The 64 bit ELF support in Linux kernel 2.6 before 2.6.10 on 64-bit architectures does not properly check for overlapping VMA (virtual memory address) allocations which allows local users to cause a denial of service (system crash) or execute arbitrary code via a crafted ELF or a.out file.


Microsoft Windows XP SP2 and earlier 2000 SP3 and SP4 Server 2003 and older operating systems allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IP packets with malformed options aka the \IP Validation Vulnerability.\

denial of service
arbitrary code execution


The License Logging service for Windows NT Server Windows 2000 Server and Windows Server 2003 does not properly validate the length of messages which leads to an \unchecked buffer\ and allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code aka the \License Logging Service Vulnerability.\


Format string vulnerability in the SetImageInfo function in image.c for ImageMagick before 6.0.2.5 may allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a filename argument to convert which may be called by other web applications.


String handling functions in Mozilla 1.7.3 Firefox 1.0 and Thunderbird before 1.0.2 such as the nsTSubstring_CharT::Replace function do not properly check the return values of other functions that resize the string which allows remote attackers to cause a denial of service and possibly execute arbitrary code by forcing an out-of-memory state that causes a reallocation to fail and return a pointer to a fixed address which leads to heap corruption.


Format string vulnerability in Hashcash 1.16 allows remote attackers to cause a denial of service (memory consumption) and possibly execute arbitrary code via format string specifiers in a reply address which is not properly handled when printing the header.


Format string vulnerability in DataRescue Interactive Disassembler and Debugger (IDA) Pro 4.7.0.830 allows remote attackers or local users to cause a denial of service (CPU consumption or application crash) and possibly execute arbitrary code via format string specifiers in a dynamic link library (DLL) name.


Format string vulnerability in cgi.c for Monkey daemon (monkeyd) before 0.9.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an HTTP GET request containing double-encoded format string specifiers (aka \double expansion error\).


The pkt_ioctl function in the pktcdvd block device ioctl handler (pktcdvd.c) in Linux kernel 2.6.12-rc4 and earlier calls the wrong function before passing an ioctl to the block device which crosses security boundaries by making kernel address space accessible from user space and allows local users to cause a denial of service and possibly execute arbitrary code a similar vulnerability to CVE-2005-1264.


Novell NetMail 3.5.2a 3.5.2b and 3.5.2c when running on Linux sets the owner and group ID to 500 for certain files which could allow users or groups with that ID to execute arbitrary code or cause a denial of service by modifying those files.


Format string vulnerability in the snmppd_log function in snmppd_util.c for snmppd 0.4.5 and earlier may allow remote attackers to cause a denial of service or execute arbitrary code via format string specifiers that are not properly handled in a syslog call.


The native implementations of InstallTrigger and other functions in Firefox before 1.0.3 and Mozilla Suite before 1.7.7 do not properly verify the types of objects being accessed which causes the Javascript interpreter to continue execution at the wrong memory address which may allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code by passing objects of the wrong type.


Integer signedness error in the qmail_put and substdio_put functions in qmail when running on 64 bit platforms with a large amount of virtual memory allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large number of SMTP RCPT TO commands.


Multiple unknown vulnjerabilities HP OpenView Event Correlation Services (OV ECS) 3.32 and 3.33 allow attackers to cause a denial of service or execute arbitrary code.


The filtering of URLs in JunkBuster before 2.0.2-r3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via heap corruption.


commands.c in qmail when running on 64 bit platforms with a large amount of virtual memory allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long SMTP command without a space character which causes an array to be referenced with a negative index.


The Internet Key Exchange version 1 (IKEv1) implementation in Clavister Client Web allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IKE packets as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due to the lack of details in the advisory it is unclear which of CVE-2005-3666 CVE-2005-3667 and/or CVE-2005-3668 this issue applies to.


Macromedia Flash plugin (1) Flash.ocx 7.0.19.0 (Windows) and earlier and (2) libflashplayer.so before 7.0.25.0 (Unix) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via parameters to the ActionDefineFunction ActionScript call in a SWF file which causes an improper memory access condition a different vulnerability than CVE-2005-2628.


The Internet Key Exchange version 1 (IKEv1) implementation in Juniper JUNOS and JUNOSe software for M T and J-series routers before release 6.4 and E-series routers before 7-1-0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IKE packets as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due to the lack of details in the advisory it is unclear which of CVE-2005-3666 CVE-2005-3667 and/or CVE-2005-3668 this issue applies to.


Format string vulnerability in miniserv.pl Perl web server in Webmin before 1.250 and Usermin before 1.180 with syslog logging enabled allows remote attackers to cause a denial of service (crash or memory consumption) and possibly execute arbitrary code via format string specifiers in the username parameter to the login form which is ultimately used in a syslog call. NOTE: the code execution might be associated with an issue in Perl.


The Internet Key Exchange version 1 (IKEv1) implementation in Astaro Security Linux before 6.102 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IKE packets as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due to the lack of details in the advisory it is unclear which of CVE-2005-3666 CVE-2005-3667 and/or CVE-2005-3668 this issue applies to.


Blue Coat Systems Inc. WinProxy before 6.1a allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of packets with 0xFF characters to the Telnet port (TCP 23) which corrupts the heap.


Integer underflow in Apple Quicktime before 7.0.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Color Map Entry Size in a TGA image file.


Firefox before 1.0.5 Mozilla before 1.7.9 and Netscape 8.0.2 and 7.2 allows remote attackers to cause a denial of service (access violation and crash) and possibly execute arbitrary code by calling InstallVersion.compareTo with an object instead of a string.


Cisco IOS 12.0 through 12.4 and IOS XR before 3.2 with IPv6 enabled allows remote attackers on a local network segment to cause a denial of service (device reload) and possibly execute arbitrary code via a crafted IPv6 packet.


MySQL when running on Windows allows remote authenticated users with insert privileges on the mysql.func table to cause a denial of service (server hang) and possibly execute arbitrary code via (1) a request for a non-library file which causes the Windows LoadLibraryEx function to block or (2) a request for a function in a library that has the XXX_deinit or XXX_init functions defined but is not tailored for mySQL such as jpeg1x32.dll and jpeg2x32.dll.


Format string vulnerability in Evolution 1.4 through 2.3.6.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the calendar entries such as task lists which are not properly handled when the user selects the Calendars tab.


Internet Explorer 5.01 SP4 up to 6 on various Windows operating systems including IE 6.0.2900.2180 on Windows XP allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls as demonstrated using the JVIEW Profiler (Javaprxy.dll). NOTE: the researcher says that the vendor could not reproduce this problem.


Array index overflow in the xfrm_sk_policy_insert function in xfrm_user.c in Linux kernel 2.6 allows local users to cause a denial of service (oops or deadlock) and possibly execute arbitrary code via a p->dir value that is larger than XFRM_POLICY_OUT which is used as an index in the sock->sk_policy array.


Multiple format string vulnerabilities in Evolution 1.5 through 2.3.6.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) full vCard data (2) contact data from remote LDAP servers or (3) task list data from remote servers.


Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via Unicode sequences with \zero-width non-joiner\ characters.


Format string vulnerability in ui.c in Textbased MSN Client (TMSNC) before 0.2.5 allows attackers to cause a denial of service and possibly execute arbitrary code via unknown attack vectors that cause format strings to be injected into the wprintw function.


The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to \.dll\ followed by arguments such as \~0\ through \~9\ which causes ntdll.dll to produce a return value that is not correctly handled by IIS as demonstrated using \/_vti_bin/.dll/*/~0\. NOTE: the consequence was originally believed to be only a denial of service (application crash and reboot).


Off-by-one error in the sql_error function in sql_unixodbc.c in FreeRADIUS 1.0.2.5-5 and possibly other versions including 1.0.4 might allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by causing the external database query to fail. NOTE: this single issue is part of a larger-scale disclosure originally by SUSE which reported multiple issues that were disputed by FreeRADIUS. Disputed issues included file descriptor leaks memory disclosure LDAP injection and other issues. Without additional information the most recent FreeRADIUS report is being regarded as the authoritative source for this CVE identifier.


MailEnable Enterprise 1.1 before patch ME-10009 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via several \...\ (triple dot) sequences in a UID FETCH command.


The Internet Key Exchange version 1 (IKEv1) implementation in NEC UNIVERGE IX1000 IX2000 and IX3000 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IKE packets as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due to the lack of details in the advisory it is unclear which of CVE-2005-3666 CVE-2005-3667 and/or CVE-2005-3668 this issue applies to.


