John Heasman

An elevation-of-privilege issue allows attackers to affect the system.

A directory traversal issue allows remote attackers to read arbitrary files when a site plugin is enabled.

Name of the Vulnerable Software and Affected Versions: Castle Rock Computing SNMPc versions 7.1 and earlier Description: The issue is a stack-based buffer overflow in the Network Manager, which can be triggered by remote attackers sending a long community string in an SNMP TRAP packet. This can cause a denial of service, resulting in a crash, or potentially allow the execution of arbitrary code. Recommendations: For Castle Rock Computing SNMPc versions 7.1 and earlier, update to a version later than 7.1 to resolve the issue. As a temporary workaround, consider restricting access to the Network Manager to minimize the risk of exploitation.

The issue allows remote attackers to bypass the same origin policy and execute local applications via unknown vectors. This could potentially lead to unauthorized access or execution of local resources.

The issue allows remote attackers to gain privileges via an untrusted application.

A stack-based buffer overflow issue exists in an ActiveX control used by the Symantec Automated Support Assistant. This could allow user-assisted remote attackers to cause a denial of service, potentially leading to a crash, and may also enable the execution of arbitrary code. The attack vectors for this issue are not specified.

The issue is related to a buffer overflow in the swfformat.dll component. This can be exploited by remote attackers through a crafted SWF (Flash) file, allowing them to execute arbitrary code. The exploitation can occur via a size value in the SWF file that is less than the actual size, or through other unspecified manipulations of the file.

A buffer overflow issue exists, allowing remote attackers to have an unknown impact via a malicious Mimio boardCast (mbc) file.

Name of the Vulnerable Software and Affected Versions: Microsoft Outlook versions 2000 through 2003 Microsoft Exchange 5.0 Server version SP2 Microsoft Exchange 5.0 Server version SP4 Microsoft Exchange 2000 version SP3 Microsoft Office (affected versions not specified) Description: The issue is related to a remote code execution vulnerability due to improper decoding of Transport Neutral Encapsulation Format (TNEF) MIME attachments in e-mail messages. This allows remote attackers to execute arbitrary code via a crafted attachment. The vulnerability is also related to message length validation. Recommendations: For Microsoft Outlook versions 2000 through 2003, consider disabling the handling of TNEF MIME attachments until a fix is available. For Microsoft Exchange 5.0 Server versions SP2 and SP4, restrict access to TNEF encoded messages to minimize the risk of exploitation. For Microsoft Exchange 2000 version SP3, avoid processing e-mail messages with crafted TNEF attachments until the issue is resolved. For Microsoft Office, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer overflow in RealNetworks RealPlayer 10 and 10.5 allows remote attackers to execute arbitrary code via a crafted image in a RealPlayer Skin (RJS) file. NOTE: due to the lack of details, it is unclear how this is different than CVE-2005-2629 and CVE-2005-2630, but the vendor advisory implies that it is different.

A buffer overflow issue exists in the font processing component, allowing local users to gain privileges through a specially-designed application.

The issue allows local users to load arbitrary shared libraries and execute code via the LOAD extension. Any database user is permitted to load arbitrary shared libraries using the LOAD command. A valid login is required to exploit this issue.

The issue is related to a stack-based buffer overflow in the SetSkin function, which allows remote attackers to execute arbitrary code via a long skin name.

The issue is related to an off-by-one buffer overflow in the processing of tags in Real Metadata Package (RMP) files. This could allow remote attackers to execute arbitrary code via a long tag.

Name of the Vulnerable Software and Affected Versions: Apple QuickTime versions prior to 6.5.2 Description: The issue is related to an integer overflow that occurs when running Apple QuickTime on Windows systems. This can be triggered by certain inputs, leading to a denial of service due to excessive memory consumption. Recommendations: For Apple QuickTime versions prior to 6.5.2, update to version 6.5.2 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Internet Explorer versions 5.01 through 6 Description: A heap-based buffer overflow issue exists in the Hrtbeat.ocx (Heartbeat) ActiveX control. This issue can be exploited by remote attackers to execute arbitrary code when users visit specific online gaming sites associated with MSN. The exploitation is possible via the `SetupData` parameter. Recommendations: For Internet Explorer versions 5.01 through 6, consider disabling the Hrtbeat.ocx (Heartbeat) ActiveX control as a temporary workaround until a patch is available. Restrict access to online gaming sites associated with MSN to minimize the risk of exploitation. Avoid using the `SetupData` parameter in the affected ActiveX control until the issue is resolved.

The issue allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application. This is possibly due to an "unchecked buffer," which may be related to a buffer overflow.

The issue is related to a stack-based buffer overflow in the HandleAction function. This allows remote attackers to execute arbitrary code via a long `ShowPreferences` argument.

The issue is related to a format string vulnerability in the SetBaseURL function. This vulnerability allows remote attackers to execute arbitrary code via format string specifiers in an invalid URL that is recorded in the debug log.

A directory traversal issue exists in the parsing of Skin file names, allowing remote attackers to read arbitrary files by including a .. (dot dot) in an RJS filename.