CVE-2008-1238

Referrer spoofing bug

Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9, when generating the HTTP Referer header, does not list the entire URL when it contains Basic Authentication credentials without a username, which makes it easier for remote attackers to bypass application protection mechanisms that rely on Referer headers, such as with some Cross-Site Request Forgery (CSRF) mechanisms.

CVSS 2.0 · 5.0 Medium EPSS 2.4% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Seamonkey Enterprise Linux

CVE-2008-1241

XUL popup spoofing

GUI overlay vulnerability in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 allows remote attackers to spoof form elements and redirect user inputs via a borderless XUL pop-up window from a background tab.

CVSS 2.0 · 4.3 Medium EPSS 1.8% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Seamonkey Enterprise Linux

CVE-2008-1294

kernel: setrlimit(RLIMIT_CPUINFO) with zero value doesn't inherit properly across children

Linux kernel 2.6.17, and other versions before 2.6.22, does not check when a user attempts to set RLIMIT_CPU to 0 until after the change is made, which allows local users to bypass intended resource limits.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2008-1367

Kernel doesn't clear DF for signal handlers

gcc 4.3.x does not generate a cld instruction while compiling functions used for string manipulation such as memcpy and memmove on x86 and i386, which can prevent the direction flag (DF) from being reset in violation of ABI conventions and cause data to be copied in the wrong direction during signal handling in the Linux kernel, which might allow context-dependent attackers to trigger memory corruption. NOTE: this issue was originally reported for CPU consumption in SBCL.

CVSS 2.0 · 7.5 High EPSS 2.8% KEV · Not listed

Vendors

Gnu Redhat

Products

Gcc Enterprise Linux

CVE-2008-1372

bzip2: crash on malformed archive file

bzlib.c in bzip2 before 1.0.5 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted file that triggers a buffer over-read, as demonstrated by the PROTOS GENOME test suite for Archive Formats.

CVSS 2.0 · 4.3 Medium EPSS 4.5% KEV · Not listed

Vendors

Bzip Redhat

Products

Bzip2 Enterprise Linux

CVE-2008-1373

cups: overflow in gif image filter

Buffer overflow in the gif_read_lzw function in CUPS 1.3.6 allows remote attackers to have an unknown impact via a GIF file with a large code_size value, a similar issue to CVE-2006-4484.

CVSS 2.0 · 5.8 Medium EPSS 2.2% KEV · Not listed

Vendors

Easy Software Products Redhat

Products

Cups Enterprise Linux

CVE-2008-1374

cups: incomplete fix for CVE-2004-0888 / CVE-2005-0206

Integer overflow in pdftops filter in CUPS in Red Hat Enterprise Linux 3 and 4, when running on 64-bit platforms, allows remote attackers to execute arbitrary code via a crafted PDF file. NOTE: this issue is due to an incomplete fix for CVE-2004-0888.

CVSS 2.0 · 6.8 Medium EPSS 3.9% KEV · Not listed

Vendors

Apple Redhat

Products

Cups Enterprise Linux

CVE-2008-1375

kernel: race condition in dnotify (local DoS, local roothole possible)

Race condition in the directory notification subsystem (dnotify) in Linux kernel 2.6.x before 2.6.24.6, and 2.6.25 before 2.6.25.1, allows local users to cause a denial of service (OOPS) and possibly gain privileges via unspecified vectors.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 6 more

CVE-2008-1376

nfs-utils: missing tcp_wrappers support

A certain Red Hat build script for nfs-utils before 1.0.9-35z.el5_2 on Red Hat Enterprise Linux (RHEL) 5 omits TCP wrappers support, which might allow remote attackers to bypass intended access restrictions.

CVSS 2.0 · 7.5 High EPSS 2.6% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Nfs Utils

CVE-2008-1377

X.org Record and Security extensions memory corruption

The (1) SProcRecordCreateContext and (2) SProcRecordRegisterClients functions in the Record extension and the (3) SProcSecurityGenerateAuthorization function in the Security extension in the X server 1.4 in X.Org X11R7.3 allow context-dependent attackers to execute arbitrary code via requests with crafted length values that specify an arbitrary number of bytes to be swapped on the heap, which triggers heap corruption.

