Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code on the host OS by leveraging a loop that triggers an invalid memory copy affecting certain cancel_work_item data.


Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X and before 11.2.202.356 on Linux allows remote attackers to execute arbitrary code via unspecified vectors as exploited in the wild in April 2014.

buffer overflow
arbitrary code execution


Stack-based buffer overflow in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux Adobe AIR before 4.0.0.1628 on Android Adobe AIR SDK before 4.0.0.1628 and Adobe AIR SDK & Compiler before 4.0.0.1628 allows attackers to execute arbitrary code via unspecified vectors.


Buffer overflow in Poster Software PUBLISH-iT 3.6d allows remote attackers to execute arbitrary code via a crafted PUI file.


Buffer overflow in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux Adobe AIR before 13.0.0.83 on Android Adobe AIR SDK before 13.0.0.83 and Adobe AIR SDK & Compiler before 13.0.0.83 allows attackers to execute arbitrary code via unspecified vectors.


Multiple

buffer

overflows

in

X.Org

libXfont

before

and

before

allow

remote

font

servers

to

execute

arbitrary

code

via

a

crafted

xfs

protocol

reply

to

the

or

function.


Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android Adobe AIR SDK before 15.0.0.249 and Adobe AIR SDK & Compiler before 15.0.0.249 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2014-0556.


Heap-based buffer overflow in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux Adobe AIR before 15.0.0.356 Adobe AIR SDK before 15.0.0.356 and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2014-0582.


Buffer overflow in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows remote attackers to execute arbitrary code via a crafted BMP file.


Buffer overflow in IOHIDFamily in Apple iOS before 8.1.3 Apple OS X before 10.10.2 and Apple TV before 7.0.3 allows attackers to execute arbitrary code in a privileged context via a crafted app.


Buffer overflow in Hikvision DVR DS-7204 Firmware 2.2.10 build 131009 and other models and versions allows remote attackers to execute arbitrary code via an RTSP PLAY request with a long Authorization header.


Buffer overflow in Cybozu Office 9 and 10 before 10.1.0 Mailwise 4 and 5 before 5.1.4 and Dezie 8 before 8.1.1 allows remote authenticated users to execute arbitrary code via e-mail messages.


Buffer overflow in Senkas Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a POST request.


Multiple Stack-based Buffer Overflow vulnerabilities exists in Sniffit prior to 0.3.7 via a crafted configuration file that will bypass Non-eXecutable bit NX stack smashing protector SSP and address space layout randomization ASLR protection mechanisms which could let a malicious user execute arbitrary code.


Heap-based buffer overflow in the K7FWFilt.sys kernel mode driver (aka K7Firewall Packet Driver) before 14.0.1.16 as used in multiple K7 Computing products allows local users to execute arbitrary code with kernel privileges via a crafted parameter in a DeviceIoControl API call.


Stack-based buffer overflow in login_mgr.cgi in D-Link firmware DNR-320L and DNS-320LW before 1.04b08 DNR-322L before 2.10 build 03 DNR-326 before 2.10 build 03 and DNS-327L before 1.04b01 allows remote attackers to execute arbitrary code by crafting malformed \Host\ and \Referer\ header values.


Buffer

overflow

on

the

Allied

Telesis

CentreCOM

CentreCOM

CentreCOM

CentreCOM

CentreCOM

CentreCOM

CentreCOM

CentreCOM

Rapier

and

with

firmware

before

allows

remote

attackers

to

execute

arbitrary

code

via

a

crafted

HTTP

POST

request.


Buffer overflow in CHICKEN 4.9.0 and 4.9.0.1 may allow remote attackers to execute arbitrary code via the 'select' function.


Stack-based buffer overflow in the MailCheck821Address function in nnotes.dll in the nrouter.exe service in the server in IBM Lotus Domino 8.0.x before 8.0.2 FP5 and 8.5.x before 8.5.1 FP2 allows remote attackers to execute arbitrary code via a long e-mail address in an ORGANIZER:mailto header in an iCalendar calendar-invitation e-mail message aka SPR NRBY7ZPJ9V.


Buffer overflow in tm-console-bin in the DevonIT thin-client management tool might allow remote attackers to execute arbitrary code via unspecified vectors.


Buffer overflow in ftpd in IBM AIX 5.3 and earlier allows remote attackers to execute arbitrary code via a long NLST command.


Buffer overflow in mng_core_com.dll in CA XOsoft Replication r12.0 SP1 and r12.5 SP2 rollup CA XOsoft High Availability r12.0 SP1 and r12.5 SP2 rollup CA XOsoft Content Distribution r12.0 SP1 and r12.5 SP2 rollup and CA ARCserve Replication and High Availability (RHA) r15.0 SP1 allows remote attackers to execute arbitrary code via a crafted create_session_bab operation in a SOAP request to xosoapapi.asmx.


Stack-based buffer overflow in the UpdateFrameTitleForDocument method in the CFrameWnd class in mfc42.dll in the Microsoft Foundation Class (MFC) Library in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7 allows context-dependent attackers to execute arbitrary code via a long window title that this library attempts to create at the request of an application as demonstrated by the Trident PowerZip 7.2 Build 4010 application aka \Windows MFC Document Title Updating Buffer Overflow Vulnerability.\


Heap-based buffer overflow in the nsTextFrameUtils::TransformText function in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9 Thunderbird before 3.0.7 and 3.1.x before 3.1.3 and SeaMonkey before 2.0.7 might allow remote attackers to execute arbitrary code via a bidirectional text run.


Stack-based buffer overflow in Cisco WebEx Meeting Center T27LB before SP21 EP3 and T27LC before SP22 allows user-assisted remote authenticated users to execute arbitrary code by providing a crafted .atp file and then disconnecting from a meeting. NOTE: since this is a site-specific issue with no expected action for consumers it might be REJECTed.


Stack-based buffer overflow in the validateUser implementation in the com.ibm.db2.das.core.DasSysCmd function in db2dasrrm in the DB2 Administration Server (DAS) component in IBM DB2 9.1 before FP10 9.5 before FP6a and 9.7 before FP3 allows remote attackers to execute arbitrary code via a long username string.


Buffer overflow in the CGM image converter in the graphics filters in Microsoft Office XP SP3 Office 2003 SP3 and Office Converter Pack allows remote attackers to execute arbitrary code via a crafted CGM image in an Office document aka \CGM Image Converter Buffer Overrun Vulnerability.\


Multiple stack-based buffer overflows in the Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players T27LB before SP21 EP3 and T27LC before SP22 allow remote attackers to execute arbitrary code via a crafted (1) .wrf or (2) .arf file related to use of a function pointer in a callback mechanism.


Multiple buffer overflows in abcm2ps before 5.9.12 might allow remote attackers to execute arbitrary code via (1) a crafted input file related to the PUT0 and PUT1 output macros; (2) a crafted input file related to the trim_title function; and possibly (3) a long -O option on a command line.


Stack-based buffer overflow in the CreateSizedDIBSECTION function in shimgvw.dll in the Windows Shell graphics processor (aka graphics rendering engine) in Microsoft Windows XP SP2 and SP3 Server 2003 SP2 Vista SP1 and SP2 and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted .MIC or unspecified Office document containing a thumbnail bitmap with a negative biClrUsed value as reported by Moti and Xu Hao aka \Windows Shell Graphics Processing Overrun Vulnerability.\


Buffer overflow in the TIFF image converter in the graphics filters in Microsoft Office XP SP3 and Office Converter Pack allows remote attackers to execute arbitrary code via a crafted TIFF image in an Office document aka \TIFF Image Converter Buffer Overflow Vulnerability.\


Multiple stack-based buffer overflows in agent.exe in Setup Manager in Cisco Intelligent Contact Manager (ICM) before 7.0 allow remote attackers to execute arbitrary code via a long parameter in a (1) HandleUpgradeAll (2) AgentUpgrade (3) HandleQueryNodeInfoReq or (4) HandleUpgradeTrace TCP packet aka Bug IDs CSCti45698 CSCti45715 CSCti45726 and CSCti46164.


Buffer overflow in kavfm.sys in Kingsoft Antivirus 2010.04.26.648 and earlier allows local users to execute arbitrary code via a long argument to IOCTL 0x80030004. NOTE: some of these details are obtained from third party information.


Buffer overflow in the FlashPix image converter in the graphics filters in Microsoft Office XP SP3 and Office Converter Pack allows remote attackers to execute arbitrary code via a crafted FlashPix image in an Office document aka \FlashPix Image Converter Buffer Overflow Vulnerability.\


Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 21 5.0 Update 25 1.4.2_27 and 1.3.1_28 allows remote attackers to affect confidentiality integrity and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this involves an incorrect sign extension in the HeadspaceSoundbank.nGetName function which allows attackers to execute arbitrary code via a crafted BANK record that leads to a buffer overflow.


Heap-based buffer overflow in the TIFF image converter in the graphics filters in Microsoft Office XP SP3 Office Converter Pack and Works 9 allows remote attackers to execute arbitrary code via a crafted TIFF image in an Office document aka \TIFF Image Converter Heap Overflow Vulnerability.\


Multiple heap-based buffer overflows in an ActiveX control in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1.4 allow remote attackers to execute arbitrary code via a long .smil argument to the (1) tfile (2) pnmm or (3) cdda protocol handler.


Multiple stack-based buffer overflows in FastBackServer.exe in the Server in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 allow remote attackers to execute arbitrary code via vectors involving the (1) AGI_SendToLog (aka _SendToLog) function; the (2) group (3) workgroup or (4) domain name field to the USER_S_AddADGroup function; the (5) user_path variable to the FXCLI_checkIndexDBLocation function; or (6) the _AGI_S_ActivateLTScriptReply (aka ActivateLTScriptReply) function. NOTE: this might overlap CVE-2010-3059.


Stack-based buffer overflow in Microsoft Office XP SP3 Office 2003 SP3 Office 2007 SP2 Office 2010 Office 2004 and 2008 for Mac Office for Mac 2011 and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data aka \RTF Stack Buffer Overflow Vulnerability.\


Heap-based buffer overflow in the GSM mobility management implementation in Telephony in Apple iOS before 4.2 on the iPhone and iPad allows remote attackers to execute arbitrary code on the baseband processor via a crafted Temporary Mobile Subscriber Identity (TMSI) field.


Stack-based

buffer

overflow

in

the

Java_com_ibm_es_oss_CryptionNative_ESEncrypt

function

in

in

the

login

form

in

the

administration

interface

in

IBM

OmniFind

Enterprise

Edition

before

allows

remote

attackers

to

execute

arbitrary

code

via

a

long

password.


Stack-based buffer overflow in Microsoft Word 2002 SP3 2003 SP3 2007 SP2 and 2010; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP2; Word Viewer; Office Web Apps; and Word Web App allows remote attackers to execute arbitrary code via a crafted Word document aka \Word Stack Overflow Vulnerability.\


Multiple heap-based buffer overflows in loaders/load_it.c in libmikmod possibly 3.1.12 might allow remote attackers to execute arbitrary code via (1) crafted samples or (2) crafted instrument definitions in an Impulse Tracker file related to panpts pitpts and IT_ProcessEnvelope. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-3995.


