CVE-2007-4924

ekiga remote crash caused by insufficient input validation

The Open Phone Abstraction Library (opal), as used by (1) Ekiga before 2.0.10 and (2) OpenH323 before 2.2.4, allows remote attackers to cause a denial of service (crash) via an invalid Content-Length header field in Session Initiation Protocol (SIP) packets, which causes a \0 byte to be written to an "attacker-controlled address."

CVSS 2.0 · 5.0 Medium EPSS 10.7% KEV · Not listed

Vendors

Ekiga Openh323 Project Redhat

Products

Ekiga Openh323 Enterprise Linux

CVE-2007-4965

python imageop module heap corruption

Multiple integer overflows in the imageop module in Python 2.5.1 and earlier allow context-dependent attackers to cause a denial of service (application crash) and possibly obtain sensitive information (memory contents) via crafted arguments to (1) the tovideo method, and unspecified other vectors related to (2) imageop.c, (3) rbgimgmodule.c, and other files, which trigger heap-based buffer overflows.

CVSS 2.0 · 5.8 Medium EPSS 14.0% KEV · Not listed

Vendors

Python Redhat

Products

Python Enterprise Linux Network Satellite

CVE-2007-4985

Infinite loops in ImageMagick's XCF and DCM coders

ImageMagick before 6.3.5-9 allows context-dependent attackers to cause a denial of service via a crafted image file that triggers (1) an infinite loop in the ReadDCMImage function, related to ReadBlobByte function calls; or (2) an infinite loop in the ReadXCFImage function, related to ReadBlobMSBLong function calls.

CVSS 2.0 · 4.3 Medium EPSS 1.8% KEV · Not listed

Vendors

Imagemagick Redhat

Products

Imagemagick Enterprise Linux

CVE-2007-4986

Multiple integer overflows in ImageMagick

Multiple integer overflows in ImageMagick before 6.3.5-9 allow context-dependent attackers to execute arbitrary code via a crafted (1) .dcm, (2) .dib, (3) .xbm, (4) .xcf, or (5) .xwd image file, which triggers a heap-based buffer overflow.

CVSS 2.0 · 6.8 Medium EPSS 3.3% KEV · Not listed

Vendors

Imagemagick Redhat

Products

Imagemagick Enterprise Linux

CVE-2007-4995

openssl dtls out of order vulnerabilitiy

Off-by-one error in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8f allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 10.5% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux

CVE-2007-4988

Integer overflow in ImageMagick's DIB coder

Sign extension error in the ReadDIBImage function in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted width value in an image file, which triggers an integer overflow and a heap-based buffer overflow.

CVSS 3.1 · 7.8 High EPSS 3.1% KEV · Not listed

Vendors

Canonical Imagemagick Redhat

Products

Ubuntu Linux Imagemagick Enterprise Linux

CVE-2007-4990

xfs heap overflow in the swap_char2b function

The swap_char2b function in X.Org X Font Server (xfs) before 1.0.5 allows context-dependent attackers to execute arbitrary code via (1) QueryXBitmaps and (2) QueryXExtents protocol requests with crafted size values that specify an arbitrary number of bytes to be swapped on the heap, which triggers heap corruption.

CVSS 2.0 · 7.5 High EPSS 10.7% KEV · Not listed

Vendors

Redhat X.org

Products

Enterprise Linux X Font Server

CVE-2007-4993

xen guest root can escape to domain 0 through pygrub

pygrub (tools/pygrub/src/GrubConf.py) in Xen 3.0.3, when booting a guest domain, allows local users with elevated privileges in the guest domain to execute arbitrary commands in domain 0 via a crafted grub.conf file whose contents are used in exec statements.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat Xensource Inc

Products

Enterprise Linux Xen

CVE-2007-4997

kernel ieee80211 off-by-two integer underflow

Integer underflow in the ieee80211_rx function in net/ieee80211/ieee80211_rx.c in the Linux kernel 2.6.x before 2.6.23 allows remote attackers to cause a denial of service (crash) via a crafted SKB length value in a runt IEEE 802.11 frame when the IEEE80211_STYPE_QOS_DATA flag is set, aka an "off-by-two error."

