XnView

Classic

for

Windows

Version

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

file

related

to

a

\User

Mode

Write

AV

starting

at

ntdll_77400000!RtlImpersonateSelfEx+0x000000000000024e.\


XnView

Classic

for

Windows

Version

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

file

related

to

a

\User

Mode

Write

AV

near

starting

at

wow64!Wow64NotifyDebugger+0x000000000000001d.\

denial of service
arbitrary code execution


XnView

Classic

for

Windows

Version

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

file

related

to

a

\User

Mode

Write

AV

starting

at

ntdll_77400000!RtlFillMemoryUlong+0x0000000000000010.\


XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file related to \Data from Faulting Address controls subsequent Write Address starting at jbig2dec+0x0000000000008706.\


XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file related to \Data from Faulting Address controls subsequent Write Address starting at jbig2dec+0x0000000000008823.\


XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file related to a \User Mode Write AV starting at jbig2dec+0x000000000000595d.\


XnView Classic for Windows Version 2.41 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file related to a \User Mode Write AV starting at jbig2dec+0x000000000000870f.\


XnView

Classic

for

Windows

Version

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

file

related

to

a

\User

Mode

Write

AV

starting

at

ntdll_77400000!RtlInterlockedPopEntrySList+0x00000000000003b0.\


XnView Classic for Windows Version 2.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file related to \Data from Faulting Address controls Code Flow starting at CADImage+0x0000000000221a9a.\


XnView Classic for Windows Version 2.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file related to a \Read Access Violation on Control Flow starting at CADImage+0x0000000000286a76.\


XnView Classic for Windows Version 2.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file related to a \User Mode Write AV starting at CADImage+0x00000000000048e7.\


XnView Classic for Windows Version 2.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file related to \Data from Faulting Address controls subsequent Write Address starting at CADImage+0x00000000000034b0.\


XnView Classic for Windows Version 2.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file related to a \User Mode Write AV starting at CADImage+0x0000000000002d83.\


XnView Classic for Windows Version 2.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file related to an \Illegal Instruction Violation starting at xnview+0x0000000000370074.\


XnView Classic for Windows Version 2.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file related to a \User Mode Write AV near NULL starting at CADImage+0x0000000000288750.\


XnView Classic for Windows Version 2.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file related to a \User Mode Write AV starting at CADImage+0x00000000000032eb.\


XnView Classic for Windows Version 2.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file related to a \Data Execution Prevention Violation starting at xnview+0x0000000000580063.\


Stack consumption vulnerability in CoreAnimation in Apple Mac OS X before 10.8.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted text glyph in a URL encountered by Safari.


The ThreadX-based firmware on Marvell Avastar Wi-Fi devices models 88W8787 88W8797 88W8801 88W8897 and 88W8997 allows remote attackers to execute arbitrary code or cause a denial of service (block pool overflow) via malformed Wi-Fi packets during identification of available Wi-Fi networks. Exploitation of the Wi-Fi device can lead to exploitation of the host application processor in some cases but this depends on several factors including host OS hardening and the availability of DMA.


Stack-based overflow vulnerability in the logMess function in Open TFTP Server MT 1.65 and earlier allows remote attackers to perform a denial of service or execute arbitrary code via a long TFTP error packet a different vulnerability than CVE-2018-10387 and CVE-2019-12568.


Stack-based overflow vulnerability in the logMess function in Open TFTP Server SP 1.66 and earlier allows remote attackers to perform a denial of service or execute arbitrary code via a long TFTP error packet a different vulnerability than CVE-2018-10387 and CVE-2019-12567.


A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18 as used in WhatsApp for Android before version 2.19.244 and many other Android applications allows remote attackers to execute arbitrary code or cause a denial of service when the library is used to parse a specially crafted GIF image.


In shiftfs a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series shiftfs_btrfs_ioctl_fd_replace() calls fdget(oldfd) then without further checks passes the resulting file* into shiftfs_real_fdget() which casts file->private_data a void* that points to a filesystem-dependent type to a \struct shiftfs_file_info *\. As the private_data is not required to be a pointer an attacker can use this to cause a denial of service or possibly execute arbitrary code.


A heap overflow flaw was found in the Linux kernel all versions 3.x.x and 4.x.x before 4.18.0 in Marvell WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash resulting in a denial of service or execute arbitrary code. The highest threat with this vulnerability is with the availability of the system. If code execution occurs the code will run with the permissions of root. This will affect both confidentiality and integrity of files on the system.


The getaddrinfo function in glibc before 2.15 when compiled with libidn and the AI_IDN flag is used allows context-dependent attackers to cause a denial of service (invalid free) and possibly execute arbitrary code via unspecified vectors as demonstrated by an internationalized domain name to ping6.


Format string vulnerability in the PROJECT::write_account_file function in client/cs_account.cpp in BOINC possibly 7.2.33 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via format string specifiers in the gui_urls item in an account file.


Integer underflow in regcomp.c in Perl before 5.20 as used in Apple OS X before 10.10.5 and other products allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression.


VideoLAN VLC Media Player 2.0.8 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a URL in a m3u file.


The libxlDomainGetNumaParameters function in the libxl driver (libxl/libxl_driver.c) in libvirt before 1.2.1 does not properly initialize the nodemap which allows local users to cause a denial of service (invalid free operation and crash) or possibly execute arbitrary code via an inactive domain to the virsh numatune command.


Multiple format string vulnerabilities in Yet Another Radius Daemon (YARD RADIUS) 1.1.2 allow context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via format string specifiers in a request in the (1) log_msg function in log.c or (2) version or (3) build_version function in version.c.


sysdeps/posix/readdir_r.c in the GNU C Library (aka glibc or libc6) 2.18 and earlier allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a crafted (1) NTFS or (2) CIFS image.


Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure.


Format string vulnerability in the osLogMsg function in server/os/aulog.c in Network Audio System (NAS) 1.9.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in unspecified vectors related to syslog.


The LZW decompressor in the gif2tiff tool in libtiff 4.0.3 and earlier allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a crafted GIF image.


The virtio_net_load function in hw/net/virtio-net.c in QEMU 1.5.0 through 1.7.x before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors in which the value of curr_queues is greater than max_queues which triggers an out-of-bounds write.


Use-after-free vulnerability in the libxl_list_cpupool function in the libxl toolstack library in Xen 4.2.x and 4.3.x when running \under memory pressure \ returns the original pointer when the realloc function fails which allows local users to cause a denial of service (heap corruption and crash) and possibly execute arbitrary code via unspecified vectors.


hw/net/vmxnet3.c in QEMU 2.0.0-rc0 1.7.1 and earlier allows local guest users to cause a denial of service or possibly execute arbitrary code via vectors related to (1) RX or (2) TX queue numbers or (3) interrupt indices. NOTE: some of these details are obtained from third party information.


The ocaml binding for the xc_vcpu_getaffinity function in Xen 4.2.x and 4.3.x frees certain memory that may still be intended for use which allows local users to cause a denial of service (heap corruption and crash) and possibly execute arbitrary code via unspecified vectors that trigger a (1) use-after-free or (2) double free.


Double free vulnerability in the writeDataError function in the ElasticSearch plugin (omelasticsearch) in rsyslog before 7.4.2 and before 7.5.2 devel when errorfile is set to local logging allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted JSON response.


The IOSerialFamily driver in Apple iOS before 7 allows attackers to execute arbitrary code or cause a denial of service (out-of-bounds array access) via a crafted application.


Unspecified vulnerability in Oracle Java SE 5.0u55 6u65 and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality integrity and availability via unknown vectors related to 2D. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is due to incorrect input validation in LookupProcessor.cpp in the ICU Layout Engine which allows attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted font file.


