Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux Adobe AIR before 20.0.0.233 Adobe AIR SDK before 20.0.0.233 and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-8634 CVE-2015-8635 CVE-2015-8638 CVE-2015-8639 CVE-2015-8640 CVE-2015-8641 CVE-2015-8642 CVE-2015-8643 CVE-2015-8647 CVE-2015-8648 CVE-2015-8649 and CVE-2015-8650.


Use-after-free

vulnerability

in

Adobe

Flash

Player

before

and

and

before

on

Windows

and

OS

X

and

before

on

Linux

Adobe

AIR

before

Adobe

AIR

SDK

before

and

Adobe

AIR

SDK

Compiler

before

allows

attackers

to

execute

arbitrary

code

via

unspecified

vectors

a

different

vulnerability

than

and


Use-after-free

vulnerability

in

the

MovieClip

object

implementation

in

Adobe

Flash

Player

before

and

and

before

on

Windows

and

OS

X

and

before

on

Linux

Adobe

AIR

before

Adobe

AIR

SDK

before

and

Adobe

AIR

SDK

Compiler

before

allows

attackers

to

execute

arbitrary

code

via

a

crafted

filters

property

value

a

different

vulnerability

than

and


Intel McAfee ePolicy Orchestrator (ePO) 4.6.9 and earlier 5.0.x 5.1.x before 5.1.3 Hotfix 1106041 and 5.3.x before 5.3.1 Hotfix 1106041 allow remote attackers to execute arbitrary code via a crafted serialized Java object related to the Apache Commons Collections (ACC) library.


Use-after-free

vulnerability

in

Adobe

Flash

Player

before

and

and

before

on

Windows

and

OS

X

and

before

on

Linux

Adobe

AIR

before

Adobe

AIR

SDK

before

and

Adobe

AIR

SDK

Compiler

before

allows

attackers

to

execute

arbitrary

code

via

crafted

data

a

different

vulnerability

than

and


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux Adobe AIR before 20.0.0.233 Adobe AIR SDK before 20.0.0.233 and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-8635 CVE-2015-8638 CVE-2015-8639 CVE-2015-8640 CVE-2015-8641 CVE-2015-8642 CVE-2015-8643 CVE-2015-8646 CVE-2015-8647 CVE-2015-8648 CVE-2015-8649 and CVE-2015-8650.


The SharedObject object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux Adobe AIR before 20.0.0.204 Adobe AIR SDK before 20.0.0.204 and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code by leveraging an unspecified \type confusion\ during a getRemote call a different vulnerability than CVE-2015-8456.


SAP 3D Visual Enterprise Viewer (VEV) allows remote attackers to execute arbitrary code via a crafted (1) U3D (2) LWO (3) JPEG2000 or (4) FBX file aka \Out-Of-Bounds Indexing\ vulnerabilities.


The SysPlant.sys driver in the Application and Device Control (ADC) component in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6-MP4 allows remote attackers to execute arbitrary code via a crafted HTML document related to \RWX Permissions.\


Use-after-free

vulnerability

in

the

Color

object

implementation

in

Adobe

Flash

Player

before

and

and

before

on

Windows

and

OS

X

and

before

on

Linux

Adobe

AIR

before

Adobe

AIR

SDK

before

and

Adobe

AIR

SDK

Compiler

before

allows

attackers

to

execute

arbitrary

code

via

crafted

setTransform

arguments

a

different

vulnerability

than

and


Use-after-free

vulnerability

in

the

TextField

object

implementation

in

Adobe

Flash

Player

before

and

and

before

on

Windows

and

OS

X

and

before

on

Linux

Adobe

AIR

before

Adobe

AIR

SDK

before

and

Adobe

AIR

SDK

Compiler

before

allows

attackers

to

execute

arbitrary

code

via

crafted

text

property

a

different

vulnerability

than

and


The

Jenkins

CLI

subsystem

in

Jenkins

before

and

LTS

before

allows

remote

attackers

to

execute

arbitrary

code

via

a

crafted

serialized

Java

object

related

to

a

problematic

webapps/ROOT/WEB-INF/lib/commons-collections-*.jar

file

and

the

\Groovy

variant

in

'ysoserial'\.


NetApp OnCommand System Manager 8.3.x before 8.3.2 allows remote authenticated users to execute arbitrary code via unspecified vectors.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux Adobe AIR before 20.0.0.233 Adobe AIR SDK before 20.0.0.233 and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-8634 CVE-2015-8638 CVE-2015-8639 CVE-2015-8640 CVE-2015-8641 CVE-2015-8642 CVE-2015-8643 CVE-2015-8646 CVE-2015-8647 CVE-2015-8648 CVE-2015-8649 and CVE-2015-8650.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux Adobe AIR before 20.0.0.233 Adobe AIR SDK before 20.0.0.233 and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-8634 CVE-2015-8635 CVE-2015-8638 CVE-2015-8639 CVE-2015-8640 CVE-2015-8641 CVE-2015-8642 CVE-2015-8646 CVE-2015-8647 CVE-2015-8648 CVE-2015-8649 and CVE-2015-8650.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux Adobe AIR before 20.0.0.233 Adobe AIR SDK before 20.0.0.233 and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-8634 CVE-2015-8635 CVE-2015-8638 CVE-2015-8640 CVE-2015-8641 CVE-2015-8642 CVE-2015-8643 CVE-2015-8646 CVE-2015-8647 CVE-2015-8648 CVE-2015-8649 and CVE-2015-8650.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux Adobe AIR before 19.0.0.241 Adobe AIR SDK before 19.0.0.241 and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via a crafted loadSound call a different vulnerability than CVE-2015-7651 CVE-2015-7652 CVE-2015-7653 CVE-2015-7654 CVE-2015-7655 CVE-2015-7656 CVE-2015-7657 CVE-2015-7658 CVE-2015-7660 CVE-2015-7661 CVE-2015-7663 CVE-2015-8043 CVE-2015-8044 and CVE-2015-8046.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux Adobe AIR before 20.0.0.233 Adobe AIR SDK before 20.0.0.233 and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-8634 CVE-2015-8635 CVE-2015-8638 CVE-2015-8639 CVE-2015-8640 CVE-2015-8641 CVE-2015-8642 CVE-2015-8643 CVE-2015-8646 CVE-2015-8648 CVE-2015-8649 and CVE-2015-8650.


Use-after-free vulnerability in the create_smp_dialog function in gtk-dialog.c in the Off-the-Record Messaging (OTR) pidgin-otr plugin before 4.0.2 for Pidgin allows remote attackers to execute arbitrary code via vectors related to the \Authenticate buddy\ menu item.


Use-after-free

vulnerability

in

Adobe

Flash

Player

before

and

and

before

on

Windows

and

OS

X

and

before

on

Linux

Adobe

AIR

before

Adobe

AIR

SDK

before

and

Adobe

AIR

SDK

Compiler

before

allows

attackers

to

execute

arbitrary

code

via

unspecified

vectors

a

different

vulnerability

than

and


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux Adobe AIR before 19.0.0.241 Adobe AIR SDK before 19.0.0.241 and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-7651 CVE-2015-7652 CVE-2015-7653 CVE-2015-7654 CVE-2015-7655 CVE-2015-7656 CVE-2015-7657 CVE-2015-7658 CVE-2015-7660 CVE-2015-7661 CVE-2015-7663 CVE-2015-8042 CVE-2015-8043 and CVE-2015-8044.


Use-after-free

vulnerability

in

the

MovieClip

object

implementation

in

Adobe

Flash

Player

before

and

and

before

on

Windows

and

OS

X

and

before

on

Linux

Adobe

AIR

before

Adobe

AIR

SDK

before

and

Adobe

AIR

SDK

Compiler

before

allows

attackers

to

execute

arbitrary

code

via

a

crafted

beginGradientFill

call

a

different

vulnerability

than

and


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux Adobe AIR before 20.0.0.233 Adobe AIR SDK before 20.0.0.233 and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-8634 CVE-2015-8635 CVE-2015-8638 CVE-2015-8639 CVE-2015-8640 CVE-2015-8641 CVE-2015-8642 CVE-2015-8643 CVE-2015-8646 CVE-2015-8647 CVE-2015-8648 and CVE-2015-8650.


The AMF3CD_AddProp function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to execute arbitrary code.


Use-after-free

vulnerability

in

Adobe

Flash

Player

before

and

and

before

on

Windows

and

OS

X

and

before

on

Linux

Adobe

AIR

before

Adobe

AIR

SDK

before

and

Adobe

AIR

SDK

Compiler

before

allows

attackers

to

execute

arbitrary

code

via

crafted

data

a

different

vulnerability

than

and


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux Adobe AIR before 20.0.0.233 Adobe AIR SDK before 20.0.0.233 and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-8634 CVE-2015-8635 CVE-2015-8638 CVE-2015-8639 CVE-2015-8640 CVE-2015-8642 CVE-2015-8643 CVE-2015-8646 CVE-2015-8647 CVE-2015-8648 CVE-2015-8649 and CVE-2015-8650.


The phase_one_correct function in Libraw before 0.17.1 allows attackers to cause memory errors and possibly execute arbitrary code related to memory object initialization.


The rtsp_getdlsendtime method in the CNC_Ctrl control in Samsung SmartViewer allows remote attackers to execute arbitrary code via an index value.


The Session package 1.x before 1.3.1 for Joomla! Framework allows remote attackers to execute arbitrary code via unspecified session values.


Use-after-free

vulnerability

in

the

MovieClip

object

implementation

in

Adobe

Flash

Player

before

and

and

before

on

Windows

and

OS

X

and

before

on

Linux

Adobe

AIR

before

Adobe

AIR

SDK

before

and

Adobe

AIR

SDK

Compiler

before

allows

attackers

to

execute

arbitrary

code

via

a

crafted

lineTo

method

call

a

different

vulnerability

than

and


Arista EOS before 4.11.12 4.12 before 4.12.11 4.13 before 4.13.14M 4.14 before 4.14.5FX.5 and 4.15 before 4.15.0FX1.1 allows remote attackers to execute arbitrary code as root by leveraging management-plane access aka Bug 138716.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux Adobe AIR before 19.0.0.241 Adobe AIR SDK before 19.0.0.241 and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-7651 CVE-2015-7652 CVE-2015-7653 CVE-2015-7654 CVE-2015-7655 CVE-2015-7656 CVE-2015-7657 CVE-2015-7658 CVE-2015-7660 CVE-2015-7661 CVE-2015-7663 CVE-2015-8042 CVE-2015-8043 and CVE-2015-8046.


