Computer Security
[EN] securityvulns.ru no-pyccku


ghostscript integer overflow
Published:20.03.2009
Source:
SecurityVulns ID:9758
Type:library
Threat Level:
5/10
Description:Integer overflows in ICC library.
CVE:CVE-2009-0584 (icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using a device file for processing a crafted image file associated with large integer values for certain sizes, related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.)
 CVE-2009-0583 (Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.)
Original documentdocumentRPATH, rPSA-2009-0050-1 ghostscript (20.03.2009)

Jasper library multiplesecurity vulnerabilities
Published:20.03.2009
Source:
SecurityVulns ID:9759
Type:library
Threat Level:
5/10
Description:Integer overflow on JPEG2000 processing, format string vulnerability, symbolic links problem.
Affected:JASPER : JasPer 1.900
CVE:CVE-2008-3522 (Buffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via vectors related to the mif_hdr_put function and use of vsprintf.)
 CVE-2008-3521 (Race condition in the jas_stream_tmpfile function in libjasper/base/jas_stream.c in JasPer 1.900.1 allows local users to cause a denial of service (program exit) by creating the appropriate tmp.XXXXXXXXXX temporary file, which causes Jasper to exit. NOTE: this was originally reported as a symlink issue, but this was incorrect. NOTE: some vendors dispute the severity of this issue, but it satisfies CVE's requirements for inclusion.)
 CVE-2008-3520 (Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation.)
Original documentdocumentUBUNTU, [USN-742-1] JasPer vulnerabilities (20.03.2009)

Hannon Hill Cascade Server privilege escalation
Published:20.03.2009
Source:
SecurityVulns ID:9760
Type:local
Threat Level:
5/10
Description:Privilege escalation with XSLT files.
Original documentdocumentelliot.kendall_(at)_emory.edu, Command Execution in Hannon Hill Cascade Server (20.03.2009)

Breach Security ModSecurity for Apache DoS
Published:20.03.2009
Source:
SecurityVulns ID:9761
Type:remote
Threat Level:
5/10
Description:Module hangs on incomplete HTTP POST multipart/form-data request.
Affected:BREACH : ModSecurity 2.5
Original documentdocumentISecAuditors Security Advisories, [ISecAuditors Security Advisories] ModSecurity < 2.5.9 remote Denial of Service (DoS) (20.03.2009)

About | Terms of use | Privacy Policy
© SecurityVulns, 3APA3A, Vladimir Dubrovin
Nizhny Novgorod