Mark Litchfield

The issue is related to a heap-based buffer overflow in the Message HTTP Server. This can be exploited by remote attackers to execute arbitrary code. The exploitation occurs via a long string in the `group` parameter to the "/msgserver/html/group" API endpoint.

The issue is related to a stack-based buffer overflow in the kweditcontrol.kwedit.1 ActiveX control. This control is located in the FrontEndSapGuikwedit.dll component of the SAP GUI. The overflow can be triggered by passing a long argument to the PrepareToPostHTML function, potentially allowing remote attackers to execute arbitrary code.

The issue allows remote attackers to cause a denial of service, resulting in a process crash. This is achieved by sending a URI of a certain length that contains a `sap-isc-key` parameter, which is related to the configuration of a web cache.

The issue involves unspecified vulnerabilities in ActiveX controls within the SAP GUI, allowing remote attackers to create certain files through unspecified vectors.

The issue involves multiple unspecified vulnerabilities in ActiveX controls within the SAP GUI, allowing remote attackers to cause a denial of service, specifically a process crash, via unspecified vectors.

The issue is related to a heap-based buffer overflow in the rfcguisink.rfcguisink.1 ActiveX control. This can be exploited by remote attackers to execute arbitrary code by providing a long first argument to the `LaunchGui` function.

Name of the Vulnerable Software and Affected Versions: Symantec Automated Support Assistant (affected versions not specified) Norton AntiVirus (affected versions not specified) Norton Internet Security (affected versions not specified) Norton System Works 2006 (affected versions not specified) Description: The issue is related to multiple buffer overflows in the SupportSoft ActiveX controls, specifically in the SmartIssue and ScriptRunner components. This allows remote attackers to execute arbitrary code via a crafted HTML message. Recommendations: For Symantec Automated Support Assistant, update to a version that includes the fix for the buffer overflows in the SmartIssue and ScriptRunner ActiveX controls. For Norton AntiVirus, update to a version that includes the fix for the buffer overflows in the SmartIssue and ScriptRunner ActiveX controls. For Norton Internet Security, update to a version that includes the fix for the buffer overflows in the SmartIssue and ScriptRunner ActiveX controls. For Norton System Works 2006, update to a version that includes the fix for the buffer overflows in the SmartIssue and ScriptRunner ActiveX controls. As a temporary workaround, consider disabling the `tgctlsi.dll` and `tgctlsr.dll` ActiveX controls until a patch is available.

Name of the Vulnerable Software and Affected Versions: Microsoft Outlook versions 2000 through 2003 Microsoft Exchange 5.0 Server version SP2 Microsoft Exchange 5.0 Server version SP4 Microsoft Exchange 2000 version SP3 Microsoft Office (affected versions not specified) Description: The issue is related to a remote code execution vulnerability due to improper decoding of Transport Neutral Encapsulation Format (TNEF) MIME attachments in e-mail messages. This allows remote attackers to execute arbitrary code via a crafted attachment. The vulnerability is also related to message length validation. Recommendations: For Microsoft Outlook versions 2000 through 2003, consider disabling the handling of TNEF MIME attachments until a fix is available. For Microsoft Exchange 5.0 Server versions SP2 and SP4, restrict access to TNEF encoded messages to minimize the risk of exploitation. For Microsoft Exchange 2000 version SP3, avoid processing e-mail messages with crafted TNEF attachments until the issue is resolved. For Microsoft Office, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to multiple heap-based and stack-based buffer overflows in certain DCOM server components. This allows remote attackers to execute arbitrary code via certain ActiveX controls.

Name of the Vulnerable Software and Affected Versions: VERITAS Backup Exec Web Administration Console (BEWAC) versions 9.0 4367 through 10.0 rev. 5484 Description: A buffer overflow issue allows remote attackers to execute arbitrary code. Recommendations: For versions 9.0 4367 through 10.0 rev. 5484, update to a version that contains a fix for this issue.

A buffer overflow issue in the Web Client service allows remote authenticated users to execute arbitrary code via a crafted WebDAV request containing special parameters.

Name of the Vulnerable Software and Affected Versions: Apple iTunes versions prior to 4.8 Description: A buffer overflow issue allows remote attackers to execute arbitrary code via a crafted MPEG4 file. Recommendations: For versions prior to 4.8, update to version 4.8 or later to resolve the issue.

The issue is related to multiple buffer overflows that can be triggered by sending large amounts of data in certain time or date fields. This can cause a denial of service, resulting in an application crash, and potentially allow the execution of arbitrary code.

The issue allows attackers to cause a denial of service, resulting in a process crash, by sending malformed data to the XP Server TCP port.

A heap-based buffer overflow issue allows remote attackers to execute arbitrary code via .WAV files.

The issue is related to a stack-based buffer overflow in the SetSkin function, which allows remote attackers to execute arbitrary code via a long skin name.

The issue allows remote authenticated users to execute arbitrary code via several vulnerable functions, including the `attrib valid` function, `covert` function, `declare` statement, or a crafted query plan. Additionally, remote authenticated users with database owner or "sa" role privileges can execute arbitrary code via a crafted install java statement.

The issue is related to a format string vulnerability in the SetBaseURL function. This vulnerability allows remote attackers to execute arbitrary code via format string specifiers in an invalid URL that is recorded in the debug log.

The issue concerns the WrapNISUM ActiveX component, specifically the WrapUM.dll file, which is marked as safe for scripting. This marking allows remote attackers to execute arbitrary programs by utilizing the LaunchURL method.

The issue is related to a stack-based buffer overflow in the SymSpamHelper ActiveX component. This occurs when a long parameter is passed to the `LaunchCustomRuleWizard` method, allowing remote attackers to execute arbitrary code.