CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 8433 | CVE-2004-0005 | Candidate | Multiple buffer overflows in Gaim 0.75 allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) octal encoding in yahoo_decode that causes a null byte to be written beyond the buffer, (2) octal encoding in yahoo_decode that causes a pointer to reference memory beyond the terminating null byte, (3) a quoted printable string to the gaim_quotedp_decode MIME decoder that causes a null byte to be written beyond the buffer, and (4) quoted printable encoding in gaim_quotedp_decode that causes a pointer to reference memory beyond the terminating null byte. | Modified (20071113) | ACCEPT(5) Armstrong, Baker, Cole, Cox, Green | NOOP(2) Christey, Wall | Christey> CERT-VN:VU#404470 | URL:http://www.kb.cert.org/vuls/id/404470 | CERT-VN:VU#655974 | URL:http://www.kb.cert.org/vuls/id/655974 | CERT-VN:VU#226974 | URL:http://www.kb.cert.org/vuls/id/226974 | CERT-VN:VU#190366 | URL:http://www.kb.cert.org/vuls/id/190366 | View |
| 4030 | CVE-2001-1226 | Candidate | AdCycle 1.17 and earlier allow remote attackers to modify SQL queries, which are not properly sanitized before being passed to the MySQL database. | Proposed (20020315) | ACCEPT(2) Frech, Green | NOOP(5) Christey, Cole, Foat, Wall, Ziese | Christey> CERT-VN:VU#282403 | URL:http://www.kb.cert.org/vuls/id/282403 | View |
| 3486 | CVE-2001-0678 | Candidate | A buffer overflow in reggo.dll file used by Trend Micro InterScan VirusWall prior to 3.51 build 1349 for Windows NT 3.5 and InterScan WebManager 1.2 allows a local attacker to execute arbitrary code. | Proposed (20010829) | ACCEPT(5) Baker, Cole, Frech, Stracener, Ziese | NOOP(2) Foat, Wall | RECAST(1) Christey | Christey> CD:SF-LOC may suggest merging with CVE-2001-0761 | CHANGE> [Christey changed vote from NOOP to REVIEWING] | Christey> CONFIRM:http://solutionbank.antivirus.com/solutions/solutionDetail.asp?solutionID=9590 | CONFIRM:http://solutionfile.trendmicro.com/SolutionFile/9590/en/PatchT3419.zip | Also say it"s the Serial Number field, as stated in | ISVWNTBufferOverflowPatch.txt of the zip file. | Since there is a separate patch for CVE-2001-0761 (though no | build number), there is enough evidence to keep these | 2 candidates separate. | CHANGE> [Christey changed vote from REVIEWING to RECAST] | Christey> CONFIRM:http://download.antivirus.com/ftp/products/patches/isapi_security_patch_351b1360.zip | | This patch fixes a number of overflows in various DLL"s, | including RegGo.dll. See Readme_ISNT_BufferOverflowPatchFiles.txt. | By CD:SF-LOC, the same type of issue appears in the same | versions, so CVE-2001-0678 must be RECAST to include the following | *other* issues in 1512: | (1) FtpSaveCSP.dll, (2) FtpSaveCVP.dll, (3) | HttpSaveCSP.dll, (4) HttpSaveCVP.dll, (5) RegGo.dll, (6) ViewLog.dll, | (7) ftpSaveCVP.dll, (8) patupd.dll, (9) smtpscan.dll, or (10) | smtpscanCVP.dll. | | BUGTRAQ:20010612 [SNS Advisory No.31] Trend Micro InterScan VirusWall for Windows NT 3.51 FtpSaveC*P.dll Buffer Overflow Vulnerability | URL:http://archives.neohapsis.com/archives/bugtraq/2001-06/0148.html | XF:interscan-viruswall-ftpsave-bo(6698) | URL:http://xforce.iss.net/static/6698.php | View |
