Stack-based buffer overflow in the getPlus ActiveX control in gp.ocx 1.2.2.50 in NOS Microsystems getPlus Download Manager as used for the Adobe Reader 8.1 installation process and other downloads allows remote attackers to execute arbitrary code via unspecified vectors a different issue than CVE-2008-4817.


Stack-based buffer overflow in the ExecuteRequest method in the Novell iPrint ActiveX control in ienipp.ocx in Novell iPrint Client 5.06 and earlier allows remote attackers to execute arbitrary code via a long target-frame option value a different vulnerability than CVE-2008-2431.

buffer overflow
arbitrary code execution


Buffer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 and earlier might allow remote attackers to execute arbitrary code related to a ConvolveOp operation in the Java AWT library.


Multiple heap-based buffer overflows in xine-lib before 1.1.15 allow remote attackers to execute arbitrary code via vectors that send ID3 data to the (1) id3v22_interp_frame and (2) id3v24_interp_frame functions in src/demuxers/id3.c. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple stack-based buffer overflows in (1) University of Washington IMAP Toolkit 2002 through 2007c (2) University of Washington Alpine 2.00 and earlier and (3) Panda IMAP allow (a) local users to gain privileges by specifying a long folder extension argument on the command line to the tmail or dmail program; and (b) remote attackers to execute arbitrary code by sending e-mail to a destination mailbox name composed of a username and '+' character followed by a long string processed by the tmail or possibly dmail program.


Multiple heap-based buffer overflows in xine-lib 1.1.12 and other versions before 1.1.15 allow remote attackers to execute arbitrary code via vectors related to (1) a crafted metadata atom size processed by the parse_moov_atom function in demux_qt.c and (2) frame reading in the id3v23_interp_frame function in id3.c. NOTE: as of 20081122 it is possible that vector 1 has not been fixed in 1.1.15.


Stack-based buffer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows locally-launched and possibly remote untrusted Java applications to execute arbitrary code via a JAR file with a long Main-Class manifest entry.


Heap-based buffer overflow in Mplayer.exe in Herosoft Inc. Hero DVD Player 3.0.8 allows user-assisted remote attackers to execute arbitrary code via an M3u file with a \long entry.\ NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Buffer overflow in the ovlaunch CGI program in HP OpenView Network Node Manager (OV NNM) 7.01 7.51 and 7.53 on Windows allows remote attackers to execute arbitrary code via a crafted Host parameter. NOTE: this issue may be partially covered by CVE-2009-0205.


Multiple buffer overflows in lib/http.c in Streamripper 1.63.5 allow remote attackers to execute arbitrary code via (1) a long \Zwitterion v\ HTTP header related to the http_parse_sc_header function; (2) a crafted pls playlist with a long entry related to the http_get_pls function; or (3) a crafted m3u playlist with a long File entry related to the http_get_m3u function.


Stack-based buffer overflow in Hummingbird.XWebHostCtrl.1 ActiveX control (hclxweb.dll) in Hummingbird Xweb ActiveX Control 13.0 and earlier allows remote attackers to execute arbitrary code via a long PlainTextPassword property. NOTE: code execution might not be possible in 13.0.


Heap-based buffer overflow in QvodInsert.QvodCtrl.1 ActiveX control (QvodInsert.dll) in QVOD Player before 2.1.5 build 0053 allows remote attackers to execute arbitrary code via a long URL property. NOTE: some of these details are obtained from third party information.


Heap-based buffer overflow in dhost.exe in Novell eDirectory 8.x before 8.8.3 and 8.7.3 before 8.7.3.10 ftf1 allows remote attackers to execute arbitrary code via a crafted Netware Core Protocol opcode 0x24 message that triggers a calculation error that under-allocates a heap buffer.


Buffer overflow in FlashGet (formerly JetCar) FTP 1.9 allows remote FTP servers to execute arbitrary code via a long response to the PWD command.


Stack-based buffer overflow in the Agranet-Emweb embedded management web server in Alcatel OmniSwitch OS7000 OS6600 OS6800 OS6850 and OS9000 Series devices with AoS 5.1 before 5.1.6.463.R02 5.4 before 5.4.1.429.R01 6.1.3 before 6.1.3.965.R01 6.1.5 before 6.1.5.595.R01 and 6.3 before 6.3.1.966.R01 allows remote attackers to execute arbitrary code via a long Session cookie.


Stack-based buffer overflow in the parse_master function in the Ty demux plugin (modules/demux/ty.c) in VLC Media Player 0.9.0 through 0.9.4 allows remote attackers to execute arbitrary code via a TiVo TY media file with a header containing a crafted size value.


Heap-based buffer overflow in adsmdll.dll 5.3.7.7296 as used by the daemon (dsmsvc.exe) in the backup server in IBM Tivoli Storage Manager (TSM) Express 5.3.7.3 and earlier and TSM 5.2 5.3 before 5.3.6.0 and 5.4.0.0 through 5.4.4.0 allows remote attackers to execute arbitrary code via a crafted length value.


Heap-based buffer overflow in the Data Protection for SQL CAD service (aka dsmcat.exe) in the Client Acceptor Daemon (CAD) and the scheduler in the Backup-Archive client 5.1.0.0 through 5.1.8.1 5.2.0.0 through 5.2.5.2 5.3.0.0 through 5.3.6.1 5.4.0.0 through 5.4.2.2 and 5.5.0.0 through 5.5.0.91 in IBM Tivoli Storage Manager (TSM); and the Backup-Archive client in TSM Express; allows remote attackers to execute arbitrary code by sending a large amount of crafted data to a TCP port.


Multiple stack-based buffer overflows in dsmagent.exe in the Remote Agent Service in the IBM Tivoli Storage Manager (TSM) client 5.1.0.0 through 5.1.8.2 5.2.0.0 through 5.2.5.3 5.3.0.0 through 5.3.6.4 and 5.4.0.0 through 5.4.1.96 and the TSM Express client 5.3.3.0 through 5.3.6.4 allow remote attackers to execute arbitrary code via (1) a request packet that is not properly parsed by an unspecified \generic string handling function\ or (2) a crafted NodeName in a dicuGetIdentifyRequest request packet related to the (a) Web GUI and (b) Java GUI.


Multiple stack-based buffer overflows in DZIP32.DLL before 5.0.0.8 in DynaZip Max and DZIPS32.DLL before 6.0.0.5 in DynaZip Max Secure; as used in HP OpenView Performance Agent C.04.60 HP Performance Agent C.04.70 and C.04.72 TurboZIP 6.0 and other products; allow user-assisted attackers to execute arbitrary code via a long filename in a ZIP archive during a (1) Fix (aka Repair) (2) Add (3) Update or (4) Freshen action a related issue to CVE-2006-3985.


Stack-based buffer overflow in the SetSource method in the NetCamPlayerWeb11gv2 ActiveX control in NetCamPlayerWeb11gv2.ocx on the Cisco Linksys WVC54GC wireless video camera before firmware 1.25 allows remote attackers to execute arbitrary code via long invalid arguments.


Stack-based buffer overflow in VATDecoder.VatCtrl.1 ActiveX control in (1) 4xem VatCtrl Class (VATDecoder.dll 1.0.0.27 and 1.0.0.51) (2) D-Link MPEG4 SHM Audio Control (VAPGDecoder.dll 1.7.0.5) (3) Vivotek RTSP MPEG4 SP Control (RtspVapgDecoderNew.dll 2.0.0.39) and possibly other products allows remote attackers to execute arbitrary code via a long Url property. NOTE: some of these details are obtained from third party information.


Stack-based buffer overflow in wp6sr.dll in the Autonomy KeyView SDK 10.4 and earlier as used in IBM Lotus Notes Symantec Mail Security (SMS) products Symantec BrightMail Appliance products and Symantec Data Loss Prevention (DLP) products allows remote attackers to execute arbitrary code via a crafted Word Perfect Document (WPD) file.


Microsoft Office Word 2000 SP3 2002 SP3 2003 SP3 and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via crafted control words related to multiple Drawing Object tags in (1) an RTF file or (2) a rich text e-mail message which triggers incorrect memory allocation and a heap-based buffer overflow aka \Word RTF Object Parsing Vulnerability \ a different vulnerability than CVE-2008-4030.


Multiple heap-based buffer overflows in the AddTab method in the (1) Tab and (2) CTab ActiveX controls in c1sizer.ocx and the (3) TabOne ActiveX control in sizerone.ocx in ComponentOne SizerOne 8.0.20081.140 as used in ComponentOne Studio for ActiveX 2008 TSC2 Help Desk 4.1.8 SAP GUI 6.40 Patch 29 and 7.10 and possibly other products allow remote attackers to execute arbitrary code by adding many tabs or adding tabs with long tab captions.


Stack-based buffer overflow in the VSFlexGrid.VSFlexGridL ActiveX control in ComponentOne VSFlexGrid 7.0.1.151 and 8.0.20072.239 allows remote attackers to execute arbitrary code via a long first argument to the Archive method. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Stack-based buffer overflow in the SaveAs feature (SaveFileAsWithFilter function) in win_util.cc in Google Chrome 0.2.149.27 allows user-assisted remote attackers to execute arbitrary code via a web page with a long TITLE element which triggers the overflow when the user saves the page and a long filename is generated. NOTE: it might be possible to exploit this issue via an HTTP response that includes a long filename in a Content-Disposition header.


Stack-based buffer overflow in chrome/common/gfx/url_elider.cc in Google Chrome 0.2.149.27 and other versions before 0.2.149.29 might allow user-assisted remote attackers to execute arbitrary code via a link target (href attribute) with a large number of path elements which triggers the overflow when the status bar is updated after the user hovers over the link.


Multiple stack-based buffer overflows in CMailCOM.dll in CMailServer 5.4.6 allow remote attackers to execute arbitrary code via a long argument to the (1) CreateUserPath (2) Logout (3) DeleteMailByUID (4) MoveToInbox (5) MoveToFolder (6) DeleteMailEx (7) GetMailDataEx (8) SetReplySign (9) SetForwardSign and (10) SetReadSign methods which are not properly handled by (a) the POP3 Class ActiveX control (CMailCom.POP3); or a long argument to the (11) AddAttach (12) SetSubject (13) SetBcc (14) SetBody (15) SetCc (16) SetFrom (17) SetTo and (18) SetFromUID methods which are not properly handled by the Class ActiveX control (CMailCOM.SMTP) as demonstrated via the indexOfMail parameter to mwmail.asp.


Buffer overflow in YoungZSoft CCProxy 6.5 might allow remote attackers to execute arbitrary code via a CONNECTION request with a long hostname.


Stack-based buffer overflow in the IPureServer::_Recieve function in S.T.A.L.K.E.R.: Shadow of Chernobyl 1.0006 and earlier allows remote attackers to execute arbitrary code via a compressed 0x39 packet which is decompressed by the NET_Compressor::Decompress function.


Buffer overflow in emmailstore.dll 6.5.0.3 in the QuikSoft EasyMail MailStore ActiveX control allows remote attackers to execute arbitrary code via a long first argument to the CreateStore method.


Buffer overflow in Squid Analysis Report Generator (Sarg) 2.2.3.1 and probably later allows user-assisted remote attackers to execute arbitrary code via a long HTTP request method in a crafted access.log file a different vulnerability than CVE-2008-1167.


Buffer overflow in multiscan.exe in Check Point ZoneAlarm Security Suite 7.0.483.000 and 8.0.020.000 allows local users to execute arbitrary code via a file or directory with a long path. NOTE: some of these details are obtained from third party information.