OpenSSL 0.9.6d and earlier and 0.9.7-beta2 and earlier does not properly handle ASCII representations of integers on 64 bit platforms which could allow attackers to cause a denial of service and possibly execute arbitrary code.


cgitest.exe in Sambar Server 5.1 before Beta 4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long argument.


Multiple signedness errors (mixed signed and unsigned numbers) in the I/O functions of rsync 2.4.6 2.3.2 and other versions allow remote attackers to cause a denial of service and execute arbitrary code in the rsync client or server.


Imlib before 1.9.13 sometimes uses the NetPBM package to load trusted images which could allow attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain weaknesses of NetPBM.


Apache 1.3 through 1.3.24 and Apache 2.0 through 2.0.36 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.


wwwoffled in World Wide Web Offline Explorer (WWWOFFLE) allows remote attackers to cause a denial of service and possibly execute arbitrary code via a negative Content-Length value.


Dino's Webserver 1.2 allows remote attackers to cause a denial of service (CPU consumption) and possibly execute arbitrary code via several large HTTP requests within a short time.


Squid 2.4 STABLE3 and earlier allows remote attackers to cause a denial of service (core dump) and possibly execute arbitrary code with an ftp:// URL with a larger number of special characters which exceed the buffer when Squid URL-escapes the characters.


Format string vulnerability in the administration function in Cisco Secure Access Control Server (ACS) for Windows 2.6.x and earlier and 3.x through 3.01 (build 40) allows remote attackers to crash the CSADMIN module only (denial of service of administration function) or execute arbitrary code via format strings in the URL to port 2002.


Vulnerability in Imlib before 1.9.13 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code by manipulating arguments that are passed to malloc which results in a heap corruption.


SMB dissector in Ethereal 0.9.3 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via malformed packets that cause Ethereal to dereference a NULL pointer.


PHP 4.2.0 and 4.2.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an HTTP POST request with certain arguments in a multipart/form-data form which generates an error condition that is not properly handled and causes improper memory to be freed.


Red-M 1050 (Bluetooth Access Point) PPP server allows bonded users to cause a denial of service and possibly execute arbitrary code via a long user name.


service.cgi in Cobalt RAQ 4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long service argument.


Domain Name Relay Daemon (dnrd) 2.10 and earlier allows remote malicious DNS sites to cause a denial of service and possibly execute arbitrary code via a long or malformed DNS reply which is not handled properly by parse_query get_objectname and possibly other functions.


Format string vulnerability in the CLI interface for WatchGuard Firebox Vclass 3.2 and earlier and RSSA Appliance 3.0.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in the password parameter.


Multiple SSH2 servers and clients do not properly handle packets or data elements with incorrect length specifiers which may allow remote attackers to cause a denial of service or possibly execute arbitrary code as demonstrated by the SSHredder SSH protocol test suite.


The Microsoft Java implementation as used in Internet Explorer allows remote attackers to read restricted process memory cause a denial of service (crash) and possibly execute arbitrary code via the getNativeServices function which creates an instance of the com.ms.awt.peer.INativeServices (INativeServices) class whose methods do not verify the memory addresses that are passed as parameters.


IBM Websphere 4.0.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP request with long HTTP headers such as \Host\.


libmysqlclient client library in MySQL 3.x to 3.23.54 and 4.x to 4.0.6 does not properly verify length fields for certain responses in the (1) read_rows or (2) read_one_row routines which allows remote attackers to cause a denial of service and possibly execute arbitrary code.


Ethereal 0.9.7 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed packets to the (1) LMP (2) PPP or (3) TDS dissectors possibly related to a missing field for EndVerifyAck messages.


Multiple SSH2 servers and clients do not properly handle lists with empty elements or strings which may allow remote attackers to cause a denial of service or possibly execute arbitrary code as demonstrated by the SSHredder SSH protocol test suite.


The timer implementation in QNX RTOS 6.1.0 allows local users to cause a denial of service (hang) and possibly execute arbitrary code by creating multiple timers with a 1-ms tick.


Multiple SSH2 servers and clients do not properly handle strings with null characters in them when the string length is specified by a length field which could allow remote attackers to cause a denial of service or possibly execute arbitrary code due to interactions with the use of null-terminated strings as implemented using languages such as C as demonstrated by the SSHredder SSH protocol test suite.


Balabit Syslog-NG 1.4.x before 1.4.15 and 1.5.x before 1.5.20 when using template filenames or output does not properly track the size of a buffer when constant characters are encountered during macro expansion which allows remote attackers to cause a denial of service and possibly execute arbitrary code.


Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by causing negative arguments to be fed into memcpy() calls via HTTP requests with (1) a negative Content-Length value or (2) a negative length in a chunked transfer encoding.


xine-lib 1.1.12 and other versions before 1.1.15 does not check for failure of malloc in circumstances including (1) the mymng_process_header function in demux_mng.c (2) the open_mod_file function in demux_mod.c and (3) frame_buffer allocation in the real_parse_audio_specific_data function in demux_real.c which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted media file.


jslock.cpp in Mozilla Firefox 3.x before 3.0.2 Firefox 2.x before 2.0.0.18 Thunderbird 2.x before 2.0.0.18 and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by modifying the window.__proto__.__proto__ object in a way that causes a lock on a non-native object which triggers an assertion failure related to the OBJ_IS_NATIVE function.


nsFrameManager in Firefox 3.x before 3.0.4 Firefox 2.x before 2.0.0.18 Thunderbird 2.x before 2.0.0.18 and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by modifying properties of a file input element while it is still being initialized then using the blur method to access uninitialized memory.


Unspecified vulnerability in the pdf.xmd module in (1) BitDefender Free Edition 10 and Antivirus Standard 10 (2) BullGuard Internet Security 8.5 and (3) Software602 Groupware Server 6.0.08.1118 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file possibly related to included compressed streams that were processed with the ASCIIHexDecode filter. NOTE: some of these details are obtained from third party information.


demux_qt.c in xine-lib 1.1.12 and other 1.1.15 and earlier versions does not validate the count field before calling calloc for STSD_ATOM atom allocation which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted media file.


DLMFENC.sys 1.0.0.28 in DESlock+ 3.2.7 allows local users to cause a denial of service (system crash) or potentially execute arbitrary code via a certain DLMFENC_IOCTL request to \\\\.\\DLKPFSD_Device that overwrites a pointer probably related to use of the ProbeForRead function when ProbeForWrite was intended.


Cisco Unified IP Phone (aka SIP phone) 7960G and 7940G with firmware P0S3-08-9-00 and possibly other versions before 8.10 allows remote attackers to cause a denial of service (device reboot) or possibly execute arbitrary code via a Realtime Transport Protocol (RTP) packet with malformed headers.


Format string vulnerability in the URI handler in KVirc 3.4.0 when set as the default application for processing IRC URIs allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in the irc:// URI.


Unspecified vulnerability in Opera before 9.52 on Windows when registered as a protocol handler allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors in which Opera is launched by other applications.


Integer signedness error in (1) QuickLook in Apple Mac OS X 10.5.5 and (2) Office Viewer in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 allows remote attackers to cause a denial of service (application termination) and execute arbitrary code via a crafted Microsoft Excel file that triggers an out-of-bounds memory access related to \handling of columns.\


Format string vulnerability in Xitami Web Server 2.2a through 2.5c2 and possibly other versions allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via format string specifiers in a Long Running Web Process (LRWP) request which triggers incorrect logging code involving the sendfmt function in the SMT kernel.


Multiple format string vulnerabilities in the SSI filter in Xitami Web Server 2.5c2 and possibly other versions allow remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via format string specifiers in a URI that ends in (1) .ssi (2) .shtm or (3) .shtml which triggers incorrect logging code involving the sendfmt function in the SMT kernel.


Multiple unspecified vulnerabilities in Sophos SAVScan 4.33.0 for Linux and possibly other products and versions allow remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via crafted files that have been packed with (1) armadillo (2) asprotect or (3) asprotectSKE.


Format string vulnerability in MemeCode Software i.Scribe 1.88 through 2.00 before Beta9 allows remote SMTP servers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in a server response which is not properly handled \when displaying the signon message.\


Format string vulnerability in Ipswitch WS_FTP Home 2007.0.0.2 and WS_FTP Professional 2007.1.0.0 allows remote FTP servers to cause a denial of service (application crash) or possibly execute arbitrary code via format string specifiers in a connection greeting (response).


