Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
Published:		19.10.2009
Source:
SecurityVulns ID:		10326
Type:		remote
Level:		5/10
Description:		PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.

Affected:		BUGZILLA : Bugzilla 3.0
		AMIRO : Amiro.CMS 5.4
		PHPCMS : phpcms 2008

Original document		info_(at)_securitylab.ir, phpcms 2008 Remote File Disclosure Vulnerability (19.10.2009)
		DEBIAN, [SECURITY] [DSA 1913-1] New bugzilla packages fix SQL injection (19.10.2009)
		ONSEC, [ONSEC-09-018] Twilight CMS XSS (19.10.2009)
		ONSEC, [ONSEC-09-004] Amiro.CMS Multiple XSS (19.10.2009)
		ONSEC, [ONSEC-09-005] Amiro.CMS root folder disclosure (19.10.2009)

Discuss:

Read or add your comments to this news (0 comments)

IBM DB2 JDBC DoS
Published:		19.10.2009
Source:		BUGTRAQ
SecurityVulns ID:		10328
Type:		remote
Level:		5/10
Description:		jdbcReadString() read behind memory.

Affected:		IBM : DB2 8.1
		IBM : DB2 8.2
CVE:		CVE-2009-2971

Original document

NSFOCUS, NSFOCUS SA2009-02 : IBM DB2 JDBC Applet Server Remote DoS Vulnerability (19.10.2009)

Discuss:

Read or add your comments to this news (0 comments)

Adobe Acrobat / Reader multiple security vulnerabilities updated since 14.10.2009
Published:		19.10.2009
Source:		CERT
SecurityVulns ID:		10320
Type:		remote
Level:		8/10
Description:		Multiple memory corruptions, array index overflows, etc.

Affected:		ADOBE : Adobe Reader 8.1
		ADOBE : Adobe Reader 9.1
		ADOBE : Adobe Reader 7.1
CVE:		CVE-2009-3459 (Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.)
		CVE-2009-3458 (Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 do not properly validate input, which might allow attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-2998.)
		CVE-2009-2998 (Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 do not properly validate input, which might allow attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-3458.)
		CVE-2009-2997 (Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 might allow attackers to execute arbitrary code via unspecified vectors.)
		CVE-2009-2991 (Unspecified vulnerability in the Mozilla plug-in in Adobe Reader and Acrobat 8.x before 8.1.7, and possibly 7.x before 7.1.4 and 9.x before 9.2, might allow remote attackers to execute arbitrary code via unknown vectors.)
		CVE-2009-2990 (Array index error in Adobe Reader and Acrobat 9.x before 9.2, 8.x before 8.1.7, and possibly 7.x through 7.1.4 might allow attackers to execute arbitrary code via unspecified vectors.)
		CVE-2009-2985 (Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allow attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-2996.)

Original document		cocoruder, In-depth research on the recent PDF zero-day exploit (CVE-2009-3459) (19.10.2009)
		security_(at)_nruns.com, n.runs-SA-2009.007 - Adobe Acrobat - Invalid pointer write could lead to arbitrary code execution (17.10.2009)
		VUPEN Security Research, VUPEN Security - Adobe Acrobat and Reader U3D Filter Code Execution Vulnerabilities (17.10.2009)
		IDEFENSE, iDefense Security Advisory 10.13.09: Adobe Acrobat and Reader Firefox Plugin Use After Free Vulnerability (14.10.2009)
		ZDI, ZDI-09-073: Adobe Reader Compact Font Format Malformed Index Memory Corruption Vulnerability (14.10.2009)
		IDEFENSE, iDefense Security Advisory 10.13.09: Adobe Acrobat and Reader U3D File Invalid Array Index Vulnerability (14.10.2009)
		CERT, US-CERT Technical Cyber Security Alert TA09-286B -- Adobe Reader and Acrobat Vulnerabilities (14.10.2009)

Discuss:

Read or add your comments to this news (0 comments)

Zoiper softphone DoS
Published:		19.10.2009
Source:		BUGTRAQ
SecurityVulns ID:		10332
Type:		remote
Level:		5/10
Description:		Crash on SIP request parsing.

Affected:

ZOIPER : Zoiper 2.22

Original document

Inj3ct0r.com, Vulnerability in Zoiper softphone version 2.22 - Denial Of Service (19.10.2009)

Files:		Vulnerability in Zoiper softphone version 2.22 - Denial Of Service
Discuss:		Read or add your comments to this news (0 comments)

UiTV UiPlayer ActiveX buffer overflow
Published:		19.10.2009
Source:		BUGTRAQ
SecurityVulns ID:		10327
Type:		client
Level:		5/10
Description:		Buffer overflow in UiCheck.dll

CVE:

CVE-2009-2970 (Stack-based buffer overflow in the GetUiDllVersion function in an ActiveX control in UiCheck.dll before 1.0.0.7 in UiTV UiPlayer, as used in BaiduX and other products, allows remote attackers to execute arbitrary code via the filename parameter.)

Original document

NSFOCUS, NSFOCUS SA2009-01 : UiTV UiPlayer UiCheck Component Stack Buffer Overflow Vulnerability (19.10.2009)

Discuss:

Read or add your comments to this news (0 comments)

xpdf integer overflow
Published:		19.10.2009
Source:		BUGTRAQ
SecurityVulns ID:		10329
Type:		client
Level:		6/10
Description:		Integer overflow during PDF parsing leads to heap overflow.

Original document

adam_(at)_hispasec.com, Xpdf - Integer overflow which causes heap overflow and NULL pointer derefernce. (19.10.2009)

Discuss:

Read or add your comments to this news (0 comments)

3COM OfficeConnect routers multiple security vulnerabilities
Published:		19.10.2009
Source:		BUGTRAQ
SecurityVulns ID:		10330
Type:		remote
Level:		6/10
Description:		Backdoor accounts, password stored in clear text, code execution.

Original document

Andrea Fabrizi, 3Com OfficeConnect Firewall/Router multiple remote Vulnerabilities (19.10.2009)

Discuss:

Read or add your comments to this news (0 comments)

McKesson Horizon Clinical Infrastructure multiple hardcoded accounts
Published:		19.10.2009
Source:		BUGTRAQ
SecurityVulns ID:		10331
Type:		remote
Level:		6/10
Description:		Multiple unchangable hardcoded accounts.

Affected:		MCKESSON : Horizon Clinical Infrastructure 7.6
		MCKESSON : Horizon Clinical Infrastructure 7.8
		MCKESSON : Horizon Clinical Infrastructure 10.0
		MCKESSON : Horizon Clinical Infrastructure 10.1

Original document

foo_(at)_bar.com, McKesson Horizon Clinical Infrastructure (HCI) version 7.6/7.8/10.0/10.1 hardcoded passwords (19.10.2009)

Discuss:

Read or add your comments to this news (0 comments)