Georgi Guninski

The issue is related to the qmail-verify module in the netqmail email client, which lacks protection for service data. This can allow an attacker to gain access to confidential data. A local attacker can test for the existence of files and directories anywhere in the filesystem because qmail-verify runs as root and tests for the existence of files in the attacker's home directory, without dropping its privileges first.

The issue is related to a lack of input validation in the qmail-verify module of the netqmail email client. This can be exploited by a remote attacker to compromise data integrity. The vulnerability allows for a mail-address verification bypass.

The issue is related to the incorrect validation of gpg keys with the master keyring by apt-key in apt, which can lead to a potential man-in-the-middle attack.

The issue allows remote attackers to install Trojan horse packages via a man-in-the-middle (MITM) attack, due to reliance on GnuPG argument order and lack of checks for GPG subkeys when using the apt-key net-update to import keyrings.

A double free vulnerability in the ssl3 get key exchange function in the OpenSSL client allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via a crafted private key with an invalid prime. This issue may also be referred to as a use-after-free issue. The vulnerability can be exploited remotely and may lead to a violation of confidentiality, integrity, and availability of protected information.

The issue allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via an embedded SVG document, due to improper support for the application/octet-stream content type as a protection mechanism against execution of web script in certain circumstances involving SVG and the EMBED element.

The issue allows remote attackers to bypass the same-origin policy and read XML data from another domain via a cross-domain redirect. This is due to a problem with the nsIRDFService.

The issue allows remote attackers to cause a denial of service, resulting in a crash, via vectors related to dangling pointers, heap corruption, signed/unsigned, and other issues.

The issue is related to multiple heap-based buffer overflows that can be triggered by remote attackers. This can be achieved through external message modes with long Content-Type headers or long RFC2047-encoded (MIME non-ASCII) headers, potentially allowing the execution of arbitrary code.

The issue affects the layout engine, allowing remote attackers to cause a denial of service, which may result in memory corruption and a crash, and potentially execute arbitrary code. The attack vectors for this issue are not specified.

The issue involves multiple integer overflows in the Javascript engine. Remote attackers might execute arbitrary code via vectors involving long strings in the `toSource` method of the `Object`, `Array`, and `String` objects, as well as unspecified string function arguments.

The issue allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code. This can be achieved through various means, including nested `<option>` tags in a `select` tag, a `DOMNodeRemoved` mutation event, Content-implemented tree views, BoxObjects, the XBL implementation, or an `iframe` that attempts to remove itself, leading to memory corruption.

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions 1.0.x through 1.5.0.1 Mozilla Thunderbird versions 1.0.x through 1.5.0.1 Mozilla Suite versions prior to 1.7.13 SeaMonkey versions prior to 1.0.1 Description: The issue allows remote attackers to gain chrome privileges via multiple attack vectors related to the use of XBL scripts with "Print Preview". Recommendations: For Mozilla Firefox versions 1.0.x through 1.5.0.1, update to version 1.5.0.2 or later. For Mozilla Thunderbird versions 1.0.x through 1.5.0.1, update to version 1.5.0.2 or later. For Mozilla Suite versions prior to 1.7.13, update to version 1.7.13 or later. For SeaMonkey versions prior to 1.0.1, update to version 1.0.1 or later.

The issue allows attackers to bypass javascript security settings and obtain sensitive information or cause a crash. This is achieved through an e-mail containing a javascript URI in the SRC attribute of an `IFRAME` tag, which is executed when the user edits the e-mail.

The issue allows remote attackers to execute arbitrary code via the QueryInterface method of the built-in Location and Navigator objects, which leads to memory corruption.

The issue is related to multiple integer overflows that could allow remote attackers to execute arbitrary code. This is possible via the `EscapeAttributeValue` in `jsxml.c` for E4X, `nsSVGCairoSurface::Init` in SVG, and `nsCanvasRenderingContext2D.cpp` in Canvas, when Javascript is enabled in mail.

The issue allows external user-assisted attackers to execute arbitrary commands via shell metacharacters in the (1) glob or (2) expand commands of a foldexpr expression for calculating fold levels, when modelines are enabled.

The issue is related to improper implementation of security checks for script injection, allowing remote attackers to execute scripts via `javascript:` URLs. This can be achieved through various methods, including using a `javascript:` URL in a `view-source:` URL, a `javascript:` URL in a `jar:` URL, or a nested variant.

The issue is caused by an integer overflow in the `stralloc readyplus` function in qmail. This allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large SMTP request, particularly when running on 64-bit platforms with a large amount of virtual memory. Researchers from Qualys demonstrated the possibility of exploiting this vulnerability, which was known since 2005, by preparing an exploit that initiates remote code execution on the server through sending a specially crafted message.

The issue is related to an integer signedness error in the `qmail put` and `substdio put` functions of qmail. This error can be exploited by remote attackers, particularly when qmail is running on 64-bit platforms with a large amount of virtual memory. The exploitation can occur via a large number of SMTP RCPT TO commands, potentially leading to a denial of service and possibly allowing the execution of arbitrary code. The vulnerability is also associated with uncontrolled resource consumption.