Use-after-free

vulnerability

in

the

Selection

object

implementation

in

Adobe

Flash

Player

before

and

and

before

on

Windows

and

OS

X

and

before

on

Linux

Adobe

AIR

before

Adobe

AIR

SDK

before

and

Adobe

AIR

SDK

Compiler

before

allows

attackers

to

execute

arbitrary

code

via

a

crafted

setFocus

call

a

different

vulnerability

than

and


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux Adobe AIR before 20.0.0.233 Adobe AIR SDK before 20.0.0.233 and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-8634 CVE-2015-8635 CVE-2015-8638 CVE-2015-8639 CVE-2015-8641 CVE-2015-8642 CVE-2015-8643 CVE-2015-8646 CVE-2015-8647 CVE-2015-8648 CVE-2015-8649 and CVE-2015-8650.


Use-after-free

vulnerability

in

Adobe

Flash

Player

before

and

and

before

on

Windows

and

OS

X

and

before

on

Linux

Adobe

AIR

before

Adobe

AIR

SDK

before

and

Adobe

AIR

SDK

Compiler

before

allows

attackers

to

execute

arbitrary

code

via

a

crafted

filters

property

value

in

a

TextField

object

a

different

vulnerability

than

and


MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was discovered (fixed and publicly disclosed in 2015) in Lenovo Solution Center (LSC) prior to version 3.3.002 that could allow a user to execute arbitrary code with elevated privileges.


Use-after-free

vulnerability

in

Adobe

Flash

Player

before

and

and

before

on

Windows

and

OS

X

and

before

on

Linux

Adobe

AIR

before

Adobe

AIR

SDK

before

and

Adobe

AIR

SDK

Compiler

before

allows

attackers

to

execute

arbitrary

code

via

unspecified

vectors

a

different

vulnerability

than

and


Use-after-free

vulnerability

in

the

DisplacementMapFilter

object

implementation

in

Adobe

Flash

Player

before

and

and

before

on

Windows

and

OS

X

and

before

on

Linux

Adobe

AIR

before

Adobe

AIR

SDK

before

and

Adobe

AIR

SDK

Compiler

before

allows

attackers

to

execute

arbitrary

code

via

a

crafted

mapBitmap

property

value

a

different

vulnerability

than

and


Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux Adobe AIR before 20.0.0.233 Adobe AIR SDK before 20.0.0.233 and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code by leveraging an unspecified \type confusion.\


Format string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format string specifiers in a string that is misused as a class name leading to incorrect error handling.


Use-after-free

vulnerability

in

the

PrintJob

object

implementation

in

Adobe

Flash

Player

before

and

and

before

on

Windows

and

OS

X

and

before

on

Linux

Adobe

AIR

before

Adobe

AIR

SDK

before

and

Adobe

AIR

SDK

Compiler

before

allows

attackers

to

execute

arbitrary

code

via

crafted

addPage

arguments

a

different

vulnerability

than

and


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux Adobe AIR before 20.0.0.233 Adobe AIR SDK before 20.0.0.233 and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-8634 CVE-2015-8635 CVE-2015-8638 CVE-2015-8639 CVE-2015-8640 CVE-2015-8641 CVE-2015-8642 CVE-2015-8643 CVE-2015-8646 CVE-2015-8647 CVE-2015-8648 and CVE-2015-8649.


The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code.


Use-after-free

vulnerability

in

the

TextField

object

implementation

in

Adobe

Flash

Player

before

and

and

before

on

Windows

and

OS

X

and

before

on

Linux

Adobe

AIR

before

Adobe

AIR

SDK

before

and

Adobe

AIR

SDK

Compiler

before

allows

attackers

to

execute

arbitrary

code

via

a

crafted

autoSize

property

value

a

different

vulnerability

than

and


CGI handling flaw in bozohttpd in NetBSD 6.0 through 6.0.6 6.1 through 6.1.5 and 7.0 allows remote attackers to execute arbitrary code via crafted arguments which are handled by a non-CGI aware program.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux Adobe AIR before 20.0.0.233 Adobe AIR SDK before 20.0.0.233 and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-8634 CVE-2015-8635 CVE-2015-8638 CVE-2015-8639 CVE-2015-8640 CVE-2015-8641 CVE-2015-8642 CVE-2015-8643 CVE-2015-8646 CVE-2015-8647 CVE-2015-8649 and CVE-2015-8650.


The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safe when \html\ are the last four characters as demonstrated by a .phtml file containing PHP code.


The

VideoWhisper

videowhisper-video-conference-integration

plugin

for

WordPress

allows

remote

attackers

to

execute

arbitrary

code

because

considers

a

file

safe

when

\html\

are

the

last

four

characters

as

demonstrated

by

a

.phtml

file

containing

PHP

code

a

different

vulnerability

than


Lansweeper 4.x through 6.x before 6.0.0.48 allows attackers to execute arbitrary code on the administrator's workstation via a crafted Windows service.


Unspecified vulnerability in mso.dll in Microsoft PowerPoint 2003 allows user-assisted attackers to execute arbitrary code via a crafted PowerPoint file. NOTE: due to the lack of available details as of 20060717 it is unclear how this is related to CVE-2006-3656 CVE-2006-3660 and CVE-2006-3590 although it is possible that they are all different.


Unspecified vulnerability in PowerPoint in Microsoft Office 2000 Office 2002 Office 2003 Office 2004 for Mac and Office v.X for Mac allows user-assisted attackers to execute arbitrary code via a crafted Data record in a PPT file a different vulnerability than CVE-2006-3435 and CVE-2006-4694.


WebEx Downloader ActiveX Control and WebEx Downloader Java before 2.1.0.0 do not validate downloaded components which allows remote attackers to execute arbitrary code via a website that activates the GpcUrlRoot and GpcIniFileName ActiveX controls to cause the client to download a DLL file.


The dynamic linker (dyld) in Apple Mac OS X 10.4.7 allows local users to execute arbitrary code via an \improperly handled condition\ that leads to use of \dangerous paths \ probably related to an untrusted search path vulnerability.


The SAVRT.SYS device driver as used in Symantec AntiVirus Corporate Edition 8.1 and 9.0.x up to 9.0.3 and Symantec Client Security 1.1 and 2.0.x up to 2.0.3 allows local users to execute arbitrary code via a modified address for the output buffer argument to the DeviceIOControl function.


Microsoft Internet Explorer 5 SP4 and 6 do not properly garbage collect when \multiple imports are used on a styleSheets collection\ to construct a chain of Cascading Style Sheets (CSS) which allows remote attackers to execute arbitrary code via unspecified vectors.


Multiple format string vulnerabilities in Symantec AntiVirus Corporate Edition 8.1 up to 10.0 and Client Security 1.x up to 3.0 allow local users to execute arbitrary code via format strings in (1) Tamper Protection and (2) Virus Alert Notification messages.


Unspecified vulnerability in Microsoft Excel 2000 2002 2003 2004 for Mac v.X for Mac and Excel Viewer 2003 allows user-assisted attackers to execute arbitrary code via a crafted Lotus 1-2-3 file a different vulnerability than CVE-2006-2387 and CVE-2006-3875.


Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code by using the document.getElementByID Javascript function to access crafted Cascading Style Sheet (CSS) elements and possibly other unspecified vectors involving certain layout positioning combinations in an HTML file.


The Javascript engine in Mozilla Firefox before 1.5.0.5 Thunderbird before 1.5.0.5 and SeaMonkey before 1.0.3 might allow remote attackers to execute arbitrary code via vectors involving garbage collection that causes deletion of a temporary object that is still being used.


Unspecified vulnerability in PowerPoint in Microsoft Office 2000 Office 2002 Office 2003 Office 2004 for Mac and Office v.X for Mac allows user-assisted attackers to execute arbitrary code via an unspecified \crafted file \ a different vulnerability than CVE-2006-3435 CVE-2006-4694 and CVE-2006-3876.


Microsoft Office 2000 XP 2003 2004 for Mac and v.X for Mac do not properly parse the length of a chart record which allows remote user-assisted attackers to execute arbitrary code via a Word document with an embedded malformed chart record that triggers an overwrite of pointer values with values from the document a different vulnerability than CVE-2006-3434 CVE-2006-3864 and CVE-2006-3868.


Unspecified vulnerability in Microsoft Windows 2000 SP4 XP SP1 and SP2 Server 2003 and 2003 SP1 allows remote attackers to execute arbitrary code via unspecified vectors involving unhandled exceptions memory resident applications and incorrectly \unloading chained exception.\


Mozilla Firefox 1.5 before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to execute arbitrary code by changing certain properties of the window navigator object (window.navigator) that are accessed when Java starts up which causes a crash that leads to code execution.


The Symantec NAVOPTS.DLL ActiveX control (aka Symantec.Norton.AntiVirus.NAVOptions) 12.2.0.13 as used in Norton AntiVirus Internet Security and System Works 2005 and 2006 is designed for use only in application-embedded web browsers which allows remote attackers to \crash the control\ via unspecified vectors related to content on a web site and place Internet Explorer into a \defunct state\ in which remote attackers can execute arbitrary code in addition to other Symantec ActiveX controls regardless of whether they are marked safe for scripting. NOTE: this CVE was inadvertently used for an E-mail Auto-Protect issue but that issue has been assigned CVE-2007-3771.


Multiple

PHP

remote

file

inclusion

vulnerabilities

in

phpRaid

and

allow

remote

attackers

to

execute

arbitrary

code

via

a

URL

in

the

parameter

to

configuration.php

guilds.php

index.php

locations.php

login.php

permissions.php

profile.php

raids.php

register.php

roster.php

and

view.php.


Mozilla Firefox before 1.5.0.5 Thunderbird before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to execute arbitrary code via script that changes the standard Object() constructor to return a reference to a privileged object and calling \named JavaScript functions\ that use the constructor.


Unspecified vulnerability in Pragmatic General Multicast (PGM) in Microsoft Windows XP SP2 and earlier allows remote attackers to execute arbitrary code via a crafted multicast message.


Unspecified vulnerability in Microsoft Excel 2000 2002 2003 2004 for Mac v.X for Mac and Excel Viewer 2003 allows user-assisted attackers to execute arbitrary code via a crafted COLINFO record in an XLS file a different vulnerability than CVE-2006-2387 and CVE-2006-3867.