The PreserveWrapper implementation in Mozilla Firefox before 22.0 Firefox ESR 17.x before 17.0.7 Thunderbird before 17.0.7 and Thunderbird ESR 17.x before 17.0.7 does not properly handle the lack of a wrapper which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by leveraging unintended clearing of the wrapper cache's preserved-wrapper flag.


Mozilla Firefox before 24.0 Firefox ESR 17.x before 17.0.9 Thunderbird before 24.0 Thunderbird ESR 17.x before 17.0.9 and SeaMonkey before 2.21 do not properly handle movement of XBL-backed nodes between documents which allows remote attackers to execute arbitrary code or cause a denial of service (JavaScript compartment mismatch or assertion failure and application exit) via a crafted web site.


Mozilla Firefox before 22.0 Firefox ESR 17.x before 17.0.7 Thunderbird before 17.0.7 and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.


Format string vulnerability in the token processing system (pki-tps) in Red Hat Certificate System (RHCS) 8.1 and possibly Dogtag Certificate System 9 and 10 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in unspecified vectors related to viewing certificates.


The httparty gem 0.9.0 and earlier for Ruby does not properly restrict casts of string values which might allow remote attackers to conduct object-injection attacks and execute arbitrary code or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for YAML type conversion a similar vulnerability to CVE-2013-0156.


MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey which allows remote authenticated users to cause a denial of service (invalid memory access and server crash) or execute arbitrary code via a crafted memory address in the first argument.


The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values which might allow remote attackers to conduct object-injection attacks and execute arbitrary code or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion a similar vulnerability to CVE-2013-0156.


The Intel drivers in Mesa 8.0.x and 9.0.x allow context-dependent attackers to cause a denial of service (reachable assertion and crash) and possibly execute arbitrary code via vectors involving 3d graphics that trigger an out-of-bounds array access related to the fs_visitor::remove_dead_constants function. NOTE: this issue might be related to CVE-2013-0796.


The _cairo_xlib_surface_add_glyph function in Mozilla Firefox before 21.0 Firefox ESR 17.x before 17.0.6 Thunderbird before 17.0.6 and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary code or cause a denial of service (invalid write operation) via unspecified vectors.


The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values which might allow remote attackers to conduct object-injection attacks and execute arbitrary code or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion a similar vulnerability to CVE-2013-0156.


CoreMedia Playback in Apple Mac OS X before 10.8.4 does not properly initialize memory during the processing of text tracks which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file.


Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4 9.1.x before 9.1.9 and 9.0.x before 9.0.13 allows remote attackers to cause a denial of service (file corruption) and allows remote authenticated users to modify configuration settings and execute arbitrary code via a connection request using a database name that begins with a \-\ (hyphen).


poppler before 0.22.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors that trigger an \invalid memory access\ in (1) splash/Splash.cc (2) poppler/Function.cc and (3) poppler/Stream.cc.


The nori gem 2.0.x before 2.0.2 1.1.x before 1.1.4 and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values which allows remote attackers to conduct object-injection attacks and execute arbitrary code or cause a denial of service (memory and CPU consumption) involving nested XML entity references by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion a similar vulnerability to CVE-2013-0156.


Directory Service in Apple Mac OS X through 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted message.


The WebGL subsystem in Mozilla Firefox before 20.0 Firefox ESR 17.x before 17.0.5 Thunderbird before 17.0.5 Thunderbird ESR 17.x before 17.0.5 and SeaMonkey before 2.17 on Linux does not properly interact with Mesa drivers which allows remote attackers to execute arbitrary code or cause a denial of service (free of unallocated memory) via unspecified vectors.


Mozilla Firefox before 18.0 Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2 Thunderbird before 17.0.2 Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2 and SeaMonkey before 2.15 do not properly implement quickstubs that use the jsval data type for their return values which allows remote attackers to execute arbitrary code or cause a denial of service (compartment mismatch and application crash) via crafted JavaScript code that is not properly handled during garbage collection.


Invensys Wonderware Information Server (WIS) 4.0 SP1SP1 4.5- Portal and 5.0- Portal does not restrict unspecified size and amount values which allows remote attackers to execute arbitrary code or cause a denial of service (resource consumption) via unknown vectors.


The client in Novell GroupWise 8.0 before 8.0.3 HP2 and 2012 before SP1 HP1 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference) via unspecified vectors.


IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote attackers to execute arbitrary code or cause a denial of service (daemon hang) via a crafted public-key authentication request.


in

Ruby

on

Rails

before

before

before

and

before

does

not

properly

restrict

casts

of

string

values

which

allows

remote

attackers

to

conduct

object-injection

attacks

and

execute

arbitrary

code

or

cause

a

denial

of

service

(memory

and

CPU

consumption)

involving

nested

XML

entity

references

by

leveraging

Action

Pack

support

for

YAML

type

conversion

or

Symbol

type

conversion.


multi_xml gem 0.5.2 for Ruby as used in Grape before 0.2.6 and possibly other products does not properly restrict casts of string values which allows remote attackers to conduct object-injection attacks and execute arbitrary code or cause a denial of service (memory and CPU consumption) involving nested XML entity references by leveraging support for (1) YAML type conversion or (2) Symbol type conversion a similar vulnerability to CVE-2013-0156.


ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.


Use-after-free vulnerability in the virNetMessageFree function in rpc/virnetserverclient.c in libvirt 1.0.x before 1.0.2 0.10.2 before 0.10.2.3 0.9.11 before 0.9.11.9 and 0.9.6 before 0.9.6.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering certain errors during an RPC connection which causes a message to be freed without being removed from the message queue.


Cogent Real-Time Systems Cogent DataHub before 7.3.0 OPC DataHub before 6.4.22 Cascade DataHub before 6.4.22 on Windows and DataHub QuickTrend before 7.3.0 do not properly handle exceptions which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via malformed data in a formatted text command leading to out-of-bounds access to (1) heap or (2) stack memory.


Multiple double free vulnerabilities in the LibRaw::unpack function in libraw_cxx.cpp in LibRaw before 0.15.2 allow context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a malformed full-color (1) Foveon or (2) sRAW image file.


The NMEA0183 driver in gpsd before 3.9 allows remote attackers to cause a denial of service (daemon termination) and possibly execute arbitrary code via a GPS packet with a malformed $GPGGA interpreted sentence that lacks certain fields and a terminator. NOTE: a separate issue in the AIS driver was also reported but it might not be a vulnerability.


The RACInstaller.StateCtrl.1 ActiveX control in InstallerDlg.dll in RealNetworks GameHouse RealArcade Installer 2.6.0.481 performs unexpected type conversions for invalid parameter types which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted arguments to the (1) AddTag (2) Ping (3) QueuePause (4) QueueRemove (5) QueueTop (6) RemoveTag (7) TagRemoved or (8) message method.


Unspecified vulnerability in War FTP Daemon (warftpd) 1.82 when running as a Windows service allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors related to log messages and the \internal log handler to the Windows Event log.\


The SSH service on Dell PowerConnect 3348 1.2.1.3 3524p 2.0.0.48 and 5324 2.0.1.4 switches allows remote attackers to cause a denial of service (device reset) or possibly execute arbitrary code by sending many packets to TCP port 22.


Microsoft Windows 8 and Windows Server 2012 when Hyper-V is used does not ensure memory-address validity which allows guest OS users to execute arbitrary code in all guest OS instances and allows guest OS users to cause a denial of service (host OS crash) via a guest-to-host hypercall with a crafted function parameter aka \Address Corruption Vulnerability.\


The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted web page that is accessed by Internet Explorer as exploited in the wild in November 2013 aka \InformationCardSigninHelper Vulnerability.\


VMware vCenter Server Appliance (vCSA) 5.1 before Update 1 allows remote authenticated users to create or overwrite arbitrary files and consequently execute arbitrary code or cause a denial of service by leveraging Virtual Appliance Management Interface (VAMI) web-interface access.