Stack-based buffer overflow in st-wizard.exe in Subtitle Translation Wizard 3.0 allows user-assisted remote attackers to execute arbitrary code via a crafted SRT file with a long line after a time range. NOTE: some of these details are obtained from third party information.


Heap-based buffer overflow in Microsoft Outlook 2002 SP3 2003 SP3 and 2007 SP2 when Online Mode for an Exchange Server is enabled allows remote attackers to execute arbitrary code via a crafted e-mail message aka \Heap Based Buffer Overflow in Outlook Vulnerability.\


An unspecified function in TextXtra.x32 in Adobe Shockwave Player before 11.5.9.615 does not properly reallocate a buffer when processing a DEMX chunk in a Director file which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code.


Heap-based buffer overflow in Comctl32.dll (aka the common control library) in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7 when a third-party SVG viewer is used allows remote attackers to execute arbitrary code via a crafted HTML document that triggers unspecified messages from this viewer aka \Comctl32 Heap Overflow Vulnerability.\


Stack-based buffer overflow in the IMAP server component in GroupWise Internet Agent (GWIA) in Novell GroupWise 7.x before 7.0 post-SP4 FTF and 8.x before 8.0 SP2 allows remote attackers to execute arbitrary code via a long mailbox name in a CREATE command.


Buffer overflow in BarCodeWiz BarCode 3.29 ActiveX control (BarcodeWiz.dll) allows remote attackers to execute arbitrary code via a long argument to the LoadProperties method.


Array index error in AcroForm.api in Adobe Reader and Acrobat 9.x before 9.3.3 and 8.x before 8.2.3 on Windows and Mac OS X allows remote attackers to execute arbitrary code via a crafted GIF image in a PDF file which bypasses a size check and triggers a heap-based buffer overflow.


Buffer overflow in Rosoft Audio Converter 4.4.4 allows remote attackers to execute arbitrary code via a long playlist entry in a .m3u file.


Multiple heap-based buffer overflows in Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64 and Adobe AIR before 2.0.2.12610 might allow attackers to execute arbitrary code via unspecified vectors related to malformed (1) GIF or (2) JPEG data.


Stack-based buffer overflow in the IConfigurationAccess interface in the Invensys Wonderware Archestra ConfigurationAccessComponent ActiveX control in Wonderware Application Server (WAS) before 3.1 SP2 P01 as used in the Wonderware Archestra Integrated Development Environment (IDE) and the InFusion Integrated Engineering Environment (IEE) allows remote attackers to execute arbitrary code via the first argument to the UnsubscribeData method.


Stack-based buffer overflow in SonicWALL SSL-VPN End-Point Interrogator/Installer ActiveX control (Aventail.EPInstaller) before 10.5.2 and 10.0.5 hotfix 3 allows remote attackers to execute arbitrary code via long (1) CabURL and (2) Location arguments to the Install3rdPartyComponent method.


Stack-based buffer overflow in the media library in BS.Global BS.Player 2.51 build 1022 2.41 build 1003 and possibly other versions allows user-assisted remote attackers to execute arbitrary code via a long ID3 tag in a .MP3 file. NOTE: some of these details are obtained from third party information.


Stack-based buffer overflow in the nestlex function in nestlex.c in Socat 1.5.0.0 through 1.7.1.2 and 2.0.0-b1 through 2.0.0-b3 when bidirectional data relay is enabled allows context-dependent attackers to execute arbitrary code via long command-line arguments.


Buffer overflow in the smiGetNode function in lib/smi.c in libsmi 0.4.8 allows context-dependent attackers to execute arbitrary code via an Object Identifier (aka OID) represented as a numerical string containing many components separated by . (dot) characters.


Multiple buffer overflows in the PDF Distiller in the BlackBerry Attachment Service component in Research In Motion (RIM) BlackBerry Enterprise Server 4.1.3 through 5.0.2 and Enterprise Server Express 5.0.1 and 5.0.2 allow remote attackers to execute arbitrary code via a crafted PDF file.


Heap-based buffer overflow in pubconv.dll (aka the Publisher Converter DLL) in Microsoft Publisher 2002 SP3 2003 SP3 2007 SP2 and 2010 allows remote attackers to execute arbitrary code via a crafted Publisher file that uses an old file format aka \Heap Overrun in pubconv.dll Vulnerability.\


Buffer overflow in the UGameEngine::UpdateConnectingMessage function in the Unreal engine 1 2 and 2.5 as used in multiple games including Unreal Tournament 2004 Unreal tournament 2003 Postal 2 Raven Shield and SWAT4 when downloads are enabled allows remote attackers to execute arbitrary code via a long LEVEL field in a WELCOME response to a download request.


The IKE daemon in strongSwan 4.3.x before 4.3.7 and 4.4.x before 4.4.1 does not properly check the return values of snprintf calls which allows remote attackers to execute arbitrary code via crafted (1) certificate or (2) identity data that triggers buffer overflows.


Buffer overflow in Webby Webserver 1.01 allows remote attackers to execute arbitrary code via a long HTTP GET request.


Stack-based buffer overflow in BS.Global BS.Player 2.51 Build 1022 Free and possibly other versions allows user-assisted remote attackers to execute arbitrary code via the Skin parameter in the Options section of a skins file (.bsi) a different vulnerability than CVE-2009-1068.


Buffer overflow in Arcext.dll 2.16.1 and earlier in pon software Explzh 5.62 and earlier allows remote attackers to execute arbitrary code via an LZH LHA file with a crafted header that is not properly handled during expansion.


Heap-based buffer overflow in the CrystalReports12.CrystalPrintControl.1 ActiveX control in PrintControl.dll 12.3.2.753 in SAP Crystal Reports 2008 SP3 Fix Pack 3.2 allows remote attackers to execute arbitrary code via a long ServerResourceVersion property value.


Integer signedness error in rtfsr.dll in Autonomy KeyView 10.4 and 10.9 as used in multiple IBM Symantec and other products allows remote attackers to execute arbitrary code via a crafted \\ls keyword in a list override table entry in an RTF file which triggers a buffer overflow.


Buffer overflow in Cisco CiscoWorks Internetwork Performance Monitor (IPM) 2.6 and earlier on Windows as distributed in CiscoWorks LAN Management Solution (LMS) allows remote attackers to execute arbitrary code via a malformed getProcessName CORBA General Inter-ORB Protocol (GIOP) request related to a \third-party component \ aka Bug ID CSCsv62350.


Stack-based buffer overflow in vpnconf.exe in TheGreenBow IPSec VPN Client 4.51.001 4.65.003 and possibly other versions allows user-assisted remote attackers to execute arbitrary code via a long OpenScriptAfterUp parameter in a policy (.tgb) file related to \phase 2.\


Stack-based buffer overflow in the MOVIEPLAYER.MoviePlayerCtrl.1 ActiveX control in MoviePlayer.ocx 6.8.0.0 in Viscom Software Movie Player Pro SDK ActiveX 6.8 allows remote attackers to execute arbitrary code via a long strFontName parameter to the DrawText method.


Heap-based buffer overflow in Microsoft Office Excel 2007 SP1 and SP2 and Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted spreadsheet in which \a MDXSET record is broken up into several records \ aka \Microsoft Office Excel MDXSET Record Heap Overflow Vulnerability.\


Stack-based buffer overflow in nsum.exe in the Windows Media Unicast Service in Media Services for Microsoft Windows 2000 Server SP4 allows remote attackers to execute arbitrary code via crafted packets associated with transport information aka \Media Services Stack-based Buffer Overflow Vulnerability.\


Heap-based buffer overflow in DirectShow in Microsoft DirectX as used in the AVI Filter on Windows 2000 SP4 Windows XP SP2 and SP3 and Windows Server 2003 SP2 and in Quartz on Windows 2000 SP4 Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista Gold SP1 and SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7 allows remote attackers to execute arbitrary code via an AVI file with a crafted length field in an unspecified video stream which is not properly handled by the RLE video decompressor aka \DirectShow Heap Overflow Vulnerability.\


Buffer overflow in the cliproxy.objects.1 ActiveX control in the Symantec Client Proxy (CLIproxy.dll) in Symantec AntiVirus 10.0.x 10.1.x before MR9 and 10.2.x before MR4; and Symantec Client Security 3.0.x and 3.1.x before MR9 allows remote attackers to execute arbitrary code via a long argument to the SetRemoteComputerName function.


Multiple stack-based buffer overflows in Intel Alert Management System (aka AMS or AMS2) as used in Symantec AntiVirus Corporate Edition (SAVCE) 10.x before 10.1 MR10 Symantec System Center (SSC) 10.x and Symantec Quarantine Server 3.5 and 3.6 allow remote attackers to execute arbitrary code via (1) a long string to msgsys.exe related to the AMSSendAlertAct function in AMSLIB.dll in the Intel Alert Handler service (aka Symantec Intel Handler service); a long (2) modem string or (3) PIN number to msgsys.exe related to pagehndl.dll in the Intel Alert Handler service; or (4) a message to msgsys.exe related to iao.exe in the Intel Alert Originator service.


Heap-based buffer overflow in Microsoft Office Excel 2007 SP1 and SP2; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted spreadsheet in which \a MDXTUPLE record is broken up into several records \ aka \Microsoft Office Excel MDXTUPLE Record Heap Overflow Vulnerability.\


Buffer overflow in Microsoft Office Publisher 2002 SP3 2003 SP3 and 2007 SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted Publisher file aka \Microsoft Office Publisher File Conversion TextBox Processing Buffer Overflow Vulnerability.\


Stack-based buffer overflow in VBScript in Microsoft Windows 2000 SP4 XP SP2 and SP3 and Server 2003 SP2 when Internet Explorer is used might allow user-assisted remote attackers to execute arbitrary code via a long string in the fourth argument (aka helpfile argument) to the MsgBox function leading to code execution when the F1 key is pressed a different vulnerability than CVE-2010-0483.


Heap-based buffer overflow in the Local Security Authority Subsystem Service (LSASS) as used in Active Directory in Microsoft Windows Server 2003 SP2 and Windows Server 2008 Gold SP2 and R2; Active Directory Application Mode (ADAM) in Windows XP SP2 and SP3 and Windows Server 2003 SP2; and Active Directory Lightweight Directory Service (AD LDS) in Windows Vista SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7 allows remote authenticated users to execute arbitrary code via malformed LDAP messages aka \LSASS Heap Overflow Vulnerability.\


Stack-based buffer overflow in the SpreadSheet Lotus 123 reader (wkssr.dll) as used in Autonomy KeyView 10.4 and 10.9 Symantec Mail Security and possibly other products allows remote attackers to execute arbitrary code via unspecified vectors related to floating point conversion in unknown record types.