Use-after-free vulnerability in WebKit in Apple iPod touch 1.1 through 2.0.2 and iPhone 1.0 through 2.0.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a web page with crafted Cascading Style Sheets (CSS) import statements.


Apple QuickTime before 7.5.5 does not properly handle (1) MDAT atoms in MP4 video files within QuickTimeH264.qtx (2) MDAT atoms in mov video files within QuickTimeH264.scalar and (3) AVC1 atoms in an unknown media type within an unspecified component which allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via a crafted H.264 encoded movie file.


Multiple integer underflows in the Real demuxer (demux_real.c) in MPlayer 1.0_rc2 and earlier allow remote attackers to cause a denial of service (process termination) and possibly execute arbitrary code via a crafted video file that causes the stream_read function to read or write arbitrary memory.


orgchart.exe in Microsoft Organization Chart 2.00 allows user-assisted attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted .opx file.


ir50_32.qtx in an unspecified third-party Indeo v5 codec for QuickTime when used with Apple QuickTime before 7.5.5 on Windows accesses uninitialized memory which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file.


Apple QuickTime before 7.5.5 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PICT image related to an \invalid pointer issue.\


Integer signedness error in Safari on Apple iPhone before 2.0 and iPod touch before 2.0 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving JavaScript array indices that trigger an out-of-bounds access a different vulnerability than CVE-2008-2307.


Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.15 Thunderbird 2.0.0.14 and earlier and SeaMonkey before 1.1.10 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via unknown vectors related to the JavaScript engine.


Adobe Acrobat Reader 8.1.2 and earlier and before 7.1.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a malformed PDF document as demonstrated by 2008-HI2.pdf.


Double free vulnerability in IBM Tivoli Directory Server (TDS) 6.1.0.0 through 6.1.0.15 allows remote authenticated administrators to cause a denial of service (ABEND) and possibly execute arbitrary code by using ldapadd to attempt to create a duplicate ibm-globalAdminGroup LDAP database entry. NOTE: the vendor states \There is no real risk of a vulnerability \ although there are likely scenarios in which a user is allowed to make administrative LDAP requests but does not have the privileges to stop the server.


WebCore in Apple Safari does not properly perform garbage collection of JavaScript document elements which allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via a reference to the ownerNode property of a copied CSSStyleSheet object of a STYLE element as originally demonstrated on Apple iPhone before 2.0 and iPod touch before 2.0 a different vulnerability than CVE-2008-1590.


Mozilla Firefox 2.0.0.14 allows remote attackers to cause a denial of service (heap corruption and application crash) or possibly execute arbitrary code by triggering an error condition during certain Iframe operations between a JSframe write and a JSframe close as demonstrated by an error in loading an empty Java applet defined by a 'src=\javascript:\' sequence.


Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.15 Thunderbird 2.0.0.14 and earlier and SeaMonkey before 1.1.10 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via unknown vectors related to the layout engine.


Mozilla Firefox 3 before 3.0.1 on Mac OS X allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted GIF file that triggers a free of an uninitialized pointer.


The block reflow implementation in Mozilla Firefox before 2.0.0.15 Thunderbird 2.0.0.14 and earlier and SeaMonkey before 1.1.10 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an image whose display requires more pixels than nscoord_MAX related to nsBlockFrame::DrainOverflowLines.


The HTTP service on the Cisco Linksys WRH54G with firmware 1.01.03 allows remote attackers to cause a denial of service (management interface outage) or possibly execute arbitrary code via a URI that begins with a \/./\ sequence contains many instances of a \front_page\ sequence and ends with a \.asp\ sequence.


Unspecified vulnerability in Adobe Reader and Acrobat 7.0.9 and earlier and 8.0 through 8.1.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors related to an \input validation issue in a JavaScript method.\


Use-after-free vulnerability in the _gnutls_handshake_hash_buffers_clear function in lib/gnutls_handshake.c in libgnutls in GnuTLS 2.3.5 through 2.4.0 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via TLS transmission of data that is improperly used when the peer calls gnutls_handshake within a normal session leading to attempted access to a deallocated libgcrypt handle.


Cisco Secure ACS 3.x before 3.3(4) Build 12 patch 7 4.0.x 4.1.x before 4.1(4) Build 13 Patch 11 and 4.2.x before 4.2(0) Build 124 Patch 4 does not properly handle an EAP Response packet in which the value of the length field exceeds the actual packet length which allows remote authenticated users to cause a denial of service (CSRadius and CSAuth service crash) or possibly execute arbitrary code via a crafted RADIUS (1) EAP-Response/Identity (2) EAP-Response/MD5 or (3) EAP-Response/TLS Message Attribute packet.


The administration interface in McAfee E-Business Server 8.5.2 and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a long initial authentication packet.


The NEEDBITS macro in the inflate_dynamic function in inflate.c for unzip can be invoked using invalid buffers which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger a free of uninitialized or previously-freed data.


CORE FORCE before 0.95.172 does not properly validate arguments to SSDT hook handler functions in the Registry module which allows local users to cause a denial of service (system crash) and possibly execute arbitrary code in the kernel context via crafted arguments.


Double free vulnerability in the process_browse_data function in CUPS 1.3.5 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via crafted UDP Browse packets to the cupsd port (631/udp) related to an unspecified manipulation of a remote printer. NOTE: some of these details are obtained from third party information.


Unspecified vulnerability in AppKit in Apple Mac OS X before 10.5 allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted document file as demonstrated by opening the document with TextEdit.


The load_tile function in the XCF coder in coders/xcf.c in (1) ImageMagick 6.2.8-0 and (2) GraphicsMagick (aka gm) 1.1.7 allows user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted .xcf file that triggers an out-of-bounds heap write possibly related to the ScaleCharToQuantum function.


The Marvell driver for the Netgear WN802T Wi-Fi access point with firmware 1.3.16 on the Marvell 88W8361P-BEM1 chipset does not properly parse EAPoL-Key packets which allows remote authenticated users to cause a denial of service (device reboot or hang) or possibly execute arbitrary code via a malformed EAPoL-Key packet with a crafted \advertised length.\


The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5 as used in the cifs and ip_nat_snmp_basic modules; and (b) the gxsnmp package; does not properly validate length values during decoding of ASN.1 BER data which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a length greater than the working buffer which can lead to an unspecified overflow; (2) an oid length of zero which can lead to an off-by-one error; or (3) an indefinite length for a primitive encoding.


A certain ActiveX control in WkImgSrv.dll 7.03.0616.0 as distributed in Microsoft Works 7 and Microsoft Office 2003 and 2007 allows remote attackers to execute arbitrary code or cause a denial of service (browser crash) via an invalid WksPictureInterface property value which triggers an improper function call.


Opera before 9.27 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted newsfeed source which triggers an invalid memory access.


Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier as used in ePolicy Orchestrator 4.0.0 build 1015 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in a sender field in an AgentWakeup request to UDP port 8082. NOTE: this issue only exists when the debug level is 8.


start_kdeinit in KDE 3.5.5 through 3.5.9 when installed setuid root allows local users to cause a denial of service and possibly execute arbitrary code via \user-influenceable input\ (probably command-line arguments) that cause start_kdeinit to send SIGUSR1 signals to other processes.


Unspecified vulnerability in Sun Java Runtime Environment (JRE) and JDK 6 Update 4 and earlier 5.0 Update 14 and earlier and SDK/JRE 1.4.2_16 and earlier allows remote attackers to cause a denial of service (JRE crash) and possibly execute arbitrary code via unknown vectors related to XSLT transforms.


Format string vulnerability in the log_message function in lks.c in Linux Kiss Server 1.2 when background (daemon) mode is disabled allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in an invalid command.


Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.13 Thunderbird before 2.0.0.13 and SeaMonkey before 1.1.9 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors related to the JavaScript engine.


The cpoint.sys driver in Panda Internet Security 2008 and Antivirus+ Firewall 2008 allows local users to cause a denial of service (system crash or kernel panic) overwrite memory or execute arbitrary code via a crafted IOCTL request that triggers an out-of-bounds write of kernel memory.


The Marvell driver for the Netgear WN802T Wi-Fi access point with firmware 1.3.16 on the Marvell 88W8361P-BEM1 chipset does not properly parse the SSID information element in an association request which allows remote authenticated users to cause a denial of service (device reboot or hang) or possibly execute arbitrary code via a \Null SSID.\


Format string vulnerability in webmail.exe in NetWin SurgeMail 38k4 and earlier and beta 39a and WebMail 3.1s and earlier allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via format string specifiers in the page parameter.