The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and server crash) or possibly execute arbitrary code via an invalid RefDB object.


A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be written to the controller's registers and trigger undesirable actions (such as reset) while the device is still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host resulting in a denial of service condition or potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects QEMU versions before 7.0.0.


NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where it can double-free a pointer which may lead to denial of service. This flaw may result in a write-what-where condition allowing an attacker to execute arbitrary code impacting integrity and availability.


A Use after Free vulnerability exists in IOBit Advanced SystemCare 15 pro via requests sent in sequential order using the IOCTL driver codes which could let a malicious user execute arbitrary code or a Denial of Service (system crash). IOCTL list: iobit_ioctl = 0x8001e01c 0x8001e020 0x8001e024 0x8001e040 0x8001e044 0x8001e048 0x8001e04c 0x8001e000 0x8001e004 0x8001e008 0x8001e00c 0x8001e010 0x8001e014 0x8001e018


wire-avs is the audio visual signaling (AVS) component of Wire an open-source messenger. A remote format string vulnerability in versions prior to 7.1.12 allows an attacker to cause a denial of service or possibly execute arbitrary code. The issue has been fixed in wire-avs 7.1.12. There are currently no known workarounds.


xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.


EnterpriseDB Advanced Server 8.2 does not properly handle certain debugging function calls that occur before a call to pldbg_create_listener which allows remote authenticated users to cause a denial of service (daemon crash) and possibly execute arbitrary code via a SELECT statement that invokes a pldbg_ function as demonstrated by (1) pldbg_get_stack and (2) pldbg_abort_target which triggers use of an uninitialized pointer.


Gesytec Easylon OPC Server before 2.3.44 does not properly validate server handles which allows remote attackers to execute arbitrary code or cause a denial of service via unspecified network traffic to the OLE for Process Control (OPC) interface probably related to free operations on arbitrary memory addresses through certain Remove functions and read and write operations on arbitrary memory addresses through certain Set Read and Write functions.


Perl-Compatible Regular Expression (PCRE) library before 7.3 does not properly compute the length of (1) a \\p sequence (2) a \\P sequence or (3) a \\P{x} sequence which allows context-dependent attackers to cause a denial of service (infinite loop or crash) or execute arbitrary code.


Struts support in OpenSymphony XWork before 1.2.3 and 2.x before 2.0.4 as used in WebWork and Apache Struts recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a \%{\ sequence and ending with a \}\ character.


Multiple format string vulnerabilities in the ID Software Doom 3 engine as used by Doom 3 1.3.1 and earlier Quake 4 1.4.2 and earlier and Prey 1.3 and earlier when Punkbuster (PB) is enabled allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string specifiers in (1) a PB_Y packet to the YPG server or (2) a PB_U packet to UCON. NOTE: this issue might be in Punkbuster itself but there are insufficient details to be certain.


The driver for the Linksys WRT350N Wi-Fi access point with firmware 2.00.17 on the Atheros AR5416-AC1E chipset does not properly parse the Atheros vendor-specific information element in an association request which allows remote authenticated users to cause a denial of service (device reboot or hang) or possibly execute arbitrary code via an Atheros information element with an invalid length as demonstrated by an element that is too long.


TIBCO SmartSockets RTserver 6.8.0 and earlier RTworks before 4.0.4 and Enterprise Message Service (EMS) 4.0.0 through 4.4.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted requests that control loop operations related to memory.


Multiple format string vulnerabilities in the Monolith Lithtech engine as used by First Encounter Assault Recon (F.E.A.R.) 1.08 and earlier when Punkbuster (PB) is enabled allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string specifiers in (1) a PB_Y packet to the YPG server on UDP port 27888 or (2) a PB_U packet to UCON on UDP port 27888 different vectors than CVE-2004-1500. NOTE: this issue might be in Punkbuster itself but there are insufficient details to be certain.


AhnLab Antivirus 3 Internet Security 2008 Platinum appends data to a filename string at a location indicated by the \Filename length\ field in a ZIP header which allows remote attackers to cause a denial of service (machine crash) and possibly execute arbitrary code via a ZIP file in which this field's value is larger than the actual number of bytes in the filename.


Unspecified vulnerability in the Windows Schannel Security Package for Microsoft Windows 2000 SP4 XP SP2 and Server 2003 SP1 and SP2 allows remote servers to execute arbitrary code or cause a denial of service via crafted digital signatures that are processed during an SSL handshake.


vsdatant.sys in Check Point Zone Labs ZoneAlarm Pro before 7.0.302.000 does not validate certain arguments before being passed to hooked SSDT function handlers which allows local users to cause a denial of service (system crash) or possibly execute arbitrary code via crafted arguments to the (1) NtCreateKey and (2) NtDeleteFile functions.


Array index error in the (1) ieee80211_ioctl_getwmmparams and (2) ieee80211_ioctl_setwmmparams functions in net80211/ieee80211_wireless.c in MadWifi before 0.9.3.1 allows local users to cause a denial of service (system crash) possibly obtain kernel memory contents and possibly execute arbitrary code via a large negative array index value.


Multiple off-by-one errors in VooDoo cIRCle before 1.1.beta27 allow remote attackers to cause a denial of service (connection loss) or possibly execute arbitrary code via a (1) DNS name response of the exact length as a buffer; or a long (2) channel name (3) partyline channel name or unspecified vectors in crafted BOTNET packets.


The ft_bitmap_assure_buffer function in src/base/ftbimap.c in FreeType 2.3.3 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors involving bitmap fonts related to a \memory buffer overwrite bug.\


Media Player Classic (MPC) 6.4.9.0 allows user-assisted remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted FLV file.


Multiple format string vulnerabilities in plugins in VideoLAN VLC Media Player before 0.8.6c allow remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in (1) an Ogg/Vorbis file (2) an Ogg/Theora file (3) a CDDB entry for a CD Digital Audio (CDDA) file or (4) Service Announce Protocol (SAP) multicast packets.


lib/info.c in libvorbis 1.1.2 and possibly other versions before 1.2.0 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via invalid (1) blocksize_0 and (2) blocksize_1 values which trigger a \heap overwrite\ in the _01inverse function in res0.c. NOTE: this issue has been RECAST so that CVE-2007-4029 handles additional vectors.


Divide-by-zero error in Media Player Classic (MPC) 6.4.9.0 allows user-assisted remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted MPA file.


Format string vulnerability in the new_warning function in ntserv/warning.c for Netrek Vanilla Server 2.12.0 when EVENTLOG is enabled allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in the message handling.


Perl-Compatible Regular Expression (PCRE) library before 7.3 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via regex patterns containing unmatched \\\Q\\E\ sequences with orphan \\\E\ codes.


Format string vulnerability in libwebconsole_services.so in Sun Java Web Console 2.2.2 through 2.2.5 allows remote attackers to cause a denial of service (application crash) obtain sensitive information and possibly execute arbitrary code via unspecified vectors during a failed login attempt related to syslog.


SPBBCDrv.sys in Symantec Norton Personal Firewall 2006 9.1.0.33 and 9.1.1.7 does not validate certain arguments before being passed to hooked SSDT function handlers which allows local users to cause a denial of service (crash) or possibly execute arbitrary code via crafted arguments to the (1) NtCreateMutant and (2) NtOpenEvent functions. NOTE: it was later reported that Norton Internet Security 2008 15.0.0.60 and possibly other versions back to 2006 are also affected.


Format string vulnerability in GnomeMeeting 1.0.2 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in the name which is not properly handled in a call to the gnomemeeting_log_insert function.


The management service in IBM Tivoli Provisioning Manager for OS Deployment before 5.1 Fix Pack 2 does not properly handle multipart/form-data in HTTP POST requests which allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via crafted POST requests to port 8080/tcp or 443/tcp.


