CVE-2007-0010

security flaw

The GdkPixbufLoader function in GIMP ToolKit (GTK+) in GTK 2 (gtk2) before 2.4.13 allows context-dependent attackers to cause a denial of service (crash) via a malformed image file.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Gnome Redhat

Products

Gtk Enterprise Linux

CVE-2007-0063

security flaw

Integer underflow in the DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528 allows remote attackers to execute arbitrary code via a malformed DHCP packet that triggers a stack-based buffer overflow.

CVSS 2.0 · 10.0 Critical EPSS 20.4% KEV · Not listed

Vendors

Canonical Redhat Vmware

Products

Ubuntu Linux Enterprise Linux Ace and 4 more

CVE-2007-0235

Stack overflow libgtop when pathname of mmap()-ed file is too long

Stack-based buffer overflow in the glibtop_get_proc_map_s function in libgtop before 2.14.6 (libgtop2) allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a process with a long filename that is mapped in its address space, which triggers the overflow in gnome-system-monitor.

CVSS 2.0 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Libgtop Redhat

Products

Libgtop Enterprise Linux

CVE-2007-0238

security flaw

Stack-based buffer overflow in filter\starcalc\scflt.cxx in the StarCalc parser in OpenOffice.org (OOo) Office Suite before 2.2, and 1.x before 1.1.5 Patch, allows user-assisted remote attackers to execute arbitrary code via a document with a long Note.

CVSS 2.0 · 9.3 Critical EPSS 5.8% KEV · Not listed

Vendors

Openoffice Redhat

Products

Openoffice Enterprise Linux

CVE-2007-0239

security flaw

OpenOffice.org (OOo) Office Suite allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a prepared link in a crafted document.

CVSS 2.0 · 9.3 Critical EPSS 3.6% KEV · Not listed

Vendors

Openoffice Redhat

Products

Openoffice Enterprise Linux

CVE-2007-0242

QT UTF8 improper character expansion

The UTF-8 decoder in codecs/qutfcodec.cpp in Qt 3.3.8 and 4.2.3 does not reject long UTF-8 sequences as required by the standard, which allows remote attackers to conduct cross-site scripting (XSS) and directory traversal attacks via long sequences that decode to dangerous metacharacters.

CVSS 2.0 · 4.3 Medium EPSS 2.1% KEV · Not listed

Vendors

Qt Redhat

Products

Qt Enterprise Linux

CVE-2007-0243

java-jre: GIF buffer overflow

Buffer overflow in Sun JDK and Java Runtime Environment (JRE) 5.0 Update 9 and earlier, SDK and JRE 1.4.2_12 and earlier, and SDK and JRE 1.3.1_18 and earlier allows applets to gain privileges via a GIF image with a block with a 0 width field, which triggers memory corruption.

CVSS 2.0 · 6.8 Medium EPSS 11.6% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 3 more

CVE-2007-0245

openoffice.org rtf filter buffer overflow

Heap-based buffer overflow in OpenOffice.org (OOo) 2.2.1 and earlier allows remote attackers to execute arbitrary code via a RTF file with a crafted prtdata tag with a length parameter inconsistency, which causes vtable entries to be overwritten.

CVSS 2.0 · 9.3 Critical EPSS 6.7% KEV · Not listed

Vendors

Openoffice Redhat

Products

Openoffice Enterprise Linux

CVE-2007-0450

tomcat directory traversal

Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.

CVSS 2.0 · 5.0 Medium EPSS 91.2% KEV · Not listed

Vendors

Apache Redhat

Products

Http Server Tomcat Certificate System and 5 more

CVE-2007-0452

security flaw

smbd in Samba 3.0.6 through 3.0.23d allows remote authenticated users to cause a denial of service (memory and CPU exhaustion) by renaming a file in a way that prevents a request from being removed from the deferred open queue, which triggers an infinite loop.

CVSS 2.0 · 6.8 Medium EPSS 4.9% KEV · Not listed

Vendors

Redhat Samba

Products

Enterprise Linux Samba

CVE-2007-0455

gd: buffer overrun

Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted string with a JIS encoded font.

CVSS 2.0 · 7.5 High EPSS 12.3% KEV · Not listed

Vendors

Canonical Fedoraproject Gd Graphics Library Project and 2 more

Products

Ubuntu Linux Fedora Gd Graphics Library and 6 more

CVE-2007-0456

Multiple Wireshark issues (CVE-2007-0457, CVE-2007-0458, CVE-2007-0459)

Unspecified vulnerability in the LLT dissector in Wireshark (formerly Ethereal) 0.99.3 and 0.99.4 allows remote attackers to cause a denial of service (application crash) via unspecified vectors.