CVSS 2.0 · 9.0 Critical EPSS 2.7% KEV · Not listed

Vendors

Redhat X

Products

Enterprise Linux X11

CVE-2008-1379

X.org MIT-SHM extension arbitrary memory read

Integer overflow in the fbShmPutImage function in the MIT-SHM extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to read arbitrary process memory via crafted values for a Pixmap width and height.

CVSS 2.0 · 6.8 Medium EPSS 1.4% KEV · Not listed

Vendors

Redhat X

Products

Enterprise Linux X11

CVE-2008-1380

Firefox JavaScript garbage collection crash

The JavaScript engine in Mozilla Firefox before 2.0.0.14, Thunderbird before 2.0.0.14, and SeaMonkey before 1.1.10 allows remote attackers to cause a denial of service (garbage collector crash) and possibly have other impacts via a crafted web page. NOTE: this is due to an incorrect fix for CVE-2008-1237.

CVSS 2.0 · 9.3 Critical EPSS 2.9% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Seamonkey Thunderbird and 1 more

CVE-2008-1382

libpng unknown chunk handling flaw

libpng 1.0.6 through 1.0.32, 1.2.0 through 1.2.26, and 1.4.0beta01 through 1.4.0beta19 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PNG file with zero length "unknown" chunks, which trigger an access of uninitialized memory.

CVSS 2.0 · 7.5 High EPSS 5.5% KEV · Not listed

Vendors

Libpng Redhat

Products

Libpng Enterprise Linux

CVE-2008-1419

vorbis: zero-dim codebooks can cause crash, infinite loop or heap overflow

Xiph.org libvorbis 1.2.0 and earlier does not properly handle a zero value for codebook.dim, which allows remote attackers to cause a denial of service (crash or infinite loop) or trigger an integer overflow.

CVSS 2.0 · 4.3 Medium EPSS 4.3% KEV · Not listed

Vendors

Redhat Xiph.org

Products

Enterprise Linux Linux Advanced Workstation Libvorbis

CVE-2008-1420

vorbis: integer overflow in partvals computation

Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow.

CVSS 2.0 · 6.8 Medium EPSS 6.3% KEV · Not listed

Vendors

Redhat Xiph.org

Products

Enterprise Linux Linux Advanced Workstation Libvorbis

CVE-2008-1423

vorbis: integer oveflow caused by huge codebooks

Integer overflow in a certain quantvals and quantlist calculation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted OGG file with a large virtual space for its codebook, which triggers a heap overflow.

CVSS 2.0 · 9.3 Critical EPSS 8.1% KEV · Not listed

Vendors

Redhat Xiph.org

Products

Enterprise Linux Linux Advanced Workstation Libvorbis

CVE-2008-1447

bind: implement source UDP port randomization (CERT VU#800113)

The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka "DNS Insufficient Socket Entropy Vulnerability" or "the Kaminsky bug."

CVSS 3.1 · 6.8 Medium EPSS 95.2% KEV · Not listed

Vendors

Canonical Cisco Debian and 3 more

Products

Ubuntu Linux Ios Debian Linux and 5 more

CVE-2008-1483

openssh may set DISPLAY even if it's unable to listen on respective port

OpenSSH 4.3p2, and probably other versions, allows local users to hijack forwarded X connections by causing ssh to set DISPLAY to :10, even when another process is listening on the associated port, as demonstrated by opening TCP port 6010 (IPv4) and sniffing a cookie sent by Emacs.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Openbsd Redhat

Products

Openssh Enterprise Linux

CVE-2008-1514

kernel: ptrace: Padding area write - unprivileged kernel crash

arch/s390/kernel/ptrace.c in Linux kernel 2.6.9, and other versions before 2.6.27-rc6, on s390 platforms allows local users to cause a denial of service (kernel panic) via the user-area-padding test from the ptrace testsuite in 31-bit mode, which triggers an invalid dereference.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2008-1561

wireshark: crash in X.509sat and Roofnet dissectors

Multiple unspecified vulnerabilities in Wireshark (formerly Ethereal) 0.99.5 through 0.99.8 allow remote attackers to cause a denial of service (application crash) via a malformed packet to the (1) X.509sat or (2) Roofnet dissectors. NOTE: Vector 2 might also lead to a hang.

CVSS 2.0 · 5.0 Medium EPSS 8.9% KEV · Not listed

Vendors

Redhat Wireshark

Products

Enterprise Linux Wireshark