| 3568 | CVE-2001-0761 | Candidate | Buffer overflow in HttpSave.dll in Trend Micro InterScan WebManager 1.2 allows remote attackers to execute arbitrary code via a long value to a certain parameter. | Proposed (20011012) | ACCEPT(1) Baker | MODIFY(1) Frech | NOOP(4) Armstrong, Cole, Foat, Wall | REVIEWING(1) Christey | Christey> CD:SF-LOC may suggest merging with CVE-2001-0678 | Frech> XF:interscan-webmanager-httpsave-bo(6788) | CHANGE> [Christey changed vote from NOOP to REVIEWING] | Christey> There is evidence that this problem was confirmed by Trend, | but there are some inconsistencies. | MISC:http://solutionbank.antivirus.com/solutions/solutionDetail.asp?solutionID=9682 | Note, however, that the date of the patch description at | MISC:http://solutionfile.trendmicro.com/SolutionFile/9682/en/ReadMe-BufferOverflowPatch.txt | is June 19th, but the Bugtraq post was July 2, and the poster | said that a patch had not been available yet. However, the | poster also said that they had notified Trend on June 11. | Add that the Action parameter is the one with the overflow. | | This patch description only identifies HttpSave.dll, not | RegGo.dll (as identified by CVE-2001-0678), but it implies | that multiple DLL"s may have been fixed. Looking at the DLL"s | in the patch, there is RegGo.dll and a number of other DLL"s. | However, this RegGo.dll is different than the one from | the patch for CVE-2001-0678, so maybe they fixed yet another | problem here. | | That problem might be: | BUGTRAQ:20010621 TrendMicro InterScan WebManager Version 1.2 RegGo.dll Buffer Overflow Vulnerability | URL:http://www.securityfocus.com/archive/1/192645 | where the discloser said that the problem was discovered | in June 6 and implied that Trend Micro would fix the problem, | so Trend was notified sometime between June 6 and June 21. | So, the dates might imply that Trend fixed both the | HTTPSave.dll and this variant (if in fact it"s a variant and | not a rediscovery of CVE-2001-0678) in a single patch. | If true, then that would argue that this candidate should be | merged with the RegGo.dll variant reported in the above | Bugtraq reference, along with some of the other DLL"s - just | in case someone rediscovers THOSE, too. | | Other DLL"s in this patch are covered in other posts | in the same time frame by the same person. | HttpSaveCVP.dll and HttpSaveCSP.dll are in: | BUGTRAQ:20010628 [SNS Advisory No.35] TrendMicro InterScan VirusWall 3.51 HttpSaveC*P.dll Buffer Overflow | URL:http://archives.neohapsis.com/archives/bugtraq/2001-06/0388.html | smtpscan.dll is described in: | BUGTRAQ:20010628 [SNS Advisory No.34] TrendMicro InterScan VirusWall 3.51 smtpscan.dll Buffer Overflow | URL:http://archives.neohapsis.com/archives/bugtraq/2001-06/0387.html | View |
| 2150 | CVE-2000-0574 | Candidate | FTP servers such as OpenBSD ftpd, NetBSD ftpd, ProFTPd and Opieftpd do not properly cleanse untrusted format strings that are used in the setproctitle function (sometimes called by set_proc_title), which allows remote attackers to cause a denial of service or execute arbitrary commands. | Proposed (20000719) | ACCEPT(3) Cole, Levy, Magdych | MODIFY(1) Frech | NOOP(2) LeBlanc, Wall | REVIEWING(1) Christey | Christey> CD:SF-CODEBASE applies here. There are many ftpd"s that | have this setproctitle() problem, but it might be traced | back to the same codebase. See if the HP problem is the | same here as well, and if so, ADDREF HP:HPSBUX0007-117 | URL:http://www.securityfocus.com/templates/advisory.html?id=2404 | Frech> XF:ftp-setproctitle-format-string(4908) | BID:1438 does not exist. | Christey> ADDREF HP:HPSBUX0007-117?? | http://archives.neohapsis.com/archives/hp/2000-q4/0020.html | Christey> ADDREF BID:650 ? | View |
Page 323 of 20943, showing 5 records out of 104715 total, starting on record 1611, ending on 1615
