Shaun Colley

A heap-based buffer overflow issue exists in the Office Works File Converter, allowing remote attackers to execute arbitrary code via a crafted Works file. This issue enables an attacker to take complete control of an affected system, potentially leading to the installation of programs, viewing, changing, or deleting data, or creating new accounts.

A remote code execution issue exists in the Microsoft Data Analyzer ActiveX control, allowing attackers to execute arbitrary code via a crafted web page that corrupts the `system state`. This could enable an attacker to gain the same user rights as the logged-on user when a user views the specially crafted Web page.

The issue allows local users to cause a denial of service, resulting in a kernel panic, by sending a certain IOCTL request with a large count to the IATA (ata) driver when read access to /dev is available. This triggers a malloc call with a large value.

Name of the Vulnerable Software and Affected Versions: Microsoft Office versions 2000 SP3 through 2007 SP1 Works versions 8.5 through 9 Description: A buffer overflow issue exists in the Works for Windows document converters, allowing remote attackers to execute arbitrary code via a crafted Works .wps file. This could trigger memory corruption. The vulnerability could allow remote code execution if a user opens a specially crafted .wps file. Users with fewer user rights on the system could be less impacted than users who operate with administrative user rights. Recommendations: For Microsoft Office 2000 SP3, update to a version that includes the fix for this issue. For Microsoft Office XP SP3, update to a version that includes the fix for this issue. For Microsoft Office 2003 SP3, update to a version that includes the fix for this issue. For Microsoft Office 2007 SP1, update to a version that includes the fix for this issue. For Works 8.5 and 9, update to a version that includes the fix for this issue. As a temporary workaround, consider avoiding the use of the Works for Windows document converters to minimize the risk of exploitation.

The issue is a stack-based buffer overflow in the finger service of Process Software MultiNet for HP OpenVMS, allowing remote attackers to execute arbitrary code via a long request string.

A remote code execution issue exists due to the processing of a malformed LABEL record file. This allows attackers to execute arbitrary code via a crafted .xls file that triggers memory corruption. An attacker could exploit this by constructing a specially crafted Excel file.

The issue allows local users to overwrite arbitrary files via a symlink attack on the high score or save game files.

The issue is related to multiple stack-based buffer overflows that can be exploited by local users to gain privileges. This can be achieved by setting a long `HOME` environment variable, which affects various components, including `config.cc`, `game.cc`, `highscor.cc`, and `meny.cc`.

The issue is a stack-based buffer overflow in the error directive, which allows attackers to execute arbitrary code via a long error message.

The issue concerns a lack of verification of the output file before writing to it in Extcompose in metamail. This allows local users to potentially overwrite arbitrary files via a symlink attack.

The issue concerns multiple vulnerabilities in the sharutils package, which can lead to breaches in confidentiality, integrity, and availability of protected information. Exploitation of these vulnerabilities can be done remotely. A specific vulnerability is a stack-based buffer overflow in the shar utility, allowing local users to execute arbitrary code via a long `-o` command line argument.

The issue allows local users to overwrite arbitrary files via a symlink attack on `texutil.log` when TEXutil in ConTEXt is executed with the `--silent` option.

The issue allows local users to overwrite arbitrary files via a symlink attack on the mysqld multi script in MySQL.

The issue allows local users to overwrite arbitrary files via a symlink attack on the failed-mysql-bugreport temporary file.

The issue allows remote attackers to cause a denial of service by establishing two simultaneous HTTP connections, which exceeds the PalmOS accept queue. This can lead to a crash.

The issue concerns multiple vulnerabilities in the Netris package of the Debian GNU/Linux operating system, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. A buffer overflow vulnerability allows remote malicious Netris servers to execute arbitrary code on Netris clients via a long server response.

The issue involves multiple vulnerabilities in the Linux kernel packages of various operating systems, including Debian GNU/Linux and Gentoo Linux. These vulnerabilities can be exploited remotely or locally, leading to a breach of confidentiality, integrity, and availability of protected information. A potential buffer overflow exists in the `panic()` function in Linux 2.4.x, although it may not be exploitable due to the functionality of `panic()`. The vulnerabilities can be exploited to disrupt the security of the affected systems.