CVE-2009-0025

bind: DSA_do_verify() returns check issue

BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3, and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.

CVSS 2.0 · 6.8 Medium EPSS 6.9% KEV · Not listed

Vendors

Isc Redhat

Products

Bind Enterprise Linux

CVE-2009-0028

Linux kernel minor signal handling vulnerability

The clone system call in the Linux kernel 2.6.28 and earlier allows local users to send arbitrary signals to a parent process from an unprivileged child process by launching an additional child process with the CLONE_PARENT flag, and then letting this new process exit.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg

CVE-2009-0030

squirrelmail: session management flaw

A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated users to access other users' folder lists and configuration data in opportunistic circumstances by using the standard webmail.php interface. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-3663.

CVSS 2.0 · 6.5 Medium EPSS 1.7% KEV · Not listed

Vendors

Redhat Squirrelmail

Products

Enterprise Linux Squirrelmail

CVE-2009-0031

kernel: local denial of service in keyctl_join_session_keyring

Memory leak in the keyctl_join_session_keyring function (security/keys/keyctl.c) in Linux kernel 2.6.29-rc2 and earlier allows local users to cause a denial of service (kernel memory consumption) via unknown vectors related to a "missing kfree."

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg

CVE-2009-0033

tomcat6 Denial-Of-Service with AJP connection

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.

CVSS 2.0 · 5.0 Medium EPSS 10.1% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Certificate System Enterprise Linux and 4 more

CVE-2009-0034

sudo: incorrect handling of groups in Runas_User

parse.c in sudo 1.6.9p17 through 1.6.9p19 does not properly interpret a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Gratisoft Redhat Vmware

Products

Sudo Enterprise Linux Esx

CVE-2009-0037

curl: local file access via unsafe redirects

The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3) execute arbitrary commands via a redirect to an scp: URL.

CVSS 2.0 · 6.8 Medium EPSS 9.0% KEV · Not listed

Vendors

Curl Redhat

Products

Curl Libcurl Enterprise Linux

CVE-2009-0040

libpng arbitrary free() flaw

The PNG reference library (aka libpng) before 1.0.43, and 1.2.x before 1.2.35, as used in pngcrush and other applications, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file that triggers a free of an uninitialized pointer in (1) the png_read_png function, (2) pCAL chunk handling, or (3) setup of 16-bit gamma tables.

CVSS 2.0 · 6.8 Medium EPSS 4.8% KEV · Not listed

Vendors

Apple Debian Fedoraproject and 4 more

Products

Iphone Os Mac Os X Debian Linux and 7 more

CVE-2009-0065

kernel: sctp: memory overflow when FWD-TSN chunk is received with bad stream ID

Buffer overflow in net/sctp/sm_statefuns.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.28-git8 allows remote attackers to have an unknown impact via an FWD-TSN (aka FORWARD-TSN) chunk with a large stream ID.

CVSS 2.0 · 10.0 Critical EPSS 16.7% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 1 more

CVE-2009-0115

device-mapper-multipath: insecure permissions on multipathd.sock

The Device Mapper multipathing driver (aka multipath-tools or device-mapper-multipath) 0.4.8, as used in SUSE openSUSE, SUSE Linux Enterprise Server (SLES), Fedora, and possibly other operating systems, uses world-writable permissions for the socket file (aka /var/run/multipathd.sock), which allows local users to send arbitrary commands to the multipath daemon.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Avaya Christophe.varoqui Debian and 6 more

Products

Intuity Audix Lx Message Networking Messaging Storage Server and 9 more

CVE-2009-0146

xpdf: Multiple buffer overflows in JBIG2 decoder (setBitmap, readSymbolDictSeg) (CVE-2009-0195)

Multiple buffer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related to (1) JBIG2SymbolDict::setBitmap and (2) JBIG2Stream::readSymbolDictSeg.

CVSS 2.0 · 4.3 Medium EPSS 2.8% KEV · Not listed

Vendors

Apple Foolabs Glyphandcog and 1 more

Products

Cups Xpdf Xpdfreader and 1 more

CVE-2009-0147

xpdf: Multiple integer overflows in JBIG2 decoder

Multiple integer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related to (1) JBIG2Stream::readSymbolDictSeg, (2) JBIG2Stream::readSymbolDictSeg, and (3) JBIG2Stream::readGenericBitmap.