PHP remote file inclusion vulnerability in phpRaid 3.0.6 allows remote attackers to execute arbitrary code via a URL in the phpraid_dir parameter to (1) announcements.php and (2) rss.php a different set of vectors and affected versions than CVE-2006-3316 and CVE-2006-3116.


PowerPoint in Microsoft Office 2000 XP 2003 2004 for Mac and v.X for Mac does not properly parse the slide notes field in a document which allows remote user-assisted attackers to execute arbitrary code via crafted data in this field which triggers an erroneous object pointer calculation that uses data from within the document. NOTE: this issue is different than other PowerPoint vulnerabilities including CVE-2006-4694.


TWiki 01-Dec-2000 up to 4.0.3 allows remote attackers to bypass the upload filter and execute arbitrary code via filenames with double extensions such as \.php.en\ \.php.1\ and other allowed extensions that are not .txt. NOTE: this is only a vulnerability when the server allows script execution in the pub directory.


PHP remote file inclusion vulnerability in manager/frontinc/prepend.php for Plume 1.0.3 allows remote attackers to execute arbitrary code via a URL in the _PX_configmanager_path parameter. NOTE: this is a different executable and affected version than CVE-2006-0725.


Drupal 4.6.x before 4.6.8 and 4.7.x before 4.7.2 when running under certain Apache configurations such as when FileInfo overrides are disabled within .htaccess allows remote attackers to execute arbitrary code by uploading a file with multiple extensions a variant of CVE-2006-2743.


admin/upprocess.php in DGNews 1.5 and earlier allows remote attackers to execute arbitrary code by uploading scripts with arbitrary extensions to the img directory.


180solutions Zango downloads \required Adware components\ without checking integrity or authenticity which might allow context-dependent attackers to execute arbitrary code by subverting the DNS resolution of static.zangocash.com.


Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via \unexpected data\ related to \parameter validation\ in the DXImageTransform.Microsoft.Light ActiveX control which causes Internet Explorer to crash in a way that enables the code execution.


Unspecified vulnerability in Microsoft Excel 2000 2002 2003 2004 for Mac v.X for Mac Excel Viewer 2003 and Microsoft Works Suite 2004 through 2006 allows user-assisted attackers to execute arbitrary code via a crafted DATETIME record in an XLS file a different vulnerability than CVE-2006-3867 and CVE-2006-3875.


AWStats 6.5 and possibly other versions allows remote authenticated users to execute arbitrary code by using the configdir parameter to awstats.pl to upload a configuration file whose name contains shell metacharacters then access that file using the LogFile directive.


PHP remote file include vulnerability in admin/config_settings.tpl.php in I-RATER Platinum allows remote attackers to execute arbitrary code via a URL in the include_path parameter. NOTE: this is a different vector and possibly a different vulnerability than CVE-2006-1929.


Unspecified vulnerability in Mozilla Firefox before 1.5.0.4 and SeaMonkey before 1.0.2 allows remote attackers to execute arbitrary code by using the nsISelectionPrivate interface of the Selection object to add a SelectionListener and create notifications that are executed in a privileged context.


** DISPUTED ** Format string vulnerability in Mailman before 2.1.9 allows attackers to execute arbitrary code via unspecified vectors. NOTE: the vendor has disputed this vulnerability stating that it is \unexploitable.\


EMC Retrospect for Windows 6.5 before 6.5.382 7.0 before 7.0.344 and 7.5 before 7.5.1.105 allows local users to execute arbitrary code by replacing the Retrospect.exe file possibly due to improper file permissions.


Format string vulnerability in the raydium_log function in console.c in Raydium before SVN revision 310 allows local users to execute arbitrary code via format string specifiers in the format parameter which are not properly handled in a call to raydium_console_line_add.


Prodder before 0.5 and perlpodder before 0.5 allows remote attackers to execute arbitrary code via shell metacharacters in the URL of a podcast (url attribute of an enclosure tag or $enc_url variable) which is executed when running wget.


perlpodder before 0.5 allows remote attackers to execute arbitrary code via shell metacharacters in the URL of a podcast which are executed when saving the URL to a log file. NOTE: the wget vector is already covered by CVE-2006-2548.


add.asp in DUware DUbanner 3.1 allows remote attackers to execute arbitrary code by uploading files with arbitrary extensions such as ASP files probably due to client-side enforcement that can be bypassed. NOTE: some of these details are obtained from third party information since the raw source is vague.


Microsoft Office Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via malformed cell comments which lead to modification of \critical data offsets\ during the rebuilding process.


PHP remote file inclusion vulnerability in index.php in CoolMenus allows remote attackers to execute arbitrary code via a URL in the page parameter. NOTE: the original report for this issue is probably erroneous since CoolMenus does not appear to be written in PHP.


Unspecified vulnerability in ESTsoft InternetDISK versions before 2006/04/20 allows remote authenticated users to execute arbitrary code possibly by uploading a file with multiple extensions into the WebLink directory.


PHP remote file inclusion vulnerability in DeluxeBB 1.06 allows remote attackers to execute arbitrary code via a URL in the templatefolder parameter to (1) postreply.php (2) posting.php (3) and pm/newpm.php in the deluxe/ directory and (4) postreply.php (5) posting.php and (6) pm/newpm.php in the default/ directory.


EMC Retrospect for Windows 6.5 before 6.5.382 7.0 before 7.0.344 and 7.5 before 7.5.1.105 does not drop privileges before opening files which allows local users to execute arbitrary code via the File>Open dialog.


Ansilove before 1.03 does not filter uploaded file extensions which allows remote attackers to execute arbitrary code by uploading arbitrary files with dangerous extensions then accessing them directly in the upload directory.


Unspecified vulnerability in the RDS.Dataspace ActiveX control which is contained in ActiveX Data Objects (ADO) and distributed in Microsoft Data Access Components (MDAC) 2.7 and 2.8 allows remote attackers to execute arbitrary code via unknown attack vectors.


The ncprwsnt service in NCP Network Communication Secure Client 8.11 Build 146 and possibly other versions allows local users to execute arbitrary code by modifying the connect.bat script which is automatically executed by the service after a connection is established.


Mozilla Firefox before 1.5.0.1 Thunderbird 1.5 if running Javascript in mail and SeaMonkey before 1.0 allow remote attackers to execute arbitrary code by changing an element's style from position:relative to position:static which causes Gecko to operate on freed memory.


Tiny ASN.1 Library (libtasn1) before 0.2.18 as used by (1) GnuTLS 1.2.x before 1.2.10 and 1.3.x before 1.3.4 and (2) GNU Shishi allows attackers to crash the DER decoder and possibly execute arbitrary code via \out-of-bounds access\ caused by invalid input as demonstrated by the ProtoVer SSL test suite.


GUI display truncation vulnerability in Mozilla Thunderbird 1.0.2 1.0.6 and 1.0.7 allows user-assisted attackers to execute arbitrary code via an attachment with a filename containing a large number of spaces ending with a dangerous extension that is not displayed by Thunderbird along with an inconsistent Content-Type header which could be used to trick a user into downloading dangerous content by dragging or saving the attachment.


Multiple PHP remote file include vulnerabilities in RunCMS 1.2 and earlier with register_globals and allow_url_fopen enabled allow remote attackers to execute arbitrary code via the bbPathpath parameter in (1) class.forumposts.php and (2) forumpollrenderer.php.


The GUI (nod32.exe) in NOD32 2.5 runs with SYSTEM privileges when the scheduler runs a scheduled on-demand scan which allows local users to execute arbitrary code during a scheduled scan via unspecified attack vectors.


QNX Neutrino RTOS 6.3.0 ships /etc/rc.d/rc.local with world-writable permissions which allows local users to modify the file and execute arbitrary code at system startup.


Unspecified vulnerability in the Lexmark Printer Sharing LexBce Server Service (LexPPS) possibly 8.29 and 9.41 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: This information is based on a vague initial disclosure; details will be updated after the grace period has ended.


Unspecified vulnerability in weblog.pl in PerlBlog 1.09b and earlier allows remote attackers to create arbitrary files and possibly execute arbitrary code via unspecified attack vectors related to improper handling of (1) the reply parameter possibly involving injection of (2) the name parameter and (3) the body parameter.


Multiple Sophos Anti-Virus products including Anti-Virus for Windows 5.x before 5.2.1 and 4.x before 4.05 when cabinet file inspection is enabled allows remote attackers to execute arbitrary code via a CAB file with \invalid folder count values \ which leads to heap corruption.


By design Microsoft Visual Studio 2005 automatically executes code in the Load event of a user-defined control (UserControl1_Load function) which allows user-assisted attackers to execute arbitrary code by tricking the user into opening a malicious Visual Studio project file.


PHP

remote

file

include

vulnerability

in

and

certain

other

include/templates/categories/

PHP

scripts

in

Valdersoft

Shopping

Cart

allows

remote

attackers

to

execute

arbitrary

code

via

a

URL

in

the

catalogDocumentRoot

parameter.


Unspecified vulnerability in Windows Explorer in Microsoft Windows 2000 SP4 XP SP1 and SP2 and Server 2003 SP1 allows remote attackers to execute arbitrary code via attack vectors involving COM objects and \crafted files and directories \ aka the \Windows Shell Vulnerability.\


Unspecified vulnerability in index.php in a certain application available from /v1/tr/portfoy.php on www.egeinternet.com allows remote attackers to execute arbitrary code via \evilcode\ in the key parameter possibly a PHP remote file include vulnerability in which the attack vector is a URL in the key parameter. NOTE: it is not clear whether this vulnerability is associated with an online service or application service provider. If so then it should not be included in CVE.


Multiple unspecified vulnerabilities in lib-common.php in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allow remote attackers to include arbitrary local files and execute arbitrary code via (1) absolute paths in unspecified parameters and (2) the language cookie as demonstrated for code execution using error.log.


Unspecified vulnerability in Microsoft Outlook 2000 through 2003 Exchange 5.0 Server SP2 and 5.5 SP4 Exchange 2000 SP3 and Office allows remote attackers to execute arbitrary code via an e-mail message with a crafted Transport Neutral Encapsulation Format (TNEF) MIME attachment related to message length validation.


ld in SUSE Linux 9.1 through 10.0 and SLES 9 in certain circumstances when linking binaries can leave an empty RPATH or RUNPATH which allows local attackers to execute arbitrary code as other users via by running an ld-linked application from the current directory which could contain an attacker-controlled library file.


