arbitrary code when opened.


Buffer overflow in an ActiveX control in Atx45.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2014-8511. NOTE: this may be clarified later based on details provided by researchers.


Buffer overflow in decode.cpp in Cisco OpenH264 1.2.0 and earlier allows remote attackers to execute arbitrary code via an encoded media file.


Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName (2) SetParameter (3) NodeName (4) CCDParameter (5) SetColor (6) AlarmImage (7) GetParameter (8) GetColor (9) ServerResponse (10) SetBaud or (11) IPAddress parameter to an ActiveX control in (a) webvact.ocx (b) dvs.ocx or (c) webdact.ocx.


Stack-based buffer overflow in the CDownloads_Deleted::UpdateDownload function in Downloads_Deleted.cpp in Free Download Manager 3.9.3 build 1360 3.8 build 1173 3.0 build 852 and earlier allows user-assisted remote attackers to execute arbitrary code via a long file name which is then deleted from the download queue by the user.


Stack-based buffer overflow in a certain decryption function in qconnDoor on BlackBerry Z10 devices with software 10.1.0.2312 when developer-mode has been previously enabled allows remote attackers to execute arbitrary code via a crafted packet in a TCP session on a wireless network.


Buffer overflow in the Rendezvous Daemon (rvd) Rendezvous Routing Daemon (rvrd) Rendezvous Secure Daemon (rvsd) and Rendezvous Secure Routing Daemon (rvsrd) in TIBCO Rendezvous before 8.4.2 Messaging Appliance before 8.7.1 and Substation ES before 2.8.1 allows remote attackers to execute arbitrary code by leveraging access to a directly connected client and transmitting crafted data.


Buffer overflow in the sysplant driver in Symantec Endpoint Protection (SEP) Client 11.x and 12.x before 12.1 RU4 MP1b and Small Business Edition before SEP 12.1 allows local users to execute arbitrary code via a long argument to a 0x00222084 IOCTL call.


Stack-based buffer overflow in BKFSim_vhfd.exe in Yokogawa CENTUM CS 1000 CENTUM CS 3000 R3.09.50 and earlier CENTUM VP R5.03.20 and earlier Exaopc R3.72.00 and earlier B/M9000CS R5.05.01 and earlier and B/M9000 VP R7.03.01 and earlier when FCS/Test Function is enabled allows remote attackers to execute arbitrary code via a crafted packet.


Buffer overflow in RimArts Becky! Internet Mail before 2.68 allows remote POP3 servers to execute arbitrary code via a crafted response.


Buffer overflow in the Smart Call Home implementation in Cisco NX-OS on Fabric Interconnects in Cisco Unified Computing System 1.4 before 1.4(1i) NX-OS 5.0 before 5.0(3)U2(2) on Nexus 3000 devices NX-OS 4.1 before 4.1(2)E1(1l) on Nexus 4000 devices NX-OS 5.x before 5.1(3)N1(1) on Nexus 5000 devices NX-OS 5.2 before 5.2(3a) on Nexus 7000 devices and CG-OS CG4 before CG4(2) on Connected 1000 Connected Grid Routers allows remote SMTP servers to execute arbitrary code via a crafted reply aka Bug IDs CSCtk00695 CSCts56633 CSCts56632 CSCts56628 CSCug14405 and CSCuf61322.


Stack-based buffer overflow in the encode_key function in /system/bin/keystore in the KeyStore service in Android 4.3 allows attackers to execute arbitrary code and consequently obtain sensitive key information or bypass intended restrictions on cryptographic operations via a long key name.


hw/usb/bus.c in QEMU 1.6.2 allows remote attackers to execute arbitrary code via crafted savevm data which triggers a heap-based buffer overflow related to \USB post load checks.\


Stack-based buffer overflow in the do_hnap function in www/my_cgi.cgi in D-Link DSP-W215 (Rev. A1) with firmware 1.01b06 and earlier DIR-505 with firmware before 1.08b10 and DIR-505L with firmware 1.01 and earlier allows remote attackers to execute arbitrary code via a long Content-Length header in a GetDeviceSettings action in an HNAP request.


Stack-based buffer overflow in the mozilla::FileBlockCache::Read function in Mozilla Firefox before 34.0 Firefox ESR 31.x before 31.3 Thunderbird before 31.3 and SeaMonkey before 2.31 allows remote attackers to execute arbitrary code via crafted media content.


Heap-based buffer overflow in the nsTransformedTextRun function in Mozilla Firefox before 33.0 Firefox ESR 31.x before 31.2 and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via Cascading Style Sheets (CSS) token sequences that trigger changes to capitalization style.


Buffer overflow in the _cairo_truetype_index_to_ucs4 function in cairo as used in Mozilla Firefox before 28.0 Firefox ESR 24.x before 24.4 Thunderbird before 24.4 and SeaMonkey before 2.25 allows remote attackers to execute arbitrary code via a crafted extension that renders fonts in a PDF document.


Integer signedness error in system/core/adb/adb_client.c in Android Debug Bridge (ADB) for Android 4.4 in the Android SDK Platform Tools 18.0.1 allows ADB servers to execute arbitrary code via a negative length value which bypasses a signed comparison and triggers a stack-based buffer overflow.


Buffer overflow in login.cgi in MiniHttpd in Belkin N750 Router with firmware before F9K1103_WW_1.10.17m allows remote attackers to execute arbitrary code via a long string in the jump parameter.


Heap-based buffer overflow in Adobe Flash Player 12.0.0.77 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors as demonstrated by Zeguang Zhao and Liang Chen during a Pwn2Own competition at CanSecWest 2014.


Heap-based buffer overflow in the ReadDIB function in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows context-dependent attackers to execute arbitrary code via the BITMAPINFOHEADER.biClrUsed field in a BMP file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0993.


Stack-based buffer overflow in BKESimmgr.exe in the Expanded Test Functions package in Yokogawa CENTUM CS 1000 CENTUM CS 3000 Entry Class R3.09.50 and earlier CENTUM VP R5.03.00 and earlier CENTUM VP Entry Class R5.03.00 and earlier Exaopc R3.71.02 and earlier B/M9000CS R5.05.01 and earlier and B/M9000 VP R7.03.01 and earlier allows remote attackers to execute arbitrary code via a crafted packet.


Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android Adobe AIR SDK before 15.0.0.249 and Adobe AIR SDK & Compiler before 15.0.0.249 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2014-0559.