Mail in Apple Mac OS X before 10.5 when an IPv6 SMTP server is used does not properly initialize memory which might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) or obtain sensitive information (memory contents) in opportunistic circumstances by sending an e-mail message.


Unspecified vulnerability in multiple F-Secure anti-virus products including Internet Security 2006 through 2008 Anti-Virus 2006 through 2008 and others allows remote attackers to execute arbitrary code or cause a denial of service (hang or crash) via a malformed archive that triggers an unhandled exception as demonstrated by the PROTOS GENOME test suite for Archive Formats.


The RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll in RealNetworks RealPlayer Enterprise RealPlayer 10 RealPlayer 10.5 before build 6.0.12.1675 and RealPlayer 11 before 11.0.3 build 6.0.14.806 does not properly manage memory for the (1) Console or (2) Controls property which allows remote attackers to execute arbitrary code or cause a denial of service (browser crash) via a series of assignments of long string values which triggers an overwrite of freed heap memory.


libpng 1.0.6 through 1.0.32 1.2.0 through 1.2.26 and 1.4.0beta01 through 1.4.0beta19 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PNG file with zero length \unknown\ chunks which trigger an access of uninitialized memory.


Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.13 Thunderbird before 2.0.0.13 and SeaMonkey before 1.1.9 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors related to the layout engine.


The virtio_queue_notify in qemu-kvm 0.14.0 and earlier does not properly validate the virtqueue number which allows guest users to cause a denial of service (guest crash) and possibly execute arbitrary code via a negative number in the Queue Notify field of the Virtio Header which bypasses a signed comparison.


Adobe Flash Player before 10.3.183.10 on Windows Mac OS X Linux and Solaris and before 10.3.186.7 on Android allows attackers to execute arbitrary code or cause a denial of service (browser crash) via unspecified vectors related to a \logic error issue.\


Integer underflow in Mozilla Firefox 3.6.x before 3.6.23 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via JavaScript code containing a large RegExp expression.


Use-after-free vulnerability in the nsSVGPointList::AppendElement function in the implementation of SVG element lists in Mozilla Firefox before 3.6.18 Thunderbird before 3.1.11 and SeaMonkey through 2.0.14 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving a user-supplied callback.


libsecurity in Apple Mac OS X before 10.7.2 does not properly handle errors during processing of a nonstandard extension in a Certificate Revocation list (CRL) which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) a crafted (1) web site or (2) e-mail message.


Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01 as used in Google Chrome before 17.0.963.83 and other products allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file a different vulnerability than CVE-2011-3026.


The dpcm_decode_frame function in dpcm.c in libavcodec in FFmpeg before 0.10 and in Libav 0.5.x before 0.5.9 0.6.x before 0.6.6 0.7.x before 0.7.6 and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted stereo stream in a media file.


The decode_frame function in the KVG1 decoder (kgv1dec.c) in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11 and in Libav 0.5.x before 0.5.9 0.6.x before 0.6.6 0.7.x before 0.7.5 and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted media file.


Mozilla Firefox before 7.0 and SeaMonkey before 2.4 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unspecified WebGL test case that triggers a memory-allocation error and a resulting out-of-bounds write operation.


Use-after-free vulnerability in Mozilla Firefox 4.x through 6 Thunderbird before 7.0 and SeaMonkey before 2.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OGG headers in a .ogg file.


Apple Type Services (ATS) in Apple Mac OS X before 10.7.3 does not properly manage memory for data-font files which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted font that is accessed by Font Book.


The decode_init function in kmvc.c in libavcodec in FFmpeg before 0.10 and in Libav 0.5.x before 0.5.9 0.6.x before 0.6.6 0.7.x before 0.7.6 and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large palette size in a KMVC encoded file.


libvirt.c in the API in Red Hat libvirt 0.8.8 does not properly restrict operations in a read-only connection which allows remote attackers to cause a denial of service (host OS crash) or possibly execute arbitrary code via a (1) virNodeDeviceDettach (2) virNodeDeviceReset (3) virDomainRevertToSnapshot (4) virDomainSnapshotDelete (5) virNodeDeviceReAttach or (6) virConnectDomainXMLToNative call a different vulnerability than CVE-2008-5086.


The GNU C Library (aka glibc or libc6) before 2.12.2 and Embedded GLIBC (EGLIBC) allow context-dependent attackers to execute arbitrary code or cause a denial of service (memory consumption) via a long UTF8 string that is used in an fnmatch call aka a \stack extension attack \ a related issue to CVE-2010-2898 CVE-2010-1917 and CVE-2007-4782 as originally reported for use of this library by Google Chrome.


The VEGAOpBitmap::AddLine function in Opera before 10.61 does not properly initialize memory during processing of the SIZE attribute of a SELECT element which allows remote attackers to trigger an invalid memory write operation and consequently cause a denial of service (application crash) or possibly execute arbitrary code via a large integer attribute value.


Format string vulnerability in the logText function in shmemmgr9.dll in IGSSdataServer.exe 9.00.00.11074 and 9.00.00.11063 and earlier in 7-Technologies Interactive Graphical SCADA System (IGSS) allows remote attackers to cause a denial of service and possibly execute arbitrary code as demonstrated using the RMS Reports Delete command related to the logging of messages to GSST.LOG. NOTE: some of these details are obtained from third party information.


The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge which allows privileged guest users to cause a denial of service (guest crash) and possibly execute arbitrary code by sending a crafted value to the 0xae08 (PCI_EJ_BASE) I/O port which leads to a use-after-free related to \active qemu timers.\


The SPICE Firefox plug-in (spice-xpi) 2.4 2.3 2.2 and possibly other versions allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to (1) plugin/nsScriptablePeer.cpp and (2) plugin/plugin.cpp which trigger multiple uses of an uninitialized pointer.


dexdump in Android SDK before 2.3 does not properly perform structural verification which allows user-assisted remote attackers to cause a denial of service (dexdump crash) and possibly execute arbitrary code via a malformed APK or dex file that calls a method using more arguments than the number of register that have been declared for that method.


Format string vulnerability in the dkim_exim_verify_finish function in src/dkim.c in Exim before 4.76 might allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string specifiers in data used in DKIM logging as demonstrated by an identity field containing a % (percent) character.


Double free vulnerability in the prepare_error_as function in do_as_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 through 1.9 when the PKINIT feature is enabled allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via an e_data field containing typed data.


Multiple format string vulnerabilities in AppleScript in Apple Mac OS X before 10.6.7 allow context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a (1) display dialog or (2) display alert command in a dialog in an AppleScript Studio application.


The process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT Kerberos 5 (aka krb5) 1.7 through 1.9 frees an invalid pointer which allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted request that triggers an error condition.


Use-after-free vulnerability in the nsSVGPathSegList::ReplaceItem function in the implementation of SVG element lists in Mozilla Firefox before 3.6.18 Thunderbird before 3.1.11 and SeaMonkey through 2.0.14 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving a user-supplied callback.


Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows Mac OS X Linux and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader and Acrobat 9.x through 9.4.2 and 10.x through 10.0.1 on Windows and Mac OS X allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content as demonstrated by a .swf file embedded in an Excel spreadsheet and as exploited in the wild in March 2011.


Unspecified vulnerability in Adobe Reader and Acrobat 10.x before 10.0.1 9.x before 9.4.2 and 8.x before 8.2.6 on Windows and Mac OS X allows attackers to cause a denial of service or possibly execute arbitrary code via unknown vectors a different vulnerability than CVE-2011-0585.


Adobe Flash Player before 10.2.154.27 on Windows Mac OS X Linux and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Windows Adobe Reader 9.x before 9.4.4 and 10.x before 10.0.3 on Mac OS X and Adobe Acrobat 9.x before 9.4.4 and 10.x before 10.0.3 on Windows and Mac OS X allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content; as demonstrated by a Microsoft Office document with an embedded .swf file that has a size inconsistency in a \group of included constants \ object type confusion ActionScript that adds custom functions to prototypes and Date objects; and as exploited in the wild in April 2011.


The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier as used on Apple Mac OS X before 10.6.7 and other platforms does not properly allocate memory which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process related to an \integer truncation issue.\


Unspecified vulnerability in Adobe Reader and Acrobat 10.x before 10.0.1 9.x before 9.4.2 and 8.x before 8.2.6 on Windows and Mac OS X allows attackers to cause a denial of service or possibly execute arbitrary code via unknown vectors a different vulnerability than CVE-2011-0565.