NETxAutomation NETxEIB OPC Server before 3.0.1300 does not properly validate OLE for Process Control (OPC) server handles which allows attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors involving the (1) IOPCSyncIO::Read (2) IOPCSyncIO::Write (3) IOPCServer::AddGroup (4) IOPCServer::RemoveGroup (5) IOPCCommon::SetClientName and (6) IOPCGroupStateMgt::CloneGroup functions which allow access to arbitrary memory. NOTE: the vectors might be limited to attackers with physical access.


Multiple unspecified vulnerabilities in the layout engine in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2 Thunderbird before 1.5.0.10 and SeaMonkey before 1.0.8 allow remote attackers to cause a denial of service (crash) and potentially execute arbitrary code via certain vectors.


Format string vulnerability in Apple Software Update 2.0.5 on Mac OS X 10.4.8 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via format string specifiers in (1) SWUTMP or (2) SUCATALOG filenames or using the (3) application/x-apple.sucatalog+xml MIME type.


Format string vulnerability in the LogMessage function in FileZilla before 3.0.0-beta5 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted arguments. NOTE: some of these details are obtained from third party information.


Multiple format string vulnerabilities in (1) _invitedToRoom: and (2) _invitedToDirectChat: in Colloquy 2.1 and earlier allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in the channel name of an INVITE request related to the implementation of AlertSheet and AlertPanel in Apple AppKit.


Use-after-free vulnerability in Libinfo in Apple Mac OS X 10.3.9 through 10.4.9 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors involving crafted web pages that trigger certain error conditions that are not properly reported in certain circumstances resulting in accessing deallocated memory.


Cisco IOS 9.x 10.x 11.x and 12.x and IOS XR 2.0.x 3.0.x and 3.2.x allows remote attackers to cause a denial of service or execute arbitrary code via a crafted IP option in the IP header in a (1) ICMP (2) PIMv2 (3) PGM or (4) URD packet.


The extract_files function in installer.rb in RubyGems before 0.9.1 does not check whether files exist before overwriting them which allows user-assisted remote attackers to overwrite arbitrary files cause a denial of service or execute arbitrary code via crafted GEM packages.


Blue Coat Systems WinProxy 6.1a and 6.0 r1c and possibly earlier allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long HTTP CONNECT request which triggers heap corruption.


XINE 0.99.4 allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a certain M3U file that contains a long #EXTINF line and contains format string specifiers in an invalid udp:// URI possibly a variant of CVE-2007-0017.


The seg_write_packet function in libavformat/segment.c in ffmpeg 2.1.4 and earlier does not free the correct memory location which allows remote attackers to cause a denial of service (\invalid memory handler\) and possibly execute arbitrary code via a crafted video that triggers a use after free.


The auth_gssapi_unwrap_data function in lib/rpc/auth_gssapi_misc.c in MIT Kerberos 5 (aka krb5) through 1.11.5 1.12.x through 1.12.2 and 1.13.x before 1.13.1 does not properly handle partial XDR deserialization which allows remote authenticated users to cause a denial of service (use-after-free and double free and daemon crash) or possibly execute arbitrary code via malformed XDR data as demonstrated by data sent to kadmind.


The picture_Release function in misc/picture.c in VideoLAN VLC media player 2.1.5 allows remote attackers to execute arbitrary code or cause a denial of service (write access violation) via a crafted M2V file.


LibreOffice before 4.3.5 allows remote attackers to cause a denial of service (invalid write operation and crash) and possibly execute arbitrary code via a crafted RTF file.


Ettercap 0.8.1 does not validate certain return values which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted (1) name to the parse_line function in mdns_spoof/mdns_spoof.c or (2) base64 encoded password to the dissector_imap function in dissectors/ec_imap.c.


Integer underflow in Ettercap 0.8.1 allows remote attackers to cause a denial of service (out-of-bounds write) and possibly execute arbitrary code via a small (1) size variable value in the dissector_dhcp function in dissectors/ec_dhcp.c (2) length value to the dissector_gg function in dissectors/ec_gg.c or (3) string length to the get_decode_len function in ec_utils.c or a request without a (4) username or (5) password to the dissector_TN3270 function in dissectors/ec_TN3270.c.


The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted date string as demonstrated by the \--date=TZ=\123\345\ @1\ string to the touch or date command.


The picture_pool_Delete function in misc/picture_pool.c in VideoLAN VLC media player 2.1.5 allows remote attackers to execute arbitrary code or cause a denial of service (DEP violation and application crash) via a crafted FLV file.


The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted section group headers in an ELF file.


The D-Bus security policy files in /etc/dbus-1/system.d/*.conf in fso-gsmd 0.12.0-3 fso-frameworkd 0.9.5.9+git20110512-4 and fso-usaged 0.12.0-2 as packaged in Debian the upstream cornucopia.git (fsoaudiod fsodatad fsodeviced fsogsmd fsonetworkd fsotdld fsousaged) git master on 2015-01-19 the upstream framework.git 0.10.1 and git master on 2015-01-19 phonefsod 0.1+git20121018-1 as packaged in Debian Ubuntu and potentially other packages and potentially other fso modules do not properly filter D-Bus message paths which might allow local users to cause a denial of service (dbus-daemon memory consumption) or execute arbitrary code as root by sending a crafted D-Bus message to any D-Bus system service.


The NVIDIA Linux Discrete GPU drivers before R304.125 R331.x before R331.113 R340.x before R340.65 R343.x before R343.36 and R346.x before R346.22 Linux for Tegra (L4T) driver before R21.2 and Chrome OS driver before R40 allows remote attackers to cause a denial of service (segmentation fault and X server crash) or possibly execute arbitrary code via a crafted GLX indirect rendering protocol request.


The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode (ICU) before 55.1 uses an integer data type that is inconsistent with a header file which allows remote attackers to cause a denial of service (incorrect malloc followed by invalid free) or possibly execute arbitrary code via crafted text.


The Bluetooth driver in Apple OS X before 10.10.2 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (arbitrary-size bzero of kernel memory) via a crafted app.


Multiple format string vulnerabilities in the parse_error_msg function in parsehelp.c in dpkg before 1.17.22 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in the (1) package or (2) architecture name.


Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux Adobe AIR before 15.0.0.293 Adobe AIR SDK before 15.0.0.302 and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference) via unspecified vectors.


main/http.c in Asterisk Open Source 1.8.x before 1.8.26.1 11.8.x before 11.8.1 and 12.1.x before 12.1.1 and Certified Asterisk 1.8.x before 1.8.15-cert5 and 11.6 before 11.6-cert2 allows remote attackers to cause a denial of service (stack consumption) and possibly execute arbitrary code via an HTTP request with a large number of Cookie headers.


net/netfilter/nf_conntrack_proto_dccp.c in the Linux kernel through 3.13.6 uses a DCCP header pointer incorrectly which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a DCCP packet that triggers a call to the (1) dccp_new (2) dccp_packet or (3) dccp_error function.


The FortiManager protocol service in Fortinet FortiOS before 4.3.16 and 5.0.0 before 5.0.8 on FortiGate devices allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted request.


The

function

in

in

DirectFB

allows

remote

attackers

to

cause

a

denial

of

service

(crash)

and

possibly

execute

arbitrary

code

via

the

Voodoo

interface

which

triggers

an

out-of-bounds

write.


The DfDiskLo.sys driver in Faronics Deep Freeze Standard and Enterprise 8.10 and earlier allows local administrators to cause a denial of service (crash) and execute arbitrary code via a crafted IOCTL request that writes to arbitrary memory locations related to the IofCallDriver function.


rsyslog before 7.6.6 and 8.x before 8.4.1 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) possibly execute arbitrary code or have other unspecified impact via a crafted priority (PRI) value that triggers an out-of-bounds array access.


libgadu before 1.11.4 and 1.12.0 before 1.12.0-rc3 as used in Pidgin and other products allows remote Gadu-Gadu file relay servers to cause a denial of service (memory overwrite) or possibly execute arbitrary code via a crafted message.


