CVE-2007-1308

kdelibs KDE JavaScript denial of service (crash)

ecma/kjs_html.cpp in KDE JavaScript (KJS), as used in Konqueror in KDE 3.5.5, allows remote attackers to cause a denial of service (crash) by accessing the content of an iframe with an ftp:// URI in the src attribute, probably due to a NULL pointer dereference.

CVSS 2.0 · 4.3 Medium EPSS 8.4% KEV · Not listed

Vendors

Kde Redhat

Products

Konqueror Enterprise Linux

CVE-2007-1320

xen/qemu Cirrus LGD-54XX "bitblt" Heap Overflow

Multiple heap-based buffer overflows in the cirrus_invalidate_region function in the Cirrus VGA extension in QEMU 0.8.2, as used in Xen and possibly other products, might allow local users to execute arbitrary code via unspecified vectors related to "attempting to mark non-existent regions as dirty," aka the "bitblt" heap overflow.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Opensuse and 3 more

Products

Debian Linux Fedora Fedora Core and 4 more

CVE-2007-1321

xen QEMU NE2000 emulation issues

Integer signedness error in the NE2000 emulator in QEMU 0.8.2, as used in Xen and possibly other products, allows local users to trigger a heap-based buffer overflow via certain register values that bypass sanity checks, aka QEMU NE2000 "receive" integer signedness error. NOTE: this identifier was inadvertently used by some sources to cover multiple issues that were labeled "NE2000 network driver and the socket code," but separate identifiers have been created for the individual vulnerabilities since there are sometimes different fixes; see CVE-2007-5729 and CVE-2007-5730.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Qemu and 2 more

Products

Debian Linux Fedora Fedora Core and 3 more

CVE-2007-1349

mod_perl PerlRun denial of service

PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.

CVSS 2.0 · 5.0 Medium EPSS 10.4% KEV · Not listed

Vendors

Apache Canonical Redhat

Products

Mod Perl Ubuntu Linux Certificate System and 9 more

CVE-2007-1351

Multiple font integer overflows (CVE-2007-1352)

Integer overflow in the bdfReadCharacters function in bdfread.c in (1) X.Org libXfont before 20070403 and (2) freetype 2.3.2 and earlier allows remote authenticated users to execute arbitrary code via crafted BDF fonts, which result in a heap overflow.

CVSS 2.0 · 8.5 High EPSS 5.6% KEV · Not listed

Vendors

Mandrakesoft Openbsd Redhat and 4 more

Products

Mandrake Linux Mandrake Linux Corporate Server Mandrake Multi Network Firewall and 8 more

CVE-2007-1352

Multiple font integer overflows (CVE-2007-1352)

Integer overflow in the FontFileInitTable function in X.Org libXfont before 20070403 allows remote authenticated users to execute arbitrary code via a long first line in the fonts.dir file, which results in a heap overflow.

CVSS 2.0 · 3.8 Low EPSS 1.5% KEV · Not listed

Vendors

Mandrakesoft Openbsd Redhat and 5 more

Products

Mandrake Linux Mandrake Linux Corporate Server Mandrake Multi Network Firewall and 11 more

CVE-2007-1353

Bluetooth setsockopt() information leaks

The setsockopt function in the L2CAP and HCI Bluetooth support in the Linux kernel before 2.4.34.3 allows context-dependent attackers to read kernel memory and obtain sensitive information via unspecified vectors involving the copy_from_user function accessing an uninitialized stack buffer.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2007-1358

tomcat accept-language xss flaw

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

CVSS 2.0 · 2.6 Low EPSS 19.9% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Certificate System Enterprise Linux and 4 more

CVE-2007-1362

Multiple Firefox flaws (CVE-2007-1562, CVE-2007-2867, CVE-2007-2868, CVE-2007-2869, CVE-2007-2870, CVE-2007-2871)

Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2, allows remote attackers to cause a denial of service via (1) a large cookie path parameter, which triggers memory consumption, or (2) an internal delimiter within cookie path or name values, which could trigger a misinterpretation of cookie data, aka "Path Abuse in Cookies."

CVSS 2.0 · 4.3 Medium EPSS 7.8% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Seamonkey Enterprise Linux

CVE-2007-1380

php session extension information leak

The php_binary serialization handler in the session extension in PHP before 4.4.5, and 5.x before 5.2.1, allows context-dependent attackers to obtain sensitive information (memory contents) via a serialized variable entry with a large length value, which triggers a buffer over-read.