Stack-based buffer overflow in the read_special_escape function in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta when the -e (aka special escapes processing) option is enabled allows user-assisted remote attackers to execute arbitrary code via a crafted ASCII file related to the setfilename command.


Stack-based buffer overflow in Microsoft Excel 2000 SP3 2002 SP3 2003 SP2 and SP3 and 2007 Gold and SP1; Office Excel Viewer 2003 SP3; Office Excel Viewer; Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via a BIFF file with a malformed record that triggers a user-influenced size calculation aka \File Format Parsing Vulnerability.\


Stack-based buffer overflow in the CLogger::WriteFormated function in echoware/Logger.cpp in EchoVNC Linux before 1.1.2 allows remote echoServers to execute arbitrary code via a large (1) group or (2) user list aka a \very crowded echoServer\ attack. NOTE: some of these details are obtained from third party information.


Stack-based buffer overflow in the (1) diff_addremove and (2) diff_change functions in GIT before 1.5.6.4 might allow local users to execute arbitrary code via a PATH whose length is larger than the system's PATH_MAX when running GIT utilities such as git-diff or git-grep.


Heap-based buffer overflow in the open_man_file function in callbacks.c in gmanedit 0.4.1 allows remote attackers to execute arbitrary code via a crafted man page which is not properly handled during utf8 conversion. NOTE: another overflow was reported using a configuration file but that vector does not have a scenario that crosses privilege boundaries.


Buffer overflow in src/openttd.cpp in OpenTTD before 0.6.2 allows local users to execute arbitrary code via a large filename supplied to the \-g\ parameter in the ttd_main function. NOTE: it is unlikely that this issue would cross privilege boundaries in typical environments.


Buffer overflow in the HTML parser in IntelliTamper 2.07 allows remote attackers to execute arbitrary code via a long URL in the SRC attribute of an IMG element. NOTE: this might be related to CVE-2008-3360. NOTE: it was later reported that 2.08 Beta 4 is also affected.


Multiple buffer overflows in TIBCO Hawk (1) AMI C library (libtibhawkami) and (2) Hawk HMA (tibhawkhma) as used in TIBCO Hawk before 4.8.1; Runtime Agent (TRA) before 5.6.0; iProcess Engine 10.3.0 through 10.6.2 and 11.0.0; and Mainframe Service Tracker before 1.1.0 might allow remote attackers to execute arbitrary code via a crafted message.


Heap-based buffer overflow in the strip_escapes function in signal.c in GNU ed before 1.0 allows context-dependent or user-assisted attackers to execute arbitrary code via a long filename. NOTE: since ed itself does not typically run with special privileges this issue only crosses privilege boundaries when ed is invoked as a third-party component.


Stack-based buffer overflow in CGI programs in the server in Trend Micro OfficeScan 7.3 Patch 4 build 1367 and other builds before 1374 and 8.0 SP1 Patch 1 before build 3110 allows remote attackers to execute arbitrary code via an HTTP POST request containing crafted form data related to \parsing CGI requests.\


Multiple stack-based buffer overflows in the Animation GIF ActiveX control in JComSoft AniGIF.ocx 1.12 and 2.47 as used in products such as SpeedBit Download Accelerator Plus (DAP) 8.6 allow remote attackers to execute arbitrary code via a long argument to the (1) ReadGIF or (2) ReadGIF2 method.


Heap-based buffer overflow in the OpenGifFile function in BiGif.dll in Black Ice Document Imaging SDK 10.95 allows remote attackers to execute arbitrary code via a long string argument to the GetNumberOfImagesInGifFile method in the BIImgFrm Control ActiveX control in biimgfrm.ocx. NOTE: some of these details are obtained from third party information.


Heap-based buffer overflow in the PPMedia Class ActiveX control in PPMPlayer.dll in PPMate 2.3.1.93 allows remote attackers to execute arbitrary code via a long argument to the StartUrl method. NOTE: some of these details are obtained from third party information.


Multiple buffer overflows in Princeton WordNet (wn) 3.0 allow context-dependent attackers to execute arbitrary code via (1) a long argument on the command line; a long (2) WNSEARCHDIR (3) WNHOME or (4) WNDBVERSION environment variable; or (5) a user-supplied dictionary (aka data file). NOTE: since WordNet itself does not run with special privileges this issue only crosses privilege boundaries when WordNet is invoked as a third party component.


Stack-based buffer overflow in the Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 in Ultra Shareware Ultra Office Control allows remote attackers to execute arbitrary code via long strUrl strFile and strPostData parameters to the HttpUpload method.


Buffer overflow in gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1 Windows XP SP2 and SP3 Server 2003 SP1 and SP2 Vista Gold and SP1 Server 2008 Office XP SP3 Office 2003 SP2 and SP3 2007 Microsoft Office System Gold and SP1 Visio 2002 SP2 PowerPoint Viewer 2003 Works 8 Digital Image Suite 2006 SQL Server 2000 Reporting Services SP2 SQL Server 2005 SP2 Report Viewer 2005 SP1 and 2008 and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via a malformed WMF image file that triggers improper memory allocation aka \GDI+ WMF Buffer Overrun Vulnerability.\


Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string as demonstrated by a string after \POST /.jsp\ in an HTTP request.


Buffer overflow in the ObjRemoveCtrl Class ActiveX control in OfficeScanRemoveCtrl.dll 7.3.0.1020 in Trend Micro OfficeScan Corp Edition (OSCE) Web-Deployment 7.0 7.3 build 1343 Patch 4 and other builds and 8.0; Client Server Messaging Security (CSM) 3.5 and 3.6; and Worry-Free Business Security (WFBS) 5.0 allows remote attackers to execute arbitrary code via a long string in the Server property and possibly other properties. NOTE: some of these details are obtained from third party information.


Multiple heap-based buffer overflows in the ApiThread function in the firewall service (aka TmPfw.exe) in Trend Micro Network Security Component (NSC) modules as used in Trend Micro OfficeScan 8.0 SP1 Patch 1 and Internet Security 2007 and 2008 17.0.1224 allow remote attackers to execute arbitrary code via a packet with a small value in an unspecified size field.


Buffer overflow in the CoVideoWindow.ocx ActiveX control 5.0.907.1 in Eyeball MessengerSDK as used in products such as SiOL Komunikator 1.3 allows remote attackers to execute arbitrary code via a large argument supplied to the BGColor method. NOTE: this might only be a vulnerability in certain insecure configurations of Internet Explorer.


Stack-based buffer overflow in the WMEncProfileManager ActiveX control in wmex.dll in Microsoft Windows Media Encoder 9 Series allows remote attackers to execute arbitrary code via a long first argument to the GetDetailsString method aka \Windows Media Encoder Buffer Overrun Vulnerability.\


Stack-based buffer overflow in a certain ActiveX control in rjbdll.dll in RealNetworks RealPlayer Enterprise RealPlayer 10 and RealPlayer 10.5 before build 6.0.12.1675 allows remote attackers to execute arbitrary code by importing a file into a media library and then deleting this file.


Multiple stack-based buffer overflows in ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.51 and possibly 7.01 7.50 and 7.53 allow remote attackers to execute arbitrary code via a long (1) REQUEST_SEV_CHANGE (aka number 47) (2) REQUEST_SAVE_STATE (aka number 61) or (3) REQUEST_RESTORE_STATE (aka number 62) request to TCP port 2954.


Multiple buffer overflows in Novell iPrint Client before 5.06 allow remote attackers to execute arbitrary code by calling the Novell iPrint ActiveX control (aka ienipp.ocx) with (1) a long third argument to the GetDriverFile method; a long first argument to the (2) GetPrinterURLList or (3) GetPrinterURLList2 method; (4) a long argument to the GetFileList method; a long argument to the (5) GetServerVersion (6) GetResourceList or (7) DeleteResource method related to nipplib.dll; a long uploadPath argument to the (8) UploadPrinterDriver or (9) UploadResource method related to URIs; (10) a long seventh argument to the UploadResource method; a long string in the (11) second (12) third or (13) fourth argument to the GetDriverSettings method related to the IppGetDriverSettings function in nipplib.dll; or (14) a long eighth argument to the UploadResourceToRMS method.


Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4DecryptFunction) functions in crypto.c in libexslt in libxslt 1.1.8 through 1.1.24 allow context-dependent attackers to execute arbitrary code via an XML file containing a long string as \an argument in the XSL input.\


Multiple buffer overflows in xdr functions in the server in CA BrightStor ARCServe Backup 11.0 11.1 and 11.5 allow remote attackers to execute arbitrary code as demonstrated by a stack-based buffer overflow via a long parameter to the xdr_rwsstring function.


Multiple stack-based buffer overflows in a certain ActiveX control in ienipp.ocx in Novell iPrint Client for Windows before 4.36 allow remote attackers to execute arbitrary code via a long value of the (1) operation (2) printer-url or (3) target-frame parameter. NOTE: some of these details are obtained from third party information.


Buffer overflow in the DXTTextOutEffect ActiveX control (aka the Text-Effect DXT Filter) as distributed in TextOut.dll 6.0.18.1 and mvtextout.dll in muvee autoProducer 6.0 and 6.1 allows remote attackers to execute arbitrary code via a long FontSetting property value.


Buffer overflow in TFTP Server SP 1.4 and 1.5 on Windows and possibly other versions allows remote attackers to execute arbitrary code via a long TFTP error packet. NOTE: some of these details are obtained from third party information.


Heap-based buffer overflow in the IBM AFP Viewer Plug-in 2.0.7.1 and 3.2.1.1 allows remote attackers to execute arbitrary code via a long SRC property value. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Stack-based buffer overflow in the searchwn function in Wordnet 2.0 2.1 and 3.0 might allow context-dependent attackers to execute arbitrary code via a long command line option. NOTE: this issue probably does not cross privilege boundaries except in cases in which Wordnet is used as a back end.


Multiple stack-based buffer overflows in Novell GroupWise Messenger (GWIM) Client before 2.0.3 HP1 for Windows allow remote attackers to execute arbitrary code via \spoofed server responses\ that contain a long string after the NM_A_SZ_TRANSACTION_ID field name.


Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file that calls the util.printf JavaScript function with a crafted format string argument a related issue to CVE-2008-1104.


Multiple buffer overflows in VIX API 1.1.x before 1.1.4 build 93057 on VMware Workstation 5.x and 6.x VMware Player 1.x and 2.x VMware ACE 2.x VMware Server 1.x VMware Fusion 1.x VMware ESXi 3.5 and VMware ESX 3.0.1 through 3.5 allow guest OS users to execute arbitrary code on the host OS via unspecified vectors.


Heap-based buffer overflow in the InternalOpenColorProfile function in mscms.dll in Microsoft Windows Image Color Management System (MSCMS) in the Image Color Management (ICM) component on Windows 2000 SP4 XP SP2 and SP3 and Server 2003 SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted image file.


Off-by-one error in the read_client function in webhttpd.c in Motion 3.2.10 and earlier might allow remote attackers to execute arbitrary code via a long request to a Motion HTTP Control interface which triggers a stack-based buffer overflow with some combinations of processor architecture and compiler.


Stack-based buffer overflow in the split_redraw function in split.c in mtr before 0.73 when invoked with the -p (aka --split) option allows remote attackers to execute arbitrary code via a crafted DNS PTR record. NOTE: it could be argued that this is a vulnerability in the ns_name_ntop function in resolv/ns_name.c in glibc and the proper fix should be in glibc; if so then this should not be treated as a vulnerability in mtr.