The Download Validation in Mail in Mac OS X 10.4 does not properly recognize attachment file types to warn a user of an unsafe type which allows user-assisted remote attackers to execute arbitrary code via crafted file types.


Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8 Mozilla Suite before 1.7.13 and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via \an invalid and non-sensical ordering of table-related tags\ that results in a negative array index.


gdi/driver.c and gdi/printdrv.c in Wine 20050930 and other versions implement the SETABORTPROC GDI Escape function call for Windows Metafile (WMF) files which allows attackers to execute arbitrary code the same vulnerability as CVE-2005-4560 but in a different codebase.


Format string vulnerability in the SMTP server for McAfee WebShield 4.5 MR2 and earlier allows remote attackers to execute arbitrary code via format strings in the domain name portion of a destination address which are not properly handled when a bounce message is constructed.


rsh utility in Sun Grid Engine (SGE) before 6.0u7_1 allows local users to gain privileges and execute arbitrary code via unspecified vectors possibly involving command line arguments.


PHP remote file include vulnerability in index.php in OrjinWeb E-commerce allows remote attackers to execute arbitrary code via a URL in the page parameter. NOTE: it is not clear but OrjinWeb might be an application service in which case it should not be included in CVE.


X.Org server (xorg-server) 1.0.0 and later X11R6.9.0 and X11R7.0 inadvertently treats the address of the geteuid function as if it is the return value of a call to geteuid which allows local users to bypass intended restrictions and (1) execute arbitrary code via the -modulepath command line option or (2) overwrite arbitrary files via -logfile.


Multiple format string vulnerabilities in the logging code in Clam AntiVirus (ClamAV) before 0.88.1 might allow remote attackers to execute arbitrary code. NOTE: as of 20060410 it is unclear whether this is a vulnerability as there is some evidence that the arguments are actually being sanitized properly.


Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted BIFF record with an attacker-controlled array index that is used for a function pointer aka \Malformed OBJECT record Vulnerability.\


Format string vulnerability in the safe_cprintf function in acebot_cmds.c in Alien Arena 2006 Gold Edition 5.00 allows remote attackers (possibly authenticated) to execute arbitrary code via unspecified vectors when the server sends crafted messages to the clients.


Unspecified vulnerability in Firefox and Thunderbird 1.5 before 1.5.0.2 and SeaMonkey before 1.0.1 allows remote attackers to bypass the js_ValueToFunctionObject check and execute arbitrary code via unknown vectors involving setTimeout and Firefox' ForEach method.


The bundle API in CoreFoundation in Apple Mac OS X 10.3.9 and 10.4.6 loads dynamic libraries even if the client application has not directly requested it which allows attackers to execute arbitrary code from an untrusted bundle.


Microsoft Internet Explorer 5.01 through 6 does not always return the correct IOleClientSite information when dynamically creating an embedded object which could cause Internet Explorer to run the object in the wrong security context or zone and allow remote attackers to execute arbitrary code.


Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8 Mozilla Suite before 1.7.13 and SeaMonkey before 1.0 does not properly protect the compilation scope of privileged built-in XBL bindings which allows remote attackers to execute arbitrary code via the (1) valueOf.call or (2) valueOf.apply methods of an XBL binding or (3) \by inserting an XBL method into the DOM's document.body prototype chain.\


OpenVPN 2.0 through 2.0.5 allows remote malicious servers to execute arbitrary code on the client by using setenv with the LD_PRELOAD environment variable.


Integer

underflow

in

CoreFoundation

in

Apple

Mac

OS

X

and

allows

context-dependent

attackers

to

execute

arbitrary

code

via

unspecified

vectors

involving

conversions

from

string

to

file

system

representation

within

CFStringGetFileSystemRepresentation

or

getFileSystemRepresentation:maxLength:withPath

in

NSFileManager

and

possibly

other

similar

API

functions.


Format string vulnerability in the (1) Con_message and (2) conPrintf functions in con_main.c in Doomsday engine 1.8.6 allows remote attackers to execute arbitrary code via format string specifiers in an argument to the JOIN command and possibly other command arguments.


The installation of Cisco Transport Controller (CTC) for Cisco Optical Networking System (ONS) 15000 series nodes adds a Java policy file entry with a wildcard that grants the java.security.AllPermission permission to any http URL containing \fs/LAUNCHER.jar\ which allows remote attackers to execute arbitrary code on a CTC workstation aka bug ID CSCea25049.


Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8 Mozilla Suite before 1.7.13 and SeaMonkey before 1.0 allows remote attackers to execute arbitrary code by using an eval in an XBL method binding (XBL.method.eval) to create Javascript functions that are compiled with extra privileges.


Format string vulnerability in the visualization function in Jason Boettcher Liero Xtreme 0.62b and earlier allows remote attackers to execute arbitrary code via format string specifiers in (1) a nickname (2) a dedicated server name or (3) a mapname in a level (aka .lxl) file.


Microsoft Office 2003 SP1 and SP2 Office XP SP3 Office 2000 SP3 Office 2004 for Mac and Office X for Mac do not properly parse record lengths which allows remote attackers to execute arbitrary code via a malformed control in an Office document aka \Microsoft Office Control Vulnerability.\


SQL injection vulnerability in php121language.php in PHP121 1.4 allows remote attackers to execute arbitrary SQL commands and execute arbitrary code via the sess_username variable as set by the php121un HTTP COOKIE parameter which is used in multiple files including php121login.php. NOTE: the code execution occurs because the SQL query results are used in an include statement.


Finder in Apple Mac OS X 10.3.9 and 10.4.6 allows user-assisted attackers to execute arbitrary code by tricking a user into launching an Internet Location item that appears to use a safe URL scheme but which actually has a different and more risky scheme.


Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8 Mozilla Suite before 1.7.13 and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via unknown vectors related to the crypto.generateCRMFRequest method.


Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8 Mozilla Suite before 1.7.13 and SeaMonkey before 1.0 allows remote attackers to execute arbitrary code by using the Object.watch method to access the \clone parent\ internal function.


Format string vulnerability in the CF_syslog function launchd in Apple Mac OS X 10.4 up to 10.4.6 allows local users to execute arbitrary code via format string specifiers that are not properly handled in a syslog call in the logging facility as demonstrated by using a crafted plist file.


Format string vulnerability in the ActiveX control (ATXCONSOLE.OCX) in TrendMicro OfficeScan Corporate Edition (OSCE) before 7.3 Patch 1 allows remote attackers to execute arbitrary code via format string identifiers in the \Management Console's Remote Client Install name search\.


The ICQPhone.SipxPhoneManager ActiveX control in America Online ICQ 5.1 allows remote attackers to download and execute arbitrary code via the DownloadAgent function as demonstrated using an ICQ avatar.


Unspecified vulnerability in XLink Omni-NFS Enterprise allows remote attackers to execute arbitrary code via unspecified vectors as demonstrated by vd_xlink2.pm an \Omni-NFS Enterprise remote exploit.\ NOTE: this is probably a different vulnerability than CVE-2006-5780. As of 20061107 this disclosure has no actionable information. However since it is from a reliable researcher it is being assigned a CVE identifier for tracking purposes.


The LinkSBIcons method in the SuperBuddy ActiveX control (Sb.SuperBuddy.1) in America Online 9.0 Security Edition dereferences an arbitrary function pointer which allows remote attackers to execute arbitrary code via a modified pointer value.


MDaemon 9.0.5 9.0.6 9.51 and 9.53 and possibly other versions installs the MDaemon application folder with insecure permissions (Users create files/directories) which allows local users to execute arbitrary code by creating malicious RASAPI32.DLL or MPRAPI.DLL libraries in the MDaemon\\APP folder which is an untrusted search path element due to insecure permissions.


Multiple PHP remote file inclusion vulnerabilities in Security Images (com_securityimages) component 3.0.5 and earlier for Joomla! allow remote attackers to execute arbitrary code via a URL in the mosConfig_absolute_path parameter in (1) configinsert.php (2) lang.php (3) client.php and (4) server.php.


Integer underflow in McAfee ePolicy Orchestrator 3.5 through 3.6.1 ProtectionPilot 1.1.1 and 1.5 and Common Management Agent (CMA) 3.6.0.453 and earlier allows remote attackers to execute arbitrary code via a crafted UDP packet which causes stack corruption.


Unspecified vulnerability in Novell eDirectory allows remote attackers to execute arbitrary code as demonstrated by vd_novell.pm a \Novell eDirectory remote exploit.\ NOTE: As of 20061108 this disclosure has no actionable information. However since it is from a reliable researcher it is being assigned a CVE identifier for tracking purposes.


Unspecified vulnerability in the Brazilian Portuguese Grammar Checker in Microsoft Office 2003 and the Multilingual Interface for Office 2003 Project 2003 and Visio 2003 allows user-assisted remote attackers to execute arbitrary code via crafted text that is not properly parsed.


Links web browser 1.00pre12 and Elinks 0.9.2 with smbclient installed allows remote attackers to execute arbitrary code via shell metacharacters in an smb:// URI as demonstrated by using PUT and GET statements.


The WZFILEVIEW.FileViewCtrl.61 ActiveX control (aka Sky Software \FileView\ ActiveX control) for WinZip 10.0 before build 7245 allows remote attackers to execute arbitrary code via unspecified \unsafe methods.\


The accelerated rendering functionality of NVIDIA Binary Graphics Driver (binary blob driver) For Linux v8774 and v8762 and probably on other operating systems allows local and remote attackers to execute arbitrary code via a large width value in a font glyph which can be used to overwrite arbitrary memory locations.


The System.CodeDom.Compiler classes in Novell Mono create temporary files with insecure permissions which allows local users to overwrite arbitrary files or execute arbitrary code via a symlink attack.


Unspecified vulnerability in rsgallery2.html.php in RS Gallery2 component (com_rsgallery2) before 1.11.3 for Joomla! allows attackers to execute arbitrary code.


Untrusted search path vulnerability in OpenBase SQL 10.0 and earlier as used in Apple Xcode 2.2 2.2 and earlier and possibly other products allows local users to execute arbitrary code via a modified PATH that references a malicious gzip program which is executed by gnutar with certain TAR_OPTIONS environment variable settings when gnutar is invoked by OpenBase.


Format string vulnerability in the swask command in HP-UX B.11.11 and possibly other versions allows local users to execute arbitrary code via format string specifiers in the -s argument. NOTE: this might be a duplicate of CVE-2006-2574 but the details relating to CVE-2006-2574 are too vague to be certain.