Investintech.com SlimPDF Reader does not properly restrict write operations which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.


Unspecified vulnerability in Investintech.com Absolute PDF Server allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.


ZenSysSrv.exe in Ing. Punzenberger COPA-DATA zenon 6.51 SP0 allows remote attackers to cause a denial of service (service crash) or possibly execute arbitrary code via a series of connections and disconnections on TCP port 1101 aka Reference Number 25212.


Format string vulnerability in the p_cgi_error function in python/neo_cgi.c in the Python CGI Kit (neo_cgi) module for Clearsilver 0.10.5 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers that are not properly handled when creating CGI error messages using the cgi_error API function.


Investintech.com SlimPDF Reader does not properly restrict read operations during block data moves which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.


Unspecified vulnerability in Investintech.com Able2Extract and Able2Extract Server allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted document.


zenAdminSrv.exe in Ing. Punzenberger COPA-DATA zenon 6.51 SP0 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted packet to TCP port 50777 aka Reference Number 25240.


Investintech.com SlimPDF Reader does not prevent faulting-address data from affecting branch selection which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.


Investintech.com SlimPDF Reader does not properly restrict the arguments to unspecified function calls which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.


Unspecified vulnerability in Investintech.com Able2Doc and Able2Doc Professional allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted document.


Investintech.com SlimPDF Reader does not prevent faulting-instruction data from affecting write operations which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.


Multiple format string vulnerabilities in Condor 7.2.0 through 7.6.4 and possibly certain 7.7.x versions as used in Red Hat MRG Grid and possibly other products allow local users to cause a denial of service (condor_schedd daemon and failure to launch jobs) and possibly execute arbitrary code via format string specifiers in (1) the reason for a hold for a job that uses an XML user log (2) the filename of a file to be transferred and possibly other unspecified vectors.


Multiple off-by-one errors in the (1) token and (2) linetoken functions in backend/dvi/mdvi-lib/afmparse.c in t1lib as used in teTeX 3.0.x GNOME evince and possibly other products allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a DVI file containing a crafted Adobe Font Metrics (AFM) file different vulnerabilities than CVE-2010-2642 and CVE-2011-0433.


https50.ocx in IP*Works! SSL in the server in Unitronics UniOPC before 2.0.0 does not properly implement an unspecified function which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site.


A flaw was found in htmldoc in v1.9.12. Double-free in function pspdf_export() in ps-pdf.cxx may result in a write-what-where condition allowing an attacker to execute arbitrary code and denial of service.


Double free vulnerability in the Networking component in Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to cause a denial of service (system shutdown) or execute arbitrary code via crafted IPV6 packets.


Double free vulnerability in VMware ESX Server 3.0.0 and 3.0.1 allows attackers to cause a denial of service (crash) obtain sensitive information or possibly execute arbitrary code via unspecified vectors.


Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file.


Double free vulnerability in Apple Pages 2.x before 2.1 and 5.x before 5.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Microsoft Word file.


Double free vulnerability in WebKit in Apple iOS before 4.1 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the rendering of an inline element.


Double free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an SSL client certificate with a certain invalid ASN.1 encoding.


Double free vulnerability in the ASN.1 library as used in Windows NT 4.0 Windows 2000 Windows XP and Windows Server 2003 allows remote attackers to cause a denial of service and possibly execute arbitrary code.


Double free vulnerability in the getRawDER function for nsIX509Cert in Firefox allows remote attackers to cause a denial of service (hang) and possibly execute arbitrary code via certain Javascript code.


Double free vulnerability in nsVCard.cpp in Mozilla Thunderbird before 1.5.0.4 and SeaMonkey before 1.0.2 allows remote attackers to cause a denial of service (hang) and possibly execute arbitrary code via a VCard that contains invalid base64 characters.


Double free vulnerability in the PyPAM_conv in PAMmodule.c in PyPam 0.5.0 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a NULL byte in a password string.


Double free vulnerability in ImageIO in Apple iOS before 6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JPEG image.


Double free vulnerability in the sftp_mkdir function in sftp.c in libssh before 0.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors a different vector than CVE-2012-4559.


Double free vulnerability in the mem_close function in jas_stream.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image to the imginfo command.


Double free vulnerability in OfficeImport in Apple iOS before 5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Excel spreadsheet.


Double free vulnerability in the Rx server process in OpenAFS 1.4.14 1.4.12 1.4.7 and possibly other versions allows remote attackers to cause a denial of service and execute arbitrary code via unknown vectors.


CoreGraphics in Apple iOS before 7.1.2 does not properly restrict allocation of stack memory for processing of XBM images which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted image data.


CoreCrypto in Apple iOS before 10 OS X before 10.12 tvOS before 10 and watchOS before 3 allows attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted app.


CoreText in Apple Mac OS X 10.4 through 10.4.10 allows attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted text content that triggers an access of an uninitialized object pointer.


QuickTime in Apple Mac OS X 10.6.x before 10.6.5 accesses uninitialized memory locations during processing of GIF image data which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted GIF file.


QuickTime in Apple Mac OS X 10.6.x before 10.6.5 accesses uninitialized memory locations during processing of JP2 image data which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JP2 file.


WebKit in Apple Mac OS X 10.3.9 and 10.4.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML document that causes WebKit to access an object that has already been deallocated.


CoreText in Apple Mac OS X 10.7.x before 10.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write or read) via a crafted text glyph.


CoreGraphics in Apple Mac OS X before 10.5.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document related to an uninitialized variable.


QuickTime in Apple Mac OS X before 10.7.3 does not prevent access to uninitialized memory locations which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MP4 file.


CoreUI in Apple Mac OS X 10.7.x before 10.7.3 does not properly restrict the allocation of stack memory which allows remote attackers to execute arbitrary code or cause a denial of service (memory consumption and application crash) via a long URL.


QuickTime in Apple Mac OS X before 10.7.2 does not properly handle the atom hierarchy in movie files which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted file.


SceneKit in Apple OS X before 10.10.2 allows attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted app.


IOHIDFamily in Apple OS X before 10.10.2 allows attackers to execute arbitrary code in a kernel context or cause a denial of service (write to kernel memory) via a crafted app that calls an unspecified user-client method.


Thunderbolt in Apple OS X before 10.9.4 does not properly restrict IOThunderBoltController API calls which allows attackers to execute arbitrary code or cause a denial of service (out-of-bounds memory access and application crash) via a crafted call.


WebKit in Apple Safari before 4.0 does not properly initialize memory for Attr DOM objects which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document.


ImageIO in Apple Safari before 5.0.6 on Windows does not properly address re-entrancy issues which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF file.


automount in Mac OS X 10.4.5 and earlier allows remote file servers to cause a denial of service (unresponsiveness) or execute arbitrary code via unspecified vectors that cause automount to \mount file systems with reserved names\.


Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain createTextRange call on a checkbox object which results in a dereference of an invalid table pointer.


The kernel in Apple iOS before 10 OS X before 10.12 tvOS before 10 and watchOS before 3 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (invalid pointer dereference) via a crafted app.


Multiple off-by-one errors in order_cmd.cpp in OpenTTD before 1.1.3 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted CMD_INSERT_ORDER command.


Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving document.write calls with long crafted strings.


Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long exception string in a throw statement possibly a related issue to CVE-2009-1514.


Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a MARQUEE element.


Format string vulnerabilities in the (1) die or (2) log_event functions for ssmtp before 2.50.6 allow remote mail relays to cause a denial of service and possibly execute arbitrary code.


Format string vulnerabilities in Lotus Domino R5 before R5.0.7a allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code as demonstrated by the PROTOS LDAPv3 test suite.


Format string vulnerabilities in iPlanet Directory Server 4.1.4 and earlier (LDAP) allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code as demonstrated by the PROTOS LDAPv3 test suite.


Format string vulnerabilities in Livingston/Lucent RADIUS before 2.1.va.1 may allow local or remote attackers to cause a denial of service and possibly execute arbitrary code via format specifiers that are injected into log messages.


Format string vulnerability in the client in Tftpd32 before 4.50 allows remote servers to cause a denial of service (crash) or possibly execute arbitrary code via format string specifiers in the Remote File field.


Format string vulnerability in OmniGroup OmniWeb 5.5.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via format string specifiers in the Javascript alert function.


Format string vulnerability in CoreServicesUIAgent in Apple OS X 10.9.x through 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a URL.