Multiple heap-based buffer overflows in the IppCreateServerRef function in nipplib.dll in Novell iPrint Client 4.x before 4.38 and 5.x before 5.08 allow remote attackers to execute arbitrary code via a long argument to the (1) GetPrinterURLList (2) GetPrinterURLList2 or (3) GetFileList2 function in the Novell iPrint ActiveX control in ienipp.ocx.


Heap-based buffer overflow in the VMware Host Guest File System (HGFS) in VMware Workstation 6 before 6.0.4 build 93057 VMware Player 2 before 2.0.4 build 93057 VMware ACE 2 before 2.0.2 build 93057 and VMware Fusion before 1.1.2 build 87978 when folder sharing is used allows guest OS users to execute arbitrary code on the host OS via unspecified vectors.


Stack-based buffer overflow in the Read32s_64 function in src/lib/cdfread64.c in the NASA Goddard Space Flight Center Common Data Format (CDF) library before 3.2.1 allows context-dependent attackers to execute arbitrary code via a .cdf file with crafted length tags.


Stack-based buffer overflow in cgiRecvFile.exe in Trend Micro OfficeScan 7.3 patch 4 build 1362 and other builds OfficeScan 8.0 and 8.0 SP1 and Client Server Messaging Security 3.6 allows remote attackers to execute arbitrary code via an HTTP request containing a long ComputerName parameter.


Multiple buffer overflows in the QIP Server Service (aka qipsrvr.exe) in LANDesk Management Suite Security Suite and Server Manager 8.8 and earlier allow remote attackers to execute arbitrary code via a crafted heal request related to the StringToMap and StringSize arguments.


Stack-based buffer overflow in msiexec.exe 3.1.4000.1823 and 4.5.6001.22159 in Microsoft Windows Installer allows context-dependent attackers to execute arbitrary code via a long GUID value for the /x (aka /uninstall) option. NOTE: this issue might cross privilege boundaries if msiexec.exe is reachable via components such as ActiveX controls and might additionally require a separate vulnerability in the control.


Buffer overflow in x87 before 3.5.5 in ABB Process Communication Unit 400 (PCU400) 4.4 through 4.6 allows remote attackers to execute arbitrary code via a crafted packet using the (1) IEC60870-5-101 or (2) IEC60870-5-104 communication protocol to the X87 web interface.


Heap-based buffer overflow in the Veritas Enterprise Administrator (VEA) service (aka vxsvc.exe) in Symantec Veritas Storage Foundation 5.0 allows remote attackers to execute arbitrary code via a packet with a crafted value of a certain size field which is not checked for consistency with the actual buffer size.


Stack-based buffer overflow in the Persits.XUpload.2 ActiveX control in XUpload.ocx 3.0.0.4 and earlier in Persits XUpload 3.0 allows remote attackers to execute arbitrary code via a long argument to the AddFile method. NOTE: some of these details are obtained from third party information.


Heap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors possibly related to the product's configuration a different vulnerability than CVE-2008-0012 and CVE-2008-0013.


Multiple buffer overflows in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access Control Server (ACS) for Windows and ACS Solution Engine allow remote attackers to execute arbitrary code via a long argument located immediately after the Logout argument and possibly unspecified other vectors.


Heap-based buffer overflow in the cgiCompileSearch function in CUPS 1.3.5 and other versions including the version bundled with Apple Mac OS X 10.5.2 when printer sharing is enabled allows remote attackers to execute arbitrary code via crafted search expressions.


Multiple stack-based buffer overflows in the BackWeb Lite Install Runner ActiveX control in the BackWeb Web Package ActiveX object in LiteInstActivator.dll in BackWeb before 8.1.1.87 as used in Logitech Desktop Manager (LDM) before 2.56 allow remote attackers to execute arbitrary code via unspecified vectors.


Buffer overflow in url.c in MPlayer 1.0rc2 and SVN before r25823 allows remote attackers to execute arbitrary code via a crafted URL that prevents the IPv6 parsing code from setting a pointer to NULL which causes the buffer to be reused by the unescape code.


Heap-based buffer overflow in the rmff_dump_cont function in input/libreal/rmff.c in xine-lib 1.1.9 and earlier allows remote attackers to execute arbitrary code via the SDP Abstract attribute in an RTSP session related to the rmff_dump_header function and related to disregarding the max field. NOTE: some of these details are obtained from third party information.


Stack-based buffer overflow in the QMPUpgrade.Upgrade.1 ActiveX control in QMPUpgrade.dll 1.0.0.1 in Move Networks Upgrade Manager allows remote attackers to execute arbitrary code via a long first argument to the Upgrade method. NOTE: some of these details are obtained from third party information.


Buffer overflow in the Sony AxRUploadServer.AxRUploadControl.1 ActiveX control in AxRUploadServer.dll 1.0.0.38 in SonyISUpload.cab 1.0.0.38 for Sony ImageStation allows remote attackers to execute arbitrary code via a long argument to the SetLogging method. NOTE: some of these details are obtained from third party information.


Array index vulnerability in libmpdemux/demux_audio.c in MPlayer 1.0rc2 and SVN before r25917 and possibly earlier versions as used in Xine-lib 1.1.10 might allow remote attackers to execute arbitrary code via a crafted FLAC tag which triggers a buffer overflow.


Stack-based buffer overflow in the AutoFix Support Tool ActiveX control 2.7.0.1 in SYMADATA.DLL in multiple Symantec Norton products including Norton 360 1.0 AntiVirus 2006 through 2008 Internet Security 2006 through 2008 and System Works 2006 through 2008 allows remote attackers to execute arbitrary code via a long argument to the GetEventLogInfo method. NOTE: some of these details are obtained from third party information.


Buffer overflow in the NamoInstaller.NamoInstall.1 ActiveX control in NamoInstaller.dll 3.0.0.1 as used in Sejoong Namo ActiveSquare6 allows remote attackers to execute arbitrary code via a long argument to the Install method a different vulnerability than CVE-2008-0551.


Multiple buffer overflows in htmsr.dll in the HTML speed reader in Autonomy (formerly Verity) KeyView as used by IBM Lotus Notes 7.0.2 and 7.0.3 allow remote attackers to execute arbitrary code via an HTML document with (1) \large chunks of data \ or a long URL in the (2) BACKGROUND attribute of a BODY element or (3) SRC attribute of an IMG element.


Heap-based buffer overflow in the FileUploader.FUploadCtl.1 ActiveX control in FileUploader.dll 2.0.0.2 in Lycos FileUploader Module allows remote attackers to execute arbitrary code via a long HandwriterFilename property value. NOTE: some of these details are obtained from third party information.


Buffer overflow in stream_cddb.c in MPlayer 1.0rc2 and SVN before r25824 allows remote user-assisted attackers to execute arbitrary code via a CDDB database entry containing a long album title.


Multiple stack-based buffer overflows in the WebLaunch.WeblaunchCtl.1 (aka CWebLaunchCtl) ActiveX control in weblaunch.ocx 1.0.0.1 in Gateway Weblaunch allow remote attackers to execute arbitrary code via a long string in the (1) second or (2) fourth argument to the DoWebLaunch method. NOTE: some of these details are obtained from third party information.


Multiple heap-based buffer overflows in the rmff_dump_cont function in input/libreal/rmff.c in xine-lib 1.1.9 allow remote attackers to execute arbitrary code via the SDP (1) Title (2) Author or (3) Copyright attribute related to the rmff_dump_header function different vectors than CVE-2008-0225. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 7.01 7.51 and 7.53 allow remote attackers to execute arbitrary code via (1) long string parameters to the OpenView5.exe CGI program; (2) a long string parameter to the OpenView5.exe CGI program related to ov.dll; or a long string parameter to the (3) getcvdata.exe (4) ovlaunch.exe or (5) Toolbar.exe CGI program.


Stack-based buffer overflow in the EnumPrinters function in the Spooler service (nwspool.dll) in Novell Client 4.91 SP2 SP3 and SP4 for Windows allows remote attackers to execute arbitrary code via a crafted RPC request aka Novell bug 353138 a different vulnerability than CVE-2006-5854. NOTE: this issue exists because of an incomplete fix for CVE-2007-6701.


Buffer overflow in Citadel SMTP server 7.10 and earlier allows remote attackers to execute arbitrary code via a long RCPT TO command which is not properly handled by the makeuserkey function. NOTE: some of these details were obtained from third party information.


Buffer overflow in SAPLPD 6.28 and earlier included in SAP GUI 7.10 and SAPSprint before 1018 allows remote attackers to execute arbitrary code via long arguments to the (1) 0x01 (2) 0x02 (3) 0x03 (4) 0x04 and (5) 0x05 LPD commands.


Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL) as used in the MPEG2TuneRequest ActiveX control in msvidctl.dll in DirectShow in Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP2 Vista Gold SP1 and SP2 and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted web page as exploited in the wild in July 2009 aka \Microsoft Video ActiveX Control Vulnerability.\


Multiple stack-based buffer overflows in the HanGamePluginCn18.HanGamePluginCn18.1 ActiveX control in HanGamePluginCn18.dll in Ourgame GLWorld 2.6.1.29 (aka Lianzong Game Platform) allow remote attackers to execute arbitrary code via long arguments to the (1) hgs_startGame and (2) hgs_startNotify methods as exploited in the wild as of February 2008. NOTE: some of these details are obtained from third party information.


Multiple stack-based and heap-based buffer overflows in the Windows RPC components for IBM Informix Storage Manager (ISM) as used in Informix Dynamic Server (IDS) 10.00.xC8 and earlier and 11.10.xC2 and earlier allow attackers to execute arbitrary code via crafted XDR requests.


Buffer overflow in Apple Quicktime Player 7.3.1.70 and other versions before 7.4.1 when RTSP tunneling is enabled allows remote attackers to execute arbitrary code via a long Reason-Phrase response to an rtsp:// request as demonstrated using a 404 error message.


Multiple stack-based buffer overflows in Aurigma Image Uploader ActiveX control (ImageUploader4.ocx) 4.6.17.0 4.5.70.0 and 4.5.126.0 and ImageUploader5 5.0.10.0 as used by Facebook PhotoUploader 4.5.57.0 allow remote attackers to execute arbitrary code via long (1) ExtractExif and (2) ExtractIptc properties.


Multiple stack-based buffer overflows in the Online Media Technologies NCTSoft NCTAudioInformation2 ActiveX control in NCTAudioInformation2.dll as used in (1) Power Audio CD Grabber 1.0 (2) Power Audio CD Burner 1.02 (3) CinematicMP3 1.4.0.0 (4) Alive MP3 WAV Converter 3.9.3.2 and possibly other products allow remote attackers to execute arbitrary code via unspecified vectors.


Stack-based buffer overflow in the PAMBasicAuthenticator::PAMCallback function in OpenPegasus CIM management server (tog-pegasus) when compiled to use PAM and without PEGASUS_USE_PAM_STANDALONE_PROC defined might allow remote attackers to execute arbitrary code via unknown vectors a different vulnerability than CVE-2007-5360.


Stack-based buffer overflow in RpmSrvc.exe in Brooks Remote Print Manager (RPM) 4.5.1.11 and earlier (Elite and Select) for Windows allows remote attackers to execute arbitrary code via a long filename in a \Receive data file\ LPD command. NOTE: some of these details are obtained from third party information.


Multiple buffer overflows in yaSSL 1.7.5 and earlier as used in MySQL and possibly other products allow remote attackers to execute arbitrary code via (1) the ProcessOldClientHello function in handshake.cpp or (2) \input_buffer& operator>>\ in yassl_imp.cpp.


Heap-based buffer overflow in the GIF library in the WebKit framework for Google Android SDK m3-rc37a and earlier allows remote attackers to execute arbitrary code via a crafted GIF file whose logical screen height and width are different than the actual height and width.