Cross-zone scripting vulnerability in the WMI Object Broker (WMIScriptUtils.WMIObjectBroker2) ActiveX control (WmiScriptUtils.dll) in Microsoft Visual Studio 2005 allows remote attackers to bypass Internet zone restrictions and execute arbitrary code by instantiating dangerous objects aka \WMI Object Broker Vulnerability.\


Unspecified vulnerability in certain COM objects in Microsoft Office Web Components 2000 allows user-assisted remote attackers to execute arbitrary code via a crafted URL aka \Office Web Components URL Parsing Vulnerability.\


The evtFilteredMonitorEventsRequest function in the LDAP service in Novell eDirectory before 8.8.1 FTF1 allows remote attackers to execute arbitrary code via a crafted request containing a value that is larger than the number of objects transmitted which triggers an invalid free of unallocated memory.


Unspecified vulnerability in PowerPoint in Microsoft Office 2000 Office XP and Office 2003 allows user-assisted attackers to execute arbitrary code via a crafted record in a PPT file as exploited by malware such as Exploit:Win32/Controlppt.W Exploit:Win32/Controlppt.X and Exploit-PPT.d/Trojan.PPDropper.F. NOTE: it has been reported that the attack vector involves SlideShowWindows.View.GotoNamedShow.


Unspecified vulnerability in Fenestrae Faxination Server allows remote attackers to execute arbitrary code via a crafted packet.


The NDIS-TDI Hooking Engine as used in the (1) KLICK (KLICK.SYS) and (2) KLIN (KLIN.SYS) device drivers 2.0.0.281 for in Kaspersky Labs Anti-Virus 6.0.0.303 and other Anti-Virus and Internet Security products allows local users to execute arbitrary code via crafted Irp structure with invalid addresses in the 0x80052110 IOCTL.


Unspecified vulnerability in Microsoft Word 2000 2002 and Office 2003 allows remote user-assisted attackers to execute arbitrary code via unspecified vectors involving a crafted file resulting in a malformed stack as exploited by malware with names including Trojan.Mdropper.Q Mofei and Femo.


** DISPUTED ** Microsoft Terminal Server when running an application session with the \Start program at logon\ and \Override settings from user profile and Client Connection Manager wizard\ options allows local users to execute arbitrary code by forcing an Explorer error. NOTE: a third-party researcher has stated that the options are \a convenience to users\ and were not intended to restrict execution of arbitrary code.


Unspecified vulnerability in dtterm in IBM AIX 5.2 and 5.3 allows local users to execute arbitrary code with root privileges via unspecified vectors.


Multiple format string vulnerabilities in DConnect Daemon 0.7.0 and earlier allow remote administrators to execute arbitrary code via format string specifiers that are not properly handled when calling the (1) privmsg() or (2) pubmsg functions from (a) cmd.user.c (b) penalties.c or (c) cmd.dc.c.


Unspecified vulnerability in the TIFF viewer (possibly libTIFF) in the Photo Viewer in the Sony PlaystationPortable (PSP) 2.00 through 2.80 allows local users to execute arbitrary code via crafted TIFF images. NOTE: due to lack of details it is not clear whether this is related to other issues such as CVE-2006-3464 or CVE-2006-3465.


Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via a crafted FlashPix (FPX) file which triggers an exception that leads to an operation on an uninitialized object.


Unspecified vulnerability in the backup agent and Cell Manager in HP OpenView Storage Data Protector 5.1 and 5.5 before 20060810 allows remote attackers to execute arbitrary code on an agent via unspecified vectors related to authentication and input validation.


Format string vulnerability in the Real Time Virus Scan service in Symantec AntiVirus Corporate Edition 8.1 up to 10.0 and Client Security 1.x up to 3.0 allows local users to execute arbitrary code via an unspecified vector related to alert notification messages a different vector than CVE-2006-3454 a \second format string vulnerability\ as found by the vendor.


The (1) settings.php and (2) subscribers.php scripts in Open Newsletter 2.5 and earlier do not exit when authentication fails which allows remote attackers to perform unauthorized administrative actions or execute arbitrary code in conjunction with another vulnerability.


Multiple

PHP

remote

file

inclusion

vulnerabilities

in

GeekLog

allow

remote

attackers

to

execute

arbitrary

code

via

a

URL

in

the

parameter

to

links/functions.inc

polls/functions.inc

spamx/BlackList.Examine.class.php

spamx/DeleteComment.Action.class.php

spamx/EditIPofURL.Admin.class.php

spamx/MTBlackList.Examine.class.php

spamx/MassDelete.Admin.class.php

spamx/MailAdmin.Action.class.php

spamx/MassDelTrackback.Admin.class.php

spamx/EditHeader.Admin.class.php

spamx/EditIP.Admin.class.php

spamx/IPofUrl.Examine.class.php

spamx/Import.Admin.class.php

spamx/LogView.Admin.class.php

and

staticpages/functions.inc

in

the

plugins/

directory.


A \stack overwrite\ vulnerability in GnuPG (gpg) 1.x before 1.4.6 2.x before 2.0.2 and 1.9.0 through 1.9.95 allows attackers to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to dereference a function pointer from deallocated stack memory.


** DISPUTED ** PHP remote file inclusion vulnerability in centipaid_class.php in CentiPaid 1.4.3 allows remote attackers to execute arbitrary code via a URL in the class_pwd parameter. NOTE: this issue has been disputed by CVE and multiple third parties who state that $class_pwd is set to a static value before the relevant include statement.


The eyeHome function in apps/eyeHome.eyeapp/aplic.php in EyeOS before 0.9.3-3 allows remote attackers to upload and execute arbitrary code via dangerous file extensions that are not all lowercase which bypasses a cleansing operation.


Format string vulnerability in the inputAnswer function in file.c in w3m before 0.5.2 when run with the dump or backend option allows remote attackers to execute arbitrary code via format string specifiers in the Common Name (CN) field of an SSL certificate associated with an https URL.


Untrusted search path vulnerability in McAfee VirusScan for Linux 4510e and earlier includes the current working directory in the DT_RPATH environment variable which allows local users to load arbitrary ELF DSO libraries and execute arbitrary code by installing malicious libraries in that directory.


PHP remote file inclusion vulnerability in register.php for Andys Chat 4.5 allows remote attackers to execute arbitrary code via the action parameter. NOTE: this issue was announced by an unreliable researcher but the vendor is no longer distributing the product so the original claims can not be evaluated.


Multiple SQL injection vulnerabilities in php-stats.recphp.php in PHP-Stats 0.1.9.1b and earlier allow remote attackers to execute arbitrary code via a leading dotted-quad IP address string in the (1) PC-REMOTE-ADDR HTTP header which is inserted into $_SERVER'HTTP_PC_REMOTE_ADDR' or (2) ip parameter.


PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document which allows remote authenticated users without programming rights to execute arbitrary code by selecting a document whose author has programming rights modifying this document to contain a script and previewing without saving the document.


phpwcms

and

earlier

and

before

allows

remote

attackers

to

execute

arbitrary

code

via

a

crafted

argument

to

the

parameter

to

phpwcms_code_snippets/mail_file_form.php

and

which

is

processed

by

the

function.


phpwcms

and

earlier

and

before

allows

remote

attackers

to

execute

arbitrary

code

via

crafted

arguments

to

the

and

parameters

to

and

which

is

processed

by

the

function.

NOTE:

the

provenance

of

this

information

is

unknown;

the

details

are

obtained

solely

from

third

party

information.


Multiple PHP remote file inclusion vulnerabilities in DotWidget For Articles (dotwidgeta) 0.2 allow remote attackers to execute arbitrary code via a URL in the (1) file_path parameter to (a) index.php (b) showcatpicks.php and (c) showarticle.php; and the (2) admin_header_file and (3) admin_footer_file parameters to (d) admin/authors.php (e) admin/index.php (f) admin/categories.php (g) admin/editconfig.php and (h) admin/articles.php.


** DISPUTED ** PHP remote file inclusion vulnerability in admin.jobline.php in Jobline 1.1.1 allows remote attackers to execute arbitrary code via a URL in the mosConfig_absolute_path parameter. NOTE: CVE disputes this issue because the script is protected against direct requests.


Bharat Mediratta Gallery PHP script before 1.2.1 allows remote attackers to execute arbitrary code by including files from remote web sites via an HTTP request that modifies the includedir variable.


Eudora 5.1 allows remote attackers to execute arbitrary code when the \Use Microsoft Viewer\ option is enabled and the \allow executables in HTML content\ option is disabled via an HTML email with a form that is activated from an image that the attacker spoofs as a link which causes the user to execute the form and access embedded attachments.


tcl/tk package (tcltk) 8.3.1 searches for its libraries in the current working directory before other directories which could allow local users to execute arbitrary code via a Trojan horse library that is under a user-controlled directory.


manual.php in Marcus S. Xenakis Unix Manual 1.0 allows remote attackers to execute arbitrary code via a URL that contains shell metacharacters.


load_prefs.php and supporting include files in SquirrelMail 1.0.4 and earlier do not properly initialize certain PHP variables which allows remote attackers to (1) view sensitive files via the config_php and data_dir options and (2) execute arbitrary code by using options_order.php to upload a message that could be interpreted as PHP.


pSlash PHP script 0.7 and earlier allows remote attackers to execute arbitrary code by including files from remote web sites using an HTTP request that modifies the includedir variable.


NAI WebShield SMTP 4.5 and possibly 4.5 MR1a does not filter improperly MIME encoded email attachments which could allow remote attackers to bypass filtering and possibly execute arbitrary code in email clients that process the invalid attachments.


Format

string

vulnerabilities

in

and

prolib

in

Progress

database

allows

a

local

user

to

execute

arbitrary

code

via

format

string

specifiers

in

the

file

used

by

the

PROMSGS

environment

variable.


ws_mail.cgi in WebStore 400/400CS 4.14 allows remote authenticated WebStore administrators to execute arbitrary code via shell metacharacters in the kill parameter.


Phormation PHP script 0.9.1 and earlier allows remote attackers to execute arbitrary code by including files from remote web sites using an HTTP request that modifies the phormationdir variable.


Symantec LiveUpdate before 1.6 does not use cryptography to ensure the integrity of download files which allows remote attackers to execute arbitrary code via DNS spoofing of the update.symantec.com site.


myphpPagetool PHP script 0.4.3-1 and earlier allows remote attackers to execute arbitrary code by including files from remote web sites using an HTTP request that modifies the includedir variable.