Format string vulnerability in Login Window in Apple Mac OS X 10.4.11 and 10.5 before 10.5.8 allows attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in an application name.


Format string vulnerability in the h_readrequest function in http.c in httpdx Web Server 1.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in the Host header.


Format string vulnerability in Magic WinMail Server 2.3 and possibly other 2.x versions allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in the PASS command.


Format string vulnerability in LinuxNode (node) before 0.3.2 may allow attackers to cause a denial of service or execute arbitrary code.


Format string vulnerability in main.cpp in kpopup 0.9.1 and 0.9.5pre2 allows local users to cause a denial of service (segmentation fault) and possibly execute arbitrary code via format string specifiers in command line arguments.


Format string vulnerability in xml_elem.c for XMLStarlet Command Line XML Toolkit 0.9.3 may allow attackers to cause a denial of service or execute arbitrary code.


Format string vulnerability in games using the Epic Games Unreal Engine 436 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in class names.


Format string vulnerability in SHOUTcast 1.9.4 allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via format string specifiers in a content URL as demonstrated in the filename portion of a .mp3 file.


Format string vulnerability in Dream FTP 1.02 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in the username.


Format string vulnerability in OllyDbg 1.10 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers that are directly provided to the OutputDebugString function call.


Format string vulnerability in the monitor \memory dump\ command in VICE 1.6 to 1.14 allows local users to cause a denial of service (emulator crash) and possibly execute arbitrary code via format string specifiers in an output string.


Format string vulnerability in hsftp 1.11 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via file names containing format string characters that are not properly handled when executing an \ls\ command.


Format string vulnerability in the log routine for gopher daemon (gopherd) 3.0.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code.


Format string vulnerability in Brian Wotring Osiris before 4.2.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via unspecified attack vectors related to the logging functions.


Format string vulnerability in Easy File Sharing (EFS) Web Server 3.2 allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via format string specifiers in the query string argument in an HTTP GET request.


Format string vulnerability in avpkeeper in Kaspersky KAV 3.5.135.2 for Sendmail allows remote attackers to cause a denial of service or possibly execute arbitrary code via a malformed mail message.


Format string vulnerability in the LogVHdrMessageVerb function in os/log.c in X.Org X11 1.11 allows attackers to cause a denial of service or possibly execute arbitrary code via format string specifiers in an input device name.


Format string vulnerability in the logMess function in TFTP Server MT 1.65 and earlier allows remote attackers to perform a denial of service or execute arbitrary code via format string sequences in a TFTP error packet.


Format string vulnerability in the logMess function in TFTP Server SP 1.66 and earlier allows remote attackers to perform a denial of service or execute arbitrary code via format string sequences in a TFTP error packet.


Format string vulnerability in Soldner Secret Wars 30830 and earlier allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via format string specifiers in a message.


Format string vulnerability in Foxmail Server 2.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in the USER command.


Format string vulnerability in bidwatcher before 1.3.17 allows remote malicious web servers from eBay or a spoofed eBay server to cause a denial of service and possibly execute arbitrary code via certain responses.


Format string vulnerability in the logging functionality in BitDefender AntiVirus 7.2 through 9 allows remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in file or directory name.


Format string vulnerability in Lithium II mod 1.24 for Quake 2 allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via format string specifiers in the nickname.


Format string vulnerability in TN3270 Resource Gateway 1.1.0 allows local users to cause a denial of service and possibly execute arbitrary code via format string specifiers in syslog function calls.


Format string vulnerability in Logger.cc for Spey 0.3.3 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in a syslog call.


Format string vulnerability in the logging() function in C-Note Squid LDAP authentication module (squid_auth_LDAP) 2.0.2 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code by triggering log messages.


Format string vulnerability in the Cio_PrintF function of cio_main.c in Unreal IRCd 3.1.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers.


Format string vulnerability in Pablo FTP Server 1.5 1.3 and possibly other versions allows remote attackers to cause a denial of service and possibly execute arbitrary code via format strings in the USER command.


Format string vulnerability in SMTP service for WebEasyMail 3.4.2.2 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in SMTP requests.


Format string vulnerability in c++filt in Apple Mac OS X 10.5 before 10.5.4 allows user-assisted attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string in (1) C++ or (2) Java source code.


Format string vulnerability in the grant helper (polkit-grant-helper.c) in PolicyKit 0.7 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in a password.


Format string vulnerability in the embedded Internet Explorer component for Mirabilis ICQ 6 build 6043 allows remote servers to execute arbitrary code or cause a denial of service (crash) via unspecified vectors related to HTML code generation.


Integer underflow in the iso_recv_msg function (iso.c) in rdesktop 1.5.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Remote Desktop Protocol (RDP) request with a small length field.


Multiple unknown vulnerabilities in OpenView Network Node Manager (OV NNM) 6.2 6.4 7.01 and 7.50 allow attackers to cause a denial of service or execute arbitrary code.


Multiple unknown vulnerabilities in L-Soft LISTSERV 14.3 1.8e and 1.8d allow remote attackers to execute arbitrary code or cause a denial of service. NOTE: this candidate may be SPLIT in the future when more precise technical details become available.


An unspecified ActiveX control in McAfee Virtual Technician (MVT) before 6.4 and ePO-MVT allows remote attackers to execute arbitrary code or cause a denial of service (Internet Explorer crash) via a crafted web site.


Multiple unspecified vulnerabilities in JP1/Cm2/Network Node Manager (NNM) before 07-10-05 and before 08-00-02 in the 08-x series allow remote attackers to execute arbitrary code cause a denial of service or trigger invalid Web utility behavior.


Multiple unspecified vulnerabilities in liboggz before cf5feeaab69b05e24 as used in Mozilla Firefox 3.5.x before 3.5.4 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors.


Multiple unspecified vulnerabilities in Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 allow attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors.


Multiple unspecified vulnerabilities in Hitachi JP1/Cm2/Network Node Manager i before 09-50-03 allow remote attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors.


Multiple unspecified vulnerabilities in Solaris print service for Sun Solaris 8 9 and 10 allow remote attackers to cause a denial of service or execute arbitrary code via unknown vectors.


IrfanView

version

with

PDF

plugin

version

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.pdf

file

related

to

a

\User

Mode

Write

AV

starting

at

PDF!xmlGetGlobalState+0x0000000000031abe.\


IrfanView

version

with

PDF

plugin

version

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.pdf

file

related

to

a

\User

Mode

Write

AV

starting

at

PDF!xmlGetGlobalState+0x000000000007dff2.\


IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file related to a \User Mode Write AV starting at FPX!GetPlugInInfo+0x0000000000017426.\


IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file related to a \Read Access Violation on Control Flow starting at FPX!GetPlugInInfo+0x0000000000012bf2.\


IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file related to \Data from Faulting Address controls Code Flow starting at FPX+0x0000000000007216.\


IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file related to a \User Mode Write AV starting at FPX+0x000000000000176c.\


IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file related to a \User Mode Write AV starting at FPX!GetPlugInInfo+0x0000000000016e53.\


IrfanView

version

with

FPX

Plugin

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.fpx

file

related

to

a

\User

Mode

Write

AV

starting

at

FPX!FPX_GetScanDevicePropertyGroup+0x0000000000007822.\


IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file related to a \User Mode Write AV starting at FPX!DE_Decode+0x0000000000000a9b.\


IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file related to a \User Mode Write AV starting at FPX+0x0000000000001555.\


IrfanView

version

with

TOOLS

plugin

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

file

related

to

a

\Read

Access

Violation

on

Block

Data

Move

starting

at

ntdll_77df0000!memcpy+0x0000000000000033.\


IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file related to \Data from Faulting Address controls Code Flow starting at FPX+0x0000000000007236.\


IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file related to a \User Mode Write AV starting at FPX!DE_Decode+0x0000000000000cdb.\


IrfanView version 4.44 (32bit) with FPX Plugin 4.45 allows remote attackers to execute arbitrary code or cause a denial of service (Heap Corruption and application crash) in processing a FlashPix (.FPX) file a different vulnerability than CVE-2017-7721.