CVSS 2.0 · 5.0 Medium EPSS 9.4% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux Rhel Application Stack and 1 more

CVE-2007-1388

security flaw

The do_ipv6_setsockopt function in net/ipv6/ipv6_sockglue.c in Linux kernel before 2.6.20, and possibly other versions, allows local users to cause a denial of service (oops) by calling setsockopt with the IPV6_RTHDR option name and possibly a zero option length or invalid option value, which triggers a NULL pointer dereference.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2007-1420

Single MySQL worker can be crashed (NULL deref) with certain SELECT statements

MySQL 5.x before 5.0.36 allows local users to cause a denial of service (database crash) by performing information_schema table subselects and using ORDER BY to sort a single-row result, which prevents certain structure elements from being initialized and triggers a NULL dereference in the filesort function.

CVSS 2.0 · 2.1 Low EPSS 1.0% KEV · Not listed

Vendors

Mysql Oracle Redhat

Products

Mysql Mysql Enterprise Linux

CVE-2007-1466

security flaw

Integer overflow in the WP6GeneralTextPacket::_readContents function in WordPerfect Document importer/exporter (libwpd) before 0.8.9 allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted WordPerfect file, a different vulnerability than CVE-2007-0002.

CVSS 2.0 · 6.8 Medium EPSS 3.4% KEV · Not listed

Vendors

Redhat Sourceforge

Products

Enterprise Linux Wordperfect Document Importer-exporter

CVE-2007-1496

Various NULL pointer dereferences in netfilter code

nfnetlink_log in netfilter in the Linux kernel before 2.6.20.3 allows attackers to cause a denial of service (crash) via unspecified vectors involving the (1) nfulnl_recv_config function, (2) using "multiple packets per netlink message", and (3) bridged packets, which trigger a NULL pointer dereference.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2007-1497

IPv6 fragments bypass in nf_conntrack netfilter code

nf_conntrack in netfilter in the Linux kernel before 2.6.20.3 does not set nfctinfo during reassembly of fragmented packets, which leaves the default value as IP_CT_ESTABLISHED and might allow remote attackers to bypass certain rulesets using IPv6 fragments.

CVSS 2.0 · 5.0 Medium EPSS 3.1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2007-1536

file 4.20 fixes a heap overflow in that can result in arbitrary code execution

Integer underflow in the file_printf function in the "file" program before 4.20 allows user-assisted attackers to execute arbitrary code via a file that triggers a heap-based buffer overflow.

CVSS 2.0 · 9.3 Critical EPSS 13.6% KEV · Not listed

Vendors

File Redhat

Products

File Enterprise Linux

CVE-2007-1558

fetchmail/mutt/evolution/...: APOP password disclosure vulnerability

The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including (1) Thunderbird 1.x before 1.5.0.12 and 2.x before 2.0.0.4, (2) Evolution, (3) mutt, (4) fetchmail before 6.3.8, (5) SeaMonkey 1.0.x before 1.0.9 and 1.1.x before 1.1.2, (6) Balsa 2.3.16 and earlier, (7) Mailfilter before 0.8.2, and possibly other products.

CVSS 2.0 · 2.6 Low EPSS 2.5% KEV · Not listed

Vendors

Apop Protocol Redhat

Products

Apop Protocol Enterprise Linux

CVE-2007-1560

security flaw

The clientProcessRequest() function in src/client_side.c in Squid 2.6 before 2.6.STABLE12 allows remote attackers to cause a denial of service (daemon crash) via crafted TRACE requests that trigger an assertion error.

CVSS 2.0 · 5.0 Medium EPSS 28.2% KEV · Not listed

Vendors

Redhat Squid

Products

Enterprise Linux Squid

CVE-2007-1562

security flaw

The FTP protocol implementation in Mozilla Firefox before 1.5.0.11 and 2.x before 2.0.0.3 allows remote attackers to force the client to connect to other servers, perform a proxied port scan, or obtain sensitive information by specifying an alternate server address in an FTP PASV response.

CVSS 2.0 · 6.8 Medium EPSS 14.3% KEV · Not listed

Vendors

Canonical Mozilla Redhat

Products

Ubuntu Linux Firefox Enterprise Linux

CVE-2007-1564

FTP protocol PASV design flaw affects konqueror

The FTP protocol implementation in Konqueror 3.5.5 allows remote servers to force the client to connect to other servers, perform a proxied port scan, or obtain sensitive information by specifying an alternate server address in an FTP PASV response.

CVSS 2.0 · 6.8 Medium EPSS 3.9% KEV · Not listed

Vendors

Kde Redhat

Products

Konqueror Enterprise Linux