Unspecified vulnerability in the ImageIO component in Oracle Java SE and Java for Business 6 Update 18 5.0 Update 23 1.4.2_25 and 1.3.1_27 allows remote attackers to affect confidentiality integrity and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is a heap-based buffer overflow that allows remote attackers to execute arbitrary code related to an \invalid assignment\ and inconsistent length values in a JPEG image encoder (JPEGImageEncoderImpl).


Multiple stack-based buffer overflows in Free Download Manager (FDM) before 3.0.852 allow remote attackers to execute arbitrary code via vectors involving (1) the folders feature in Site Explorer (2) the websites feature in Site Explorer (3) an FTP URI or (4) a redirect.


Multiple stack-based buffer overflows in the MPEG Layer-3 audio codecs in Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP2 Vista Gold SP1 and SP2 and Server 2008 Gold and SP2 allow remote attackers to execute arbitrary code via a crafted AVI file aka \MPEG Layer-3 Audio Decoder Stack Overflow Vulnerability.\


Multiple stack-based buffer overflows in the HyleosChemView.HLChemView ActiveX control (HyleosChemView.ocx) in Hyleos ChemView 1.9.5.1 allow remote attackers to execute arbitrary code via a large number of white space characters in the filename argument to the (1) SaveasMolFile and (2) ReadMolFile methods.


Multiple stack-based buffer overflows in Embarcadero Technologies InterBase SMP 2009 9.0.3.437 allow remote attackers to execute arbitrary code via unknown vectors involving crafted packets. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Stack-based buffer overflow in the Lotus Domino Web Access ActiveX control in IBM Lotus iNotes (aka Domino Web Access or DWA) 6.5 7.0 before 7.0.4 8.0 8.0.2 and before 229.281 for Domino 8.0.2 FP4 allows remote attackers to execute arbitrary code via a long URL argument to an unspecified method aka PRAD7JTNHJ.


Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote attackers to affect confidentiality integrity and availability via unknown vectors. NOTE: the previous information was obtained from the January 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is a buffer overflow in observiced.exe that allows remote attackers to execute arbitrary code via vectors related to a \reverse lookup of connections\ to TCP port 10000.


Stack-based buffer overflow in Microsoft Office Excel 2002 SP3 Office 2004 for Mac Office 2008 for Mac and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via an Excel file with a crafted OBJ (0x5D) record aka \Excel Object Stack Overflow Vulnerability.\


Multiple stack-based buffer overflows in the SpreadSheet Lotus 123 reader (wkssr.dll) in Autonomy KeyView 10.4 and 10.9 as used in multiple IBM Symantec and other products allow remote attackers to execute arbitrary code via unspecified vectors related to \certain records.\


Buffer overflow in MSO.DLL in Microsoft Office XP SP3 and Office 2004 for Mac allows remote attackers to execute arbitrary code via a crafted Office document aka \MSO.DLL Buffer Overflow.\


Heap-based buffer overflow in an unspecified library in Autonomy KeyView 10.4 and 10.9 as used in multiple IBM Symantec and other products allows remote attackers to execute arbitrary code via a crafted compound file as demonstrated using a Quattro Pro file which is not properly handled by the Quattro speed reader (qpssr.dll).


Stack-based buffer overflow in the AgentX::receive_agentx function in AgentX++ 1.4.16 as used in RealNetworks Helix Server and Helix Mobile Server 11.x through 13.x and other products allows remote attackers to execute arbitrary code via unspecified vectors.


Buffer overflow in ovutil.dll in ovwebsnmpsrv.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via unspecified variables to jovgraph.exe which are not properly handled in a call to the sprintf function.


Multiple buffer overflows in the MPEG Layer-3 Audio Codec for Microsoft DirectShow in l3codecx.ax in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allow remote attackers to execute arbitrary code via an MPEG Layer-3 audio stream in (1) a crafted media file or (2) crafted streaming content aka \MPEG Layer-3 Audio Decoder Buffer Overflow Vulnerability.\


Multiple stack-based buffer overflows in a certain Tetradyne ActiveX control in HP Operations Manager 7.5 8.10 and 8.16 might allow remote attackers to execute arbitrary code via a long string argument to the (1) LoadFile or (2) SaveFile method related to srcvw32.dll and srcvw4.dll.


Buffer overflow in ovwebsnmpsrv.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via unspecified parameters to jovgraph.exe aka ZDI-CAN-683.


Buffer overflow in VISIODWG.DLL before 10.0.6880.4 in Microsoft Office Visio allows user-assisted remote attackers to execute arbitrary code via a crafted DXF file a different vulnerability than CVE-2010-0254 and CVE-2010-0256.


Buffer overflow in Microsoft Office Word 2002 SP3 2003 SP3 and 2007 SP2; Microsoft Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Word Viewer; and Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP2 allows remote attackers to execute arbitrary code via unspecified properties in the data in a crafted RTF document aka \Word RTF Parsing Buffer Overflow Vulnerability.\


Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3 as used in progressive applications might allow remote attackers to execute arbitrary code via a PNG image that triggers an additional data row.


Multiple

stack-based

buffer

overflows

in

the

jclient._Java_novell_jclient_JClient_defineClass@20

function

in

jclient.dll

in

the

Tomcat

web

server

in

Novell

iManager

and

allow

remote

authenticated

users

to

execute

arbitrary

code

via

the

EnteredClassID

or

NewClassName

parameter

to

nps/servlet/webacc.


Stack-based buffer overflow in IBM Lotus Notes 8.5 and 8.5fp1 and possibly other versions allows remote attackers to execute arbitrary code via unknown attack vectors as demonstrated by the vd_ln module in VulnDisco 9.0. NOTE: as of 20100222 this disclosure has no actionable information. However because the VulnDisco author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


Buffer overflow in MySQL 5.0 through 5.0.91 and 5.1 before 5.1.47 allows remote authenticated users to execute arbitrary code via a COM_FIELD_LIST command with a long table name.


Stack-based buffer overflow in serv.exe in SAP MaxDB 7.4.3.32 and 7.6.0.37 through 7.6.06 allows remote attackers to execute arbitrary code via an invalid length parameter in a handshake packet to TCP port 7210. NOTE: some of these details are obtained from third party information.


Buffer overflow in the RunCmd method in the SdcUser.TgConCtl ActiveX control in tgctlcm.dll in Consona Live Assistance Dynamic Agent and Subscriber Assistance allows remote attackers to execute arbitrary code via vectors involving \CreateProcess params.\ NOTE: some of these details are obtained from third party information.


Stack-based buffer overflow in the TIFMergeMultiFiles function in the SCRIBBLE.ScribbleCtrl.1 ActiveX control (ImageViewer2.ocx) in Viscom Image Viewer CP Pro 8.0 and Gold 6.0 allows remote attackers to execute arbitrary code via a long strDelimit parameter.


Stack-based buffer overflow in MicroP 0.1.1.1600 allows remote attackers to execute arbitrary code via a crafted .mppl file. NOTE: it has been reported that the overflow is in the lpFileName parameter of the CreateFileA function but the overflow is probably caused by a separate unnamed function.


Stack-based buffer overflow in the Image2PDF function in the SCRIBBLE.ScribbleCtrl.1 ActiveX control (ImageViewer2.ocx) in Viscom Image Viewer CP Pro 8.0 Gold 5.5 Gold 6.0 and earlier allows remote attackers to execute arbitrary code via a long strPDFFile parameter.


Stack-based buffer overflow in an unspecified logging function in oninit.exe in IBM Informix Dynamic Server (IDS) 11.10 before 11.10.xC2W2 and 11.50 before 11.50.xC1 allows remote authenticated users to execute arbitrary code via a crafted EXPLAIN directive aka idsdb00154125 and idsdb00154243.


Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1 RealPlayer SP 1.0 through 1.1.5 and RealPlayer Enterprise 2.1.2 and 2.1.3 allows remote attackers to execute arbitrary code via a crafted value in an unspecified header field in an RMX file.


Heap-based buffer overflow in the cook codec in RealNetworks RealPlayer 11.0 through 11.1 RealPlayer SP 1.0 through 1.1.5 and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code via unspecified data in the initialization buffer.


Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1.5 allows remote web servers to execute arbitrary code via a long Server header in a response to an HTTP request that occurs during parsing of a RealPix file.


Stack-based buffer overflow in a certain ActiveX control for the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmware 1.102A-008 allows remote attackers to execute arbitrary code via a long string in the first argument to the connect method.


Multiple stack-based buffer overflows in gwia.exe in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via a Content-Type header containing (1) multiple items separated by ; (semicolon) characters or (2) crafted string data.


Multiple buffer overflows in gwwww1.dll in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via variables in a VCALENDAR message as demonstrated by a long (1) REQUEST-STATUS (2) TZNAME (3) COMMENT or (4) RRULE variable in this message.


Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1 Mac RealPlayer 11.0 through 11.1 Linux RealPlayer 11.0.2.1744 and possibly HelixPlayer 1.0.6 and other versions allows remote attackers to execute arbitrary code via malformed multi-rate data in an audio stream.


Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers leading to improper rejection logging.


Multiple stack-based buffer overflows in libopensc in OpenSC 0.11.13 and earlier allow physically proximate attackers to execute arbitrary code via a long serial-number field on a smart card related to (1) card-acos5.c (2) card-atrust-acos.c and (3) card-starcos.c.


Stack-based buffer overflow in the save method in the IntegraXor.Project ActiveX control in igcomm.dll in Ecava IntegraXor Human-Machine Interface (HMI) before 3.5.3900.10 allows remote attackers to execute arbitrary code via a long string in the second argument.


Multiple stack-based buffer overflows in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via a long HTTP Host header to (1) gwpoa.exe in the Post Office Agent (2) gwmta.exe in the Message Transfer Agent (3) gwia.exe in the Internet Agent (4) the WebAccess Agent or (5) the Monitor Agent.


Stack-based buffer overflow in IBM Informix Dynamic Server (IDS) 7.x through 7.31 9.x through 9.40 10.00 before 10.00.xC10 11.10 before 11.10.xC3 and 11.50 before 11.50.xC3 allows remote authenticated users to execute arbitrary code via long DBINFO keyword arguments in a SQL statement aka idsdb00165017 idsdb00165019 idsdb00165021 idsdb00165022 and idsdb00165023.


Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1 RealPlayer SP 1.0 through 1.1.5 RealPlayer Enterprise 2.1.2 and 2.1.3 Linux RealPlayer 11.0.2.1744 and possibly HelixPlayer 1.0.6 and other versions allows remote attackers to execute arbitrary code via crafted ImageMap data in a RealMedia file related to certain improper integer calculations.


Heap-based buffer overflow in the getarena function in abc2ps.c in abcm2ps before 5.9.13 might allow remote attackers to execute arbitrary code via a crafted ABC file a different vulnerability than CVE-2010-3441. NOTE: some of these details are obtained from third party information.


Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1 RealPlayer SP 1.0 through 1.1.5 Mac RealPlayer 11.0 through 12.0.0.1444 and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code by specifying many subbands in cook audio codec information in a Real Audio file.


Buffer overflow in gwwww1.dll in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP2 allows remote attackers to execute arbitrary code via a crafted TZID variable in a VCALENDAR message.


Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1 RealPlayer SP 1.0 through 1.1.1 Mac RealPlayer 11.0 through 11.1 and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code via a large Screen Width value in the Screen Descriptor header of a GIF87a file in an RTSP stream.


Heap-based buffer overflow in the CDrawPoly::Serialize function in fxscover.exe in Microsoft Windows Fax Services Cover Page Editor 5.2 r2 in Windows XP Professional SP3 Server 2003 R2 Enterprise Edition SP2 and Windows 7 Professional allows remote attackers to execute arbitrary code via a long record in a Fax Cover Page (.cov) file. NOTE: some of these details are obtained from third party information.


Mediaserver.exe in ALLMediaServer 1.6 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long string to TCP port 888 a related issue to CVE-2017-17932.


MariaDB CONNECT Storage Engine Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16191.


MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.


A maliciously crafted DXF file in Autodesk AutoCAD 2022 2021 2020 2019 and Autodesk Navisworks 2022 can be used to write beyond the allocated buffer through Buffer overflow vulnerability. This vulnerability can be exploited to execute arbitrary code.


A

vulnerability

has

been

identified

in

SCALANCE

EEC

SCALANCE

EEC

coated)

SCALANCE

EEC

SCALANCE

EEC

coated)

SCALANCE

EEC

SCALANCE

EEC

coated)

SCALANCE

EEC

SCALANCE

EEC

coated)

SCALANCE

SCALANCE

FE

SCALANCE

EEC

SCALANCE

EEC

coated)

SCALANCE

EEC

SCALANCE

EEC

coated)

SCALANCE

EEC

SCALANCE

EEC

coated)

SCALANCE

EEC

SCALANCE

EEC

coated)

SCALANCE

SCALANCE

SCALANCE

SCALANCE

SCALANCE

SCALANCE

SCALANCE

SCALANCE

SCALANCE

SCALANCE

SCALANCE

SCALANCE

SCALANCE

SCALANCE

SCALANCE

PoE

SCALANCE

PoE

SCALANCE

TS

SCALANCE

TS

SCALANCE

SCALANCE

SCALANCE

SCALANCE

SCALANCE

FE

SCALANCE

FE

SCALANCE

SCALANCE

ports

on

front)

SCALANCE

ports

on

front)

SCALANCE

ports

on

rear)

SCALANCE

ports

on

rear)

SCALANCE

ports

on

front)

SCALANCE

ports

on

front)

SCALANCE

ports

on

rear)

SCALANCE

ports

on

rear)

SCALANCE

TS

SCALANCE

TS

SCALANCE

EEC

ports

on

front)

SCALANCE

EEC

ports

on

front)

SCALANCE

EEC

ports

on

rear)

SCALANCE

EEC

ports

on

rear)

SCALANCE

EEC

ports

on

front)

SCALANCE

EEC

ports

on

front)

SCALANCE

EEC

ports

on

rear)

SCALANCE

EEC

ports

on

rear)

SCALANCE

EEC

ports

on

front)

SCALANCE

EEC

ports

on

front)

SCALANCE

EEC

ports

on

rear)

SCALANCE

EEC

ports

on

rear)

SCALANCE

EEC

ports

on

front)

SCALANCE

EEC

ports

on

front)

SCALANCE

EEC

ports

on

rear)

SCALANCE

EEC

ports

on

rear)

SCALANCE

PoE

ports

on

front)

SCALANCE

PoE

ports

on

rear)

SCALANCE

PoE

ports

on

front)

SCALANCE

PoE

ports

on

rear)

SCALANCE

PoE

TS

ports

on

front)

SIPLUS

NET

SCALANCE

The

handling

of

arguments

such

as

IP

addresses

in

the

CLI

of

affected

devices

is

prone

to

buffer

overflows.

This

could

allow

an

authenticated

remote

attacker

to

execute

arbitrary

code

on

the

device.


A wgagent stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execute arbitrary code by initiating a firmware update with a malicious upgrade image. This vulnerability impacts Fireware OS before 12.7.2_U2 12.x before 12.1.3_U8 and 12.2.x through 12.5.x before 12.5.9_U2.


A systemd stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execute arbitrary code by initiating a firmware update with a malicious upgrade image. This vulnerability impacts Fireware OS before 12.7.2_U2 12.x before 12.1.3_U8 and 12.2.x through 12.5.x before 12.5.9_U2.


A maliciously crafted TIF or PICT file in Autodesk AutoCAD 2022 2021 2020 2019 can be used to write beyond the allocated buffer through Buffer overflow vulnerability. This vulnerability may be exploited to execute arbitrary code.


Omron CX-Position (versions 2.5.3 and prior) is vulnerable to multiple stack-based buffer overflow conditions while parsing a specific project file which may allow an attacker to locally execute arbitrary code.


Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors.


Omron CX-One Versions 4.60 and prior are vulnerable to a stack-based buffer overflow while processing specific project files which may allow an attacker to execute arbitrary code.


Heap-based buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3 Office 2003 SP3 Office XP Web Components SP3 Office 2003 Web Components SP3 Office 2003 Web Components SP1 for the 2007 Microsoft Office System Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 SP1 and Office Small Business Accounting 2006 allows remote attackers to execute arbitrary code via unspecified parameters to unknown methods aka \Office Web Components Heap Corruption Vulnerability.\


Multiple buffer overflows in NASA Common Data Format (CDF) allow context-dependent attackers to execute arbitrary code as demonstrated using (1) an array index error in the ReadAEDRList64 function and other errors in the (2) SearchForRecord_r_64 (3) LastRecord64 (4) CDFsel64 and other unspecified functions.


Integer signedness error in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe) as used in IBM Informix Dynamic Server (IDS) 10.x before 10.00.TC9 and 11.x before 11.10.TC3 and EMC Legato NetWorker allows remote attackers to execute arbitrary code via a crafted parameter size that triggers a stack-based buffer overflow.


Stack-based buffer overflow in SureThing CD/DVD Labeler 5.1.616 trial version allows user-assisted remote attackers to execute arbitrary code via a crafted (1) m3u or (2) pls playlist file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Buffer overflow in amp.exe in Brothersoft PEamp 1.02b allows user-assisted remote attackers to execute arbitrary code via a long string in a .m3u playlist file. NOTE: some of these details are obtained from third party information.


The License Logging Server (llssrv.exe) in Microsoft Windows 2000 SP4 allows remote attackers to execute arbitrary code via an RPC message containing a string without a null terminator which triggers a heap-based buffer overflow in the LlsrLicenseRequestW method aka \License Logging Server Heap Overflow Vulnerability.\


Stack-based buffer overflow in the _tt_internal_realpath function in the ToolTalk library (libtt.a) in IBM AIX 5.2.0 5.3.0 5.3.7 through 5.3.10 and 6.1.0 through 6.1.3 when the rpc.ttdbserver daemon is enabled in /etc/inetd.conf allows remote attackers to execute arbitrary code via a long XDR-encoded ASCII string to remote procedure 15.


Multiple

heap-based

buffer

overflows

in

in

Go-oo

and

before

previously

named

ooo-build

and

related

to

OpenOffice.org

(OOo)

allow

remote

attackers

to

execute

arbitrary

code

via

a

crafted

EMF+

file

a

similar

issue

to


Buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1 Windows XP SP2 and SP3 Office XP SP3 Office 2003 SP3 2007 Microsoft Office System SP1 and SP2 Office Project 2002 SP1 Visio 2002 SP2 Office Word Viewer Word Viewer 2003 Gold and SP3 Office Excel Viewer 2003 Gold and SP3 Office Excel Viewer Office PowerPoint Viewer 2007 Gold SP1 and SP2 Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP1 and SP2 Expression Web Expression Web 2 Groove 2007 Gold and SP1 Works 8.5 SQL Server 2000 Reporting Services SP2 SQL Server 2005 SP2 and SP3 Report Viewer 2005 SP1 Report Viewer 2008 Gold and SP1 and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via a crafted TIFF image file aka \GDI+ TIFF Buffer Overflow Vulnerability.\


Stack-based buffer overflow in rping in HP OpenView Network Node Manager (OV NNM) 7.53 on Linux allows remote attackers to execute arbitrary code via unspecified vectors possibly involving a CGI request to webappmon.exe. NOTE: this may overlap CVE-2009-1420.


Multiple buffer overflows in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe) as used in IBM Informix Dynamic Server (IDS) 10.x before 10.00.TC9 and 11.x before 11.10.TC3 allow remote attackers to execute arbitrary code via a crafted parameter size.


Multiple stack-based buffer overflows in the pgsqlQuery function in NullLogic Groupware 1.2.7 when PostgreSQL is used might allow remote attackers to execute arbitrary code via input to the (1) POP3 (2) SMTP or (3) web component that triggers a long SQL query.


Stack-based buffer overflow in a token searching function in the dtscore library in Data Transport Services in CA Software Delivery r11.2 C1 C2 C3 and SP4; Unicenter Software Delivery 4.0 C3; CA Advantage Data Transport 3.0 C1; and CA IT Client Manager r12 allows remote attackers to execute arbitrary code via crafted data.


Heap-based

buffer

overflow

in

in

Go-oo

and

before

previously

named

ooo-build

and

related

to

OpenOffice.org

(OOo)

allows

remote

attackers

to

execute

arbitrary

code

via

a

crafted

EMF

file

a

similar

issue

to


Heap-based buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1 Windows XP SP2 and SP3 Office XP SP3 Office 2003 SP3 2007 Microsoft Office System SP1 and SP2 Office Project 2002 SP1 Visio 2002 SP2 Office Word Viewer Word Viewer 2003 Gold and SP3 Office Excel Viewer 2003 Gold and SP3 Office Excel Viewer Office PowerPoint Viewer 2007 Gold SP1 and SP2 Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP1 and SP2 Expression Web Expression Web 2 Groove 2007 Gold and SP1 Works 8.5 SQL Server 2000 Reporting Services SP2 SQL Server 2005 SP2 and SP3 Report Viewer 2005 SP1 Report Viewer 2008 Gold and SP1 and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via a crafted PNG image file aka \GDI+ PNG Heap Overflow Vulnerability.\


Buffer overflow in the SIEVE script component (sieve/script.c) as used in cyrus-imapd in Cyrus IMAP Server 2.2.13 and 2.3.14 and Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7 allows local users to execute arbitrary code and read or modify arbitrary messages via a crafted SIEVE script related to the incorrect use of the sizeof operator for determining buffer length combined with an integer signedness error.


Stack-based buffer overflow in manager.exe in Akamai Download Manager (aka DLM or dlmanager) before 2.2.4.8 allows remote web servers to execute arbitrary code via a malformed HTTP response during a Redswoosh download a different vulnerability than CVE-2007-1891 and CVE-2007-1892.


Buffer overflow in the set_page_size function in util.cxx in HTMLDOC 1.8.27 and earlier allows context-dependent attackers to execute arbitrary code via a long MEDIA SIZE comment. NOTE: it was later reported that there were additional vectors in htmllib.cxx and ps-pdf.cxx using an AFM font file with a long glyph name but these vectors do not cross privilege boundaries.