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

file

related

to

\Heap

Corruption

starting

at

wow64!Wow64NotifyDebugger+0x000000000000001d.\


STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file related to a \User Mode Write AV starting at Unknown Symbol @ 0x00000000039d76c4 called from Unknown Symbol @ 0x0000000000049d2c.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.djvu

file

related

to

a

\User

Mode

Write

AV

starting

at

STDUDjVuFile!DllUnregisterServer+0x000000000000dd3f.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

file

related

to

a

\User

Mode

Write

AV

starting

at

STDUJBIG2File!DllGetClassObject+0x0000000000002ff7.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

file

related

to

a

\User

Mode

Write

AV

starting

at

STDUJBIG2File!DllUnregisterServer+0x000000000000566e.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.djvu

file

related

to

a

\User

Mode

Write

AV

starting

at

STDUDjVuFile!DllUnregisterServer+0x00000000000085f5.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

file

related

to

\Data

from

Faulting

Address

controls

subsequent

Write

Address

starting

at

STDUJBIG2File!DllGetClassObject+0x00000000000038e8.\


STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file related to a \User Mode Write AV starting at Unknown Symbol @ 0x000000000479049b called from Unknown Symbol @ 0x000000000d89645b.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

file

related

to

\Data

from

Faulting

Address

controls

subsequent

Write

Address

starting

at

STDUJBIG2File!DllGetClassObject+0x00000000000064e7.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

file

related

to

\Data

from

Faulting

Address

controls

subsequent

Write

Address

starting

at

STDUJBIG2File!DllGetClassObject+0x000000000000384b.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.epub

file

related

to

a

\Read

Access

Violation

on

Block

Data

Move

starting

at

STDUEPubFile!DllUnregisterServer+0x0000000000010262.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

file

related

to

a

\User

Mode

Write

AV

starting

at

STDUJBIG2File!DllUnregisterServer+0x00000000000076d8.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

file

related

to

a

\User

Mode

Write

AV

starting

at

STDUJBIG2File!DllGetClassObject+0x000000000000303e.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.djvu

file

related

to

a

\User

Mode

Write

AV

starting

at

STDUDjVuFile!DllUnregisterServer+0x000000000000da27.\


STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file related to \Data from Faulting Address controls Code Flow starting at STDUJBIG2File+0x00000000000015e9.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

file

related

to

\Data

from

Faulting

Address

controls

subsequent

Write

Address

starting

at

STDUJBIG2File!DllGetClassObject+0x0000000000004479.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.djvu

file

related

to

a

\User

Mode

Write

AV

starting

at

STDUDjVuFile!DllUnregisterServer+0x000000000000d9a9.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.xps

file

related

to

a

\Read

Access

Violation

on

Block

Data

Move

starting

at

STDUXPSFile!DllUnregisterServer+0x0000000000005311.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

file

related

to

a

\User

Mode

Write

AV

starting

at

STDUJBIG2File!DllGetClassObject+0x000000000000653b.\


STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file related to a \Read Access Violation on Control Flow starting at STDUJBIG2File+0x00000000000015eb.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.djvu

file

related

to

a

\User

Mode

Write

AV

starting

at

STDUDjVuFile!DllUnregisterServer+0x0000000000018cc2.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

file

related

to

\Heap

Corruption

starting

at

wow64!Wow64LdrpInitialize+0x00000000000008e1.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

file

related

to

\Data

from

Faulting

Address

controls

Code

Flow

starting

at

STDUJBIG2File!DllGetClassObject+0x0000000000002f35.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.djvu

file

related

to

a

\User

Mode

Write

AV

starting

at

STDUDjVuFile!DllUnregisterServer+0x000000000000854d.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

file

related

to

a

\Read

Access

Violation

on

Control

Flow

starting

at

STDUJBIG2File!DllGetClassObject+0x0000000000005b70.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

file

related

to

a

\User

Mode

Write

AV

starting

at

STDUJBIG2File!DllUnregisterServer+0x000000000000570e.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.djvu

file

related

to

a

\Heap

Corruption

starting

at

wow64!Wow64NotifyDebugger+0x000000000000001d.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

file

related

to

\Data

from

Faulting

Address

controls

subsequent

Write

Address

starting

at

STDUJBIG2File!DllGetClassObject+0x00000000000043e6.\


STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file related to a \User Mode Write AV starting at Unknown Symbol @ 0x0000000004940490.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.xps

file

related

to

a

\Read

Access

Violation

on

Block

Data

Move

starting

at

STDUXPSFile!DllUnregisterServer+0x0000000000005af2.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

file

related

to

a

\User

Mode

Write

AV

starting

at

STDUJBIG2File!DllUnregisterServer+0x000000000000cb8c.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.xps

file

related

to

a

\User

Mode

Write

AV

near

starting

at


Unspecified vulnerability in Adobe Reader and Acrobat 9.x before 9.4 and 8.x before 8.2.5 on Windows and Mac OS X allows attackers to cause a denial of service or possibly execute arbitrary code via unknown vectors.


Unspecified vulnerability in Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64 and Adobe AIR before 2.0.2.12610 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors.


Unspecified vulnerability in Adobe Reader and Acrobat 9.x before 9.3.3 and 8.x before 8.2.3 on Windows and Mac OS X allows attackers to cause a denial of service or possibly execute arbitrary code via unknown vectors.


Unspecified vulnerability in Adobe Reader and Acrobat 8.x before 8.2.1 and 9.x before 9.3.1 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors.


Unspecified vulnerability in Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64 and Adobe AIR before 2.0.2.12610 allows attackers to cause a denial of service (memory consumption) or possibly execute arbitrary code via unknown vectors.


Unspecified vulnerability in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a crafted Shockwave Flash (aka .swf) file.


Unspecified vulnerability in Adobe Reader and Acrobat 10.x before 10.0.1 9.x before 9.4.2 and 8.x before 8.2.6 on Mac OS X allows attackers to cause a denial of service or possibly execute arbitrary code via unknown vectors.


Unspecified vulnerability in Apple QuickTime MPEG-2 Playback Component before 7.60.92.0 on Windows allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted MPEG-2 movie.


Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors aka ZDI-CAN-2008.


Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors aka ZDI-CAN-1905.


Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors aka ZDI-CAN-1869.


Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors aka ZDI-CAN-1896.


Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors aka ZDI-CAN-1892.


Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors aka ZDI-CAN-1897.


Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors aka ZDI-CAN-1866.


Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors aka ZDI-CAN-1870.


Unspecified vulnerability in HP Storage Data Protector 7.x before 7.03 build 107 allows remote authenticated users to execute arbitrary code or cause a denial of service via unknown vectors.


Unspecified vulnerability in HP Data Protector Express (aka DPX) 5.0.00 before build 59287 and 6.0.00 before build 11974 allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors aka ZDI-CAN-1393.


Unspecified vulnerability in HP Data Protector Express (aka DPX) 5.0.00 before build 59287 and 6.0.00 before build 11974 allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors aka ZDI-CAN-1498.


Unspecified vulnerability in HP Data Protector Express (aka DPX) 5.0.00 before build 59287 and 6.0.00 before build 11974 allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors aka ZDI-CAN-1392.


Unspecified vulnerability in HP Data Protector Express (aka DPX) 5.0.00 before build 59287 and 6.0.00 before build 11974 allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors.


Unspecified vulnerability in Opera before 9.60 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a redirect that specifies a crafted URL.


Unspecified vulnerability in the HTTP dissector for Wireshark (formerly Ethereal) 0.10.14 to 0.99.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted chunked messages.


Unspecified vulnerability in the image decoder in Adobe Acrobat 9.x before 9.2 and possibly 7.x through 7.1.4 and 8.x through 8.1.7 allows attackers to cause a denial of service or possibly execute arbitrary code via unknown vectors.


Unspecified vulnerability in the Authentication Manager (aka utauthd) in Sun Ray Server Software 4.0 and 4.1 allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors.


Unknown vulnerability in the Linux kernel before 2.4.23 on the AMD AMD64 and Intel EM64T architectures associated with \setting up TSS limits \ allows local users to cause a denial of service (crash) and possibly execute arbitrary code.


Unspecified vulnerability in the custom tag support for the TIFF library (libtiff) before 3.8.2 allows remote attackers to cause a denial of service (instability or crash) and execute arbitrary code via unknown vectors.


Unspecified vulnerability in the \compression state handling\ in Bom for Apple Mac OS X 10.3.9 and 10.4.7 allows user-assisted attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Zip archive.


Unspecified vulnerability in the hsfs filesystem in Solaris 8 9 and 10 allows unspecified attackers to cause a denial of service (panic) or execute arbitrary code.


Unspecified vulnerability in the client in Skype 5.x before 5.1.0.922 on Mac OS X allows remote authenticated users to execute arbitrary code or cause a denial of service (application crash) via a crafted message.