Buffer overflow in the Independent Management Architecture (IMA) service in Citrix Presentation Server (MetaFrame Presentation Server) 4.5 and earlier Access Essentials 2.0 and earlier and Desktop Server 1.0 allows remote attackers to execute arbitrary code via an invalid size value in a packet to TCP port 2512 or 2513.


Heap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors possibly related to the product's configuration a different vulnerability than CVE-2008-0012 and CVE-2008-0014.


Buffer overflow in RealPlayer 11 build 6.0.14.748 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: As of 20080103 this disclosure has no actionable information. However because the VulnDisco Pack author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


Buffer overflow in PCRE before 7.6 allows remote attackers to execute arbitrary code via a regular expression containing a character class with a large number of characters with Unicode code points greater than 255.


Multiple buffer overflows in the WebHPVCInstall.HPVirtualRooms14 ActiveX control in HPVirtualRooms14.dll 1.0.0.100 as used in the installation process for HP Virtual Rooms allow remote attackers to execute arbitrary code via a long (1) AuthenticationURL (2) PortalAPIURL or (3) cabroot property value. NOTE: some of these details are obtained from third party information.


Buffer overflow in ACDSee Photo Manager 8.1 9.0 and 10.0 allows user-assisted remote attackers to execute arbitrary code via a malformed XBM file. NOTE: this might be the same as CVE-2007-6009.


Heap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors possibly related to the product's configuration a different vulnerability than CVE-2008-0013 and CVE-2008-0014.


Heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.12 and SeaMonkey before 1.1.8 might allow remote attackers to execute arbitrary code via a crafted external-body MIME type in an e-mail message related to an incorrect memory allocation during message preview.


Stack-based buffer overflow in wkcvqd01.dll in Microsoft Works 6 File Converter as used in Office 2003 SP2 and SP3 Works 8.0 and Works Suite 2005 allows remote attackers to execute arbitrary code via a .wps file with crafted field lengths aka \Microsoft Works File Converter Field Length Vulnerability.\


Buffer overflow in dBpowerAMP Audio Player Release 2 allows remote attackers to execute arbitrary code via a .M3U file with a long URI. NOTE: this might be the same issue as CVE-2004-1569.


Buffer overflow in JustSystems JSFC.DLL as used in multiple JustSystems products such as Ichitaro allows remote attackers to execute arbitrary code via a crafted .JTD file.


Buffer overflow in (1) X.Org Xserver before 1.4.1 and (2) the libfont and libXfont libraries on some platforms including Sun Solaris allows context-dependent attackers to execute arbitrary code via a PCF font with a large difference between the last col and first col values in the PCF_BDF_ENCODINGS table.


Stack-based buffer overflow in Pierre-emmanuel Gougelet (1) XnView 1.91 and 1.92 (2) NConvert 4.85 and (3) libgfl280.dll in GFL SDK 2.870 for Windows allows user-assisted remote attackers to execute arbitrary code via a crafted Radiance RGBE (.hdr) file.


Buffer overflow in msjet40.dll before 4.0.9505.0 in Microsoft Jet Database Engine allows remote attackers to execute arbitrary code via a crafted Word file as exploited in the wild in March 2008. NOTE: as of 20080513 Microsoft has stated that this is the same issue as CVE-2007-6026.


Stack-based buffer overflow in the database service (ibserver.exe) in Borland InterBase 2007 SP2 allows remote attackers to execute arbitrary code via a malformed opcode 0x52 request to TCP port 3050. NOTE: this might overlap CVE-2007-5243 or CVE-2007-5244.


Multiple stack-based buffer overflows in the Danske Bank e-Sec Control Module ActiveX control (DanskeSikker.ocx) 3.1.0.48 and possibly earlier versions allow remote attackers to execute arbitrary code via long arguments to unspecified methods which are not properly handled by a logging function.


Stack-based buffer overflow in the AntServer module (AntServer.exe) in BigAnt IM Server in BigAnt Messenger 2.2 allows remote attackers to execute arbitrary code via a long URI in a request to TCP port 6080. NOTE: some of these details are obtained from third party information.


Multiple buffer overflows in the useEncodingDecl function in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier and 5.0 Update 14 and earlier allow remote attackers to execute arbitrary code via a JNLP file with (1) a long key name in the xml header or (2) a long charset value different issues than CVE-2008-1189 aka \The first two issues.\


Stack-based buffer overflow in ovwparser.dll in HP OpenView Network Node Manager (OV NNM) 7.53 7.51 and earlier allows remote attackers to execute arbitrary code via a long URI in an HTTP request processed by ovas.exe as demonstrated by a certain topology/homeBaseView request. NOTE: some of these details are obtained from third party information.


Buffer overflow in WebKit as used in Apple Safari before 3.1 allows remote attackers to execute arbitrary code via crafted regular expressions in JavaScript.


Stack-based buffer overflow in GDI in Microsoft Windows 2000 SP4 XP SP2 Server 2003 SP1 and SP2 Vista and Server 2008 allows remote attackers to execute arbitrary code via an EMF image file with crafted filename parameters aka \GDI Stack Overflow Vulnerability.\


Stack-based buffer overflow in the audit_log_user_command function in lib/audit_logging.c in Linux Audit before 1.7 might allow remote attackers to execute arbitrary code via a long command argument. NOTE: some of these details are obtained from third party information.


Buffer overflow in Adobe Photoshop Album Starter Edition 3.2 and possibly After Effects CS3 allows user-assisted remote attackers and physically proximate attackers to execute arbitrary code via a BMP file with an invalid image header. NOTE: the related issue in Photoshop CS3 is already covered by CVE-2007-2244.


Buffer overflow in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier 5.0 Update 14 and earlier and SDK/JRE 1.4.2_16 and earlier allows remote attackers to execute arbitrary code via unknown vectors a different issue than CVE-2008-1188 aka the \third\ issue.


Multiple buffer overflows in the IMAP service (MEIMAPS.EXE) in MailEnable Professional Edition and Enterprise Edition 3.13 and earlier allow remote authenticated attackers to execute arbitrary code via long arguments to the (1) FETCH (2) EXAMINE and (3) UNSUBSCRIBE commands.


Buffer overflow in XnView 1.92.1 allows user-assisted remote attackers to execute arbitrary code via a long filename argument on the command line. NOTE: it is unclear whether there are common handler configurations in which this argument is controlled by an attacker.


Stack-based buffer overflow in the IActiveXTransfer.FileTransfer method in the SecureTransport FileTransfer ActiveX control in vcst_en.dll 1.0.0.5 in Tumbleweed SecureTransport Server before 4.6.1 Hotfix 20 allows remote attackers to execute arbitrary code via a long remoteFile parameter.


Buffer overflow in a certain Aurigma ActiveX control in ImageUploader4.ocx 4.1.36.0 as used with Piczo (aka Pizco) and possibly other online services allows remote attackers to execute arbitrary code via unspecified vectors possibly involving a long Action property a different CLSID than CVE-2008-0659.


Buffer overflow in Evolution 2.22.1 when the ITip Formatter plugin is disabled allows remote attackers to execute arbitrary code via a long timezone string in an iCalendar attachment.


Buffer overflow in rsync 2.6.9 to 3.0.1 with extended attribute (xattr) support enabled might allow remote attackers to execute arbitrary code via unknown vectors.


Buffer overflow in Microsoft Visual InterDev 6.0 (SP6) allows user-assisted attackers to execute arbitrary code via a Studio Solution (.SLN) file with a long malformed Project line beginning with a 'Project(\{}\) =' sequence probably a different vector than CVE-2008-0250.


Unspecified vulnerability in Microsoft Word in Office 2000 and XP SP3 2003 SP2 and SP3 and 2007 Office System SP1 and earlier allows remote attackers to execute arbitrary code via a Rich Text Format (.rtf) file with a malformed string that triggers a \memory calculation error\ and a heap-based buffer overflow aka \Object Parsing Vulnerability.\


Stack-based buffer overflow in Microsoft DirectX 7.0 and 8.1 on Windows 2000 SP4 allows remote attackers to execute arbitrary code via a Synchronized Accessible Media Interchange (SAMI) file with crafted parameters for a Class Name variable aka the \SAMI Format Parsing Vulnerability.\


Stack-based buffer overflow in the useragent function in useragent.c in Squid Analysis Report Generator (Sarg) 2.2.3.1 allows remote attackers to execute arbitrary code via a long Squid proxy server User-Agent header. NOTE: some of these details are obtained from third party information.


Python 2.5.2 and earlier allows context-dependent attackers to execute arbitrary code via multiple vectors that cause a negative size value to be provided to the PyString_FromStringAndSize function which allocates less memory than expected when assert() is disabled and triggers a buffer overflow.


Multiple off-by-one errors in FreeType2 before 2.3.6 allow context-dependent attackers to execute arbitrary code via (1) a crafted table in a Printer Font Binary (PFB) file or (2) a crafted SHC instruction in a TrueType Font (TTF) file which triggers a heap-based buffer overflow.


Buffer overflow in mimesr.dll in Autonomy (formerly Verity) KeyView as used in IBM Lotus Notes before 8.0 might allow user-assisted remote attackers to execute arbitrary code via an e-mail message with a crafted Text mail (MIME) attachment.


Buffer overflow in kvdocve.dll in the KeyView document viewing engine in Autonomy (formerly Verity) KeyView as used by IBM Lotus Notes 7.0.2 and 7.0.3 allows remote attackers to execute arbitrary code via a long pathname as demonstrated by a long SRC attribute of an IMG element in an HTML document.


Heap-based buffer overflow in Evolution 2.22.1 allows user-assisted remote attackers to execute arbitrary code via a long DESCRIPTION property in an iCalendar attachment which is not properly handled during a reply in the calendar view (aka the Calendars window).


Stack-based buffer overflow in the Quantum Streaming Player (Quantum Streaming IE Player) ActiveX control (aka QSP2IE.QSP2IE) in qsp2ie07076007.dll 7.7.6.7 and qsp2ie07074039.dll 7.7.4.39 in Move Media Player allows remote attackers to execute arbitrary code via a long argument to the UploadLogs method a different vector than CVE-2007-4722. NOTE: some of these details are obtained from third party information.


Heap-based buffer overflow in Almost Native Graphics Layer Engine (ANGLE) as used in the WebGL implementation in Mozilla Firefox 4.x through 5 Thunderbird before 6 SeaMonkey 2.x before 2.3 and possibly other products might allow remote attackers to execute arbitrary code via unspecified vectors.


Buffer overflow in Adobe Flash Player before 10.3.183.5 on Windows Mac OS X Linux and Solaris and before 10.3.186.3 on Android and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2011-2130 CVE-2011-2134 CVE-2011-2137 and CVE-2011-2415.


Stack-based buffer overflow in the (1) put_dir function in mongoose.c in Mongoose 3.0 (2) put_dir function in yasslEWS.c in yaSSL Embedded Web Server (yasslEWS) 0.2 and (3) _shttpd_put_dir function in io_dir.c in Simple HTTPD (shttpd) 1.42 allows remote attackers to execute arbitrary code via an HTTP PUT request as exploited in the wild in 2011.


The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD as used in zopen.c in OpenBSD before 3.8 FreeBSD NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1 FreeType 2.1.9 and other products does not properly handle code words that are absent from the decompression table when encountered which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow and possibly execute arbitrary code via a crafted compressed stream a related issue to CVE-2006-1168 and CVE-2011-2896.


Stack-based buffer overflow in Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows Mac OS X Linux and Solaris and before 11.1.102.59 on Android and Adobe AIR before 3.1.0.4880 allows attackers to execute arbitrary code via unspecified vectors.


