Robert Swiecki

A specially crafted request could crash the server due to an out of bound access after a size limit is reached by reading the HTTP header. This issue is considered very hard if not impossible to trigger in non-debug mode, so it is classified as low risk for common server usage. The issue is related to an out of bound access in memory after reaching the size limit by reading the HTTP header, which could allow a remote attacker to cause a denial of service.

The issue is related to the X509 cmp time function, which does not properly check the length of the ASN1 TIME string and can read a few bytes out of bounds. This can allow remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1 TIME data. The vulnerability can be exploited by an unauthenticated, remote attacker to cause a denial of service (DoS) condition or corrupt portions of OpenSSL process memory.

The issue allows remote attackers to read content from a different domain or zone via a crafted web site. An information disclosure vulnerability exists that could allow an attacker to force the browser to perform unexpected actions when a user downloads Web content, allowing an attacker to view content from a different domain or Internet Explorer zone other than the domain or zone of the attacker's Web page.

The issue is related to an integer overflow in the Linux kernel, specifically in the vma to resize function in mm/mremap.c, which can be exploited by local users to cause a denial of service, resulting in a system crash. Additionally, there are multiple vulnerabilities in the kernel-kdumppae package of SUSE Linux Enterprise that can be exploited remotely, potentially leading to a disruption of protected information.

The issue is related to multiple integer overflows in the next pidmap function in kernel/pid.c, which can cause a denial of service (system crash) via crafted system calls, specifically (1) getdents or (2) readdir. Additionally, there are multiple vulnerabilities in the kernel-kdumppae package of SUSE Linux Enterprise that can lead to disruption of protected information availability, and these can be exploited remotely.

The issue is related to the handling of interaction between mutex possession and llseek operations in the Linux kernel when debugfs is enabled. This can be exploited by local users to cause a denial of service, resulting in a NULL pointer dereference and outage of all function tracing files, via an lseek call on a file descriptor associated with the set ftrace filter file.

The issue affects the freetype package in Gentoo Linux, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Exploitation can occur remotely. A buffer overflow in the `Mac Read POST Resource` function in `base/ftobjs.c` allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted Adobe Type 1 Mac Font File.

The issue is related to multiple vulnerabilities in the FreeType package, which can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Specifically, FreeType before version 2.4.2 uses incorrect integer data types during bounds checking. This can allow remote attackers to cause a denial of service, such as an application crash, or possibly execute arbitrary code via a crafted font file.

The issue is related to an integer underflow in glyph handling, which can be exploited by remote attackers using a crafted font file. This can lead to a denial of service, causing the application to crash, or possibly allow the execution of arbitrary code. The vulnerability can be exploited remotely and may compromise the confidentiality, integrity, and availability of protected information.

The issue concerns multiple vulnerabilities in the freetype package that can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. A heap-based buffer overflow in the `Ins IUP` function in `truetype/ttinterp.c` can occur when TrueType bytecode support is enabled, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted font file.

The issue concerns multiple buffer overflows in demo programs within FreeType, potentially allowing remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted font file. Exploitation of the vulnerabilities may lead to breaches in confidentiality, integrity, and availability of protected information, and can be carried out remotely.

The issue concerns multiple vulnerabilities in the freetype package, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. Specifically, the `psh glyph find strong points` function in `pshinter/pshalgo.c` does not properly implement hinting masks, allowing remote attackers to cause a denial of service, such as heap memory corruption and application crash, or possibly execute arbitrary code via a crafted font file that triggers an invalid free operation.

The issue concerns multiple vulnerabilities in the FreeType package, which can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. A buffer overflow in the `Mac Read POST Resource` function in `base/ftobjs.c` allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted LaserWriter PS font file with an embedded PFB fragment.

The issue is related to an integer overflow in the gray render span function in smooth/ftgrays.c, which allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted font file. Multiple vulnerabilities in the freetype package may lead to violations of confidentiality, integrity, and availability of protected information, and exploitation can be done remotely.

The issue is related to a heap-based buffer overflow in the Mac Read POST Resource function in base/ftobjs.c, which can be triggered by a crafted length value in a POST fragment header in a font file. This can cause a denial of service, such as an application crash, or possibly allow the execution of arbitrary code. The vulnerability can be exploited remotely.

The issue in the Cascading Style Sheets (CSS) implementation allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via crafted format arguments.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via built-in XSLT templates.

Name of the Vulnerable Software and Affected Versions: ImageIO in Apple Mac OS X versions 10.4.11 and 10.5 through 10.5.4 Description: The issue allows context-dependent attackers to cause a denial of service, resulting in memory corruption and application crash, or execute arbitrary code via a crafted TIFF image. Recommendations: For Mac OS X 10.4.11, update to a version that fixes the issue. For Mac OS X versions 10.5 through 10.5.4, update to a version that fixes the issue. As a temporary workaround, consider avoiding the use of crafted TIFF images until a patch is available.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via a crafted URL that is not properly handled in the error page, affecting Apple Safari when running on Windows XP or Vista.

A visual truncation issue allows remote attackers to spoof the URL address bar by using an http URI with a large amount of whitespace in the `user/password` portion.