CVSS: 9.8EPSS: 69%CPEs: 26EXPL: 0CVE-2010-2941 – cups: cupsd memory corruption vulnerability
https://notcve.org/view.php?id=CVE-2010-2941
ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted IPP request. ipp.c en cupsd en CUPS v1.4.4 y anteriores no asigna correctamente memoria para valores de atributo con tipos de datos de cadena inválidos, permitiendo a atacantes remotos provocar una denegación de servicio (uso después de liberación y caída de la aplicación) o posiblemente ejecutar código arbitrario mediante una solicitud IPP manipulada. • http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050977.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051277.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051301.html http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html http://rhn.redhat.com/errata/RHSA&# • CWE-416: Use After Free •
CVSS: 9.3EPSS: 87%CPEs: 11EXPL: 6CVE-2010-1297 – Adobe Flash Player Memory Corruption Vulnerability
https://notcve.org/view.php?id=CVE-2010-1297
Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010. Vulnerabilidad sin especificar en Adobe Flash Player v9.0.x a v9.0.262 y v10.x a v10.0.45.2, y authplay.dl en Adobe Reader y Acrobat v9.x a 9.3.2, permite a atacantes remotos ejecutar código a su elección a través de contenido SWF manipulado, se explota activamente desde Junio de 2010. Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS). • https://www.exploit-db.com/exploits/13787 https://www.exploit-db.com/exploits/14853 https://www.exploit-db.com/exploits/16614 https://www.exploit-db.com/exploits/16687 http://blog.zynamics.com/2010/06/09/analyzing-the-currently-exploited-0-day-for-adobe-reader-and-adobe-flash http://community.websense.com/blogs/securitylabs/archive/2010/06/09/having-fun-with-adobe-0-day-exploits.aspx http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751 http://lists.apple.com& • CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 2%CPEs: 7EXPL: 2CVE-2010-1866 – PHP 5.3 - 'PHP_dechunk()' HTTP Chunked Encoding Integer Overflow
https://notcve.org/view.php?id=CVE-2010-1866
The dechunk filter in PHP 5.3 through 5.3.2, when decoding an HTTP chunked encoding stream, allows context-dependent attackers to cause a denial of service (crash) and possibly trigger memory corruption via a negative chunk size, which bypasses a signed comparison, related to an integer overflow in the chunk size decoder. El filtro dechunk en PHP 5.3 hasta v.5.3.2, cuando se decodifica un cadena HTTP fragmentada, permite a atacantes depediendo del contexto provocar una denegación de servicio (caída) y posiblemente una corrupción de memoria mediante un tamaño de fragmento negativo, lo que evita la comparación de signo, relativo a un desbordamiento de entero en el decodificados de tamaño del fragmento. • https://www.exploit-db.com/exploits/33920 http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html http://php-security.org/2010/05/02/mops-2010-003-php-dechunk-filter-signed-comparison-vulnerability/index.html • CWE-190: Integer Overflow or Wraparound •
CVSS: 10.0EPSS: 96%CPEs: 10EXPL: 1CVE-2009-3953 – Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2009-3953
The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994. La implementación U3D en Adobe Reader y Acrobat v9.x anterior a v9.3, y v8.x anterior a v8.2 sobre Windows y Mac OS X, podría permitir a atacantes ejecutar código de su elección a través de vectores no especificados, relacionados con una "cuestión de limitación en el array". Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution. • https://www.exploit-db.com/exploits/16622 http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html http://osvdb.org/61690 http://secunia.com/advisories/38138 http://secunia.com/advisories/38215 http://www.adobe.com/support/security/bulletins/apsb10-02.html http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl http://www.redhat.com/support/errata/RHSA-2010-0060.html http://www.securityfocus.com/bid/37758 http://www.securitytracker.com/i • CWE-787: Out-of-bounds Write •
CVSS: 9.3EPSS: 97%CPEs: 11EXPL: 4CVE-2009-4324 – Adobe Acrobat and Reader Use-After-Free Vulnerability
https://notcve.org/view.php?id=CVE-2009-4324
Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009. La vulnerabilidad de uso de la memoria previamente liberada (Use-after-free) en la función Doc.media.newPlayer en el archivo Multimedia.api en Adobe Reader y Acrobat versión 9.x anterior a 9.3, y versión 8.x anterior a 8.2 en Windows y Mac OS X, permite a los atacantes remotos ejecutar código arbitrario por medio de un archivo PDF creado utilizando una transmisión comprimida ZLib, tal como se explotó “in the wild” en diciembre de 2009. Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file. • https://www.exploit-db.com/exploits/16503 https://www.exploit-db.com/exploits/16623 https://www.exploit-db.com/exploits/10618 http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html http://contagiodump.blogspot.com/2009/12/virustotal-httpwww.html http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html http://osvdb.org/60980 http://secunia.com/advisories/37690 http://secunia.com/advisories/38138 http://secunia.com/advisories/38215 http:&# • CWE-416: Use After Free •