Multiple buffer overflows in the Provideo ActiveX controls allow remote attackers to execute arbitrary code via crafted input fields as demonstrated by (1) a long strIp argument to the voice method in 2way.dll in the alarm 1.0.3.1 ActiveX control (2) a network response to AXPlayer.ocx in the GMAXPlayer 2.0.8.2 ActiveX control the (3) UserName or (4) Password parameter to AXPlayer.ocx in the GMAXPlayer 2.0.8.2 ActiveX control (5) a long Id parameter to the GetString method in PAxPlayer.ocx in the PAxPlayer 3.0.0.9 ActiveX control or (6) a long strAdr parameter to the ConnectIPCam method in PAxPlayer.ocx in the PAxPlayer 3.0.0.9 ActiveX control.


Buffer overflow in Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows Mac OS X Linux and Solaris and before 11.1.102.59 on Android and Adobe AIR before 3.1.0.4880 allows attackers to execute arbitrary code via unspecified vectors.


Buffer overflow in Adobe Flash Player before 10.3.183.5 on Windows Mac OS X Linux and Solaris and before 10.3.186.3 on Android and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2011-2130 CVE-2011-2134 CVE-2011-2414 and CVE-2011-2415.


Buffer overflow in Adobe Flash Player before 10.3.183.5 on Windows Mac OS X Linux and Solaris and before 10.3.186.3 on Android and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2011-2130 CVE-2011-2134 CVE-2011-2137 and CVE-2011-2414.


Heap-based buffer overflow in tcptrack before 1.4.2 might allow attackers to execute arbitrary code via a long command line argument. NOTE: this is only a vulnerability in limited scenarios in which tcptrack is \configured as a handler for other applications.\ This issue might not qualify for inclusion in CVE.


The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7 the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier and other products does not properly handle code words that are absent from the decompression table when encountered which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow and possibly execute arbitrary code via a crafted compressed stream a related issue to CVE-2006-1168 and CVE-2011-2895.


Buffer overflow in Dirapix.dll in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code via unspecified vectors.


Heap-based buffer overflow in the StartEpa method in the nsepacom ActiveX control (nsepa.exe) in Citrix Access Gateway Enterprise Edition Plug-in for Windows 9.x before 9.3-57.5 and 10.0 before 10.0-69.4 allows remote attackers to execute arbitrary code via a long CSEC HTTP response header.


Multiple unspecified vulnerabilities in Cisco Unified Service Monitor before 8.6 as used in Unified Operations Manager before 8.6 and CiscoWorks LAN Management Solution 3.x and 4.x before 4.1; and multiple EMC Ionix products including Application Connectivity Monitor (Ionix ACM) 2.3 and earlier Adapter for Alcatel-Lucent 5620 SAM EMS (Ionix ASAM) 3.2.0.2 and earlier IP Management Suite (Ionix IP) 8.1.1.1 and earlier and other Ionix products; allow remote attackers to execute arbitrary code via crafted packets to TCP port 9002 aka Bug IDs CSCtn42961 and CSCtn64922 related to a buffer overflow.


Stack-based buffer overflow in the SetActiveXGUID method in the VersionInfo ActiveX control in GenVersion.dll 8.0.138.0 in the WebHMI subsystem in ICONICS BizViz 9.x before 9.22 and GENESIS32 9.x before 9.22 allows remote attackers to execute arbitrary code via a long string in the argument. NOTE: some of these details are obtained from third party information.


Stack-based buffer overflow in the ActionScript Virtual Machine (AVM) component in Adobe Flash Player before 10.3.183.10 on Windows Mac OS X Linux and Solaris and before 10.3.186.7 on Android allows remote attackers to execute arbitrary code via unspecified vectors.


Stack-based buffer overflow in the NSEPA.NsepaCtrl.1 ActiveX control in nsepa.ocx in Citrix Access Gateway Enterprise Edition 8.1 before 8.1-67.7 9.0 before 9.0-70.5 and 9.1 before 9.1-96.4 allows remote attackers to execute arbitrary code via crafted HTTP header data.


Buffer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted .fon file aka \Font Library File Buffer Overrun Vulnerability.\


Buffer overflow in Adobe Flash Player before 10.3.183.5 on Windows Mac OS X Linux and Solaris and before 10.3.186.3 on Android and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2011-2130 CVE-2011-2137 CVE-2011-2414 and CVE-2011-2415.


Buffer overflow in Adobe Flash Player before 10.3.183.5 on Windows Mac OS X Linux and Solaris and before 10.3.186.3 on Android and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2011-2134 CVE-2011-2137 CVE-2011-2414 and CVE-2011-2415.


Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5 RealPlayer SP 1.0 through 1.1.5 and RealPlayer Enterprise 2.0 through 2.1.5 allows remote attackers to execute arbitrary code via crafted ID3v2 tags in an MP3 file.


Buffer overflow in the UnitelWay Windows Device Driver as used in Schneider Electric Unity Pro 6 and earlier OPC Factory Server 3.34 Vijeo Citect 7.20 and earlier Telemecanique Driver Pack 2.6 and earlier Monitor Pro 7.6 and earlier and PL7 Pro 4.5 and earlier allows local users and possibly remote attackers to execute arbitrary code via an unspecified system parameter.


Buffer overflow in Active Directory Active Directory Application Mode (ADAM) and Active Directory Lightweight Directory Service (AD LDS) in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote authenticated users to execute arbitrary code via a crafted query that leverages incorrect memory initialization aka \Active Directory Buffer Overflow Vulnerability.\


Multiple stack-based buffer overflows in VideoLAN VLC media player before 1.0.2 allow remote attackers to execute arbitrary code via (1) a crafted ASF file related to the ASF_ObjectDumpDebug function in modules/demux/asf/libasf.c; (2) a crafted AVI file related to the AVI_ChunkDumpDebug_level function in modules/demux/avi/libavi.c; or (3) a crafted MP4 file related to the __MP4_BoxDumpStructure function in modules/demux/mp4/libmp4.c.


Buffer overflow in VMware Workstation 7.x before 7.1.5 VMware Player 3.x before 3.1.5 VMware Fusion 3.1.x before 3.1.3 and VMware AMS allows remote attackers to execute arbitrary code via a crafted UDF filesystem in an ISO image.


Stack-based buffer overflow in libsysutils in Android 2.2.x through 2.2.2 and 2.3.x through 2.3.6 allows user-assisted remote attackers to execute arbitrary code via an application that calls the FrameworkListener::dispatchCommand method with the wrong number of arguments as demonstrated by zergRush to trigger a use-after-free error.


Stack-based buffer overflow in the NSFComputeEvaluateExt function in Nnotes.dll in IBM Lotus Domino 8.5.2 allows remote authenticated users to execute arbitrary code via a long tHPRAgentName parameter in an fmHttpPostRequest OpenForm action to WebAdmin.nsf.


The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream which allows remote attackers to trigger a heap-based buffer overflow and possibly execute arbitrary code via a crafted stream a different vulnerability than CVE-2011-2896.


Buffer overflow in the DoFindReplace function in the ISGrid.Grid2.1 ActiveX control in InstallShield/ISGrid2.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2 10.3 and 11 SP1 allows remote attackers to execute arbitrary code via a long bstrReplaceText parameter.


Buffer overflow in kpprzrdr.dll in Autonomy KeyView as used in IBM Lotus Notes before 8.5.2 FP3 allows remote attackers to execute arbitrary code via a crafted .prz attachment. NOTE: some of these details are obtained from third party information.


Heap-based buffer overflow in the thunder (aka ThunderScan) decoder in tif_thunder.c in LibTIFF 3.9.4 and earlier allows remote attackers to execute arbitrary code via crafted THUNDER_2BITDELTAS data in a .tiff file that has an unexpected BitsPerSample value.


Integer underflow in lzhsr.dll in Autonomy KeyView as used in IBM Lotus Notes before 8.5.2 FP3 allows remote attackers to execute arbitrary code via a crafted header in a .lzh attachment that triggers a stack-based buffer overflow aka SPR PRAD88MJ2W.


Heap-based buffer overflow in rvrender.dll in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.2 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to execute arbitrary code via a crafted frame in an Internet Video Recording (IVR) file.


Buffer overflow in omniinet.exe in the inet service in HP OpenView Storage Data Protector 6.00 through 6.20 allows remote attackers to execute arbitrary code via a crafted request related to the EXEC_CMD functionality.


Stack-based buffer overflow in the server process in ibmslapd.exe in IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-IF0010 6.0 before 6.0.0.67 (aka 6.0.0.8-TIV-ITDS-IF0009) 6.1 before 6.1.0.40 (aka 6.1.0.5-TIV-ITDS-IF0003) 6.2 before 6.2.0.16 (aka 6.2.0.3-TIV-ITDS-IF0002) and 6.3 before 6.3.0.3 (aka 6.3.0.0-TIV-ITDS-IF0003) allows remote attackers to execute arbitrary code via a crafted LDAP request. NOTE: some of these details are obtained from third party information.


Multiple

stack-based

buffer

overflows

in

the

HMI

application

in

DATAC

RealFlex

RealWin

(Build

and

earlier

allow

remote

attackers

to

execute

arbitrary

code

via

a

long

username

in

an

packet

and

crafted

unspecified

and

packets

to

port


Stack-based buffer overflow in iNodeMngChecker.exe in the User Access Manager (UAM) 5.0 before SP1 E0101P03 and Endpoint Admission Defense (EAD) 5.0 before SP1 E0101P03 components in HP Intelligent Management Center (aka iNode Management Center) allows remote attackers to execute arbitrary code via a 0x0A0BF007 packet.


Multiple stack-based buffer overflows in the Web Viewer ActiveX controls in CA Output Management Web Viewer 11.0 and 11.5 allow remote attackers to execute arbitrary code via (1) a long SRC property value to the PPSViewer ActiveX control in PPSView.ocx before 1.0.0.7 or (2) a long Title property value to the UOMWV_Helper ActiveX control in UOMWV_HelperActiveX.ocx before 11.5.0.1.


Buffer overflow in kvarcve.dll in Autonomy KeyView as used in IBM Lotus Notes before 8.5.2 FP3 allows remote attackers to execute arbitrary code via a crafted .zip attachment aka SPR PRAD8E3NSP. NOTE: some of these details are obtained from third party information.


Buffer overflow in the Advantech ADAM OLE for Process Control (OPC) Server ActiveX control in ADAM OPC Server before 3.01.012 Modbus RTU OPC Server before 3.01.010 and Modbus TCP OPC Server before 3.01.010 allows remote attackers to execute arbitrary code via unspecified vectors.


Stack-based buffer overflow in ftserver.exe in the OpenText Hummingbird Client Connector as used in the Indexing Server in EMC Documentum eRoom 7.x before 7.4.3.f and other products allows remote attackers to execute arbitrary code by sending a crafted message over TCP.


Buffer overflow in ALZip 8.21 and earlier allows remote attackers to execute arbitrary code via a crafted mim file.


Multiple buffer overflows in the InduSoft ISSymbol ActiveX control in ISSymbol.ocx 301.1104.601.0 in InduSoft Web Studio 7.0B2 hotfix 7.0.01.04 allow remote attackers to execute arbitrary code via a long parameter to the (1) Open (2) Close or (3) SetCurrentLanguage method.


Buffer overflow in the JavaScript engine in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14 and SeaMonkey before 2.0.12 might allow remote attackers to execute arbitrary code via vectors involving non-local JavaScript variables aka an \upvarMap\ issue.


Buffer overflow in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a long schd_select1 parameter.


