Mark Dowd

A directory traversal issue in the BOM component allows remote attackers to execute arbitrary code via a crafted CPIO archive.

The issue concerns multiple vulnerabilities in the libzrtpcpp package, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. A heap-based buffer overflow in the ZRtp::storeMsgTemp function allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large packet.

The issue affects the libzrtpcpp package in Gentoo Linux and GNU ZRTPCPP, allowing remote attackers to exploit multiple stack-based buffer overflows. This can lead to a denial of service (crash) and possibly the execution of arbitrary code via crafted ZRTP Hello packets to specific functions, including `ZRtp::findBestSASType`, `ZRtp::findBestAuthLen`, `ZRtp::findBestCipher`, `ZRtp::findBestHash`, and `ZRtp::findBestPubKey`. The exploitation of these vulnerabilities can result in the disruption of confidentiality, integrity, and availability of protected information.

The issue is related to the kernel's validation of `copyin` and `copyout` arguments. Local users can bypass intended pointer restrictions and access certain locations in kernel memory by providing a length of less than one page.

The issue concerns the extensions APIs in the kernel, which provide kernel addresses in certain responses. This makes it easier for remote attackers to bypass the Address Space Layout Randomization (ASLR) protection mechanism by using a crafted app. ASLR is a security feature that randomizes the location of an application's code and data in memory to prevent attackers from predicting where certain pieces of code or data will be.

The issue is related to the handling of ViewHostMsg DatabaseOpenFile messages in chroot-based sandboxing. It allows remote attackers to bypass intended sandbox restrictions via vectors involving fchdir and chdir calls.

The issue allows remote attackers to execute arbitrary code or cause a denial of service, specifically an application crash, via vectors related to the `Node.normalize` method.

The issue allows remote attackers to execute arbitrary code or cause a denial of service via vectors related to the `removeChild` DOM method. This can lead to an application crash.

The sandbox infrastructure in Google Chrome does not properly use pointers, which has unspecified impact and attack vectors.

The issue is related to an integer overflow in the CrossCallParamsEx::CreateFromBuffer function, which can be triggered by a malformed message. This can lead to a denial of service due to heap memory corruption, and potentially have other unspecified impacts. The issue is related to the deserialization of sandbox messages.

The issue arises from improper argument validation for unspecified variables, allowing remote attackers to execute arbitrary code via a crafted HTML document. This is related to the handling of HTML components.

Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-0510, CVE-2009-0511, CVE-2009-0512, and CVE-2009-0888.

A heap-based buffer overflow in the JBIG2 filter allows remote attackers to execute arbitrary code via a crafted file that triggers memory corruption.

Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-0511, CVE-2009-0512, CVE-2009-0888, and CVE-2009-0889.

Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-0510, CVE-2009-0512, CVE-2009-0888, and CVE-2009-0889.

Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-0510, CVE-2009-0511, CVE-2009-0888, and CVE-2009-0889.

Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-0510, CVE-2009-0511, CVE-2009-0512, and CVE-2009-0889.

The issue is related to multiple heap-based buffer overflows in the xvidcore library, which can be triggered by providing a crafted macroblock number in a video stream within a crafted movie file. This can lead to heap memory corruption and allow remote attackers to execute arbitrary code. The problem is associated with a missing resync marker range check and involves the `decoder iframe`, `decoder pframe`, and `decoder bframe` functions.

A heap-based buffer overflow issue exists in the decoder create function within the initialization functionality of Xvid. This issue can be exploited by remote attackers to execute arbitrary code through crafted movie files, particularly when the XVID ERR MEMORY return code is improperly handled during processing. The exploitation vector involves the DirectShow frontend.

Name of the Vulnerable Software and Affected Versions: Microsoft Visual Basic 6.0 Visual Studio .NET versions 2002 SP1 and 2003 SP1 Visual FoxPro versions 8.0 SP1, 9.0 SP1, and 9.0 SP2 Office Project versions 2003 SP3 and 2007 Gold and SP1 Description: A heap-based buffer overflow issue exists, allowing remote attackers to execute arbitrary code via a crafted AVI file. This triggers an allocation error and memory corruption. The vulnerability can be exploited by constructing a specially crafted web page, potentially leading to remote code execution when viewed. If successfully exploited, an attacker could gain the same user rights as the logged-on user. Recommendations: For Microsoft Visual Basic 6.0, update to a version that includes the fix for this issue. For Visual Studio .NET versions 2002 SP1 and 2003 SP1, apply the necessary patch or update to a newer version. For Visual FoxPro versions 8.0 SP1, 9.0 SP1, and 9.0 SP2, consider disabling the use of AVI files until a patch is available. For Office Project versions 2003 SP3 and 2007 Gold and SP1, restrict access to crafted web pages to minimize the risk of exploitation.