Use-after-free vulnerability in the socket manager of Impress Remote in LibreOffice 4.x before 4.2.7 and 4.3.x before 4.3.3 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted request to TCP port 1599.


The HVMOP_set_mem_type control in Xen 4.1 through 4.4.x allows local guest HVM administrators to cause a denial of service (hypervisor crash) or possibly execute arbitrary code by leveraging a separate qemu-dm vulnerability to trigger invalid page table translations for unspecified memory page types.


Array index error in the logi_dj_raw_event function in drivers/hid/hid-logitech-dj.c in the Linux kernel before 3.16.2 allows physically proximate attackers to execute arbitrary code or cause a denial of service (invalid kfree) via a crafted device that provides a malformed REPORT_TYPE_NOTIF_DEVICE_UNPAIRED value.


The GetGUID function in codecs/dmp4.dll in RealNetworks RealPlayer 16.0.3.51 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (write access violation and application crash) via a malformed .3gp file.


Apple QuickTime before 7.7.5 does not properly perform a byte-swapping operation which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds memory access and application crash) via a crafted ttfo element in a movie file.


vmtypedarrayobject.cpp in Mozilla Firefox before 28.0 Firefox ESR 24.x before 24.4 Thunderbird before 24.4 and SeaMonkey before 2.25 does not validate the length of the destination array before a copy operation which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by triggering incorrect use of the TypedArrayObject class.


The sse2_composite_src_x888_8888 function in Pixman as used in Cairo in Mozilla Firefox 28.0 and SeaMonkey 2.25 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by painting on a CANVAS element.


Apple QuickTime before 7.7.5 does not initialize an unspecified pointer which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted track list in a movie file.


RasterImage.cpp in Mozilla Firefox before 27.0 Firefox ESR 24.x before 24.3 Thunderbird before 24.3 and SeaMonkey before 2.24 does not prevent access to discarded data which allows remote attackers to execute arbitrary code or cause a denial of service (incorrect write operations) via crafted image data as demonstrated by Goo Create.


TypedArrayObject.cpp in Mozilla Firefox before 28.0 Firefox ESR 24.x before 24.4 Thunderbird before 24.4 and SeaMonkey before 2.25 does not prevent a zero-length transition during use of an ArrayBuffer object which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based out-of-bounds write or read) via a crafted web site.


The byte-swapping implementation in copyfile in Apple OS X before 10.9.4 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds memory access and application crash) via a crafted AppleDouble file in a ZIP archive.


Cybozu Garoon 3.7 before SP4 allows remote authenticated users to bypass intended access restrictions and execute arbitrary code or cause a denial of service via an API call.


The get_tile function in Mozilla Firefox before 33.0 Firefox ESR 31.x before 31.2 and Thunderbird 31.x before 31.2 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly execute arbitrary code via WebM frames with invalid tile sizes that are improperly handled in buffering operations during video playback.


pubconv.dll in Microsoft Publisher 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference and application crash) via a crafted .pub file aka \Arbitrary Pointer Dereference Vulnerability.\


Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console functions.


Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object which allows remote attackers to cause a denial of service (resource consumption) or execute arbitrary code via crafted serialized data.


Array index error in Dock in Apple OS X before 10.9.4 allows attackers to execute arbitrary code or cause a denial of service (incorrect function-pointer dereference and application crash) by leveraging access to a sandboxed application for sending a message.


The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion provide an undocumented access method involving the FTP protocol which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.


The client in Novell GroupWise before 8.0.3 HP4 2012 before SP3 and 2014 before SP1 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference) via unspecified vectors.


The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5 1.12.x through 1.12.2 and 1.13.x before 1.13.1 does not properly maintain security-context handles which allows remote authenticated users to cause a denial of service (use-after-free and double free and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic as demonstrated by traffic to kadmind.


Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via vectors related to the CHARSET environment variable and gconv transliteration modules.


Rockwell Automation Connected Components Workbench (CCW) before 7.00.00 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an invalid property value to an ActiveX control that was built with an outdated compiler.


The IOHIDSecurePromptClient function in Apple OS X does not properly validate pointer values which allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via a crafted web site.


Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 2 before 2.27 and 4 before 2.03 and iLO Chassis Management (CM) firmware before 1.30 allows remote attackers to gain privileges execute arbitrary code or cause a denial of service via unknown vectors.


Multiple format string vulnerabilities in the python module in RRDtool as used in Zenoss Core before 4.2.5 and other products allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted third argument to the rrdtool.graph function aka ZEN-15415 a related issue to CVE-2013-2131.


GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access and untrusted-pointer read and write operations) via a crafted environment as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd the mod_cgi and mod_cgid modules in the Apache HTTP Server scripts executed by unspecified DHCP clients and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.


The HandleRFBServerMessage function in libvncclient/rfbproto.c in LibVNCServer 0.9.9 and earlier does not check certain malloc return values which allows remote VNC servers to cause a denial of service (application crash) or possibly execute arbitrary code by specifying a large screen size in a (1) FramebufferUpdate (2) ResizeFrameBuffer or (3) PalmVNCReSizeFrameBuffer message.


The dissector_postgresql function in dissectors/ec_postgresql.c in Ettercap before 0.8.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted password length which triggers a 0 character to be written to an arbitrary memory location.


VideoLAN VLC media player before 2.1.5 allows remote attackers to execute arbitrary code or cause a denial of service.


Multiple off-by-one errors in the WW8DopTypography::ReadFromMem function in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted typography information in a Microsoft Word .DOC file that triggers an out-of-bounds write.


WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows and before 4.1.3 on Mac OS X 10.4 does not properly perform a cast of an unspecified variable during processing of Cascading Style Sheets (CSS) boxes which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site.


The LookupGetterOrSetter function in js3250.dll in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11 Thunderbird before 3.0.9 and 3.1.x before 3.1.5 and SeaMonkey before 2.0.9 does not properly support window.__lookupGetter__ function calls that lack arguments which allows remote attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference and application crash) via vectors involving a \dangling pointer\ and the JS_ValueToId function.


Integer underflow in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows and before 4.1.3 on Mac OS X 10.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving WebSockets. NOTE: this may overlap CVE-2010-3254.


WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows and before 4.1.3 on Mac OS X 10.4 does not properly perform a cast of an unspecified variable during processing of inline styling which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site.


WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows and before 4.1.3 on Mac OS X 10.4 accesses uninitialized memory during processing of editable elements which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site.


Use-after-free vulnerability in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows and before 4.1.3 on Mac OS X 10.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving element attributes.


Use-after-free vulnerability in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows and before 4.1.3 on Mac OS X 10.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving SVG use elements.


WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows and before 4.1.3 on Mac OS X 10.4 does not properly perform a cast of an unspecified variable during processing of editing commands which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site.


Use-after-free vulnerability in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows and before 4.1.3 on Mac OS X 10.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving inline text boxes.


Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21 5.0 Update 25 1.4.2_27 and 1.3.1_28 allows remote attackers to affect confidentiality integrity and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is a double free vulnerability in IndexColorModel that allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code.


The Mount service in IBM Tivoli Storage Manager (TSM) FastBack 5.x.x before 5.5.7 and 6.1.0.0 establishes an open UDP port which might allow remote attackers to overwrite memory locations and execute arbitrary code or cause a denial of service (application hang) via unspecified vectors.