Citrix Independent Computing Architecture (ICA) Client for Windows 6.1 allows remote malicious web sites to execute arbitrary code via a .ICA file which is downloaded and automatically executed by the client.


Outlook Express 6.0 with \Do not allow attachments to be saved or opened that could potentially be a virus\ enabled does not block email attachments from forwarded messages which could allow remote attackers to execute arbitrary code.


Vulnerability in (1) Book of guests and (2) Post it! allows remote attackers to execute arbitrary code via shell metacharacters in the email parameter.


Eudora before 5.1 allows a remote attacker to execute arbitrary code when the 'Use Microsoft Viewer' and 'allow executables in HTML content' options are enabled via an HTML email message containing Javascript with ActiveX controls and malicious code within IMG tags.


Internet Explorer 6.0 allows remote attackers to execute arbitrary code by modifying the Content-Disposition and Content-Type header fields in a way that causes Internet Explorer to believe that the file is safe to open without prompting the user aka the \File Execution Vulnerability.\


viralator CGI script in Viralator 0.9pre1 and earlier allows remote attackers to execute arbitrary code via a URL for a file being downloaded which is insecurely passed to a call to wget.


dbsnmp in Oracle 8.0.5 and 8.1.5 under certain conditions trusts the PATH environment variable to find and execute the (1) chown or (2) chgrp commands which allows local users to execute arbitrary code by modifying the PATH to point to Trojan Horse programs.


The #sinclude directive in Embedded Perl (ePerl) 2.2.14 and earlier allows a remote attacker to execute arbitrary code by modifying the 'sinclude' file to point to another file that contains a #include directive that references a file that contains the code.


RPM Package Manager 4.0.x through 4.0.2.x allows an attacker to execute arbitrary code via corrupted data in the RPM file when the file is queried.


Format string vulnerability in the permitted function of GNOME libgtop_daemon in libgtop 1.0.12 and earlier allows remote attackers to execute arbitrary code via an argument that contains format specifiers that are passed into the (1) syslog_message and (2) syslog_io_message functions.


CatalogMgr.pl in VirtualCatalog (incorrectly claimed to be in VirtualCart) allows remote attackers to execute arbitrary code via the template parameter.


Lotus Domino 5.x allows remote attackers to read files or execute arbitrary code by requesting the ReplicaID of the Web Administrator template file (webadmin.ntf).


Use-after-free vulnerability in the nsGlobalWindow::PageHidden function in Mozilla Firefox 4.x through 13.0 Firefox ESR 10.x before 10.0.6 Thunderbird 5.0 through 13.0 Thunderbird ESR 10.x before 10.0.6 and SeaMonkey before 2.11 might allow remote attackers to execute arbitrary code via vectors related to focused content.


Unrestricted file upload vulnerability in addons/uploadify/uploadify.php in appRain CMF 0.1.5 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in the uploads directory.


The

TabStrip

ActiveX

control

in

the

Common

Controls

in

MSCOMCTL.OCX

in

Microsoft

Office

Office

Web

Components

Office

and

Office

SQL

Server

SQL

Server

SQL

Server

and

Commerce

Server

Commerce

Server

Commerce

Server

Gold

and

Host

Integration

Server

Visual

FoxPro

Visual

FoxPro

and

Visual

Basic

Runtime

allows

remote

attackers

to

execute

arbitrary

code

via

a

crafted

document

or

web

page

that

triggers

system-state

corruption

aka

\MSCOMCTL.OCX

RCE

Vulnerability.\


Apache OFBiz 10.04.x before 10.04.02 allows remote attackers to execute arbitrary code via unspecified vectors.


Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin before 1.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with a PHP extension then accessing it via a direct request to the file in the directory specified by the folder parameter.


Unspecified vulnerability in Gretech GOM Media Player before 2.1.37.5091 allows remote attackers to execute arbitrary code via a crafted AVI file.


The RPC code generator in Samba 3.x before 3.4.16 3.5.x before 3.5.14 and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation which allows remote attackers to execute arbitrary code via a crafted RPC call.


Use-after-free vulnerability in Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly initialized or (2) is deleted aka \OnMove Use After Free Vulnerability.\


Use-after-free vulnerability in Microsoft Excel 2003 SP3 2007 SP2 and SP3 and 2010 SP1 and Office 2008 and 2011 for Mac allows remote attackers to execute arbitrary code via a crafted spreadsheet aka \Excel SST Invalid Length Use After Free Vulnerability.\


Incomplete blacklist vulnerability in Open Journal Systems before 2.3.7 allows remote authenticated users with the Author Role permission to execute arbitrary code by uploading a file with an executable extension that is not \.php\ then accessing it via a direct request to the file in submission/original/ in the associated article directory as demonstrated using .pHp .asp and other extensions.


@Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to execute arbitrary code via an e-mail attachment with an executable extension leading to the creation of an executable file under tmp/.


Microsoft .NET Framework 2.0 SP2 3.5 3.5.1 4 and 4.5 does not properly handle function pointers which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application aka \.NET Framework Memory Access Vulnerability.\


The reflection implementation in Microsoft .NET Framework 1.0 SP3 1.1 SP1 2.0 SP2 3.5.1 and 4 does not properly enforce object permissions which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application aka \Reflection Bypass Vulnerability.\


Format string vulnerability in the Print Spooler service in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted response aka \Print Spooler Service Format String Vulnerability.\


base_ag_main.php in Basic Analysis and Security Engine (BASE) 1.4.5 allows remote attackers to execute arbitrary code by uploading contents of the file with an executable extension via a create action then accessing it via a view action.


Use-after-free vulnerability in Google Chrome 17.0.963.66 and earlier allows remote attackers to bypass the DEP and ASLR protection mechanisms and execute arbitrary code via unspecified vectors as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012. NOTE: the primary affected product may be clarified later; it was not identified by the researcher who reportedly stated \it really doesn't matter if it's third-party code.\


Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality integrity and availability via unknown vectors related to Deployment a different vulnerability than other CVEs listed in the February 2013 CPU. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from a third party that the issue is due to an interaction error in between the JRE plug-in for WebKit-based browsers and the Javascript engine which allows remote attackers to execute arbitrary code by modifying DOM nodes that contain applet elements in a way that triggers an incorrect reference count and a use after free.


sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2 when configured as a CGI script (aka php-cgi) does not properly handle query strings that lack an = (equals sign) character which allows remote attackers to execute arbitrary code by placing command-line options in the query string related to lack of skipping a certain php_getopt for the 'd' case.


Unrestricted

file

upload

vulnerability

in

in

the

ServerSetup

web

service

in

Lenovo

ThinkManagement

Console

allows

remote

attackers

to

execute

arbitrary

code

by

uploading

a

file

with

an

executable

extension

via

a

PutUpdateFileCore

command

in

a

RunAMTCommand

SOAP

request

then

accessing

the

file

via

a

direct

request

to

the

file

in

the

web

root.


The Extbase Framework in TYPO3 4.6.x through 4.6.6 4.7 and 6.0 unserializes untrusted data which allows remote attackers to unserialize arbitrary objects and possibly execute arbitrary code via vectors related to \a missing signature (HMAC) for a request argument.\


Use-after-free vulnerability in the nsINode::ReplaceOrInsertBefore function in Mozilla Firefox 4.x through 12.0 Firefox ESR 10.x before 10.0.5 Thunderbird 5.0 through 12.0 Thunderbird ESR 10.x before 10.0.5 and SeaMonkey before 2.10 might allow remote attackers to execute arbitrary code via document changes involving replacement or insertion of a node.


The nsTableFrame::InsertFrames function in Mozilla Firefox 4.x through 13.0 Firefox ESR 10.x before 10.0.6 Thunderbird 5.0 through 13.0 Thunderbird ESR 10.x before 10.0.6 and SeaMonkey before 2.11 does not properly perform a cast of a frame variable during processing of mixed row-group and column-group frames which might allow remote attackers to execute arbitrary code via a crafted web site.


The

ListView

TreeView

and

ActiveX

controls

in

MSCOMCTL.OCX

in

the

Common

Controls

in

Microsoft

Office

and

and

Gold

and

Office

Web

Components

SQL

Server

and

and

BizTalk

Server

Commerce

Server

and

Gold

and

Visual

FoxPro

and

and

Visual

Basic

Runtime

allow

remote

attackers

to

execute

arbitrary

code

via

a

crafted

(a)

web

site

(b)

Office

document

or

(c)

.rtf

file

that

triggers

\system

state\

corruption

as

exploited

in

the

wild

in

April

aka

\MSCOMCTL.OCX

RCE

Vulnerability.\


The StopModule method in the NTR ActiveX control before 2.0.4.8 allows remote attackers to execute arbitrary code via a crafted lModule parameter that triggers use of an arbitrary memory address as a function pointer.


Use-after-free

vulnerability

in

the

nsSMILTimeValueSpec::ConvertBetweenTimeContainer

function

in

Mozilla

Firefox

before

and

through

Firefox

ESR

before

Thunderbird

before

and

through

Thunderbird

ESR

before

and

SeaMonkey

before

might

allow

remote

attackers

to

execute

arbitrary

code

via

an

SVG

animation.


Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not properly calculate the length of an unspecified buffer which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) (2) a crafted ASP.NET application or (3) a crafted .NET Framework application aka \.NET Framework Heap Corruption Vulnerability.\


Unspecified vulnerability in Hitachi COBOL2002 Net Developer Net Server Suite and Net Client Suite 01-00 01-01 through 01-01-/D 01-02 through 01-02-/F 01-03 through 01-03-/F 02-00 through 02-00-/D 02-01 through 02-01-/C and possibly other versions before 02-01-/D allows remote attackers to execute arbitrary code via unknown attack vectors.


Microsoft .NET Framework 1.0 SP3 1.1 SP1 2.0 SP2 3.0 SP2 3.5 SP1 3.5.1 and 4 does not properly handle an unspecified exception during use of partially trusted assemblies to serialize input data which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application aka \.NET Framework Serialization Vulnerability.\


GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2 and Office 2003 SP3 2007 SP2 and SP3 and 2010 Gold and SP1 does not properly validate record types in EMF images which allows remote attackers to execute arbitrary code via a crafted image aka \GDI+ Record Type Vulnerability.\


An ActiveX control in gwcls1.dll in the client in Novell GroupWise 8.0 before 8.0.3 HP2 and 2012 before SP1 HP1 allows remote attackers to execute arbitrary code via (1) a pointer argument to the SetEngine method or (2) an XPItem pointer argument to an unspecified method.


debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to execute arbitrary code via a crafted tarball file name in the top-level directory of an original (.orig) source tarball of a source package.


