CVSS: 9.3EPSS: 1%CPEs: 40EXPL: 0CVE-2011-2895 – BSD compress LZW decoder buffer overflow
https://notcve.org/view.php?id=CVE-2011-2895
The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896. El descompresor en LZW en (1) la función BufCompressedFill en fontfile/decompress.c en X.Org libXfont antes de la versión v1.4.4 y (2) compress/compress.c en 4.3BSD, tal y como se utiliza en zopen.c en OpenBSD antes de la versión v3.8, FreeBSD, NetBSD, FreeType v2.1.9, y otros productos, no controla correctamente las palabras de código ausentes de la tabla de descompresión, lo que permite provocar un bucle infinito o un desbordamiento de búfer basado en memoria dinámica (heap) a atacantes (dependiendo del contexto) y posiblemente ejecutar código de su elección a través de un flujo comprimido debidamente modificado. Se trata de un problema relacionado con los CVE-2006-1168 y CVE-2011 2896. • http://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=d11ee5886e9d9ec610051a206b135a4cdc1e09a0 http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2011-007.txt.asc http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html http://lists.apple.com/archives/security-announce/2012/May/msg00001.html http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html http://lists.apple.com/archives/secur • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 2%CPEs: 31EXPL: 0CVE-2011-0465 – xorg: xrdb code execution via crafted X client hostname
https://notcve.org/view.php?id=CVE-2011-0465
xrdb.c in xrdb before 1.0.9 in X.Org X11R7.6 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a (1) DHCP or (2) XDMCP message. xrdb.c en xrdb anterior a v1.0.9 en X.Org X11R7.6 y anteriores permite a atacantes remotos ejecutar comandos arbitrarios mediante metacaracteres en un hostname obtenido de un mensaje (1) DHCP o (2) XDMCP. • http://cgit.freedesktop.org/xorg/app/xrdb/commit/?id=1027d5df07398c1507fb1fe3a9981aa6b4bc3a56 http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057928.html http://lists.freedesktop.org/archives/xorg-announce/2011-April/001635.html http://lists.freedesktop.org/archives/xorg-announce/2011-April/001636.html http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00002.html http://secunia.com/advisories/44010 http://secunia.com/advisories/44012 http://secunia.com/advisories/44040 http&# • CWE-20: Improper Input Validation •
CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 1CVE-2010-1166 – Xorg: X server Render extension memory corruption
https://notcve.org/view.php?id=CVE-2010-1166
The fbComposite function in fbpict.c in the Render extension in the X server in X.Org X11R7.1 allows remote authenticated users to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a crafted request, related to an incorrect macro definition. La función fbComposite en fbpict.c en la extensión Render en el servidor de X en X.Org X11R7.1 permite a los usuarios remotos autenticados causar una denegación de servicio (corrupción de memoria y cuelgue del demonio) o posiblemente ejecutar código arbitrario mediante una petición manipulada, relacionado con una definición de macro incorrecta. • http://cgit.freedesktop.org/xorg/xserver/commit/?id=d2f813f7db http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html http://secunia.com/advisories/39650 http://secunia.com/advisories/39834 http://securitytracker.com/id?1023929 http://www.ubuntu.com/usn/USN-939-1 http://www.vupen.com/english/advisories/2010/1185 https://bugzilla.redhat.com/show_bug.cgi?id=495733 https://bugzilla.redhat.com/show_bug.cgi?id=582601 https://oval.cisecurity.org/repository/sea • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-189: Numeric Errors •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 3CVE-2009-3119 – PHP-fusion dsmsf Mod Downloads - SQL Injection
https://notcve.org/view.php?id=CVE-2009-3119
SQL injection vulnerability in screen.php in the Download System mSF (dsmsf) module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the view_id parameter. Vulnerabilidad de inyección SQL en screen.php del módulo Download System mSF (dsmf) para PHP-Fusion, permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro "view_id". • https://www.exploit-db.com/exploits/12028 http://packetstormsecurity.org/0908-exploits/phpfusiondsmsf-sql.txt http://www.securityfocus.com/bid/36180 http://www.vupen.com/english/advisories/2009/2469 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.0EPSS: 0%CPEs: 35EXPL: 0CVE-2009-3100
https://notcve.org/view.php?id=CVE-2009-3100
xscreensaver (aka Gnome-XScreenSaver) in Sun Solaris 9 and 10, OpenSolaris snv_109 through snv_122, and X11 6.4.1 on Solaris 8 does not properly handle Accessibility support, which allows local users to cause a denial of service (system hang) by locking the screen and then attempting to launch an Accessibility pop-up window, related to a regression in certain Solaris and OpenSolaris patches. xscreensaver (también conocido como Gnome-XScreenSaver) en Sun Solaris v9 y v10, OpenSolaris snv_109 hasta snv_122, y X11 v6.4.1 en Solaris 8 no maneja apropiadamente el soporte Accesibilidad, lo que permite a los usuarios locales causar una denegación de servicio (parada del sistema) cerrando la pantalla y logrando lanzar una venta emergente de Accesibilidad, relativa a una regresión en ciertos parches Solaris y OpenSolaris. • http://bugs.opensolaris.org/view_bug.do?bug_id=6839026 http://sunsolve.sun.com/search/document.do?assetkey=1-66-266469-1 •