Buffer overflow in VideoSpirit Pro 1.6.8.1 and possibly earlier versions and VideoSpirit Lite 1.4.0.1 and possibly other versions allows user-assisted remote attackers to execute arbitrary code via a VideoSpirit project (.visprj) file containing a valitem element with a long \name\ attribute. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Buffer overflow in the key exchange functionality in Icon Labs Iconfidant SSL Server before 1.3.0 allows remote attackers to execute arbitrary code via a client master key packet in which the sum of unspecified length fields is greater than a certain value.


Microsoft Excel 2002 SP3 Office 2004 and 2008 for Mac and Open XML File Format Converter for Mac obtain a certain length value from an uninitialized memory location which allows remote attackers to trigger a buffer overflow and execute arbitrary code via a crafted Excel file aka \Excel Data Initialization Vulnerability.\


Multiple heap-based buffer overflows in Topaz Systems SigPlus Pro ActiveX Control 3.95 and possibly other versions before 4.29 allow remote attackers to execute arbitrary code via a long (1) KeyString property (2) NewPath parameter to the SetLocalIniFilePath method or (3) NewPortPath parameter to the SetTabletPortPath method.


Buffer overflow in VideoSpirit Pro 1.6.8.1 1.68 and earlier; and VideoSpirit Lite 1.4.0.1 and possibly other versions; allows user-assisted remote attackers to execute arbitrary code via a VideoSpirit project (.visprj) file containing a valitem element with a long \value\ attribute as demonstrated using a valitem with the mp3 name.


Integer signedness error in the SQLConnectW function in an ODBC API (odbc32.dll) in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2 and Windows Data Access Components (WDAC) 6.0 allows remote attackers to execute arbitrary code via a long string in the Data Source Name (DSN) and a crafted szDSN argument which bypasses a signed comparison and leads to a buffer overflow aka \DSN Overflow Vulnerability.\


Adobe Reader and Acrobat 10.x before 10.0.1 9.x before 9.4.2 and 8.x before 8.2.6 on Windows and Mac OS X allow remote attackers to execute arbitrary code via a crafted Universal 3D (U3D) file that triggers a buffer overflow during decompression a different vulnerability than CVE-2011-0590 CVE-2011-0591 CVE-2011-0592 CVE-2011-0595 and CVE-2011-0600.


Stack-based buffer overflow in the ast_uri_encode function in main/utils.c in Asterisk Open Source before 1.4.38.1 1.4.39.1 1.6.1.21 1.6.2.15.1 1.6.2.16.1 1.8.1.2 1.8.2.; and Business Edition before C.3.6.2; when running in pedantic mode allows remote authenticated users to execute arbitrary code via crafted caller ID data in vectors involving the (1) SIP channel driver (2) URIENCODE dialplan function or (3) AGI dialplan function.


Buffer overflow in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a long data_select1 parameter.


Stack-based buffer overflow in Microsoft Excel 2002 SP3 2003 SP3 and 2007 SP2; Office 2004 for Mac; Excel Viewer SP2; and Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP2 allows remote attackers to execute arbitrary code via vectors related to an axis properties record and improper incrementing of an array index aka \Excel Array Indexing Vulnerability.\


Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2 and Windows Data Access Components (WDAC) 6.0 does not properly validate memory allocation for internal data structures which allows remote attackers to execute arbitrary code possibly via a large CacheSize property that triggers an integer wrap and a buffer overflow aka \ADO Record Memory Vulnerability.\ NOTE: this might be a duplicate of CVE-2010-1117 or CVE-2010-1118.


Buffer overflow in the PPP Access Concentrator (PPPAC) on the SEIL/x86 with firmware 1.00 through 1.61 SEIL/B1 with firmware 1.00 through 3.11 SEIL/X1 with firmware 1.00 through 3.11 SEIL/X2 with firmware 1.00 through 3.11 SEIL/Turbo with firmware 1.80 through 2.10 and SEIL/neu 2FE Plus with firmware 1.80 through 2.10 might allow remote attackers to execute arbitrary code via a PPPoE packet.


Adobe Reader and Acrobat 10.x before 10.0.1 9.x before 9.4.2 and 8.x before 8.2.6 on Windows and Mac OS X allow remote attackers to execute arbitrary code via a crafted Universal 3D (U3D) file that triggers a buffer overflow during decompression related to \Texture bmp \ a different vulnerability than CVE-2011-0590 CVE-2011-0591 CVE-2011-0593 CVE-2011-0595 and CVE-2011-0600.


Buffer overflow in ZfHIPCND.exe in Novell ZENworks Handheld Management 7.0 allows remote attackers to execute arbitrary code via a crafted IP Conduit packet to TCP port 2400.


The Bitmap parsing component in 2d.dll in Adobe Reader and Acrobat 10.x before 10.0.1 9.x before 9.4.2 and 8.x before 8.2.6 on Windows and Mac OS X allow remote attackers to execute arbitrary code via an image with crafted (1) height and (2) width values for an RLE_8 compressed bitmap which triggers a heap-based buffer overflow a different vulnerability than CVE-2011-0598 CVE-2011-0599 and CVE-2011-0602.


Buffer overflow in nLDAP.exe in IBM Lotus Domino allows remote attackers to execute arbitrary code via a long string in an LDAP Bind operation aka SPR KLYH87LMVX.


Stack-based buffer overflow in BMC PATROL Agent Service Daemon for in Performance Analysis for Servers Performance Assurance for Servers and Performance Assurance for Virtual Servers 7.4.00 through 7.5.10; Performance Analyzer and Performance Predictor for Servers 7.4.00 through 7.5.10; and Capacity Management Essentials 1.2.00 (7.4.15) allows remote attackers to execute arbitrary code via a crafted length value in a BGS_MULTIPLE_READS command to TCP port 6768.


Buffer overflow in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a long text1 parameter.


Buffer overflow in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a long nameParams parameter a different vulnerability than CVE-2011-0267.2.


Heap-based buffer overflow in the NgwiCalVTimeZoneBody::ParseSelf function in gwwww1.dll in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before HP3 allows remote attackers to execute arbitrary code via a crafted TZNAME variable in a VCALENDAR attachment in an e-mail message related to an \integer truncation error.\


Multiple stack-based buffer overflows in the tsc_launch_remote function (src/support.c) in Terminal Server Client (tsclient) 0.150 and possibly other versions allow user-assisted remote attackers to execute arbitrary code via a .RDP file with a long (1) username (2) password or (3) domain argument. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Stack-based buffer overflow in nrouter.exe in IBM Lotus Domino before 8.5.3 allows remote attackers to execute arbitrary code via a long name parameter in a Content-Type header in a malformed Notes calendar (aka iCalendar or iCal) meeting request aka SPR KLYH87LL23.


Integer underflow in Microsoft Excel 2002 SP3 2003 SP3 2007 SP2 and 2010; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Excel Viewer SP2; and Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP2 allows remote attackers to execute arbitrary code via a crafted 400h substream in an Excel file which triggers a stack-based buffer overflow aka \Excel Integer Overrun Vulnerability.\


Multiple buffer overflows in the ISSymbol ActiveX control in ISSymbol.ocx 61.6.0.0 and 301.1009.2904.0 in the ISSymbol virtual machine as distributed in Advantech Studio 6.1 SP6 61.6.01.05 InduSoft Web Studio before 7.0+SP1 and InduSoft Thin Client 7.0 allow remote attackers to execute arbitrary code via a long (1) InternationalOrder (2) InternationalSeparator or (3) LogFileName property value; or (4) a long bstrFileName argument to the OpenScreen method.


Stack-based buffer overflow in the OpenType Compact Font Format (aka OTF or CFF) driver in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted parameter values in an OpenType font aka \OpenType Font Stack Overflow Vulnerability.\


Buffer overflow in the JavaScript engine in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14 and SeaMonkey before 2.0.12 might allow remote attackers to execute arbitrary code via vectors involving exception timing and a large number of string values aka an \atom map\ issue.


Multiple stack-based buffer overflows in unspecified CGI programs in the Unified Maintenance Tool web interface in the embedded web server in the Communication Server (CS) in Alcatel-Lucent OmniPCX Enterprise before R9.0 H1.301.50 allow remote attackers to execute arbitrary code via crafted HTTP headers.


Buffer overflow in crs.exe in HP OpenView Storage Data Protector Cell Manager 6.11 allows remote attackers to execute arbitrary code via unspecified message types.


Adobe Reader and Acrobat 10.x before 10.0.1 9.x before 9.4.2 and 8.x before 8.2.6 on Windows and Mac OS X allow remote attackers to execute arbitrary code via a crafted Universal 3D (U3D) file that triggers a buffer overflow during decompression related to Texture and rgba a different vulnerability than CVE-2011-0590 CVE-2011-0592 CVE-2011-0593 CVE-2011-0595 and CVE-2011-0600.


Stack-based buffer overflow in NetSupport Manager Agent for Linux 11.00 for Solaris 9.50 and for Mac OS X 11.00 allows remote attackers to execute arbitrary code via a long control hostname to TCP port 5405 probably a different vulnerability than CVE-2007-5252.


Buffer overflow on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 1.6.x; Cisco TelePresence Multipoint Switch (CTMS) devices with software 1.0.x 1.1.x 1.5.x and 1.6.x; Cisco TelePresence endpoint devices with software 1.2.x through 1.6.x; and Cisco TelePresence Manager 1.2.x 1.3.x 1.4.x 1.5.x and 1.6.2 allows remote attackers to execute arbitrary code via a crafted Cisco Discovery Protocol packet aka Bug IDs CSCtd75769 CSCtd75766 CSCtd75754 and CSCtd75761.


Adobe Reader and Acrobat 10.x before 10.0.1 9.x before 9.4.2 and 8.x before 8.2.6 on Windows and Mac OS X allow remote attackers to execute arbitrary code via a crafted Universal 3D (U3D) file that triggers a buffer overflow during decompression a different vulnerability than CVE-2011-0590 CVE-2011-0591 CVE-2011-0592 CVE-2011-0593 and CVE-2011-0600.


Stack-based buffer overflow in the tsc_launch_remote function (src/support.c) in Terminal Server Client (tsclient) 0.150 and possibly other versions allows user-assisted remote attackers to execute arbitrary code via a .RDP file with a long hostname argument.


Stack-based buffer overflow in the NRouter (aka Router) service in IBM Lotus Domino allows remote attackers to execute arbitrary code via long filenames associated with Content-ID and ATTACH:CID headers in attachments in malformed calendar-request e-mail messages aka SPR KLYH87LKRE.


Buffer overflow in the WebClient ActiveX control in Siemens Tecnomatix FactoryLink 6.6.1 (aka 6.6 SP1) 7.5.217 (aka 7.5 SP2) and 8.0.2.54 allows remote attackers to execute arbitrary code via a long string in a parameter associated with the location URL.


Buffer overflow in Sielco Sistemi Winlog PRO before 2.07.09 and Winlog Lite before 2.07.09 allows user-assisted remote attackers to execute arbitrary code via invalid data in unspecified fields of a project file.


Buffer overflow in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via a long string value in unspecified parameters.


Multiple buffer overflows in Siemens Automation License Manager (ALM) 4.0 through 5.1+SP1+Upd1 allow remote attackers to execute arbitrary code via a long serialid field in an _licensekey command as demonstrated by the (1) check_licensekey or (2) read_licensekey command.


Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0 MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier Heimdal 1.5.1 and earlier GNU inetutils and possibly other products allows remote attackers to execute arbitrary code via a long encryption key as exploited in the wild in December 2011.