The (1) ActiveMatrix Runtime and (2) ActiveMatrix Administrator components in TIBCO ActiveMatrix Service Grid before 2.3.1 ActiveMatrix Service Bus before 2.3.1 ActiveMatrix BusinessWorks Service Engine before 5.8.1 and ActiveMatrix Service Performance Manager before 1.3.2 do not properly handle JMX connections which allows remote attackers to execute arbitrary code obtain sensitive information or cause a denial of service via unspecified vectors.


An ActiveX control in RealNetworks RealPlayer 11.0 through 11.1 RealPlayer SP 1.0 through 1.1.4 and RealPlayer Enterprise 2.1.2 does not properly initialize an unspecified object component during parsing of a CDDA URI which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer dereference and application crash) via a long URI.


Use-after-free vulnerability in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows and before 4.1.3 on Mac OS X 10.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving Geolocation objects. NOTE: this might overlap CVE-2010-3415.


Use-after-free vulnerability in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows and before 4.1.3 on Mac OS X 10.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving scrollbars.


The WW8ListManager::WW8ListManager function in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 does not properly handle an unspecified number of list levels in user-defined list styles in WW8 data in a Microsoft Word document which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted .DOC file that triggers an out-of-bounds write.


Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows Mac OS X Linux and Solaris and 10.1.95.1 on Android allows attackers to cause a denial of service or possibly execute arbitrary code via unknown vectors.


Use-after-free vulnerability in WebKit as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3 Google Chrome before 6.0.472.53 and webkitgtk before 1.2.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving element focus.


Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9 Thunderbird before 3.0.7 and 3.1.x before 3.1.3 and SeaMonkey before 2.0.7 do not properly restrict the role of property changes in triggering XUL tree removal which allows remote attackers to cause a denial of service (deleted memory access and application crash) or possibly execute arbitrary code by setting unspecified properties.


Multiple use-after-free vulnerabilities in WebKit as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3 Google Chrome before 5.0.375.127 and webkitgtk before 1.2.6 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to improper handling of MIME types by plug-ins.


WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows and before 4.1.3 on Mac OS X 10.4 accesses an uninitialized pointer during processing of Cascading Style Sheets (CSS) counter styles which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site.


QuickTime in Apple Mac OS X 10.6.x before 10.6.5 accesses uninitialized memory locations during processing of FlashPix image data which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted FlashPix file.


WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows and before 4.1.3 on Mac OS X 10.4 does not properly perform a cast of an unspecified variable during processing of Cascading Style Sheets (CSS) 3D transforms which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site.


WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows and before 4.1.3 on Mac OS X 10.4 does not properly perform a cast of an unspecified variable during processing of colors in an SVG document which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site.


The navigator.plugins implementation in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9 Thunderbird before 3.0.7 and 3.1.x before 3.1.3 and SeaMonkey before 2.0.7 does not properly handle destruction of the DOM plugin array which might allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via crafted access to the navigator object related to a \dangling pointer vulnerability.\


The FT_Stream_EnterFrame function in base/ftstream.c in FreeType before 2.4.2 does not properly validate certain position values which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.


Array index error in the PK font parser in the dvi-backend component in Evince 2.32 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font in conjunction with a DVI file that is processed by the thumbnailer.


tif_getimage.c in LibTIFF 3.9.0 and 3.9.2 on 64-bit platforms as used in ImageMagick does not properly perform vertical flips which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TIFF image related to \downsampled OJPEG input.\


Integer signedness error in the Quantum decompressor in cabextract before 1.3 when archive test mode is used allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Quantum archive in a .cab file related to the libmspack library.


BarnOwl before 1.6.2 does not check the return code of calls to the (1) ZPending and (2) ZReceiveNotice functions in libzephyr which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors.


Array index error in the VF font parser in the dvi-backend component in Evince 2.32 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font in conjunction with a DVI file that is processed by the thumbnailer.


ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted IPP request.


Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names which is not properly handled in a realloc operation when importing the certificate or verifying its signature.


Integer underflow in glyph handling in FreeType before 2.4.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.


Double free vulnerability in the ssl3_get_key_exchange function in the OpenSSL client (ssl/s3_clnt.c) in OpenSSL 1.0.0a 0.9.8 0.9.7 and possibly other versions when using ECDH allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted private key with an invalid prime. NOTE: some sources refer to this as a use-after-free issue.


Multiple unspecified vulnerabilities in Fenrir Inc. ActiveGeckoBrowser 1.0.0 and 1.0.5 alpha a module for the Sleipnir web browser allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors related to the Gecko engine.


FreeType before 2.4.2 uses incorrect integer data types during bounds checking which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.


rendering/FixedTableLayout.cpp in WebCore in WebKit in Google Chrome before 5.0.375.70 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an HTML document that has a large colspan attribute within a table.


Use-after-free vulnerability in Google Chrome before 4.0.249.78 allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving the display of a blocked popup window during navigation to a different web site.


Mozilla Thunderbird before 2.0.0.24 and SeaMonkey before 1.1.19 process e-mail attachments with a parser that performs casts and line termination incorrectly which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted message related to message indexing.


Integer signedness error in the window drawing implementation in Apple Java for Mac OS X 10.5 before Update 7 and Java for Mac OS X 10.6 before Update 2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted applet.


Unspecified vulnerability in Adobe Reader and Acrobat 9.x before 9.3.2 and 8.x before 8.2.2 on Windows and Mac OS X allows attackers to cause a denial of service or possibly execute arbitrary code via unknown vectors a different vulnerability than CVE-2010-0193 and CVE-2010-0196.


Unspecified vulnerability in Adobe Reader and Acrobat 9.x before 9.3.2 and 8.x before 8.2.2 on Windows and Mac OS X allows attackers to cause a denial of service or possibly execute arbitrary code via unknown vectors a different vulnerability than CVE-2010-0192 and CVE-2010-0193.


Multiple array index errors in set.c in dvipng 1.11 and 1.12 and teTeX allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed DVI file.


Geo++ GNCASTER 1.4.0.7 and earlier allows remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via a long NMEA data sentence.


Mozilla Firefox before 3.0.19 3.5.x before 3.5.9 and 3.6.x before 3.6.2 and SeaMonkey before 2.0.4 frees the contents of the window.navigator.plugins array while a reference to an array element is still active which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors related to a \dangling pointer vulnerability.\


OpenTTD before 1.0.1 does not properly validate index values of certain items which allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted in-game command.


Geo++ GNCASTER 1.4.0.7 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via multiple requests for a non-existent file using a long URI.


Apple Java for Mac OS X 10.5 before Update 7 and Java for Mac OS X 10.6 before Update 2 do not properly handle mediaLibImage objects which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds memory access and application crash) via a crafted applet related to the com.sun.medialib.mlib package.


Unspecified vulnerability in Adobe Reader and Acrobat 9.x before 9.3.2 and 8.x before 8.2.2 on Windows and Mac OS X allows attackers to cause a denial of service or possibly execute arbitrary code via unknown vectors a different vulnerability than CVE-2010-0192 and CVE-2010-0196.


Integer underflow in the unlzw function in unlzw.c in gzip before 1.4 on 64-bit platforms as used in ncompress and probably others allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted archive that uses LZW compression leading to an array index error.


The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function which allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a modrdn call with an RDN string containing invalid UTF-8 sequences which triggers a free of an invalid uninitialized pointer in the slap_mods_free function as demonstrated using the Codenomicon LDAPv3 test suite.


Use-after-free vulnerability in the nsTreeSelection implementation in Mozilla Firefox before 3.0.19 and 3.5.x before 3.5.9 Thunderbird before 3.0.4 and SeaMonkey before 2.0.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors that trigger a call to the handler for the select event for XUL tree items.


Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to a layout change during selection rendering and the DOCUMENT_POSITION_DISCONNECTED attribute in a container of an unspecified type.


WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 accesses uninitialized memory during the handling of a use element in an SVG document which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted document containing XML that triggers a parsing error related to ProcessInstruction.