Unspecified vulnerability in the Smart Install functionality in Cisco IOS 12.2 and 15.1 allows remote attackers to execute arbitrary code or cause a denial of service (device crash) via crafted TCP packets to port 4786 aka Bug ID CSCto10165.


The web server on Western Digital TV Media Player 1.03.07 and TV Live Hub 3.12.13 allow unauthenticated remote attackers to execute arbitrary code or cause denial of service via crafted HTTP requests to toServerValue.cgi.


The WebGL implementation in Mozilla Firefox 4.x through 4.0.1 does not properly restrict write operations which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.


FFmpeg 0.5.x as used in MPlayer and other products allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed VC-1 file.


Multiple vulnerabilities in the web-based management interface of the Cisco Small Business RV340 RV340W RV345 and RV345P Dual WAN Gigabit VPN Routers could allow an attacker to do the following: Execute arbitrary code Cause a denial of service (DoS) condition Execute arbitrary commands For more information about these vulnerabilities see the Details section of this advisory.

denial of service
arbitrary code execution
arbitrary command execution
dos


Multiple vulnerabilities in Cisco Small Business RV160 RV260 RV340 and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities see the Details section of this advisory.

denial of service
arbitrary code execution
arbitrary command execution
dos
bypass authentication


Apache before 2.0.44 when running on unpatched Windows 9x and Me operating systems allows remote attackers to cause a denial of service or execute arbitrary code via an HTTP request containing MS-DOS device names.

denial of service
arbitrary code execution
dos


A vulnerability in the web-based management interface of VVX Trio SoundStructure SoundPoint and SoundStation phones running Polycom UC Software if exploited could allow an authenticated remote attacker with admin privileges to cause a denial of service (DoS) condition or execute arbitrary code.


A vulnerability in the web-based management interface of Cisco RV132W ADSL2+ Wireless-N VPN Routers and Cisco RV134W VDSL2 Wireless-AC VPN Routers could allow an authenticated remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload resulting in a denial of service (DoS) condition on the affected device.


Multiple vulnerabilities in Cisco SD-WAN vEdge Software could allow an attacker to execute arbitrary code as the root user or cause a denial of service (DoS) condition on an affected device. For more information about these vulnerabilities see the Details section of this advisory.


Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business RV Series Routers. An unauthenticated adjacent attacker could execute arbitrary code or cause an affected router to leak system memory or reload. A memory leak or device reload would cause a denial of service (DoS) condition on an affected device. For more information about these vulnerabilities see the Details section of this advisory. Note: LLDP is a Layer 2 protocol. To exploit these vulnerabilities an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).


A vulnerability in the Universal Plug-and-Play (UPnP) service of Cisco Small Business RV110W RV130 RV130W and RV215W Routers could allow an unauthenticated remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly resulting in a denial of service (DoS) condition. This vulnerability is due to improper validation of incoming UPnP traffic. An attacker could exploit this vulnerability by sending a crafted UPnP request to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload resulting in a DoS condition. Cisco has not released software updates that address this vulnerability.


A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 9000 Family Wireless Controllers could allow an unauthenticated remote attacker to execute arbitrary code with administrative privileges or cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a logic error that occurs during the validation of CAPWAP packets. An attacker could exploit this vulnerability by sending a crafted CAPWAP packet to an affected device. A successful exploit could allow the attacker to execute arbitrary code with administrative privileges or cause the affected device to crash and reload resulting in a DoS condition.


Hidden functionality in multiple Buffalo network devices (BHR-4RV firmware Ver.2.55 and prior FS-G54 firmware Ver.2.04 and prior WBR2-B11 firmware Ver.2.32 and prior WBR2-G54 firmware Ver.2.32 and prior WBR2-G54-KD firmware Ver.2.32 and prior WBR-B11 firmware Ver.2.23 and prior WBR-G54 firmware Ver.2.23 and prior WBR-G54L firmware Ver.2.20 and prior WHR2-A54G54 firmware Ver.2.25 and prior WHR2-G54 firmware Ver.2.23 and prior WHR2-G54V firmware Ver.2.55 and prior WHR3-AG54 firmware Ver.2.23 and prior WHR-G54 firmware Ver.2.16 and prior WHR-G54-NF firmware Ver.2.10 and prior WLA2-G54 firmware Ver.2.24 and prior WLA2-G54C firmware Ver.2.24 and prior WLA-B11 firmware Ver.2.20 and prior WLA-G54 firmware Ver.2.20 and prior WLA-G54C firmware Ver.2.20 and prior WLAH-A54G54 firmware Ver.2.54 and prior WLAH-AM54G54 firmware Ver.2.54 and prior WLAH-G54 firmware Ver.2.54 and prior WLI2-TX1-AG54 firmware Ver.2.53 and prior WLI2-TX1-AMG54 firmware Ver.2.53 and prior WLI2-TX1-G54 firmware Ver.2.20 and prior WLI3-TX1-AMG54 firmware Ver.2.53 and prior WLI3-TX1-G54 firmware Ver.2.53 and prior WLI-T1-B11 firmware Ver.2.20 and prior WLI-TX1-G54 firmware Ver.2.20 and prior WVR-G54-NF firmware Ver.2.02 and prior WZR-G108 firmware Ver.2.41 and prior WZR-G54 firmware Ver.2.41 and prior WZR-HP-G54 firmware Ver.2.41 and prior WZR-RS-G54 firmware Ver.2.55 and prior and WZR-RS-G54HP firmware Ver.2.55 and prior) allows a remote attacker to enable the debug option and to execute arbitrary code or OS commands change the configuration and cause a denial of service (DoS) condition.


Sophos Anti-Virus for Windows and for Unix/Linux before 2.48.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted UPX packed file resulting from an \integer cast around\. NOTE: as of 20070828 the vendor says this is a DoS and the researcher says this allows code execution but the researcher is reliable.


Microsoft Internet Information Services (IIS) 6.0 allows remote attackers to cause a denial of service (server instability or device hang) and possibly obtain sensitive information (device communication traffic); and might allow attackers with physical access to execute arbitrary code after connecting a data stream to a device COM port; via requests for a URI containing a '/' immediately before and after the name of a DOS device as demonstrated by the /AUX/.aspx URI which bypasses a blacklist for DOS device requests.


A vulnerability in a proprietary device driver in the kernel of Cisco TelePresence Multipoint Control Unit (MCU) Software could allow an unauthenticated remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. The vulnerability is due to improper size validation when reassembling fragmented IPv4 or IPv6 packets. An attacker could exploit this vulnerability by sending crafted IPv4 or IPv6 fragments to a port receiving content in Passthrough content mode. An exploit could allow the attacker to overflow a buffer. If successful the attacker could execute arbitrary code or cause a DoS condition on the affected system. Cisco TelePresence MCU platforms TelePresence MCU 5300 Series TelePresence MCU MSE 8510 and TelePresence MCU 4500 are affected when running software version 4.3(1.68) or later configured for Passthrough content mode. Cisco has released software updates that address this vulnerability. Workarounds that address this vulnerability are not available but mitigations are available. Cisco Bug IDs: CSCuu67675.


A vulnerability in the authentication authorization and accounting (AAA) security services of Cisco IOS XE Software could allow an unauthenticated remote attacker to execute arbitrary code on an affected device or cause an affected device to reload resulting in a denial of service (DoS) condition. The vulnerability is due to incorrect memory operations that the affected software performs when the software parses a username during login authentication. An attacker could exploit this vulnerability by attempting to authenticate to an affected device. A successful exploit could allow the attacker to execute arbitrary code on the affected device or cause the affected device to reload resulting in a DoS condition. This vulnerability affects Cisco devices that are running Cisco IOS XE Software Release Fuji 16.7.1 or Fuji 16.8.1 and are configured to use AAA for login authentication. Cisco Bug IDs: CSCvi25380.


A vulnerability in the web interface of the Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticated remote attacker to execute arbitrary code and gain full control of an affected system including issuing commands with root privileges. The attacker could also cause an affected system to reload resulting in a denial of service (DoS) condition. The vulnerability is due to an incomplete input validation on user-controlled input in an HTTP request to the targeted device. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to execute arbitrary code as the root user and gain full control of the affected system or cause it to reload resulting in a DoS condition. This vulnerability is fixed in firmware version 1.0.1.11 for the following Cisco products: RV132W ADSL2+ Wireless-N VPN Router and RV134W VDSL2 Wireless-AC VPN Router. Cisco Bug IDs: CSCvg92737 CSCvh60170.