CVE Vulnerability Catalog

Multiple RealNetworks products including RealPlayer 10.x, RealOne Player, and Helix Player have a heap-based buffer overflow in the embedded player. A remote malicious server can cause a denial of service (crash) and possibly execute arbitrary code via a chunked Transfer-Encoding HTTP response where the chunk header length is -1, less than actual data, or missing.

Directory traversal vulnerability in kvarcve.dll in Autonomy (formerly Verity) KeyView SDK before 9.2.0, as used in Lotus Notes 6.5.4 and 7.0, allows remote attackers to delete arbitrary files via a ZIP, UUE or TAR archive that contains a .. (dot dot) in the filename, which is not properly handled when generating a preview.

The G/PGP (GPG) Plugin 2.1 and earlier for Squirrelmail allows remote authenticated users to execute arbitrary commands via shell metacharacters in the fpr and keyserver parameters.

Multiple heap-based buffer overflows in EMC Legato NetWorker and related products (Sun Solstice Backup, StorEdge EBS) allow remote attackers to execute arbitrary code or cause denial of service via malformed RPC packets to nsrd.exe (program 390109) and nsrexecd.exe (program 390113).

A CSRF vulnerability in the management interface of VMware ESX Server allows a remote attacker to perform unauthorized actions as an administrator via crafted URLs, such as changing a password using the setUsr operation.

An unspecified vulnerability in Java 1.3.1 before version 1.3.1_16 on Apple Mac OS X allows an untrusted applet to gain elevated privileges. The issue is related to Mac OS X specific extensions.

Multiple Check Point Zone Labs ZoneAlarm products before version 7.0.362, including ZoneAlarm Security Suite 5.5.062.004 and 6.5.737, use insecure default permissions for critical files. A local user can exploit this vulnerability to gain privileges or bypass security controls.

Multiple vulnerabilities in the OpenSSL ASN.1 parser, as used in Novell iManager 2.0.2, allow remote attackers to cause a denial of service (NULL pointer dereference) via crafted packets, as demonstrated by 'OpenSSL ASN.1 brute forcer'.

The vulnerability in ISS BlackIce 3.6, used in multiple products, involves a failure to drop privileges before launching help from the 'More Info' button in the 'Application Protection' dialog. This allows local users to execute arbitrary programs as SYSTEM.

A heap-based buffer overflow in Apple QuickTime before version 7.0.4 allows remote attackers to execute arbitrary code via a crafted GIF image file with a Netscape Navigator Application Extension Block that modifies the heap in the Picture Modifier block.

The vulnerability in the crttrap command of QNX Neutrino RTOS 6.2.1 allows local users to load arbitrary libraries via the LD_LIBRARY_PATH environment variable pointing to a malicious library.

Unspecified vulnerability in Java 1.4.2 before 1.4.2 Release 2 on Apple Mac OS X allows local users to gain privileges via unspecified attack vectors relating to the utility used to update Java shared archives.

A buffer overflow vulnerability in Apple QuickTime before version 7.0.4 allows remote attackers to execute arbitrary code via crafted TGA image files.

Buffer overflow in the JBIG2Bitmap::JBIG2Bitmap function in JBIG2Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to modify memory and possibly execute arbitrary code via unknown attack vectors.

An integer overflow in Apple QuickTime before version 7.0.4 allows remote attackers to execute arbitrary code via crafted TGA image files.

Vulnerability in initscripts in Red Hat Enterprise Linux 4 allows local users with sudo permissions for /sbin/service to escalate privileges to root via improper handling of environment variables.

Multiple SQL injection vulnerabilities in PHPSurveyor before version 0.991 allow remote attackers to execute arbitrary SQL commands via the sql parameter in browse.php and the sid, lid, gid, and token parameters in other PHP scripts.

Juniper NetScreen-Security Manager (NSM) 2004 FP2 and FP3 are vulnerable to a denial of service attack via a long crafted string sent to port 7800 (GUI Server) or 7801 (Device Server), causing server components to crash or hang, though they are automatically restarted.

SQL injection vulnerability in main.php in Enterprise Heart Enterprise Connector 1.0.2 allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the loginid parameter. This is a different vulnerability than CVE-2005-3875.

In Plogger Beta 2, the file plog-admin-functions.php contains a PHP remote file inclusion vulnerability. An attacker can execute arbitrary code by providing a URL in the config[basedir] parameter.