Use-after-free vulnerability in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a foreignObject element in an SVG document.


Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to an array of long strings an array of IMG elements with crafted strings in their SRC attributes a TBODY element with no associated TABLE element and certain calls to the delete operator and the cloneNode clearAttributes and CollectGarbage methods possibly a related issue to CVE-2009-0075.


Opera before 10.53 on Windows and Mac OS X does not properly handle a series of document modifications that occur asynchronously which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via JavaScript that writes <marquee> sequences in an infinite loop leading to attempted use of uninitialized memory. NOTE: this might overlap CVE-2006-6955.


The ZIP archive decompressor in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute arbitrary code via a crafted archive.


Use-after-free vulnerability in JavaScriptCore in WebKit in Apple iTunes before 9.2 on Windows and Apple iOS before 4 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to page transitions a different vulnerability than CVE-2010-1763 and CVE-2010-1769.


Use-after-free vulnerability in WebKit as used in Apple iTunes before 10.2 on Windows Apple Safari and Google Chrome before 6.0.472.59 allows remote attackers to execute arbitrary code or cause a denial of service via vectors related to SVG styles the DOM tree and error messages.


Multiple format string vulnerabilities in Network Authorization in Apple Mac OS X 10.6 before 10.6.4 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a (1) afp (2) cifs or (3) smb URL.


Double free vulnerability in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x before 1.8.2 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a request associated with (1) renewal or (2) validation.


Multiple use-after-free vulnerabilities in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a (1) font-face or (2) use element in an SVG document.


Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows Safari before 4.1 on Mac OS X 10.4 and Safari on Apple iPhone OS allows remote attackers to execute arbitrary code or cause a denial of service (application crash) or read the SMS database or other data via vectors related to \attribute manipulation \ as demonstrated by Vincenzo Iozzo and Ralf Philipp Weinmann during a Pwn2Own competition at CanSecWest 2010.


Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to hover events.


Use-after-free vulnerability in page/Geolocation.cpp in WebCore in WebKit before r59859 as used in Google Chrome before 5.0.375.70 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site related to failure to stop timers associated with geolocation upon deletion of a document.


Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to HTML buttons and the first-letter CSS style.


Double free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to an event listener in an SVG document related to duplicate event listeners a timer and an AnimateTransform object.


Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the contentEditable attribute and removing container elements.


Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a large integer in the numcolors attribute of a recolorinfo element in a VML file possibly a related issue to CVE-2007-0024.


Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the removeChild DOM method.


The merge_authdata function in kdc_authdata.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8.x before 1.8.4 does not properly manage an index into an authorization-data list which allows remote attackers to cause a denial of service (daemon crash) or possibly obtain sensitive information spoof authorization or execute arbitrary code via a TGS request that triggers an uninitialized pointer dereference as demonstrated by a request from a Windows Active Directory client.


Integer signedness error in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows and before 4.1.1 on Mac OS X 10.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving a JavaScript array index.


Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the Cascading Style Sheets (CSS) run-in property and multiple invocations of a destructor for a child element that has been referenced multiple times.


Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an SVG document that contains recursive Use elements which are not properly handled during page deconstruction.


Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the Node.normalize method.


Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving caption elements.


WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 accesses out-of-bounds memory during processing of HTML tables which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document.


WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; accesses uninitialized memory during processing of the (1) :first-letter and (2) :first-line pseudo-elements in an SVG text element which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted document.


Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving fonts.


Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an HTML element that has custom vertical positioning.


WebKit in Apple iTunes before 9.2 on Windows and Apple iOS before 4 on the iPhone and iPod touch accesses out-of-bounds memory during the handling of tables which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document a different vulnerability than CVE-2010-1387 and CVE-2010-1763.


Use-after-free vulnerability in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to element focus.


Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving DOM Range objects.


Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving the :first-letter pseudo-element.


WebKit in Apple Safari 4.x before 4.1.2 and 5.x before 5.0.2; Android before 2.2; and webkitgtk before 1.2.6; does not properly validate floating-point data which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document related to non-standard NaN representation.


Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving a certain window close action that occurs during a drag-and-drop operation.


Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving HTML document subtrees.


WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 does not properly handle libxml contexts allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document related to an \API abuse issue.\


WebKit as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3 and Google Chrome before 6.0.472.62 does not properly perform a cast of an unspecified variable which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an SVG element in a non-SVG document.


WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; does not properly handle just-in-time (JIT) compiled JavaScript stubs which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document related to a \reentrancy issue.\


WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 accesses uninitialized memory during a selection change on a form input element which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document.


Use-after-free vulnerability in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document.


Stack consumption vulnerability in the WebCore::CSSSelector function in WebKit as used in Apple Safari 4.0.4 Apple Safari on iPhone OS and iPhone OS for iPod touch and Google Chrome 4.0.249 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a STYLE element composed of a large number of *> sequences.


Off-by-one error in the __opiereadrec function in readrec.c in libopie in OPIE 2.4.1-test1 and earlier as used on FreeBSD 6.4 through 8.1-PRERELEASE and other platforms allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long username as demonstrated by a long USER command to the FreeBSD 8.0 ftpd.


VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute arbitrary code via a crafted byte stream to the (1) AVI (2) ASF or (3) Matroska (aka MKV) demuxer.


The pfs_getextattr function in FreeBSD 7.x before 7.3-RELEASE and 8.x before 8.0-RC1 unlocks a mutex that was not previously locked which allows local users to cause a denial of service (kernel panic) overwrite arbitrary memory locations and possibly execute arbitrary code via vectors related to opening a file on a file system that uses pseudofs.


The GLX extension in X.Org xserver 1.7.7 allows remote authenticated users to cause a denial of service (server crash) and possibly execute arbitrary code via (1) a crafted request that triggers a client swap in glx/glxcmdsswap.c; or (2) a crafted length or (3) a negative value in the screen field in a request to glx/glxcmds.c.


Multiple unspecified vulnerabilities in pdf.c in libclamav in ClamAV before 0.96.5 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document aka (1) \bb #2358\ and (2) \bb #2396.\


Unspecified vulnerability in pdf.c in libclamav in ClamAV before 0.96.5 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document aka \bb #2380 \ a different vulnerability than CVE-2010-4260.


Array

index

error

in

the

FEBlend::apply

function

in

in

WebKit

as

used

in

Google

Chrome

before

webkitgtk

before

and

other

products

allows

remote

attackers

to

cause

a

denial

of

service

and

possibly

execute

arbitrary

code

via

a

crafted

SVG

document

related

to

effects

in

the

application

of

filters.


Use-after-free vulnerability in the servePendingRequests function in WebCore in WebKit in Apple Safari 4.0 and 4.0.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted HTML document that references a zero-length .js file and the JavaScript reload function. NOTE: some of these details are obtained from third party information.


The huft_build function in inflate.c in gzip before 1.3.13 creates a hufts (aka huffman) table that is too small which allows remote attackers to cause a denial of service (application crash or infinite loop) or possibly execute arbitrary code via a crafted archive. NOTE: this issue is caused by a CVE-2006-4334 regression.


Mozilla Firefox before 3.0.12 and 3.5 before 3.5.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving a Flash object a slow script dialog and the unloading of the Flash plugin which triggers attempted use of a deleted object.


Format string vulnerability in Armed Assault (aka ArmA) 1.14 and earlier and 1.16 beta and Armed Assault II 1.02 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in the (1) nickname and (2) datafile fields in a join request which is not properly handled when logging an error message.


Mozilla Thunderbird before 2.0.0.22 and SeaMonkey before 1.1.17 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a multipart/alternative e-mail message containing a text/enhanced part that triggers access to an incorrect object type.


