SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen call. It's possible to exploit this vulnerability to execute arbitrary shell commands on the remote servercveŒÀ † † ‚T €‚R Z‚| †œT ‚R>
Werner Lemberg reports:
CVE-2017-8105, CVE-2017-8287: Older FreeType versions have out-of-bounds writes caused by heap-based buffer overflows related to Type 1 font’à † † ƒ€ƒ †œq ƒename>
CVE-2011-4969 CVE-2017-2601 CVE-2015-0886 CVE-2017-2602 CVE-2017-2603 CVE-2017-2604 CVE-2017-2605 CVE-2017-2606 CVE-2017-2607 CVE-2017-2608 ™€ † † 4€V Rœ €\ t“ †œi2name>CVE-2016-74202015-02-27e722e3c6-bbee-11e6-b1cf-14dae9d210b8"> FreeBSD -- bhyve(8) virtual machine escapeŸ † † ‚7€W Zƒê~€^ †œq ‚5ing problems and cases of missing or incomplete input sanitizing may result in denial of service or the execution of arbitrary code if malformed SIXEL, PDB, MAP, SGI, TIFF and CALS files are processedwww.debian.org/security/2016/dsa-3675 ports/213032 2015-07-280c064c43-600a-11e6-a6c3-14dae9d210b8"> FreeBSD -- Resource exhaustion due to sessions stuck in LAST_ACK state1 10.1_15
Some partition-level operations exist that do not explicitly also authorize privileges of the parent table. This can lead to issues when the parent table would have denied the operation, but no denial occurs because the partition-level privilege is not checked by the authorization framework, which defines authorization entities ²€ † † ƒ€ƒ †œq ƒestkey values are not properly validated. Reported by Yihan Lian of the Cloud Security Team, Qihoo 360
wnpa-sec-2016-09
iSeries file parser crash. (Bug 11985) CVE-2016-2529
wnpa-sec-2016-10
RSL dissector crash. (Bug 11829) CVE-2016-2530 CVE-2016-2531
wnpa-sec-2016-11
LLRP dissector crash. (Bug 12048) CVE-2016-2532
wnpa-sec-2016-12
Ixia IxVeriWave file par¾À † † ‚v
€‚t w‚±@ †œ\‚tall.com/lists/oss-security/2015/01/11/1
Pidgin reports:
A series of specially crafted file transfer requests can cause clients to reference invalid memory. The user must have accepted one of the file transfer requests2-2214 <¢À † † ƒ€ƒ †œq ƒng a slow read type attack it is possible to prevent anyone from joining a server with virtually no resources. Once downloading the map no other downloads of the map can start, so downloading really slowly will prevent others from joining. This can be further aggravated by the pause-on-join setting in which case the game is paused and the players cannot continue the¨à † † ‚Y €‚W `œ~ †œI(‚Wat.com/show_bug.cgi?id=725760">
The compress/ LZW decompress implentation does not correctly handle compressed streams that contain code words that were not yet added to the decompression table. This may lead to arbitrary memory corruption. Successfull exploitation may possible lead to a local privilege escalation¯€ † † ƒ€ƒ †œq ƒffice.org/security/cves/CVE-2010-3702_CVE-2010-3704.html"> CVE-2010-3702 / CVE-2010-3704: Security Vulnerability in OpenOffice.org's PDF Import extension resulting from 3rd party library XPDF
CVE-2010-4008 / CVE-2010-4494: Possible Security Vulnerability in OpenOffice.org resulting from 3µ † † ƒ€ƒ †œq ƒ 9.3.4 and earlier versions for Windows, Macintosh and UNIX, and Adobe Acrobat 9.3.4 and earlier versions for Windows and Macintosh. This vulnerability (CVE-2010-2884) could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being actively exploited in the wild against Adobe Flash »À † † ‚6€‚ […Ñ¥ †œq ‚4nkey mail MFSA 2009-68 NTLM reflection vulnerability
MFSA 2009-62 Download filename spoofing with RTL override
MFSA 2009-59 Heap buffer overflow in string to number conversion
MFSA 2009-49 TreeColumns dangling pointer vulnerability10-0161
CVE-Áà † † Z€X zü@ =‚¹ †œpY7af2d-8db7-11de-883b-001e3300a30d"> pidgin -- MSN overflow parsing SLP messag9È€ † † ‚C€‚= N‚Ç„ †œq ‚Atrary SQL code in an environment using a multi-byte character encoding. An error exists in the "mod_sql" module when processing e.g. user names containing '%' characters. This can be exploited to bypass input sanitation routines and manipulate SQL queries by injecting arbitrary SQL codecvenÎ † † ƒ€ƒ †œq ƒ0270/">
Some vulnerabilities have been reported in Mantis, which can be exploited by malicious users to compromise a vulnerable system and malicious people to conduct cross-site scripting and request forgery attacks.
Input passed to the "filter_target" parameter in return_dynamic_filters.php is not properly sanitised before being returned to a user. This cÔÀ † † ƒ€ƒ †œq ƒn can be specified, pointing to the directory where attachments to import are stored. If the XML file being read by importxml.pl contains a malicious
../relative_path/to/local_filenode, the script follows this relative path and attaches the local file pointed by it to the bug, making the file public. The security fix makes sure the relative path is alwÚà † † € ‚hˆ7 †›{v >
2008-01-15
Impact: A remote user can create a file that, when loaded
by the target user, will execute arbitrary code on the
target user's system34
2) A boundary error within the handling of specially crafted invalid COM_TABLE_DUMP packets can be exploited by an authenticated client to cause a buffer overflow and allows arbitrary code execution.
3) An error within the handling of malformed login packets can be
exploited to disclosure cerú€ † † ‚?€N R0€o †œq ‚=
A Debian Security Advisory reports: Javier Fernández-Sanguino Peña discovered several
insecure temporary file uses in cfengine, a tool for
configuring and maintaining networked machines, that can
be exploited by a symlink attack to overwrite arbitrary
files owned by the user executing‚†À † † ƒ€ƒ †œq ƒ
Note that because this bug is related to the parsing of requests, it may happen that this bug is triggered accidently by a user when he or she makes a typo.
‚ŸÀ † † ƒ€ƒ †œq ƒ71883130372In addition, a vulnerability in the RADIUS decoder was found by Jonathan Heusser.
Finally, there is one uncredited vulnerability described by the Ethereal team as:
This vulnerability could possibly be used on a multi-user system to gain elevated privileges, e.g. root builds some packages, and another user successfully exploits this vulnerability to write to a system file.