Stack-based buffer overflow in the M_AddToServerList function in client/menu.c in Red Planet Arena Alien Arena 7.30 allows remote attackers to execute arbitrary code via a packet with a crafted server description to UDP port 27901 followed by a packet with a long print command.


Stack-based buffer overflow in libcsa.a (aka the calendar daemon library) in IBM AIX 5.x through 5.3.10 and 6.x through 6.1.3 and VIOS 2.1 and earlier allows remote attackers to execute arbitrary code via a long XDR string in the first argument to procedure 21 of rpc.cmsd.


Multiple heap-based buffer overflows in IN_MOD.DLL (aka the Module Decoder Plug-in) in Winamp before 5.57 and libmikmod 3.1.12 might allow remote attackers to execute arbitrary code via (1) crafted samples or (2) crafted instrument definitions in an Impulse Tracker file. NOTE: some of these details are obtained from third party information.


Stack-based buffer overflow in the client acceptor daemon (CAD) scheduler in the client in IBM Tivoli Storage Manager (TSM) 5.3 before 5.3.6.7 5.4 before 5.4.3 5.5 before 5.5.2.2 and 6.1 before 6.1.0.2 and TSM Express 5.3.3.0 through 5.3.6.6 allows remote attackers to execute arbitrary code via crafted data in a TCP packet.


Stack-based buffer overflow in the Meta Content Optimizer in Konae Technologies Alleycode HTML Editor 2.21 allows user-assisted remote attackers to execute arbitrary code via a long value in a (1) description or (2) keyword META tag. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22 JDK and JRE 6 before Update 17 SDK and JRE 1.3.x before 1.3.1_27 and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a long file: URL in an argument aka Bug Id 6854303.


Buffer overflow in the RunCmd method in the Altiris eXpress NS Console Utilities ActiveX control in AeXNSConsoleUtilities.dll in the web console in Symantec Altiris Deployment Solution 6.9.x Altiris Notification Server 6.0.x and Management Platform 7.0.x allows remote attackers to execute arbitrary code via a long string in the second argument.


Multiple stack-based buffer overflows in the NOS Microsystems getPlus Helper ActiveX control before 1.6.2.49 in gp.ocx in the Download Manager in Adobe Reader and Acrobat 9.x before 9.3 and 8.x before 8.2 on Windows and Mac OS X might allow remote attackers to execute arbitrary code via unspecified initialization parameters.


Buffer overflow on the D-Link DIR-400 wireless router allows remote attackers to execute arbitrary code via unspecified vectors as demonstrated by a certain module in VulnDisco Pack Professional 8.10 through 8.11. NOTE: as of 20090917 this disclosure has no actionable information. However because the VulnDisco Pack author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


Buffer overflow in xlssr.dll in the Autonomy KeyView XLS viewer (aka File Viewer for Excel) as used in IBM Lotus Notes 5.x through 8.5.x Symantec Mail Security Symantec BrightMail Appliance Symantec Data Loss Prevention (DLP) and other products allows remote attackers to execute arbitrary code via a crafted .xls spreadsheet attachment.


Stack-based buffer overflow in Core FTP 2.1 build 1612 allows user-assisted remote attackers to execute arbitrary code via a long hostname in an FTP server entry in a site backup file. NOTE: some of these details are obtained from third party information.


Stack-based buffer overflow in the BrowseAndSaveFile method in the Altiris eXpress NS ConsoleUtilities ActiveX control 6.0.0.1846 in AeXNSConsoleUtilities.dll in Symantec Altiris Notification Server (NS) 6.0 before R12 Deployment Server 6.8 and 6.9 in Symantec Altiris Deployment Solution 6.9 SP3 and Symantec Management Platform (SMP) 7.0 before SP3 allows remote attackers to execute arbitrary code via a long string in the second argument.


Buffer overflow on the Linksys WRT54GL wireless router allows remote attackers to execute arbitrary code via unspecified vectors as demonstrated by a certain module in VulnDisco Pack Professional 8.10 through 8.11. NOTE: as of 20090917 this disclosure has no actionable information. However because the VulnDisco Pack author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


Heap-based buffer overflow in the setBytePixels function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22 JDK and JRE 6 before Update 17 SDK and JRE 1.3.x before 1.3.1_27 and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via crafted arguments aka Bug Id 6872358.


Stack-based buffer overflow in OpenOffice.org (OOo) allows remote attackers to execute arbitrary code via unspecified vectors as demonstrated by a certain module in VulnDisco Pack Professional 8.8 aka \Client-side stack overflow exploit.\ NOTE: as of 20091005 this disclosure has no actionable information. However because the VulnDisco Pack author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


Stack-based buffer overflow in the setDiffICM function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22 JDK and JRE 6 before Update 17 SDK and JRE 1.3.x before 1.3.1_27 and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a crafted argument aka Bug Id 6872357.


Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 7.01 7.51 and 7.53 allow remote attackers to execute arbitrary code via (1) a long Template parameter to nnmRptConfig.exe related to the strcat function; or (2) a long Oid parameter to snmp.exe.


Buffer overflow in eXeScope 6.50 allows user-assisted remote attackers to execute arbitrary code via a crafted executable (.exe) file.


Stack-based buffer overflow in the IceWarpServer.APIObject ActiveX control in api.dll in IceWarp Merak Mail Server 9.4.1 might allow context-dependent attackers to execute arbitrary code via a large value in the second argument to the Base64FileEncode method as possibly demonstrated by a web application that accepts untrusted input for this method.


Buffer overflow in unpack200 in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier and 6 Update 12 and earlier allows remote attackers to access files or execute arbitrary code via a JAR file with crafted Pack200 headers.


Heap-based buffer overflow in the Microsoft Terminal Services Client ActiveX control running RDP 6.1 on Windows XP SP2 Vista SP1 or SP2 or Server 2008 Gold or SP2; or 5.2 or 6.1 on Windows XP SP3; allows remote attackers to execute arbitrary code via unspecified parameters to unknown methods aka \Remote Desktop Connection ActiveX Control Heap Overflow Vulnerability.\


Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74 when OpenSSL and autokey are enabled allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.


Heap-based buffer overflow in vmnc.dll in the VMnc media codec in VMware Movie Decoder before 6.5.4 Build 246459 on Windows and the movie decoder in VMware Workstation 6.5.x before 6.5.4 build 246459 VMware Player 2.5.x before 2.5.4 build 246459 and VMware Server 2.x on Windows allows remote attackers to execute arbitrary code via an AVI file with crafted video chunks that use HexTile encoding.


Stack-based buffer overflow in Adobe Reader 7 and Acrobat 7 before 7.1.3 Adobe Reader 8 and Acrobat 8 before 8.1.6 and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow attackers to execute arbitrary code via a PDF file containing a malformed U3D model file with a crafted extension block.


Multiple stack-based buffer overflows in IAO.EXE in the Intel Alert Originator Service in Symantec Alert Management System 2 (AMS2) as used in Symantec System Center (SSS); Symantec AntiVirus Server; Symantec AntiVirus Central Quarantine Server; Symantec AntiVirus (SAV) Corporate Edition 9 before 9.0 MR7 10.0 and 10.1 before 10.1 MR8 and 10.2 before 10.2 MR2; Symantec Client Security (SCS) 2 before 2.0 MR7 and 3 before 3.1 MR8; and Symantec Endpoint Protection (SEP) before 11.0 MR3 allow remote attackers to execute arbitrary code via (1) a crafted packet or (2) data that ostensibly arrives from the MsgSys.exe process.


Buffer overflow in CDex 1.70b2 allows remote attackers to execute arbitrary code via a crafted Info header in an Ogg Vorbis (.ogg) file.


vmnc.dll in the VMnc media codec in VMware Movie Decoder before 6.5.4 Build 246459 on Windows and the movie decoder in VMware Workstation 6.5.x before 6.5.4 build 246459 VMware Player 2.5.x before 2.5.4 build 246459 and VMware Server 2.x on Windows allows remote attackers to execute arbitrary code via an AVI file with crafted HexTile-encoded video chunks that trigger heap-based buffer overflows related to \integer truncation errors.\


Multiple stack-based buffer overflows in Mini-stream ASX to MP3 Converter 3.0.0.7 allow remote attackers to execute arbitrary code via (1) a long rtsp URL in a .ram file and (2) a long string in the HREF attribute of a REF element in a .asx file. NOTE: the latter was also subsequently reported in \prior to 3.1.3.7.\


Multiple heap-based buffer overflows in the D-Link MPEG4 Viewer ActiveX Control (csviewer.ocx) 2.11.918.2006 allow remote attackers to execute arbitrary code via a long argument to the (1) SetFilePath and (2) SetClientCookie methods. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Heap-based buffer overflow in the loadexponentialfunc function in mupdf/pdf_function.c in MuPDF in the mupdf-20090223-win32 package as used in SumatraPDF 0.9.3 and earlier allows remote attackers to execute arbitrary code via a crafted PDF file. NOTE: some of these details are obtained from third party information.


Heap-based buffer overflow in Microsoft Remote Desktop Connection (formerly Terminal Services Client) running RDP 5.0 through 6.1 on Windows and Remote Desktop Connection Client for Mac 2.0 allows remote attackers to execute arbitrary code via unspecified parameters aka \Remote Desktop Connection Heap Overflow Vulnerability.\


Multiple stack-based buffer overflows in the Lateral Arts Photobox uploader ActiveX control 1.x before 1.3 and 2.2.0.6 allow remote attackers to execute arbitrary code via a long URL string for the (1) LogURL (2) ConnectURL (3) SkinURL (4) AlbumCreateURL (5) ErrorURL or (6) httpsinglehost property value.


Integer signedness error in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier and 6 Update 12 and earlier allows remote attackers to access files or execute arbitrary code via crafted glyph descriptions in a Type1 font which bypasses a signed comparison and triggers a buffer overflow.


Stack-based buffer overflow in TIBCO SmartSockets before 6.8.2 SmartSockets Product Family (aka RTworks) before 4.0.5 and Enterprise Message Service (EMS) 4.0.0 through 5.1.1 as used in SmartSockets Server and RTworks Server (aka RTserver) SmartSockets client libraries and add-on products RTworks libraries and components EMS Server (aka tibemsd) SmartMQ iProcess Engine ActiveMatrix products and CA Enterprise Communicator allows remote attackers to execute arbitrary code via \inbound data \ as demonstrated by requests to the UDP interface of the RTserver component and data injection into the TCP stream to tibemsd.


Multiple buffer overflows in the Deployment Toolkit ActiveX control in deploytk.dll 6.0.130.3 in Sun Java SE Runtime Environment (aka JRE) 6 Update 13 allow remote attackers to execute arbitrary code via a long string argument to the (1) setInstallerType (2) setAdditionalPackages (3) compareVersion (4) getStaticCLSID or (5) launch method.


Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3 Office 2000 Web Components SP3 Office XP Web Components SP3 BizTalk Server 2002 and Visual Studio .NET 2003 SP1 allows remote attackers to execute arbitrary code via crafted property values aka \Office Web Components Buffer Overflow Vulnerability.\


Heap-based buffer overflow in the cdf_read_sat function in src/cdf.c in Christos Zoulas file 5.00 allows user-assisted remote attackers to execute arbitrary code via a crafted compound document file as demonstrated by a .msi .doc or .mpp file. NOTE: some of these details are obtained from third party information.


Multiple buffer overflows in the Internet Agent (aka GWIA) component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote attackers to execute arbitrary code via (1) a crafted e-mail address in an SMTP session or (2) an SMTP command.


Heap-based buffer overflow in the Windows Internet Name Service (WINS) component for Microsoft Windows 2000 SP4 and Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted WINS replication packet that triggers an incorrect buffer-length calculation aka \WINS Heap Overflow Vulnerability.\


Heap-based buffer overflow in Microsoft Office PowerPoint 2002 SP3 and 2003 SP3 and PowerPoint in Microsoft Office 2004 for Mac allows remote attackers to execute arbitrary code via a crafted structure in a Notes container in a PowerPoint file that causes PowerPoint to read more data than was allocated when creating a C++ object leading to an overwrite of a function pointer aka \Heap Corruption Vulnerability.\


Multiple stack-based and heap-based buffer overflows in Dafolo DafoloControl ActiveX control (DafoloFFControl.dll) 1.108.6.195 allow remote attackers to execute arbitrary code via long (1) baseurl (2) kommune (3) felter (4) afdeling (5) Flags (6) HelpURL (7) caburl or (8) filename properties; or (9) a long argument to the Open method. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Buffer overflow in the XMPP SOCKS5 bytestream server in Pidgin (formerly Gaim) before 2.5.6 allows remote authenticated users to execute arbitrary code via vectors involving an outbound XMPP file transfer. NOTE: some of these details are obtained from third party information.


Stack-based buffer overflow in the MPS.StormPlayer.1 ActiveX control in mps.dll 3.9.4.27 in Baofeng Storm allows remote attackers to execute arbitrary code via a long argument to the OnBeforeVideoDownload method as exploited in the wild in April and May 2009. NOTE: some of these details are obtained from third party information. NOTE: it was later reported that 3.09.04.17 and earlier are also affected.


Buffer overflow in WinAsm Studio 5.1.5.0 allows user-assisted remote attackers to execute arbitrary code via a crafted project (.wap) file.


Buffer overflow in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; 1.4.2_19 and earlier; and 1.3.1_24 and earlier allows remote attackers to access files or execute arbitrary code via a crafted GIF image aka CR 6804998.


Stack-based buffer overflow in ZipGenius might allow remote attackers to execute arbitrary code via a crafted .zip file that triggers an SEH overwrite. NOTE: it is possible that this overlaps CVE-2005-3317. NOTE: CVE has not investigated whether the specified file.zip file can be used for exploitation of this product.


Stack-based buffer overflow in the Chinagames CGAgent ActiveX control 1.x in CGAgent.dll as distributed in Chinagames iGame 2009 allows remote attackers to execute arbitrary code via a long argument to the CreateChinagames method as exploited in the wild in April and May 2009. NOTE: some of these details are obtained from third party information.


Integer underflow in OpenOffice.org (OOo) before 3.1.1 and StarOffice/StarSuite 7 8 and 9 might allow remote attackers to execute arbitrary code via crafted records in the document table of a Word document leading to a heap-based buffer overflow.


The Embedded OpenType (EOT) Font Engine (T2EMBED.DLL) in Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP2 Vista Gold SP1 and SP2 and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted name table in a data record that triggers an integer truncation and a heap-based buffer overflow aka \Embedded OpenType Font Heap Overflow Vulnerability.\


Heap-based buffer overflow in the decoder_create function in the initialization functionality in xvidcore/src/decoder.c in Xvid before 1.2.2 as used by Windows Media Player and other applications allows remote attackers to execute arbitrary code via vectors involving the DirectShow (aka DShow) frontend and improper handling of the XVID_ERR_MEMORY return code during processing of a crafted movie file. NOTE: some of these details are obtained from third party information.


Heap-based buffer overflow in Adobe Acrobat Reader and Acrobat Professional 7.1.0 8.1.3 9.0.0 and other versions allows remote attackers to execute arbitrary code via a PDF file containing a JBIG2 stream with a size inconsistency related to an unspecified table.


Buffer overflow in the IBM Lotus Notes Intellisync ActiveX control in lnresobject.dll in BlackBerry Desktop Manager in Research In Motion (RIM) BlackBerry Desktop Software before 5.0.1 allows remote attackers to execute arbitrary code via a crafted web page. NOTE: some of these details are obtained from third party information.


Heap-based buffer overflow in the VMnc media codec in vmnc.dll in VMware Movie Decoder before 6.5.3 build 185404 VMware Workstation 6.5.x before 6.5.3 build 185404 VMware Player 2.5.x before 2.5.3 build 185404 and VMware ACE 2.5.x before 2.5.3 build 185404 on Windows might allow remote attackers to execute arbitrary code via a video file with crafted dimensions (aka framebuffer parameters).


Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3 Adobe Reader 8 and Acrobat 8 before 8.1.6 and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2009-0510 CVE-2009-0511 CVE-2009-0512 and CVE-2009-0889.


Stack-based buffer overflow in Triologic Media Player 8.0.0.0 allows user-assisted remote attackers to execute arbitrary code via a long string in a .m3l playlist file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Heap-based buffer overflow in the DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module 1.49 for Perl might allow context-dependent attackers to execute arbitrary code via unspecified input to an application that uses the getline and pg_getline functions to read database rows.


Stack-based buffer overflow in the script_write_params method in client/dhclient.c in ISC DHCP dhclient 4.1 before 4.1.0p1 4.0 before 4.0.1p1 3.1 before 3.1.2p1 3.0 and 2.0 allows remote DHCP servers to execute arbitrary code via a crafted subnet-mask option.


Heap-based buffer overflow in the VNnc Codec in VMware Workstation 6.5.x before 6.5.2 build 156735 VMware Player 2.5.x before 2.5.2 build 156735 VMware ACE 2.5.x before 2.5.2 build 156735 and VMware Server 2.0.x before 2.0.1 build 156745 allows remote attackers to execute arbitrary code via a crafted web page or video file aka ZDI-CAN-435.


Buffer overflow in Becky! Internet Mail 2.48.02 and earlier allows remote attackers to execute arbitrary code via a mail message with a crafted return receipt request.


Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0 and 11.0 allow remote attackers to execute arbitrary code via (1) a long type parameter in an input tag which is not properly handled by the EndOfXmlAttributeValue function; (2) an \HTML GI\ in a start tag which is not properly handled by the ProcessStartGI function; and unspecified vectors in (3) html2thot.c and (4) xml2thot.c related to the msgBuffer variable. NOTE: these are different vectors than CVE-2008-6005.


Buffer overflow in a DLL file in RealNetworks RealPlayer 10 RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741 RealPlayer 11 11.0.0 through 11.0.4 RealPlayer Enterprise Mac RealPlayer 10 and 10.1 Linux RealPlayer 10 and Helix Player 10.x allows remote attackers to execute arbitrary code via a crafted Internet Video Recording (IVR) file with a filename length field containing a large integer which triggers overwrite of an arbitrary memory location with a 0x00 byte value related to use of RealPlayer through a Windows Explorer plugin.


Heap-based buffer overflow in the VNnc Codec in VMware Workstation 6.5.x before 6.5.2 build 156735 VMware Player 2.5.x before 2.5.2 build 156735 VMware ACE 2.5.x before 2.5.2 build 156735 and VMware Server 2.0.x before 2.0.1 build 156745 allows remote attackers to execute arbitrary code via a crafted web page or video file aka ZDI-CAN-436.


Multiple heap-based buffer overflows in OvCgi/Toolbar.exe in HP OpenView Network Node Manager (OV NNM) 7.01 7.51 and 7.53 allow remote attackers to execute arbitrary code via (1) a long OvAcceptLang cookie which triggers the error in ov.dll and ovwww.dll or (2) a long Accept-Language HTTP header which triggers the error in ovwww.dll or libovwww.so.4.


Multiple stack-based buffer overflows in the PowerPoint 4.0 importer (PP4X32.DLL) in Microsoft Office PowerPoint 2000 SP3 2002 SP3 and 2003 SP3 allow remote attackers to execute arbitrary code via crafted formatting data for paragraphs in a file that uses a PowerPoint 4.0 native file format related to (1) an incorrect calculation from a record header or (2) an interget that is used to specify the number of bytes to copy aka \Legacy File Format Vulnerability.\


Off-by-one error in the SMTP daemon in GroupWise Internet Agent (GWIA) in Novell GroupWise 6.5x 7.0 7.01 7.02 7.03 7.03HP1a and 8.0 allows remote attackers to execute arbitrary code via a long e-mail address in a malformed RCPT command leading to a buffer overflow.


Stack-based buffer overflow in MultiMedia Soft AdjMmsEng.dll 7.11.1.0 and 7.11.2.7 as distributed in multiple MultiMedia Soft audio components for .NET allows remote attackers to execute arbitrary code via a long string in a playlist (.pls) file as originally reported for Euphonics Audio Player 1.0. NOTE: some of these details are obtained from third party information.


Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3 Adobe Reader 8 and Acrobat 8 before 8.1.6 and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2009-0510 CVE-2009-0511 CVE-2009-0888 and CVE-2009-0889.


Multiple stack-based buffer overflows in the ReadSetOfCurves function in LittleCMS (aka lcms or liblcms) before 1.18beta2 as used in Firefox 3.1beta OpenJDK and GIMP allow context-dependent attackers to execute arbitrary code via a crafted image file associated with a large integer value for the (1) input or (2) output channel related to the ReadLUT_A2B and ReadLUT_B2A functions.


Stack-based buffer overflow in BreakPoint Software Hex Workshop 4.23 6.0.1.4603 and other 6.x and earlier versions allows remote attackers to execute arbitrary code via a crafted Intel Hex Code (.hex) file. NOTE: some of these details are obtained from third party information.


Stack-based buffer overflow in Foxit Reader 3.0 before Build 1506 including 1120 and 1301 allows remote attackers to execute arbitrary code via a long (1) relative path or (2) absolute path in the filename argument in an action as demonstrated by the \Open/Execute a file\ action.


Multiple buffer overflows in the torrent parsing implementation in Free Download Manager (FDM) 2.5 Build 758 and 3.0 Build 844 allow remote attackers to execute arbitrary code via (1) a long file name within a torrent file (2) a long tracker URL in a torrent file or (3) a long comment in a torrent file.


Stack-based buffer overflow in the EnumeratePrintShares function in Windows Print Spooler Service (win32spl.dll) in Microsoft Windows 2000 SP4 allows remote printer servers to execute arbitrary code via a crafted ShareName in a response to an RPC request related to \printing data structures \ aka \Buffer Overflow in Print Spooler Vulnerability.\


Stack-based buffer overflow in Merak Media Player 3.2 allows remote attackers to execute arbitrary code via a long string in a .m3u playlist file related to the status bar icon's tooltip. NOTE: some of these details are obtained from third party information.


Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3 Adobe Reader 8 and Acrobat 8 before 8.1.6 and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2009-0510 CVE-2009-0511 CVE-2009-0512 and CVE-2009-0888.


Heap-based buffer overflow in gen_msn.dll in the gen_msn plugin 0.31 for Winamp 5.541 allows remote attackers to execute arbitrary code via a playlist (.pls) file with a long URL in the File1 field. NOTE: some of these details are obtained from third party information.


Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11 might allow remote attackers to execute arbitrary code via crafted Composition Time To Sample (ctts) atom data in a malformed QuickTime media .mov file.


Heap-based buffer overflow in the big2_decode_symbol_dict function (jbig2_symbol_dict.c) in the JBIG2 decoding library (jbig2dec) in Ghostscript 8.64 and probably earlier versions allows remote attackers to execute arbitrary code via a PDF file with a JBIG2 symbol dictionary segment with a large run length value.


Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1 8 before 8.1.3 and 7 before 7.1.1 allows remote attackers to execute arbitrary code via a crafted argument to the getIcon method of a Collab object a different vulnerability than CVE-2009-0658.


Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3 Adobe Reader 8 and Acrobat 8 before 8.1.6 and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2009-0511 CVE-2009-0512 CVE-2009-0888 and CVE-2009-0889.


Stack-based buffer overflow in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 when the server has a map with a long IMAGEPATH or NAME attribute allows remote attackers to execute arbitrary code via a crafted id parameter in a query action.


Off-by-one error in the iMonitor component in Novell eDirectory 8.8 SP3 8.8 SP3 FTF3 and possibly other versions allows remote attackers to execute arbitrary code via an HTTP request with a crafted Accept-Language header which triggers a stack-based buffer overflow.


Multiple stack-based buffer overflows in the Research in Motion RIM AxLoader ActiveX control in AxLoader.ocx and AxLoader.dll in BlackBerry Application Web Loader 1.0 allow remote attackers to execute arbitrary code via unspecified use of the (1) load or (2) loadJad method.


csregprinter in the Printing component in Apple Mac OS X 10.4.11 and 10.5.6 does not properly handle error conditions which allows local users to execute arbitrary code via unknown vectors that trigger a heap-based buffer overflow.


Multiple buffer overflows in (a) BarnOwl before 1.0.5 and (b) owl 2.1.11 allow remote attackers to execute arbitrary code via vectors involving (1) a crafted zcrypt message related to zcrypt.c; (2) a reply command on a message with a Zephyr Cc: list related to zwrite.c; and unspecified other use of the products.


Buffer overflow in VUPlayer 2.49 and earlier allows user-assisted attackers to execute arbitrary code via a long URL in a File line in a .pls file as demonstrated by an http URL on a File1 line.


Array index error in FL21WIN.DLL in the PowerPoint Freelance Windows 2.1 Translator in Microsoft PowerPoint 2000 and 2002 allows remote attackers to execute arbitrary code via a Freelance file with unspecified \layout information\ that triggers a heap-based buffer overflow.


Multiple heap-based buffer overflows in the PDF distiller in the Attachment Service in Research in Motion (RIM) BlackBerry Enterprise Server (BES) 4.1.3 through 4.1.6 BlackBerry Professional Software 4.1.4 and BlackBerry Unite! before 1.0.3 bundle 28 allow user-assisted remote attackers to execute arbitrary code via (1) a crafted stream in a .pdf file related to \symWidths\; or (2) a crafted data stream in a .pdf file related to \bitmaps.\


Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11 and GStreamer Plug-ins (aka gstreamer-plugins) 0.8.5 might allow remote attackers to execute arbitrary code via crafted Time-to-sample (aka stts) atom data in a malformed QuickTime media .mov file.


Buffer overflow in Adobe Reader 9.0 and earlier and Acrobat 9.0 and earlier allows remote attackers to execute arbitrary code via a crafted PDF document related to a non-JavaScript function call and possibly an embedded JBIG2 image stream as exploited in the wild in February 2009 by Trojan.Pidief.E.


Stack-based buffer overflow in Orbit Downloader 2.8.2 and 2.8.3 and possibly other versions before 2.8.5 allows remote attackers to execute arbitrary code via a crafted HTTP URL with a long host name which is not properly handled when constructing a \Connecting\ log message.


Stack-based buffer overflow in Microsoft Office Word 2002 SP3 2003 SP3 and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; Microsoft Office Word Viewer 2003 SP3; Microsoft Office Word Viewer; and Microsoft Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a Word document with a crafted tag containing an invalid length field aka \Word Buffer Overflow Vulnerability.\


Heap-based buffer overflow in a DLL file in RealNetworks RealPlayer 10 RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741 RealPlayer 11 11.0.0 through 11.0.4 RealPlayer Enterprise Mac RealPlayer 10 and 10.1 Linux RealPlayer 10 and Helix Player 10.x allows remote attackers to execute arbitrary code via a crafted Internet Video Recording (IVR) file with a modified field that controls an unspecified structure length and triggers heap corruption related to use of RealPlayer through a Windows Explorer plugin.


Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3 Adobe Reader 8 and Acrobat 8 before 8.1.6 and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2009-0510 CVE-2009-0512 CVE-2009-0888 and CVE-2009-0889.


Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove references to destroyed objects during Shockwave Flash file processing which allows remote attackers to execute arbitrary code via a crafted file related to a \buffer overflow issue.\


Heap-based buffer overflow in Adobe Acrobat Reader 9 before 9.1 8 before 8.1.4 and 7 before 7.1.1 allows remote attackers to execute arbitrary code via a PDF file with a malformed JBIG2 symbol dictionary segment a different vulnerability than CVE-2009-1061 and CVE-2009-1062.


Stack-based buffer overflow in the eDirectory plugin in Novell iManager before 2.7.3 allows remote attackers to execute arbitrary code via vectors that trigger long arguments to an unspecified sub-application related to importing and exporting from a schema.


The FoFiType1::parse function in fofi/FoFiType1.cc in Xpdf 3.0.0 gpdf 2.8.2 kpdf in kdegraphics 3.3.1 and possibly other libraries and versions does not check the return value of the getNextLine function which allows context-dependent attackers to execute arbitrary code via a PDF file with a crafted Type 1 font that can produce a negative value leading to a signed-to-unsigned integer conversion error and a buffer overflow.


Buffer overflow in MediaServer.exe in TVersity 1.6 allows remote attackers to execute arbitrary code via unspecified vectors as demonstrated by the vd_tversity module in VulnDisco Pack Professional 8.11. NOTE: as of 20091229 this disclosure has no actionable information. However because the VulnDisco Pack author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


Buffer overflow in Adobe Illustrator CS4 14.0.0 CS3 13.0.3 and earlier and CS3 13.0.0 allows remote attackers to execute arbitrary code via a long DSC comment in an Encapsulated PostScript (.eps) file. NOTE: some of these details are obtained from third party information.


Heap-based buffer overflow in datatype/smil/common/smlpkt.cpp in smlrender.dll in RealNetworks RealPlayer 10 RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741 RealPlayer 11 11.0.0 through 11.0.4 RealPlayer Enterprise Mac RealPlayer 10 and 10.1 Linux RealPlayer 10 and 11.0.0 and Helix Player 10.x and 11.0.0 allows remote attackers to execute arbitrary code via an SMIL file with crafted string lengths.


Stack-based buffer overflow in JetCast.exe 2.0.4.1109 in jetAudio 7.5.2 and 7.5.3.15 allows remote attackers to execute arbitrary code via a long title in a FLAC file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Stack-based buffer overflow in the MYACTIVEX.MyActiveXCtrl.1 ActiveX control in MyActiveX.ocx 1.4.8.0 in Haihaisoft Universal Player allows remote attackers to execute arbitrary code via a long URL property value. NOTE: some of these details are obtained from third party information.


Stack-based buffer overflow in dsInstallerService.dll in the Juniper Installer Service as used in Juniper Odyssey Access Client 4.72.11421.0 and other products allows remote attackers to execute arbitrary code via a long string in a malformed DSSETUPSERVICE_CMD_UNINSTALL command to the NeoterisSetupService named pipe.


Multiple stack-based buffer overflows in src/Task.cc in the FastCGI program in IIPImage Server before 0.9.8 might allow remote attackers to execute arbitrary code via vectors associated with crafted arguments to the (1) RGN::run (2) JTLS::run or (3) SHD::run function. NOTE: some of these details are obtained from third party information.


Stack-based buffer overflow in RealNetworks RealPlayer 10 RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741 RealPlayer 11 11.0.0 through 11.0.4 RealPlayer Enterprise Mac RealPlayer 10 and 10.1 Linux RealPlayer 10 and Helix Player 10.x allows user-assisted remote attackers to execute arbitrary code via a malformed .RJS skin file that contains a web.xmb file with crafted length values.


Stack-based buffer overflow in HAURI ViRobot Desktop 5.5 before 2009-09-28.00 allows remote attackers to execute arbitrary code via unspecified vectors as demonstrated by a certain module in VulnDisco Pack Professional 7.15 through 8.11. NOTE: some of these details are obtained from third party information.


Heap-based buffer overflow in the CGIFCodec::GetPacketBuffer function in datatype/image/gif/common/gifcodec.cpp in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.0 through 11.0.4; RealPlayer Enterprise; Mac RealPlayer 10 10.1 and 11.0; Linux RealPlayer 10; and Helix Player 10.x allows remote attackers to execute arbitrary code via a GIF file with crafted chunk sizes that trigger improper memory allocation.


Buffer overflow in Invisible Browsing 5.0.52 allows user-assisted remote attackers to execute arbitrary code via a crafted .ibkey file containing a long string.


Stack-based buffer overflow in JustSystems Corporation Ichitaro 13 2004 through 2009 Viewer 2009 19.0.1.0 and earlier and other versions allows context-dependent attackers to execute arbitrary code via a crafted Rich Text File (RTF) related to \pvpara ffooter.\


Heap-based buffer overflow in the rb_str_justify function in string.c in Ruby 1.9.1 before 1.9.1-p376 allows context-dependent attackers to execute arbitrary code via unspecified vectors involving (1) String#ljust (2) String#center or (3) String#rjust. NOTE: some of these details are obtained from third party information.


Buffer overflow in webappmon.exe in HP OpenView Network Node Manager (OV NNM) 7.01 7.51 and 7.53 allows remote attackers to execute arbitrary code via a long HTTP Host header.


Heap-based buffer overflow in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.0 through 11.0.4; RealPlayer Enterprise; Mac RealPlayer 10 10.1 and 11.0; Linux RealPlayer 10; and Helix Player 10.x allows remote attackers to execute arbitrary code via an SIPR codec field with a small length value that triggers incorrect memory allocation.