CVSS 2.0 · 4.3 Medium EPSS 1.8% KEV · Not listed

Vendors

Redhat Wireshark

Products

Enterprise Linux Wireshark

CVE-2007-0457

Multiple Wireshark issues (CVE-2007-0457, CVE-2007-0458, CVE-2007-0459)

Unspecified vulnerability in the IEEE 802.11 dissector in Wireshark (formerly Ethereal) 0.10.14 through 0.99.4 allows remote attackers to cause a denial of service (application crash) via unspecified vectors.

CVSS 2.0 · 4.3 Medium EPSS 1.8% KEV · Not listed

Vendors

Redhat Wireshark

Products

Enterprise Linux Wireshark

CVE-2007-0458

Multiple Wireshark issues (CVE-2007-0457, CVE-2007-0458, CVE-2007-0459)

Unspecified vulnerability in the HTTP dissector in Wireshark (formerly Ethereal) 0.99.3 and 0.99.4 allows remote attackers to cause a denial of service (application crash) via unspecified vectors, a different issue than CVE-2006-5468.

CVSS 2.0 · 4.3 Medium EPSS 1.8% KEV · Not listed

Vendors

Redhat Wireshark

Products

Enterprise Linux Wireshark

CVE-2007-0459

Multiple Wireshark issues (CVE-2007-0457, CVE-2007-0458, CVE-2007-0459)

packet-tcp.c in the TCP dissector in Wireshark (formerly Ethereal) 0.99.2 through 0.99.4 allows remote attackers to cause a denial of service (application crash or hang) via fragmented HTTP packets.

CVSS 2.0 · 5.0 Medium EPSS 2.2% KEV · Not listed

Vendors

Redhat Wireshark

Products

Enterprise Linux Wireshark

CVE-2007-0493

bind use-after-free

Use-after-free vulnerability in ISC BIND 9.3.0 up to 9.3.3, 9.4.0a1 up to 9.4.0a6, 9.4.0b1 up to 9.4.0b4, 9.4.0rc1, and 9.5.0a1 (Bind Forum only) allows remote attackers to cause a denial of service (named daemon crash) via unspecified vectors that cause named to "dereference a freed fetch context."

CVSS 2.0 · 7.8 High EPSS 12.8% KEV · Not listed

Vendors

Isc Redhat

Products

Bind Enterprise Linux

CVE-2007-0494

BIND dnssec denial of service

ISC BIND 9.0.x, 9.1.x, 9.2.0 up to 9.2.7, 9.3.0 up to 9.3.3, 9.4.0a1 up to 9.4.0a6, 9.4.0b1 up to 9.4.0b4, 9.4.0rc1, and 9.5.0a1 (Bind Forum only) allows remote attackers to cause a denial of service (exit) via a type * (ANY) DNS query response that contains multiple RRsets, which triggers an assertion error, aka the "DNSSEC Validation" vulnerability.

CVSS 2.0 · 4.3 Medium EPSS 45.3% KEV · Not listed

Vendors

Isc Redhat

Products

Bind Enterprise Linux

CVE-2007-0537

konqueror XSS

The KDE HTML library (kdelibs), as used by Konqueror 3.5.5, does not properly parse HTML comments, which allows remote attackers to conduct cross-site scripting (XSS) attacks and bypass some XSS protection schemes by embedding certain HTML tags within a comment in a title tag, a related issue to CVE-2007-0478.

CVSS 2.0 · 2.6 Low EPSS 1.9% KEV · Not listed

Vendors

Kde Redhat

Products

Konqueror Enterprise Linux

CVE-2007-0555

security flaw

PostgreSQL 7.3 before 7.3.13, 7.4 before 7.4.16, 8.0 before 8.0.11, 8.1 before 8.1.7, and 8.2 before 8.2.2 allows attackers to disable certain checks for the data types of SQL function arguments, which allows remote authenticated users to cause a denial of service (server crash) and possibly access database content.

CVSS 2.0 · 8.5 High EPSS 5.0% KEV · Not listed

Vendors

Postgresql Redhat

Products

Postgresql Enterprise Linux Rhel Application Stack

CVE-2007-0556

security flaw

The query planner in PostgreSQL before 8.0.11, 8.1 before 8.1.7, and 8.2 before 8.2.2 does not verify that a table is compatible with a "previously made query plan," which allows remote authenticated users to cause a denial of service (server crash) and possibly access database content via an "ALTER COLUMN TYPE" SQL statement, which can be leveraged to read arbitrary memory from the server.

CVSS 2.0 · 6.6 Medium EPSS 3.1% KEV · Not listed

Vendors

Postgresql Redhat

Products

Postgresql Enterprise Linux Rhel Application Stack