CVSS 2.0 · 4.3 Medium EPSS 2.6% KEV · Not listed

Vendors

Apple Foolabs Glyphandcog and 1 more

Products

Cups Xpdf Xpdfreader and 1 more

CVE-2009-0148

cscope: multiple buffer overflows

Multiple buffer overflows in Cscope before 15.7a allow remote attackers to execute arbitrary code via long strings in input such as (1) source-code tokens and (2) pathnames, related to integer overflows in some cases. NOTE: this issue exists because of an incomplete fix for CVE-2004-2541.

CVSS 2.0 · 9.3 Critical EPSS 6.8% KEV · Not listed

Vendors

Cscope Redhat

Products

Cscope Enterprise Linux

CVE-2009-0153

icu: XSS vulnerability due to improper invalid byte sequence handling

International Components for Unicode (ICU) 4.0, 3.6, and other 3.x versions, as used in Apple Mac OS X 10.5 before 10.5.7, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Fedora 9 and 10, and possibly other operating systems, does not properly handle invalid byte sequences during Unicode conversion, which might allow remote attackers to conduct cross-site scripting (XSS) attacks.

CVSS 3.0 · 6.1 Medium EPSS 3.7% KEV · Not listed

Vendors

Apple Redhat

Products

Mac Os X Mac Os X Server Enterprise Linux

CVE-2009-0159

ntp: buffer overflow in ntpq

Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.

CVSS 2.0 · 6.8 Medium EPSS 13.2% KEV · Not listed

Vendors

Ntp Redhat

Products

Ntp Enterprise Linux Rhel Eus

CVE-2009-0163

cups: Integer overflow in the TIFF image filter

Integer overflow in the TIFF image decoding routines in CUPS 1.3.9 and earlier allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a crafted TIFF image, which is not properly handled by the (1) _cupsImageReadTIFF function in the imagetops filter and (2) imagetoraster filter, leading to a heap-based buffer overflow.

CVSS 2.0 · 6.8 Medium EPSS 4.2% KEV · Not listed

Vendors

Apple Redhat

Products

Cups Enterprise Linux

CVE-2009-0166

xpdf: Freeing of potentially uninitialized memory in JBIG2 decoder

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers a free of uninitialized memory.

CVSS 2.0 · 4.3 Medium EPSS 2.3% KEV · Not listed

Vendors

Apple Foolabs Glyphandcog and 2 more

Products

Cups Xpdf Xpdfreader and 2 more

CVE-2009-0195

xpdf: Multiple buffer overflows in JBIG2 decoder (setBitmap, readSymbolDictSeg) (CVE-2009-0195)

Heap-based buffer overflow in Xpdf 3.02pl2 and earlier, CUPS 1.3.9, and probably other products, allows remote attackers to execute arbitrary code via a PDF file with crafted JBIG2 symbol dictionary segments.

CVSS 2.0 · 6.8 Medium EPSS 5.4% KEV · Not listed

Vendors

Apple Foolabs Glyphandcog and 1 more

Products

Cups Xpdf Xpdfreader and 1 more

CVE-2009-0196

ghostscript: Missing boundary check in Ghostscript's jbig2dec library

Heap-based buffer overflow in the big2_decode_symbol_dict function (jbig2_symbol_dict.c) in the JBIG2 decoding library (jbig2dec) in Ghostscript 8.64, and probably earlier versions, allows remote attackers to execute arbitrary code via a PDF file with a JBIG2 symbol dictionary segment with a large run length value.

CVSS 2.0 · 9.3 Critical EPSS 7.4% KEV · Not listed

Vendors

Ghostscript Redhat

Products

Ghostscript Enterprise Linux

CVE-2009-0200

OpenOffice.org Word document Integer Underflow

Integer underflow in OpenOffice.org (OOo) before 3.1.1 and StarOffice/StarSuite 7, 8, and 9 might allow remote attackers to execute arbitrary code via crafted records in the document table of a Word document, leading to a heap-based buffer overflow.

CVSS 2.0 · 9.3 Critical EPSS 6.7% KEV · Not listed

Vendors

Openoffice Redhat

Products

Openoffice.org Enterprise Linux