Buffer overflow in MiniSmtp 3.0.11818 in NJStar Communicator allows remote attackers to execute arbitrary code via a crafted packet.


Heap-based buffer overflow in the in_mod.dll plugin in Winamp before 5.623 allows remote attackers to execute arbitrary code via crafted song message data in an Impulse Tracker (IT) file. NOTE: some of these details are obtained from third party information.


Stack-based buffer overflow in magentservice.exe in the server in HP LoadRunner 11.00 before patch 4 allows remote attackers to execute arbitrary code via a crafted size value in a packet. NOTE: it was originally reported that the affected product is HP Diagnostics Server but HP states that \the vulnerable product is actually HP LoadRunner.\


Stack-based buffer overflow in the _canonicalize function in common/uloc.c in International Components for Unicode (ICU) before 49.1 allows remote attackers to execute arbitrary code via a crafted locale ID that is not properly handled during variant canonicalization.


Multiple buffer overflows in the (1) GUIControls (2) BatchObjSrv and (3) BatchSecCtrl ActiveX controls in Invensys Wonderware InBatch 9.0 and 9.0 SP1 and InBatch 8.1 SP1 9.0 SP2 and 9.5 Server and Runtime Clients allow remote attackers to execute arbitrary code via a long string in a property value a different issue than CVE-2011-3141.


Stack-based buffer overflow in CEServer.exe in the CEServer component in the Remote Agent module in InduSoft Web Studio 6.1 and 7.0 allows remote attackers to execute arbitrary code via a crafted 0x15 (aka Remove File) operation for a file with a long name.


Stack-based buffer overflow in HmiLoad in the runtime loader in Siemens WinCC flexible 2004 2005 2007 and 2008; WinCC V11 (aka TIA portal); the TP OP MP Comfort Panels and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime when Transfer Mode is enabled allows remote attackers to execute arbitrary code via vectors related to Unicode strings.


Buffer overflow in ChaSen 2.4.x allows remote attackers to execute arbitrary code via a crafted string.


Buffer overflow in Aviosoft DTV Player 1.0.1.2 allows remote attackers to execute arbitrary code via a crafted .plf (aka playlist) file.


Buffer overflow in FFmpeg before 0.5.6 0.6.x before 0.6.4 0.7.x before 0.7.8 and 0.8.x before 0.8.8 allows remote attackers to execute arbitrary code via unspecified vectors.


Buffer overflow in the ulSetError function in util/ulError.cxx in PLIB 1.8.5 as used in TORCS 1.3.1 and other products allows user-assisted remote attackers to execute arbitrary code via vectors involving a long error message as demonstrated by a crafted acc file for TORCS. NOTE: some of these details are obtained from third party information.


Heap-based buffer overflow in the SetDevNames method of the Tidestone Formula One ActiveX control (TTF16.ocx) 6.3.5 Build 1 in Oracle Hyperion Strategic Finance 12.x and possibly earlier allows remote attackers to execute arbitrary code via a long string to the DriverName parameter.


Multiple buffer overflows in the ThreeDify.ThreeDifyDesigner.1 ActiveX control in ActiveSolid.dll in ThreeDify Designer 5.0.2 allow remote attackers to execute arbitrary code via a long argument to the (1) cmdExport (2) cmdImport (3) cmdOpen or (4) cmdSave method.


Heap-based buffer overflow in the Reflection FTP Client (rftpcom.dll 7.2.0.106 and possibly other versions) as used in Attachmate Reflection 2008 Reflection 2011 R1 before 15.3.2.569 and R1 SP1 before Reflection 2011 R2 before 15.4.1.327 Reflection Windows Client 7.2 SP1 before hotfix 7.2.1186 and Reflection 14.1 SP1 before 14.1.1.206 allows remote FTP servers to execute arbitrary code via a long directory name in a response to a LIST command.


Stack-based buffer overflow in Final Draft 8 before 8.02 allows remote attackers to execute arbitrary code via a crafted SmartType element a different vulnerability than CVE-2011-5002. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple stack-based buffer overflows in Final Draft 8 before 8.02 allow remote attackers to execute arbitrary code via a .fdx or .fdxt file with long (1) Word (2) Transition (3) Location (4) Extension (5) SceneIntro (6) TimeOfDay and (7) Character elements.


Multiple

stack-based

buffer

overflows

in

KnFTP

allow

remote

attackers

to

execute

arbitrary

code

via

a

long

string

to

the

USER

PASS

REIN

QUIT

PORT

PASV

TYPE

STRU

MODE

RETR

STOR

APPE

ALLO

REST

RNFR

RNTO

ABOR

DELE

CWD

LIST

NLST

SITE

STST

HELP

NOOP

MKD

RMD

PWD

CDUP

STOU

SNMT

SYST

and

XPWD

commands.


Stack-based buffer overflow in cstore.exe in the Media Application Server (MAS) in Avaya Aura Application Server 5300 (formerly Nortel Media Application Server) 1.x before 1.0.2 and 2.0 before Patch Bundle 10 allows remote attackers to execute arbitrary code via a crafted cs_anams parameter in a CONTENT_STORE_ADMIN_REQ packet.


Stack-based buffer overflow in the CGenericScheduler::AddTask function in cmdHandlerRedAlertController.dll in CmdProcessor.exe in Trend Micro Control Manager 5.5 before Build 1613 allows remote attackers to execute arbitrary code via a crafted IPC packet to TCP port 20101.


Multiple buffer overflows in web.c in httpd on the ASUS RT-N56U and RT-AC66U routers with firmware 3.0.0.4.374_979 allow remote attackers to execute arbitrary code via the (1) apps_name or (2) apps_flag parameter to APP_Installation.asp.


Five buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to initiate a denial-of-service attack and execute arbitrary code.


Multiple buffer overflows in the Broderbund Expressit 3DGreetings Player ActiveX control could allow remote attackers to execute arbitrary code via unspecified vectors.


Multiple buffer overflows in the (1) client and (2) server in Racer 0.5.3 beta 5 allow remote attackers to execute arbitrary code via a long string to UDP port 26000.


Multiple buffer overflows in the httplib_parse_sc_header function in lib/http.c in Streamripper before 1.62.2 allow remote attackers to execute arbitrary code via long (1) Location and (2) Server HTTP headers a different vulnerability than CVE-2006-3124.


Multiple buffer overflows in Image Space rFactor 1.250 and earlier allow remote attackers to execute arbitrary code via a packet with ID (1) 0x80 or (2) 0x88 to UDP port 34297 related to the buffer containing the server version number.


Multiple buffer overflows in CellFactor Revolution 1.03 and earlier allow remote attackers to execute arbitrary code via a long string in a (1) 0x21 (2) 0x22 or (3) 0x23 packet.


Multiple buffer overflows in the HttpSprockMake function in http.c in Frank Yaul corehttp 0.5.3alpha allow remote attackers to execute arbitrary code via a long string in the (1) method name or (2) URI in an HTTP request.


Multiple buffer overflows in the login mechanism in sidvault in Alpha Centauri Software SIDVault LDAP Server before 2.0f allow remote attackers to execute arbitrary code via crafted LDAP packets as demonstrated by a long dc entry in an LDAP bind.


Multiple buffer overflows in (1) the Message Engine and (2) AScore.dll in CA BrightStor ARCServe BackUp v9.01 through R11.5 and Enterprise Backup r10.5 allow remote attackers to execute arbitrary code via unspecified vectors.


Multiple buffer overflows in Adobe Reader and Acrobat 8.1.1 and earlier allow remote attackers to execute arbitrary code via a PDF file with long arguments to unspecified JavaScript methods. NOTE: this issue might be subsumed by CVE-2008-0655.


Multiple buffer overflows in dvi2xx.c in dviljk in teTeX and TeXlive 2007 and earlier might allow user-assisted attackers to execute arbitrary code via a crafted DVI input file.


Multiple buffer overflows in (1) RPC and (2) rpcx.dll in CA BrightStor ARCServe BackUp v9.01 through R11.5 and Enterprise Backup r10.5 allow remote attackers to execute arbitrary code via unspecified vectors.


Multiple buffer overflows in iMatix Xitami Web Server 2.5c2 allow remote attackers to execute arbitrary code via a long If-Modified-Since header to (1) xigui32.exe or (2) xitami.exe.


Multiple buffer overflows in the British Telecommunications Consumer webhelper ActiveX control before 2.0.0.8 in btwebcontrol.dll allow remote attackers to execute arbitrary code via unspecified vectors.


Multiple buffer overflows in acgm.dll in the Corel / Micrografx ActiveCGM Browser ActiveX control before 7.1.4.19 allow remote attackers to execute arbitrary code via unspecified vectors.


Multiple buffer overflows in HT Editor before 2.0.6 might allow remote attackers to execute arbitrary code via unspecified vectors possibly involving the editor display width. NOTE: some of the details were obtained from third party information.


Multiple buffer overflows in certain ActiveX controls in sasatl.dll in Zenturi ProgramChecker allow remote attackers to execute arbitrary code via unspecified vectors possibly involving the (1) DebugMsgLog or (2) DoFileProperties methods.


Multiple buffer overflows in the British Telecommunications Business Connect webhelper ActiveX control before 1.0.0.7 in btbconnectwebcontrol.dll allow remote attackers to execute arbitrary code via unspecified vectors.


Multiple buffer overflows in RealNetworks GameHouse dldisplay ActiveX control (ghdlctl.dll) allow remote attackers to execute arbitrary code via unknown vectors.


Multiple buffer overflows in a certain ActiveX control in odapi.dll in Authentium Command Antivirus before 4.93.8 allow remote attackers to execute arbitrary code via unspecified vectors.


Multiple buffer overflows in Adobe Photoshop CS2 and CS3 Illustrator CS3 and GoLive 9 allow user-assisted remote attackers to execute arbitrary code via a crafted (1) BMP (2) DIB or (3) RLE file.


Multiple buffer overflows in Norman Antivirus 5.90 allow remote attackers to execute arbitrary code via a crafted (1) ACE or (2) LZH file resulting from an \integer cast around.\


Multiple buffer overflows in unspecified ActiveX controls in COM objects in Avaya IP Softphone R5.2 before SP3 and R6.0 allow remote attackers to execute arbitrary code via unspecified vectors.


Multiple buffer overflows in the IMAP service (imapd32.exe) in Ipswitch IMail Server 2006 before 2006.21 allow remote authenticated users to execute arbitrary code via the (1) Search or (2) Search Charset command.


Multiple buffer overflows in the AMX NetLinx VNC (AmxVnc) ActiveX control in AmxVnc.dll 1.0.13.0 allow remote attackers to execute arbitrary code via long (1) Host (2) Password or (3) LogFile property values.


Multiple buffer overflows in the (1) ibase_connect and (2) ibase_pconnect functions in the interbase extension in PHP 4.4.6 and earlier allow context-dependent attackers to execute arbitrary code via a long argument.


Multiple buffer overflows in NewsBin Pro 5.33 and NewsBin Pro 4.x allow user-assisted remote attackers to execute arbitrary code via a long (1) DataPath or (2) DownloadPath attributed in a (a) NBI file or (3) a long group field in a (b) NZB file.


Multiple buffer overflows in LIBFtp 5.0 allow user-assisted remote attackers to execute arbitrary code via certain long arguments to the (1) FtpArchie (2) FtpDebugDebug (3) FtpOpenDir (4) FtpSize or (5) FtpChmod function.


Multiple buffer overflows in the Internet Pictures Corporation iPIX Image Well ActiveX control (iPIX-ImageWell-ipix.dll) allow remote attackers to execute arbitrary code via unspecified vectors.