The js_watch_set function in js/src/jsdbgapi.cpp in the JavaScript engine in Mozilla Firefox before 3.0.12 allows remote attackers to cause a denial of service (assertion failure and application exit) or possibly execute arbitrary code via a crafted .js file related to a \memory safety bug.\ NOTE: this was originally reported as affecting versions before 3.0.13.


Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1 through r8.1; Anti-Virus 2007 (v8) through 2009; eTrust EZ Antivirus r7.1; Internet Security Suite 2007 (v3) through Plus 2009; and other CA products allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted RAR archive file that triggers heap corruption a different vulnerability than CVE-2009-3588.


MixSense DJ Studio 1.0.0.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long string in an .mp3 playlist file.


Integer underflow in filter/ww8/ww8par2.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted sprmTDefTable table property modifier in a Word document.


Format string vulnerability in the AbstractCommand::onAbort function in src/AbstractCommand.cc in aria2 before 1.6.2 when logging is enabled allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a download URI. NOTE: some of these details are obtained from third party information.


filter/ww8/ww8par2.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted sprmTSetBrc table property modifier in a Word document related to a \boundary error flaw.\


Multiple unspecified vulnerabilities in WebKit in Apple Safari before 4.0.4 on Windows allow remote FTP servers to execute arbitrary code cause a denial of service (application crash) or obtain sensitive information via a crafted directory listing in a reply.


Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold SP1 and SP2 Windows Server 2008 Gold and SP2 and Windows 7 RC allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE PROTOCOL REQUEST packet which triggers an attempted dereference of an out-of-bounds memory location aka \SMBv2 Negotiation Vulnerability.\ NOTE: some of these details are obtained from third party information.


liboggplay in Mozilla Firefox 3.5.x before 3.5.6 and SeaMonkey before 2.0.1 might allow context-dependent attackers to cause a denial of service (application crash) or execute arbitrary code via unspecified vectors related to \memory safety issues.\


Multiple unspecified vulnerabilities in libvorbis as used in Mozilla Firefox 3.5.x before 3.5.4 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors. NOTE: this might overlap CVE-2009-2663.


The txMozillaXSLTProcessor::TransformToDoc function in Mozilla Firefox before 3.0.8 and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an XML file with a crafted XSLT transform.


Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18 and Adobe AIR before 1.5.2 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors related to a \null pointer vulnerability.\


Multiple insecure method vulnerabilities in the Symantec.EasySetup.1 ActiveX control in EasySetupInt.dll 14.0.4.30167 in the EasySetup wizard in Symantec Norton Ghost 14.0 allow remote attackers to cause a denial of service (browser crash) and possibly execute arbitrary code via unspecified input to the (1) GetBackupLocationPath (2) CallUninstall (3) SetupDeleteVolume (4) CanUseEasySetup (5) CallAddInitialProtection and (6) CallTour methods.


Use-after-free vulnerability in the garbage-collection implementation in WebCore in WebKit in Apple Safari before 4.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via an SVG animation element related to SVG set objects SVG marker elements the targetElement attribute and unspecified \caches.\


Unspecified vulnerability in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18 and Adobe AIR before 1.5.2 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors related to a \privilege escalation vulnerability.\


Use-after-free vulnerability in the JavaScript DOM implementation in WebKit in Apple Safari before 4.0 iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by destroying a document.body element that has an unspecified XML container with elements that support the dir attribute.


Integer signedness error in the store_id3_text function in the ID3v2 code in mpg123 before 1.7.2 allows remote attackers to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via an ID3 tag with a negative encoding value. NOTE: some of these details are obtained from third party information.


The decompression implementation in the Imf::hufUncompress function in OpenEXR 1.2.2 and 1.6.1 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger a free of an uninitialized pointer.


Apple QuickTime before 7.6.2 does not properly initialize memory before use in handling movie files which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a movie containing a user data atom of size zero.


icc.c in the International Color Consortium (ICC) Format library (aka icclib) as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using a device file for processing a crafted image file associated with large integer values for certain sizes related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.


Multiple array index errors in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via an Audible Audio (.aa) file with a crafted (1) nlen or (2) vlen Tag value each of which can lead to an invalid pointer dereference or the writing of a 0x00 byte to an arbitrary memory location after an allocation failure.


The Atheros wireless driver as used in Netgear WNDAP330 Wi-Fi access point with firmware 2.1.11 and other versions before 3.0.3 on the Atheros AR9160-BC1A chipset and other products allows remote authenticated users to cause a denial of service (device reboot or hang) and possibly execute arbitrary code via a truncated reserved management frame.


The IPv6 Neighbor Discovery Protocol (NDP) implementation in HP HP-UX B.11.11 B.11.23 and B.11.31 does not validate the origin of Neighbor Discovery messages which allows remote attackers to cause a denial of service (loss of connectivity) read private network traffic and possibly execute arbitrary code via a spoofed message that modifies the Forward Information Base (FIB) a related issue to CVE-2008-2476.


The layout engine in Mozilla Firefox 2 and 3 before 3.0.7 Thunderbird before 2.0.0.21 and SeaMonkey 1.1.15 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to gczeal a different vulnerability than CVE-2009-0773.


Multiple

integer

signedness

errors

in

UltraVNC

and

and

TightVnc

allow

remote

VNC

servers

to

cause

a

denial

of

service

(heap

corruption

and

application

crash)

or

possibly

execute

arbitrary

code

via

a

large

length

value

in

a

message

related

to

the

(a)

ClientConnection::CheckBufferSize

and

(b)

ClientConnection::CheckFileZipBufferSize

functions

in

ClientConnection.cpp.


PGP Desktop before 9.10 allows local users to (1) cause a denial of service (crash) via a crafted IOCTL request to pgpdisk.sys and (2) cause a denial of service (crash) and execute arbitrary code via a crafted IRP in an IOCTL request to pgpwded.sys.


The PNG reference library (aka libpng) before 1.0.43 and 1.2.x before 1.2.35 as used in pngcrush and other applications allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file that triggers a free of an uninitialized pointer in (1) the png_read_png function (2) pCAL chunk handling or (3) setup of 16-bit gamma tables.


Apple QuickTime before 7.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted image description atoms in an Apple video file related to a \sign extension issue.\


The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer.


Array index error in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted Sync Sample (aka stss) atom data in a malformed QuickTime media .mov file related to \mark keyframes.\


Integer underflow in the Huffman decoding functionality (pvmp3_huffman_parsing.cpp) in OpenCORE 2.0 and earlier allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a crafted MP3 file that triggers heap corruption.


Multiple integer underflows in FFmpeg 0.5 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted file that (1) bypasses a validation check in vorbis_dec.c and triggers a wraparound of the stack pointer or (2) access a pointer from out-of-bounds memory in mov.c related to an elst tag that appears before a tag that creates a stream.


ir32_32.dll 3.24.15.3 in the Indeo32 codec in Microsoft Windows 2000 SP4 XP SP2 and SP3 and Server 2003 SP2 allows remote attackers to cause a denial of service (heap corruption) or execute arbitrary code via malformed data in a stream in a media file as demonstrated by an AVI file.


Multiple integer underflows in the (1) AES and (2) RC4 decryption functionality in the crypto library in MIT Kerberos 5 (aka krb5) 1.3 through 1.6.3 and 1.7 before 1.7.1 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code by providing ciphertext with a length that is too short to be valid.


Integer underflow in the clean_string function in irc_string.c in (1) IRCD-hybrid 7.2.2 and 7.2.3 (2) ircd-ratbox before 2.2.9 and (3) oftc-hybrid before 1.6.8 when flatten_links is disabled allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a LINKS command.


Multiple vulnerabilities in multiple vendor implementations of the X.400 protocol allow remote attackers to cause a denial of service and possibly execute arbitrary code via an X.400 message containing certain unexpected ASN.1 constructs as demonstrated using the NISSC test suite.