The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0 Web Platform (EWP) before 5.2.0 BRMS Platform before 5.3.1 and SOA Platform before 5.3.1 do not require authentication by default in certain profiles which might allow remote attackers to invoke MBean methods and execute arbitrary code via unspecified vectors. NOTE: this issue can only be exploited when the interceptor is not properly configured with a \second layer of authentication \ or when used in conjunction with other vulnerabilities that bypass this second layer.


HP ProCurve 5400 zl switches with certain serial numbers include a compact flash card that contains an unspecified virus which might allow user-assisted remote attackers to execute arbitrary code on a PC by leveraging manual transfer of this card.


The Authenticode Signature Verification function in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 Windows 7 Gold and SP1 and Windows 8 Consumer Preview does not properly validate the digest of a signed portable executable (PE) file which allows user-assisted remote attackers to execute arbitrary code via a modified file with additional content aka \WinVerifyTrust Signature Validation Vulnerability.\


RealNetworks RealPlayer 11.x 14.x and 15.x before 15.02.71 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to execute arbitrary code via vectors involving a VIDOBJ_START_CODE code in a header within a video stream.


Microsoft .NET Framework 1.0 SP3 1.1 SP1 2.0 SP2 3.0 SP2 3.5 SP1 3.5.1 and 4 does not properly serialize input data which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application aka \.NET Framework Serialization Vulnerability.\


Adobe Flash Player before 10.3.183.19 and 11.x before 11.2.202.235 on Windows Mac OS X and Linux; before 11.1.111.9 on Android 2.x and 3.x; and before 11.1.115.8 on Android 4.x allows remote attackers to execute arbitrary code via a crafted file related to an \object confusion vulnerability \ as exploited in the wild in May 2012.


Use-after-free vulnerability in Dropbear SSH Server 0.52 through 2012.54 when command restriction and public key authentication are enabled allows remote authenticated users to execute arbitrary code and bypass command restrictions via multiple crafted command requests related to \channels concurrency.\


debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to obtain system information and execute arbitrary code via the file name in a (1) .dsc or (2) .changes file.


Microsoft

Windows

XP

and

Windows

Server

Windows

Vista

Windows

Server

and

Windows

Gold

and

and

Windows

Consumer

Preview;

Office

and

and

Gold

and

Silverlight

before

and

Silverlight

before

allow

remote

attackers

to

execute

arbitrary

code

via

a

crafted

TrueType

font

(TTF)

file

aka

\TrueType

Font

Parsing

Vulnerability.\


The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts which allows remote attackers to execute arbitrary code by (1) injecting crafted data or (2) including crafted data.


Microsoft .NET Framework 2.0 SP2 3.5.1 and 4 and Silverlight 4 before 4.1.10111 does not properly restrict access to memory associated with unmanaged objects which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) (2) a crafted ASP.NET application (3) a crafted .NET Framework application or (4) a crafted Silverlight application aka \.NET Framework Unmanaged Objects Vulnerability.\


The ATRAC codec in RealNetworks RealPlayer 11.x and 14.x through 14.0.7 RealPlayer SP 1.0 through 1.1.5 and Mac RealPlayer 12.x before 12.0.0.1703 does not properly decode samples which allows remote attackers to execute arbitrary code via a crafted ATRAC audio file.


Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error which allows remote attackers to modify run-time data values and consequently execute arbitrary code via invalid input to a field.


Microsoft .NET Framework 4 does not properly allocate buffers which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application aka \.NET Framework Buffer Allocation Vulnerability.\


HP Onboard Administrator (OA) before 3.50 allows remote attackers to bypass intended access restrictions and execute arbitrary code via unspecified vectors.


The RV10 codec in RealNetworks RealPlayer 11.x 14.x and 15.x before 15.02.71 and RealPlayer SP 1.0 through 1.1.5 does not properly handle height and width values which allows remote attackers to execute arbitrary code via a crafted RV10 RealVideo video stream.


Use-after-free

vulnerability

in

the

mozilla::dom::indexedDB::IDBKeyRange::cycleCollection::Trace

function

in

Mozilla

Firefox

through

Firefox

ESR

before

Thunderbird

through

Thunderbird

ESR

before

and

SeaMonkey

before

allows

remote

attackers

to

execute

arbitrary

code

via

vectors

related

to

crafted

IndexedDB

data.


The Remote Desktop Protocol (RDP) implementation in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 does not properly process packets in memory which allows remote attackers to execute arbitrary code by sending crafted RDP packets triggering access to an object that (1) was not properly initialized or (2) is deleted aka \Remote Desktop Protocol Vulnerability.\


rvrender.dll in RealNetworks RealPlayer 11.x 14.x and 15.x before 15.02.71 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to execute arbitrary code via crafted flags in an RMFF file.


debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to execute arbitrary code via shell metacharacters in the file name argument.


The php_register_variable_ex function in php_variables.c in PHP 5.3.9 allows remote attackers to execute arbitrary code via a request containing a large number of variables related to improper handling of array variables. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4885.


Cisco Digital Media Manager 5.2.2 and earlier and 5.2.3 allows remote authenticated users to execute arbitrary code via vectors involving a URL and an administrative resource aka Bug ID CSCts63878.


The Manager service in the management console in Symantec Endpoint Protection (SEP) 12.1 before 12.1 RU1-MP1 allows remote attackers to conduct file-insertion attacks and execute arbitrary code by leveraging exploitation of CVE-2012-0294.


Microsoft Word 2007 SP2 and SP3 does not properly handle memory during the parsing of Word documents which allows remote attackers to execute arbitrary code via a crafted document aka \Word PAPX Section Corruption Vulnerability.\


Use-after-free vulnerability in the browser engine in Mozilla Firefox before 3.6.28 and 4.x through 10.0 Firefox ESR 10.x before 10.0.3 Thunderbird before 3.1.20 and 5.0 through 10.0 Thunderbird ESR 10.x before 10.0.3 and SeaMonkey before 2.8 allows remote attackers to execute arbitrary code via vectors involving an empty argument to the array.join function in conjunction with the triggering of garbage collection.


The Remote Desktop Protocol (RDP) implementation in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 does not properly process packets in memory which allows remote attackers to execute arbitrary code by sending crafted RDP packets triggering access to an object that (1) was not properly initialized or (2) is deleted aka \Remote Desktop Protocol Vulnerability \ a different vulnerability than CVE-2012-0002.


The installer in Adobe Reader 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to bypass intended access restrictions and execute arbitrary code via unspecified vectors.


The texImage2D implementation in the WebGL subsystem in Mozilla Firefox 4.x through 11.0 Firefox ESR 10.x before 10.0.4 Thunderbird 5.0 through 11.0 Thunderbird ESR 10.x before 10.0.4 and SeaMonkey before 2.9 does not properly restrict JSVAL_TO_OBJECT casts which might allow remote attackers to execute arbitrary code via a crafted web page.


Incomplete blacklist vulnerability in the Windows Packager configuration in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted ClickOnce application in a Microsoft Office document related to .application files aka \Assembly Execution Vulnerability.\


Unspecified vulnerability in RealNetworks RealPlayer 11.x 14.x and 15.x before 15.02.71 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to execute arbitrary code via vectors involving the coded_frame_size value in a RealAudio audio stream.


Microsoft .NET Framework 1.0 SP3 1.1 SP1 2.0 SP2 3.5 3.5.1 4 and 4.5 does not properly validate function parameters which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) (2) a crafted ASP.NET application or (3) a crafted .NET Framework application aka \.NET Framework Parameter Validation Vulnerability.\


GbScriptAddUp.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication which allows remote attackers to execute arbitrary code via unspecified vectors.


The RV20 codec in RealNetworks RealPlayer 11.x 14.x and 15.x before 15.02.71 and RealPlayer SP 1.0 through 1.1.5 does not properly handle the frame size array which allows remote attackers to execute arbitrary code via a crafted RV20 RealVideo video stream.


Format string vulnerability in the log_message_cb function in otr-plugin.c in the Off-the-Record Messaging (OTR) pidgin-otr plugin before 3.2.1 for Pidgin might allow remote attackers to execute arbitrary code via format string specifiers in data that generates a log message.


Xunlei Thunder before 7.2.6 allows remote attackers to execute arbitrary code via a crafted file related to a \DLL injection vulnerability.\


Multiple unrestricted file upload vulnerabilities in Travelon Express 6.2.2 allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension using (1) airline-edit.php (2) hotel-image-add.php or (3) hotel-add.php.


The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 2.x before 2.5 MR6 on Windows and 2.x before 2.5 MR6 and 3.x before 3.0 MR8 on Mac OS X and Linux does not properly validate binaries that are received by the downloader process which allows remote attackers to execute arbitrary code via vectors involving (1) ActiveX or (2) Java components aka Bug ID CSCtw47523.


Mesa as used in Google Chrome before 21.0.1183.0 on the Acer AC700 Cr-48 and Samsung Series 5 and 5 550 Chromebook platforms and the Samsung Chromebox Series 3 allows remote attackers to execute arbitrary code via unspecified vectors that trigger an \array overflow.\


The server in xArrow before 3.4.1 performs an invalid read operation which allows remote attackers to execute arbitrary code via unspecified vectors.


A certain Java applet in the VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR7 on 64-bit Linux platforms does not properly restrict use of Java components which allows remote attackers to execute arbitrary code via a crafted web site aka Bug ID CSCty45925.


The DiagTraceR3Info function in the Dialog processor in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2 when a certain Developer Trace configuration is enabled allows remote attackers to execute arbitrary code via a crafted SAP Diag packet.


The URL handler in IBM Lotus Notes 8.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a crafted notes:// URL.


The Cisco Discovery Protocol (CDP) implementation on Cisco TelePresence Multipoint Switch before 1.9.0 Cisco TelePresence Immersive Endpoint Devices before 1.9.1 Cisco TelePresence Manager before 1.9.0 and Cisco TelePresence Recording Server before 1.8.1 allows remote attackers to execute arbitrary code by leveraging certain adjacency and sending a malformed CDP packet aka Bug IDs CSCtz40953 CSCtz40947 CSCtz40965 and CSCtz40953.