Multiple buffer overflows in XM Easy Personal FTP Server 5.3.0 allow remote attackers to execute arbitrary code via unspecified vectors. NOTE: this issue might overlap CVE-2006-2225 CVE-2006-2226 or CVE-2006-5728.


Multiple buffer overflows in STLport before 5.0.3 allow remote attackers to execute arbitrary code via unspecified vectors relating to (1) \print floats\ and (2) a missing null termination in the \rope constructor.\


Multiple buffer overflows in the CDDBControl ActiveX control in Gracenote CDDB before 20070418 allow remote attackers to execute arbitrary code via long values for certain Proxy configuration parameters.


Multiple buffer overflows in the LizardTech DjVu Browser Plug-in before 6.1.1 allow remote attackers to execute arbitrary code via unspecified vectors.


Multiple buffer overflows in (a) an ActiveX control (iftw.dll) and (b) Netscape plug-in (npiftw32.dll) for Macrovision (formerly InstallShield) InstallFromTheWeb allow remote attackers to execute arbitrary code via crafted HTML documents.


Multiple buffer overflows in RealNetworks RealPlayer before 17.0.10.8 allow remote attackers to execute arbitrary code via a malformed (1) elst or (2) stsz atom in an MP4 file.


Multiple buffer overflows in the authentication functionality in the web-server module in Cisco CiscoWorks Common Services before 4.0 allow remote attackers to execute arbitrary code via a session on TCP port (1) 443 or (2) 1741 aka Bug ID CSCti41352.


Multiple buffer overflows in the FathFTP ActiveX control 1.7 allow remote attackers to execute arbitrary code via (1) the GetFromURL member or (2) a long argument to the RasIsConnected method.


Multiple buffer overflows in the RealPage Module Upload ActiveX control in Realpage.dll 1.0.0.9 in RealPage Module ActiveX Controls allow remote attackers to execute arbitrary code via a long (1) DestURL or (2) SourceFile property value.


Multiple buffer overflows in Winny 2.0b7.1 and earlier might allow remote attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2006-2007.


Multiple buffer overflows in src/vl/vlDAT.cpp in Visualization Library 2009.08.812 allow user-assisted remote attackers to execute arbitrary code via a crafted DAT file related to the (1) vl::loadDAT and (2) vl::isDAT functions.


Multiple buffer overflows in CA XOsoft r12.0 and r12.5 allow remote attackers to execute arbitrary code via (1) a malformed request to the ws_man/xosoapapi.asmx SOAP endpoint or (2) a long string to the entry_point.aspx service.


Multiple buffer overflows in Adobe Photoshop CS4 before 11.0.2 allow user-assisted remote attackers to execute arbitrary code via a crafted (1) .ASL (2) .ABR or (3) .GRD file.


Multiple buffer overflows in Apple Type Services (ATS) in Apple Mac OS X 10.5.8 allow remote attackers to execute arbitrary code via a crafted embedded font in a document.


Multiple buffer overflows in Microchip MPLAB IDE 8.30 and possibly earlier versions allow user-assisted remote attackers to execute arbitrary code via a .MCP project file with long (1) FILE_INFO (2) CAT_FILTERS and possibly other fields.


Multiple buffer overflows in DigiMode Maya 1.0.2 allow remote attackers to execute arbitrary code via a long string in a malformed (1) .m3u or (2) .m3l playlist file.


Multiple buffer overflows in the JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier CUPS 1.3.9 and earlier Poppler before 0.10.6 and other products allow remote attackers to execute arbitrary code via a crafted PDF file.


Multiple buffer overflows in Wyse Device Manager (WDM) 4.7.x allow remote attackers to execute arbitrary code via (1) the User-Agent HTTP header to hserver.dll or (2) unspecified input to hagent.exe.


Multiple buffer overflows in Deliantra Server before 2.82 allow remote attackers to execute arbitrary code via vectors related to (1) the command_gsay function in server/c_party.C and (2) the book implementation.


Multiple buffer overflows in ActiveX controls used by Trend Micro HouseCall 5.5 and 5.7 and Damage Cleanup Server 1.0 allow remote attackers to execute arbitrary code via long parameter strings.


Multiple buffer overflows in IglooFTP PRO 3.8 allow remote FTP servers to execute arbitrary code via (1) a long FTP banner or long responses to the client commands (2) USER (3) PASS (4) ACCT and possibly other commands.


Multiple buffer overflows in Floosietek FTGate Pro Mail Server (FTGatePro) 1.22 allow remote attackers to execute arbitrary code via long (1) MAIL FROM or (2) RCPT TO commands.


Multiple buffer overflows in the SMTP Service for ESMTP CMailServer 4.0.2003.03.27 allow remote attackers to execute arbitrary code via long (1) MAIL FROM or (2) RCPT TO commands.


Multiple buffer overflows in asf_http_request of MPlayer before 0.92 allows remote attackers to execute arbitrary code via an ASX header with a long hostname.


Multiple buffer overflows in gnocatan 0.6.1 and earlier allow attackers to execute arbitrary code.


Multiple buffer overflows in UMN gopher daemon (gopherd) 2.x and 3.x before 3.0.6 allows attackers to execute arbitrary code via (1) a long filename as a result of a LIST command and (2) the GSisText function which calculates the view-type.


Multiple buffer overflows in SLMail 5.1.0.4420 allows remote attackers to execute arbitrary code via (1) a long EHLO argument to slmail.exe (2) a long XTRN argument to slmail.exe (3) a long string to POPPASSWD or (4) a long password to the POP3 server.


Multiple buffer overflows in vfte based on FTE before 0.50 allow local users to execute arbitrary code.


Multiple buffer overflows in IBM DB2 Universal Database 8.1 may allow local users to execute arbitrary code via long command line arguments to (1) db2start (2) db2stop or (3) db2govd.


Multiple buffer overflows in the AGate component for SAP Internet Transaction Server (ITS) allow remote attackers to execute arbitrary code via long (1) ~command (2) ~runtimemode or (3) ~session parameters or (4) a long HTTP Content-Type header.


Multiple buffer overflows in the launch_bcrelay function in pptpctrl.c in PoPToP 1.1.4-b1 through PoPToP 1.1.4-b3 allow local users to execute arbitrary code.


Multiple buffer overflows in the mySAP.com architecture for SAP allow remote attackers to execute arbitrary code via a long HTTP Host header to (1) Message Server (2) Web Dispatcher or (3) Application Server.


Multiple buffer overflows in XShisen allow attackers to execute arbitrary code via a long (1) -KCONV command line option or (2) XSHISENLIB environment variable.


Multiple buffer overflows in H-Sphere WebShell 2.3 allow remote attackers to execute arbitrary code via (1) a long URL content type in CGI::readFile (2) a long path in diskusage and (3) a long fname in flist.


Multiple buffer overflows in LaTeX2rtf 1.9.15 and possibly other versions allow remote attackers to execute arbitrary code via (1) the expandmacro function and possibly (2) Environments and (3) TranslateCommand.


Multiple buffer overflows in the (1) event_text and (2) event_specific functions in abc2midi 2004.12.04 allow remote attackers to execute arbitrary code via crafted ABC files.


Multiple buffer overflows in Sun Java System Web Proxy Server (formerly Sun ONE Proxy Server) 3.6 through 3.6 SP4 allow remote attackers to execute arbitrary code via unknown vectors possibly CONNECT requests.


Multiple buffer overflows in NetBSD kernel may allow local users to execute arbitrary code and gain privileges.


Multiple buffer overflows in uucp for Sun Solaris 2.6 7 8 and 9 allow local users to execute arbitrary code as the uucp user.


Multiple buffer overflows in the psscan function in ps.c for gv (ghostview) allow remote attackers to execute arbitrary code via a Postscript file with a long (1) BoundingBox (2) comment (3) Orientation (4) PageOrder or (5) Pages value.


Multiple buffer overflows in the RtConfigLoad function in rt-config.c for Atari800 before 1.3.4 allow local users to execute arbitrary code via large values in the configuration file.


Multiple buffer overflows in the handle_directive function in abcpp.c for abcpp 1.3.0 allow remote attackers to execute arbitrary code via crafted ABC files.


Multiple buffer overflows in the enable command for SCO OpenServer 5.0.6 and 5.0.7 allow local users to execute arbitrary code via long command line arguments.


Multiple buffer overflows in (1) the getline function in pcalutil.c and (2) the get_holiday function in readfile.c for pcal 4.7.1 allow remote attackers to execute arbitrary code via a crafted calendar file.


Multiple buffer overflows in the (1) write_heading function in subs.cpp or (2) trim_title function in parse.cpp for abctab2ps 1.6.3 allow remote attackers to execute arbitrary code via crafted ABC files.


Multiple buffer overflows in sharutils 4.2.1 and earlier may allow attackers to execute arbitrary code via (1) long output from wc to shar or (2) unknown vectors in unshar.


Multiple buffer overflows in WinZip 9.0 and earlier may allow attackers to execute arbitrary code via multiple vectors including the command line.


Multiple buffer overflows in the preparse function in asp2php 0.76.23 allow remote attackers to execute arbitrary code via crafted ASP scripts.


Multiple buffer overflows in (1) http.c (2) http-retr.c (3) main.c and other code that handles network protocols in ProZilla 1.3.6-r2 and earlier allow remote servers to execute arbitrary code via a long Location header.


Multiple buffer overflows in the digest authentication functionality in Pavuk 0.9.28-r2 and earlier allow remote attackers to execute arbitrary code.


Multiple buffer overflows in (1) iso2022jp.c or (2) shiftjis.c for Courier-IMAP before 3.0.0 Courier before 0.45 and SqWebMail before 4.0.0 may allow remote attackers to execute arbitrary code \when Unicode character is out of BMP range.\


Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root.


Multiple buffer overflows in the nd WebDAV interface 0.8.2 and earlier allows remote web servers to execute arbitrary code via certain long strings.


Multiple buffer overflows in MMDF on OpenServer 5.0.6 and 5.0.7 and possibly other operating systems may allow attackers to execute arbitrary code as demonstrated via the execmail program.


Multiple buffer overflows in Metamail 2.7 and earlier allow remote attackers to execute arbitrary code.


Multiple buffer overflows in RealOne Player RealOne Player 2.0 RealOne Enterprise Desktop and RealPlayer Enterprise allow remote attackers to execute arbitrary code via malformed (1) .RP (2) .RT (3) .RAM (4) .RPM or (5) .SMIL files.


Multiple buffer overflows in the st_wavstartread function in wav.c for Sound eXchange (SoX) 12.17.2 through 12.17.4 allow remote attackers to execute arbitrary code via certain WAV file header fields.


Multiple buffer overflows in kernel in Intel Server Platform Services Firmware 4.0 allow attacker with local access to the system to execute arbitrary code.


Multiple buffer overflows in kernel in Intel Trusted Execution Engine Firmware 3.0 allow attacker with local access to the system to execute arbitrary code.


Multiple buffer overflows in kernel in Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system to execute arbitrary code.


Multiple

buffer

overflows

in

Active

Management

Technology

(AMT)

in

Intel

Manageability

Engine

Firmware

8.x/9.x/10.x/11.0/11.5/11.6/11.7/11.10/11.20

allow

attacker

with

local

access

to

the

system

to

execute

arbitrary

code

with

AMT

execution

privilege.


Multiple buffer overflows in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I allow remote attackers to execute arbitrary code via invalid size values of NAL units in MP4 data aka internal bug 19641538.


Multiple buffer overflows in SAP 3D Visual Enterprise Viewer (VEV) allow remote attackers to execute arbitrary code via a crafted (1) 3DM or (2) Flic Animation file.