Heap-based buffer overflow in the Intel Indeo41 codec for Windows Media Player in Microsoft Windows 2000 SP4 XP SP2 and SP3 and Server 2003 SP2 allows remote attackers to execute arbitrary code via a large size value in a movi record in an IV41 stream in a media file as demonstrated by an AVI file.


Stack-based buffer overflow in the Intel Indeo41 codec for Windows Media Player in Microsoft Windows 2000 SP4 XP SP2 and SP3 and Server 2003 SP2 allows remote attackers to execute arbitrary code via crafted compressed video data in an IV41 stream in a media file leading to many loop iterations as demonstrated by data in an AVI file.


Stack-based buffer overflow in the read_1_3_textobject function in f_readold.c in Xfig 3.2.5b and earlier and in the read_textobject function in read1_3.c in fig2dev in Transfig 3.2.5a and earlier allows remote attackers to execute arbitrary code via a long string in a malformed .fig file that uses the 1.3 file format. NOTE: some of these details are obtained from third party information.


Buffer overflow in the web service in AzeoTech DAQFactory 5.77 might allow remote attackers to execute arbitrary code via unspecified vectors as demonstrated by a certain module in VulnDisco Pack Professional 7.16 through 8.11. NOTE: as of 20091229 this disclosure has no actionable information. However because the VulnDisco Pack author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


Buffer overflow in to_ascii for PostgreSQL 7.2.x and 7.3.x before 7.3.4 allows remote attackers to execute arbitrary code.


Buffer overflows in osh before 1.7-11 allow local users to execute arbitrary code and bypass shell restrictions via (1) long environment variables or (2) long \file redirections.\


The Messenger Service for Windows NT through Server 2003 does not properly verify the length of the message which allows remote attackers to execute arbitrary code via a buffer overflow attack.


Buffer overflow in PostMethod() function for Monkey HTTP Daemon (monkeyd) 0.6.1 and earlier allows remote attackers to execute arbitrary code via a POST request with a large body.


Buffer overflows in (1) try_netscape_proxy and (2) try_squid_eplf for lftp 2.6.9 and earlier allow remote HTTP servers to execute arbitrary code via long directory names that are processed by the ls or rels commands.


Buffer overflow in EXPLORER.EXE on Windows XP allows attackers to execute arbitrary code as the XP user via a desktop.ini file with a long .ShellClassInfo parameter.


Buffer overflow in get_salt_from_password from sql_acl.cc for MySQL 4.0.14 and earlier and 3.23.x allows attackers with ALTER TABLE privileges to execute arbitrary code via a long Password field.


Buffer overflow in the streaming media component for logging multicast requests in the ISAPI for the logging capability of Microsoft Windows Media Services (nsiislog.dll) as installed in IIS 5.0 allows remote attackers to execute arbitrary code via a large POST request to nsiislog.dll.


Buffer overflow in PAM SMB module (pam_smb) 1.1.6 and earlier when authenticating to a remote service allows remote attackers to execute arbitrary code.


Buffer overflow in LinuxNode (node) before 0.3.2 allows remote attackers to execute arbitrary code.


Buffer overflow in Eset Software NOD32 for UNIX before 1.013 allows local users to execute arbitrary code via a long path name.


lsh daemon (lshd) does not properly return from certain functions in (1) read_line.c (2) channel_commands.c or (3) client_keyexchange.c when long input is provided which could allow remote attackers to execute arbitrary code via a heap-based buffer overflow attack.


Buffer overflow in Web Agent Administration service in web-tools for SAP DB before 7.4.03.30 allows remote attackers to execute arbitrary code via a long Name parameter to waadmin.wa.


Buffer overflow in LeapFTP 2.7.3.600 allows remote FTP servers to execute arbitrary code via a long IP address response to a PASV request.


Buffer overflow in uvadmsh in IBM U2 UniVerse 10.0.0.9 and earlier allows the uvadm user to execute arbitrary code via a long -uv.install command line argument.


Buffer overflow in escputil as included in the printer-drivers package in Mandrake Linux allows local users to execute arbitrary code via a long printer-name command line argument.


Buffer overflow in the get_msg_text of chan_sip.c in the Session Initiation Protocol (SIP) protocol implementation for Asterisk releases before August 15 2003 allows remote attackers to execute arbitrary code via certain (1) MESSAGE or (2) INFO requests.


Buffer overflow in tryelf() in readelf.c of the file command allows attackers to execute arbitrary code as the user running file possibly via a large entity size value in an ELF header (elfhdr.e_shentsize).


Buffer overflow in Troubleshooter ActiveX Control (Tshoot.ocx) in Microsoft Windows 2000 SP4 and earlier allows remote attackers to execute arbitrary code via an HTML document with a long argument to the RunQuery2 method.


Buffer overflows in protegrity.dll of Protegrity Secure.Data Extension Feature (SEF) before 2.2.3.9 allow attackers with SQL access to execute arbitrary code via the extended stored procedures (1) xp_pty_checkusers (2) xp_pty_insert or (3) xp_pty_select.


Buffer overflow in sys_cmd.c for gtkftpd 1.0.4 and earlier allows remote attackers to execute arbitrary code by creating long directory names and listing them with a LIST command.


eo420_GetStringFromVarPart in veo420.c for SAP database server (SAP DB) 7.4.03.27 and earlier may allow remote attackers to execute arbitrary code via a connect packet with a 256 byte segment to the niserver (aka serv.exe) process on TCP port 7269 which prevents the server from NULL terminating the string and leads to a buffer overflow.


Buffer overflow in ssinc.dll for Microsoft Internet Information Services (IIS) 5.0 allows local users to execute arbitrary code via a web page with a Server Side Include (SSI) directive with a long filename aka \Server Side Include Web Pages Buffer Overrun.\


Buffer overflow in defang in libhttpd.c for thttpd 2.21 to 2.23b1 allows remote attackers to execute arbitrary code via requests that contain '<' or '>' characters which trigger the overflow when the characters are expanded to \<\ and \>\ sequences.


Multiple buffer overflows in Oracle 9i Database release 2 Release 1 8i 8.1.7 and 8.0.6 allow remote attackers to execute arbitrary code via (1) a long conversion string argument to the TO_TIMESTAMP_TZ function (2) a long time zone argument to the TZ_OFFSET function or (3) a long DIRECTORY parameter to the BFILENAME function.


Stack-based buffer overflow in a logging function for Windows Workstation Service (WKSSVC.DLL) allows remote attackers to execute arbitrary code via RPC calls that cause long entries to be written to a debug log file (\NetSetup.LOG\) as demonstrated using the NetAddAlternateComputerName API.


Buffer overflow in secure locate (slocate) before 2.7 allows local users to execute arbitrary code via a long (1) -c or (2) -r command line argument.


Buffer overflow in the COM Object Control Handler for Lotus Domino 6.0.1 and earlier allows remote attackers to execute arbitrary code via multiple attack vectors as demonstrated using the InitializeUsingNotesUserName method in the iNotes ActiveX control.


Buffer overflow in iwconfig when installed setuid allows local users to execute arbitrary code via a long OUT environment variable.


Buffer overflow in WiTango Application Server and Tango 2000 allows remote attackers to execute arbitrary code via a long cookie to Witango_UserReference.


Buffer overflow in gkrellmd for gkrellm 2.1.x before 2.1.14 may allow remote attackers to execute arbitrary code.


Off-by-one error in the fb_realpath() function as derived from the realpath function in BSD may allow attackers to execute arbitrary code as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow including (1) STOR (2) RETR (3) APPE (4) DELE (5) MKD (6) RMD (7) STOU or (8) RNTO.


Stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows NT 4.0 SP6a 2000 SP2 through SP4 XP SP1 Server 2003 NetMeeting Windows 98 and Windows ME allows remote attackers to execute arbitrary code via a packet that causes the DsRolerUpgradeDownlevelServer function to create long debug entries for the DCPROMO.LOG log file as exploited by the Sasser worm.


Buffer overflow in net.c for cfengine 2.x before 2.0.8 allows remote attackers to execute arbitrary code via certain packets with modified length values which is trusted by the ReceiveTransaction function when using a buffer provided by the BusyWithConnection function.


Buffer overflow in net_swapscore for typespeed 0.4.1 and earlier allows remote attackers to execute arbitrary code.


Buffer overflow in Notes server before Lotus Notes R4 R5 before 5.0.11 and early R6 allows remote attackers to execute arbitrary code via a long distinguished name (DN) during NotesRPC authentication and an outer field length that is less than that of the DN field.


Buffer overflow in URLMON.DLL in Microsoft Internet Explorer 5.01 5.5 and 6.0 allows remote attackers to execute arbitrary code via an HTTP response containing long values in (1) Content-type and (2) Content-encoding fields.


Multiple buffer overflows in Options Parsing Tool (OPT) shared library 3.18 and earlier when used in setuid programs may allow local users to execute arbitrary code via long command line options that are fed into macros such as opt_warn_2 as used in functions such as opt_atoi.


Buffer overflow in the RPC Locator service for Microsoft Windows NT 4.0 Windows NT 4.0 Terminal Server Edition Windows 2000 and Windows XP allows local users to execute arbitrary code via an RPC call to the service containing certain parameter information.


Multiple heap-based buffer overflows in FTP Desktop client 3.5 and possibly earlier versions allow remote malicious servers to execute arbitrary code via (1) a long FTP banner (2) a long response to a USER command or (3) a long response to a PASS command.


Buffer overflow in xpcd-svga for xpcd 2.08 and earlier allows local users to execute arbitrary code via a long HOME environment variable.


Buffer overflow in Personal FTP Server allows remote attackers to execute arbitrary code via a long USER argument.


Buffer overflow in webfs before 1.17.1 allows remote attackers to execute arbitrary code via an HTTP request with a long Request-URI.


Buffer overflow in Backup and Restore Utility for Unix (BRU) 17.0 and earlier when running setuid allows local users to execute arbitrary code via a long command line argument.


Buffer overflow in mikmod 3.1.6 and earlier allows remote attackers to execute arbitrary code via an archive file that contains a file with a long filename.


Buffer overflow in Progress 4GL Compiler 9.1D06 and earlier allows attackers to execute arbitrary code via source code containing a long invalid data type.


Buffer overflow in Tellurian TftpdNT 1.8 allows remote attackers to execute arbitrary code via a TFTP request with a long filename.


Buffer overflow in (1) foxweb.dll and (2) foxweb.exe of Foxweb 2.5 allows remote attackers to execute arbitrary code via a long URL (PATH_INFO value).


Buffer overflow in moxftp 2.2 and earlier allows remote malicious FTP servers to execute arbitrary code via a long FTP banner.


Buffer overflow in conquest 7.2 and earlier may allow a local user to execute arbitrary code via a long environment variable.


Buffer overflow in the rendering for (1) Windows Metafile (WMF) or (2) Enhanced Metafile (EMF) image formats in Microsoft Windows NT 4.0 SP6a 2000 SP2 through SP4 and XP SP1 allows remote attackers to execute arbitrary code via a malformed WMF or EMF image.