360zip 1.93beta allows remote attackers to execute arbitrary code via vectors related to file browsing and file extraction.


The Remote Desktop Protocol (RDP) implementation in Microsoft Windows XP SP3 does not properly process packets in memory which allows remote attackers to execute arbitrary code by sending crafted RDP packets triggering access to a deleted object aka \Remote Desktop Protocol Vulnerability.\


Use-after-free vulnerability in Microsoft Word 2003 SP3 2007 SP2 and SP3 and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; Word Automation Services on Microsoft SharePoint Server 2010; and Office Web Apps 2010 SP1 allows remote attackers to execute arbitrary code via a crafted RTF document aka \RTF File listid Use-After-Free Vulnerability.\


php-wrapper.fcgi does not properly handle command-line arguments which allows remote attackers to bypass a protection mechanism in PHP 5.3.12 and 5.4.2 and execute arbitrary code by leveraging improper interaction between the PHP sapi/cgi/cgi_main.c component and a query string beginning with a +- sequence.


EMC ApplicationXtender Desktop before 6.5 SP2 and ApplicationXtender Web Access .NET before 6.5 SP2 allow remote attackers to upload files to any location and possibly execute arbitrary code via unspecified vectors.


The OpenType Font (OTF) driver in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 Windows 7 Gold and SP1 Windows 8 Windows Server 2012 and Windows RT allows remote attackers to execute arbitrary code via a crafted OpenType font file aka \OpenType Font Parsing Vulnerability.\


sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3 when configured as a CGI script (aka php-cgi) does not properly handle query strings that contain a %3D sequence but no = (equals sign) character which allows remote attackers to execute arbitrary code by placing command-line options in the query string related to lack of skipping a certain php_getopt for the 'd' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.


Invision Power Board before 3.3.1 fails to sanitize user-supplied input which could allow remote attackers to obtain sensitive information or execute arbitrary code by uploading a malicious file.


The kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 Windows 7 Gold and SP1 Windows 8 Windows Server 2012 and Windows RT as used by Google Chrome before 22.0.1229.79 and other programs do not properly handle objects in memory which allows remote attackers to execute arbitrary code via a crafted TrueType font file aka \Windows Font Parsing Vulnerability\ or \TrueType Font Parsing Vulnerability.\


The client in EMC NetWorker Module for Microsoft Applications (NMM) 2.2.1 2.3 before build 122 and 2.4 before build 375 allows remote attackers to execute arbitrary code by sending a crafted message over a TCP communication channel.


Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4 11.1.1.6 and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Report Server Component. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the URLPARAMETER functionality allows remote attackers to read and upload arbitrary files to reports/rwservlet and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3153 to execute arbitrary code by uploading a .jsp file.


Use-after-free vulnerability in the WebGL implementation in Mozilla Firefox before 15.0 Firefox ESR 10.x before 10.0.7 Thunderbird before 15.0 Thunderbird ESR 10.x before 10.0.7 and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via vectors related to deletion of a fragment shader by its accessor.


Unrestricted file upload vulnerability in php/upload.php in the wpStoreCart plugin before 2.5.30 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in uploads/wpstorecart.


Mozilla Firefox before 15.0 on Android does not properly implement unspecified callers of the __android_log_print function which allows remote attackers to execute arbitrary code via a crafted web page that calls the JavaScript dump function.


Use-after-free vulnerability in the IME State Manager implementation in Mozilla Firefox before 16.0 Firefox ESR 10.x before 10.0.8 Thunderbird before 16.0 Thunderbird ESR 10.x before 10.0.8 and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors related to the nsIContent::GetNameSpaceID function.


Use-after-free vulnerability in Mozilla Firefox before 16.0 Firefox ESR 10.x before 10.0.8 Thunderbird before 16.0 Thunderbird ESR 10.x before 10.0.8 and SeaMonkey before 2.13 might allow user-assisted remote attackers to execute arbitrary code via vectors involving use of mozRequestFullScreen to enter full-screen mode and use of the history.back method for backwards history navigation.


Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4 11.1.1.6 and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Servlet. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the PARSEQUERY function allows remote attackers to obtain database credentials via reports/rwservlet/parsequery and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3152 to execute arbitrary code by uploading a .jsp file.


Unrestricted file upload vulnerability in ImageUpload.ashx in the Wallboard application in Avaya IP Office Customer Call Reporter 7.0 before 7.0.5.8 Q1 2012 Maintenance Release and 8.0 before 8.0.9.13 Q1 2012 Maintenance Release allows remote attackers to execute arbitrary code by uploading an executable file and then accessing it via a direct request.


libdbus 1.5.x and earlier when used in setuid or other privileged programs in X.org and possibly other products allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: libdbus maintainers state that this is a vulnerability in the applications that do not cleanse environment variables not in libdbus itself: \we do not support use of libdbus in setuid binaries that do not sanitize their environment before their first call into libdbus.\


Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation plugin before 1.4 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in wp-content/uploads/user_uploads.


(1) AlbumTab.py (2) ArtistTab.py (3) LinksTab.py and (4) LyricsTab.py in the Context module in GNOME Rhythmbox 0.13.3 and earlier allows local users to execute arbitrary code via a symlink attack on a temporary HTML template file in the /tmp/context directory.


Use-after-free vulnerability in the js::gc::MapAllocToTraceKind function in Mozilla Firefox before 15.0 Firefox ESR 10.x before 10.0.7 Thunderbird before 15.0 Thunderbird ESR 10.x before 10.0.7 and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via unspecified vectors.


The debugger in the developer-tools subsystem in Mozilla Firefox before 15.0 when remote debugging is disabled does not properly restrict access to the remote-debugging service which allows remote attackers to execute arbitrary code by leveraging the presence of the HTTPMonitor extension and connecting to that service through the HTTPMonitor port.


Unrestricted file upload vulnerability in uploader.php in the RBX Gallery plugin 2.1 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in uploads/rbxslider.


Munin before 2.0.6 stores plugin state files that run as root in the same group-writable directory as non-root plugins which allows local users to execute arbitrary code by replacing a state file as demonstrated using the smart_ plugin.


Unrestricted file upload vulnerability in includes/doajaxfileupload.php in the MM Forms Community plugin 2.2.5 and 2.2.6 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in upload/temp.


Unrestricted file upload vulnerability in html/Upload.php in the FCChat Widget plugin 2.2.13.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with a file with an executable extension followed by a safe extension then accessing it via a direct request to the file in html/images.


Mozilla Firefox before 15.0 Firefox ESR 10.x before 10.0.7 Thunderbird before 15.0 Thunderbird ESR 10.x before 10.0.7 and SeaMonkey before 2.12 do not properly iterate through the characters in a text run which allows remote attackers to execute arbitrary code via a crafted document.


Unrestricted file upload vulnerability in index.php in Atomymaxsite 2.5 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file as exploited in the wild in October 2012.


Spoon::Cookie in the Spoon module 0.24 for Perl does not properly use the Storable::thaw function which allows remote attackers to execute arbitrary code via a crafted request which is not properly handled when it is deserialized.


Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in an unspecified directory as exploited in the wild in July 2012.


Session::Cookie in the HTML::EP module 0.2011 for Perl does not properly use the Storable::thaw function which allows remote attackers to execute arbitrary code via a crafted request which is not properly handled when it is deserialized.


Rockwell Automation EtherNet/IP products; 1756-ENBT 1756-EWEB 1768-ENBT and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400 do not properly perform authentication for Ethernet firmware updates which allows remote attackers to execute arbitrary code via a Trojan horse update image.


The App::Context module 0.01 through 0.968 for Perl does not properly use the Storable::thaw function which allows remote attackers to execute arbitrary code via a crafted request to (1) App::Session::Cookie or (2) App::Session::HTMLHidden which is not properly handled when it is deserialized.


Multiple unspecified vulnerabilities in the JRE component in IBM Java 7 SR2 and earlier Java 6.0.1 SR3 and earlier Java 6 SR11 and earlier Java 5 SR14 and earlier and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand Rational Change Tivoli Monitoring Smart Analytics System 5600 Tivoli Remote Control 5.1.2 WebSphere Real Time Lotus Notes & Domino Tivoli Storage Productivity Center and Service Deliver Manager; and other products from other vendors such as Red Hat allow remote attackers to execute arbitrary code via \insecure use\ of the (1) java.lang.Class getDeclaredMethods or nd (2) java.lang.reflect.AccessibleObject setAccessible() methods.


The WebLaunch feature in Cisco Secure Desktop before 3.6.6020 does not properly validate binaries that are received by the downloader process which allows remote attackers to execute arbitrary code via vectors involving (1) ActiveX or (2) Java components aka Bug IDs CSCtz76128 and CSCtz78204.


OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached which allows remote attackers to execute arbitrary code via a crafted pickle object.


Unspecified vulnerability in the JavaFX component in Oracle Java SE JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality integrity and availability via unknown vectors a different vulnerability than other CVEs listed in the February 2013 CPU. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from a third party that this issue allows remote attackers to execute arbitrary code via an \invalid type case\ in the init method of the D3DShader class in the com.sun.prism.d3d package. CPU.


Unspecified vulnerability in the JavaFX component in Oracle Java SE JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality integrity and availability via unknown vectors a different vulnerability than other CVEs listed in the February 2013 CPU. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from a third party that the issue allows remote attackers to execute arbitrary code via vectors related to an \invalid type cast\ and exposed native methods in the T2KGlyph class.


Multiple

vulnerabilities

in

the

Java

Runtime

Environment

(JRE)

component

in

Oracle

Java

SE

Update

and

earlier

allow

remote

attackers

to

execute

arbitrary

code

via

a

crafted

applet

that

bypasses

SecurityManager

restrictions

by

using

com.sun.beans.finder.ClassFinder.findClass

and

leveraging

an

exception

with

the

forName

method

to

access

restricted

classes

from

arbitrary

packages

such

as

sun.awt.SunToolkit

then

using

\reflection

with

a

trusted

immediate

caller\

to

leverage

the

getField

method

to

access

and

modify

private

fields

as

exploited

in

the

wild

in

August

using

Gondzz.class

and

Gondvv.class.


The ConnectDDNS method in the (1) STWConfigNVR 1.1.13.15 and (2) STWConfig 1.1.14.13 ActiveX controls in Samsung NET-i viewer 1.37.120316 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: some of these details are obtained from third party information.


Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly initialized or (2) is deleted aka \Improper Ref Counting Use After Free Vulnerability.\