 |
|
|
|
Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
updated since 13.09.2008 | | Published: |  | 14.09.2008 | | Source: |  | | | SecurityVulns ID: |  | 9283 | | Type: |  | remote | | Level: |  | 5/10 | | Description: |  | PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.
|
Linux kernel multiple security vulnerabilities
updated since 13.09.2008 | | Published: | | 14.09.2008 | | Source: | | BUGTRAQ | | SecurityVulns ID: | | 9285 | | Type: | | remote | | Level: | | 5/10 | | Description: | | Multiple local DoS conditions, snd_seq_oss_synth_make_info() information leaks, integer overflows in DCCP and SCTP_AUTH_KEY. |
| Affected: |  | LINUX : kernel 2.6 | | CVE: |  | CVE-2008-3915 (Buffer overflow in nfsd in the Linux kernel before 2.6.26.4, when NFSv4 is enabled, allows remote attackers to have an unknown impact via vectors related to decoding an NFSv4 acl.) | | | | CVE-2008-3792 (net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.26.4 does not verify that the SCTP-AUTH extension is enabled before proceeding with SCTP-AUTH API functions, which allows attackers to cause a denial of service (NULL pointer dereference and panic) via vectors that result in calls to (1) sctp_setsockopt_auth_chunk, (2) sctp_setsockopt_hmac_ident, (3) sctp_setsockopt_auth_key, (4) sctp_setsockopt_active_key, (5) sctp_setsockopt_del_key, (6) sctp_getsockopt_maxburst, (7) sctp_getsockopt_active_key, (8) sctp_getsockopt_peer_auth_chunks, or (9) sctp_getsockopt_local_auth_chunks.) | | | | CVE-2008-3535 (Off-by-one error in the iov_iter_advance function in mm/filemap.c in the Linux kernel before 2.6.27-rc2 allows local users to cause a denial of service (system crash) via a certain sequence of file I/O operations with readv and writev, as demonstrated by testcases/kernel/fs/ftest/ftest03 from the Linux Test Project.) | | | | CVE-2008-3534 (The shmem_delete_inode function in mm/shmem.c in the tmpfs implementation in the Linux kernel before 2.6.26.1 allows local users to cause a denial of service (system crash) via a certain sequence of file create, remove, and overwrite operations, as demonstrated by the insserv program, related to allocation of "useless pages" and improper maintenance of the i_blocks count.) | | | | CVE-2008-3526 (Integer overflow in the sctp_setsockopt_auth_key function in net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel 2.6.24-rc1 through 2.6.26.3 allows remote attackers to cause a denial of service (panic) or possibly have unspecified other impact via a crafted sca_keylength field associated with the SCTP_AUTH_KEY option.) | | | | CVE-2008-3276 (Integer overflow in the dccp_setsockopt_change function in net/dccp/proto.c in the Datagram Congestion Control Protocol (DCCP) subsystem in the Linux kernel 2.6.17-rc1 through 2.6.26.2 allows remote attackers to cause a denial of service (panic) via a crafted integer value, related to Change L and Change R options without at least one byte in the dccpsf_val field.) | | | | CVE-2008-3275 (The (1) real_lookup and (2) __lookup_hash functions in fs/namei.c in the vfs implementation in the Linux kernel before 2.6.25.15 do not prevent creation of a child dentry for a deleted (aka S_DEAD) directory, which allows local users to cause a denial of service ("overflow" of the UBIFS orphan area) via a series of attempted file creations within deleted directories.) | | | | CVE-2008-3272 (The snd_seq_oss_synth_make_info function in sound/core/seq/oss/seq_oss_synth.c in the sound subsystem in the Linux kernel before 2.6.27-rc2 does not verify that the device number is within the range defined by max_synthdev before returning certain data to the caller, which allows local users to obtain sensitive information.) |
| Apple iPhone Safari DoS | | Published: | | 14.09.2008 | | Source: | | BUGTRAQ | | SecurityVulns ID: | | 9286 | | Type: | | remote | | Level: | | 5/10 | | Description: | | Invalid memory read on JavaScript alert() function. |
| Affected: | | APPLE : iPhone 1.1 | | | | APPLE : iPhone 2.0 | | | | APPLE : iPod touch 1.1 | | | | APPLE : iPod touch 2.0 | | CVE: | | CVE-2008-3950 (Off-by-one error in the _web_drawInRect:withFont:ellipsis:alignment:measureOnly function in WebKit in Safari in Apple iPhone 1.1.4 and 2.0 and iPod touch 1.1.4 and 2.0 allows remote attackers to cause a denial of service (browser crash) via a JavaScript alert call with an argument that lacks breakable characters and has a length that is a multiple of the memory page size, leading to an out-of-bounds read.) |
Baidu Hi instant messenger integer overflow
updated since 14.09.2008 | | Published: | | 16.09.2008 | | Source: | | BUGTRAQ | | SecurityVulns ID: | | 9287 | | Type: | | remote | | Level: | | 5/10 | | Description: | | Integer overflow on encrypted message decyphering causes buffer overflow. |
Nokia e90 phone Wi-Fi DoS
updated since 14.09.2008 | | Published: | | 16.09.2008 | | Source: | | BUGTRAQ | | SecurityVulns ID: | | 9288 | | Type: | | remote | | Level: | | 5/10 | | Description: | | Device crash on malformed Wi-Fi frame. |
|
|
|
|
|
|
|
|