CVSS 2.0 · 7.1 High EPSS 3.2% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2007-5000

httpd: mod_imagemap XSS

Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0 · 4.3 Medium EPSS 46.6% KEV · Not listed

Vendors

Apache Canonical Fedoraproject and 4 more

Products

Http Server Ubuntu Linux Fedora and 9 more

CVE-2007-5001

kernel asynchronous IO on a FIFO kernel panic

Linux kernel before 2.4.21 allows local users to cause a denial of service (kernel panic) via asynchronous input or output on a FIFO special file.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Enterprise Linux Desktop

CVE-2007-5034

elinks reveals POST data to HTTPS proxy

ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy is defined for https.

CVSS 2.0 · 4.3 Medium EPSS 2.6% KEV · Not listed

Vendors

Elinks Redhat

Products

Elinks Enterprise Linux

CVE-2007-5079

gdm with xdmcp ignoring tcp_wrappers on x86_64

Red Hat Enterprise Linux 4 does not properly compile and link gdm with tcp_wrappers on x86_64 platforms, which might allow remote attackers to bypass intended access restrictions.

CVSS 2.0 · 6.0 Medium EPSS 1.5% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Linux

CVE-2007-5093

kernel PWC driver DoS

The disconnect method in the Philips USB Webcam (pwc) driver in Linux kernel 2.6.x before 2.6.22.6 "relies on user space to close the device," which allows user-assisted local attackers to cause a denial of service (USB subsystem hang and CPU consumption in khubd) by not closing the device after the disconnect is invoked. NOTE: this rarely crosses privilege boundaries, unless the attacker can convince the victim to unplug the affected device.

CVSS 2.0 · 4.0 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2007-5116

perl regular expression UTF parsing errors

Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 allows context-dependent attackers to execute arbitrary code by switching from byte to Unicode (UTF) characters in a regular expression.

CVSS 2.0 · 7.5 High EPSS 4.8% KEV · Not listed

Vendors

Debian Larry Wall Mandrakesoft and 3 more

Products

Debian Linux Perl Mandrake Linux and 9 more

CVE-2007-5135

openssl: SSL_get_shared_ciphers() off-by-one

Off-by-one error in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 up to 0.9.7l, and 0.9.8 up to 0.9.8f, might allow remote attackers to execute arbitrary code via a crafted packet that triggers a one-byte buffer underflow. NOTE: this issue was introduced as a result of a fix for CVE-2006-3738. As of 20071012, it is unknown whether code execution is possible.

CVSS 2.0 · 6.8 Medium EPSS 16.1% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux

CVE-2007-5137

Tk GIF processing buffer overflow

Buffer overflow in the ReadImage function in generic/tkImgGIF.c in Tcl (Tcl/Tk) 8.4.13 through 8.4.15 allows remote attackers to execute arbitrary code via multi-frame interlaced GIF files in which later frames are smaller than the first. NOTE: this issue is due to an incorrect patch for CVE-2007-5378.

CVSS 2.0 · 6.8 Medium EPSS 4.9% KEV · Not listed

Vendors

Redhat Tcl Tk

Products

Enterprise Linux Tcl Tk

CVE-2007-5162

Net: HTTP insufficient verification of SSL certificate

The connect method in lib/net/http.rb in the (1) Net::HTTP and (2) Net::HTTPS libraries in Ruby 1.8.5 and 1.8.6 does not verify that the commonName (CN) field in a server certificate matches the domain name in an HTTPS request, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site.

CVSS 2.0 · 4.3 Medium EPSS 1.7% KEV · Not listed

Vendors

Redhat Ruby-lang

Products

Enterprise Linux Ruby

CVE-2007-5191

util-linux (u)mount doesn't drop privileges properly when calling helpers

mount and umount in util-linux and loop-aes-utils call the setuid and setgid functions in the wrong order and do not check the return values, which might allow attackers to gain privileges via helpers such as mount.nfs.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 3 more

CVE-2007-5208

hplip arbitrary command execution

hpssd in Hewlett-Packard Linux Imaging and Printing Project (hplip) 1.x and 2.x before 2.7.10 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a from address, which is not properly handled when invoking sendmail.

CVSS 2.0 · 7.6 High EPSS 67.3% KEV · Not listed

Vendors

Hp Redhat

Products

Linux Imaging And Printing Project Enterprise Linux