CVE-2008-3532

pidgin: NSS plugin doesn't verify SSL certificates

The NSS plugin in libpurple in Pidgin 2.4.3 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service.

CVSS 2.0 · 6.8 Medium EPSS 1.6% KEV · Not listed

Vendors

Pidgin Redhat

Products

Pidgin Enterprise Linux

CVE-2008-3639

CUPS: SGI image parser heap-based buffer overflow

Heap-based buffer overflow in the read_rle16 function in imagetops in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via an SGI image with malformed Run Length Encoded (RLE) data containing a small image and a large row count.

CVSS 2.0 · 7.5 High EPSS 4.4% KEV · Not listed

Vendors

Apple Redhat

Products

Cups Enterprise Linux

CVE-2008-3640

CUPS: texttops integer overflow

Integer overflow in the WriteProlog function in texttops in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via a crafted PostScript file that triggers a heap-based buffer overflow.

CVSS 2.0 · 6.8 Medium EPSS 4.6% KEV · Not listed

Vendors

Apple Redhat

Products

Cups Enterprise Linux

CVE-2008-3641

CUPS: HP/GL reader insufficient bounds checking

The Hewlett-Packard Graphics Language (HPGL) filter in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via crafted pen width and pen color opcodes that overwrite arbitrary memory.

CVSS 2.0 · 10.0 Critical EPSS 24.1% KEV · Not listed

Vendors

Apple Redhat

Products

Cups Enterprise Linux

CVE-2008-3651

ipsec-tools: racoon memory leak caused by invalid proposals

Memory leak in racoon/proposal.c in the racoon daemon in ipsec-tools before 0.7.1 allows remote authenticated users to cause a denial of service (memory consumption) via invalid proposals.

CVSS 2.0 · 4.0 Medium EPSS 2.3% KEV · Not listed

Vendors

Linux Redhat

Products

Ipsec Tools Racoon Daemon Enterprise Linux

CVE-2008-3652

ipsec-tools: racoon orphaned ph1s memory leak

src/racoon/handler.c in racoon in ipsec-tools does not remove an "orphaned ph1" (phase 1) handle when it has been initiated remotely, which allows remote attackers to cause a denial of service (resource consumption).

CVSS 2.0 · 7.8 High EPSS 3.4% KEV · Not listed

Vendors

Ipsec-tools Redhat

Products

Ipsec-tools Enterprise Linux

CVE-2008-3655

ruby: multiple insufficient safe mode restrictions

Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent attackers to bypass intended access restrictions via (1) untrace_var, (2) $PROGRAM_NAME, and (3) syslog at safe level 4, and (4) insecure methods at safe levels 1 through 3.

CVSS 2.0 · 7.5 High EPSS 14.1% KEV · Not listed

Vendors

Redhat Ruby-lang

Products

Enterprise Linux Ruby

CVE-2008-3656

ruby: WEBrick DoS vulnerability (CPU consumption)

Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted HTTP request that is processed by a backtracking regular expression.

CVSS 2.0 · 7.8 High EPSS 70.2% KEV · Not listed

Vendors

Redhat Ruby-lang

Products

Enterprise Linux Ruby

CVE-2008-3657

ruby: missing "taintness" checks in dl module

The dl module in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not check "taintness" of inputs, which allows context-dependent attackers to bypass safe levels and execute dangerous functions by accessing a library using DL.dlopen.

CVSS 2.0 · 7.5 High EPSS 13.7% KEV · Not listed

Vendors

Redhat Ruby-lang

Products

Enterprise Linux Ruby

CVE-2008-3658

php: buffer overflow in the imageloadfont function in gd extension

Buffer overflow in the imageloadfont function in ext/gd/gd.c in PHP 4.4.x before 4.4.9 and PHP 5.2 before 5.2.6-r6 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.

CVSS 2.0 · 7.5 High EPSS 6.8% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux

CVE-2008-3660

php: FastCGI module DoS via multiple dots preceding the extension

PHP 4.4.x before 4.4.9, and 5.x through 5.2.6, when used as a FastCGI module, allows remote attackers to cause a denial of service (crash) via a request with multiple dots preceding the extension, as demonstrated using foo..php.

CVSS 2.0 · 5.0 Medium EPSS 3.3% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux

CVE-2008-3663

squirrelmail: session hijacking - secure flag not set for HTTPS-only cookies

Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

CVSS 2.0 · 5.0 Medium EPSS 2.2% KEV · Not listed

Vendors

Redhat Squirrelmail

Products

Enterprise Linux Squirrelmail

CVE-2008-3790

ruby: DoS vulnerability in the REXML module

The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML document with recursively nested entities, aka an "XML entity explosion."

CVSS 2.0 · 5.0 Medium EPSS 15.2% KEV · Not listed

Vendors

Redhat Ruby-lang

Products

Enterprise Linux Ruby

CVE-2008-3825

pam_krb5 existing_ticket permission flaw

pam_krb5 2.2.14 in Red Hat Enterprise Linux (RHEL) 5 and earlier, when the existing_ticket option is enabled, uses incorrect privileges when reading a Kerberos credential cache, which allows local users to gain privileges by setting the KRB5CCNAME environment variable to an arbitrary cache filename and running the (1) su or (2) sudo program. NOTE: there may be a related vector involving sshd that has limited relevance.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Enterprise Linux Desktop

CVE-2008-3831

kernel: i915 kernel drm driver arbitrary ioremap

The i915 driver in (1) drivers/char/drm/i915_dma.c in the Linux kernel 2.6.24 on Debian GNU/Linux and (2) sys/dev/pci/drm/i915_drv.c in OpenBSD does not restrict the DRM_I915_HWS_ADDR ioctl to the Direct Rendering Manager (DRM) master, which allows local users to cause a denial of service (memory corruption) via a crafted ioctl call, related to absence of the DRM_MASTER and DRM_ROOT_ONLY flags in the ioctl's configuration.

CVSS 2.0 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Linux Openbsd and 1 more

Products

Linux Linux Kernel Linux and 2 more

CVE-2008-3833

kernel: remove SUID when splicing into an inode

The generic_file_splice_write function in fs/splice.c in the Linux kernel before 2.6.19 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by splicing into an inode in order to create an executable file in a setgid directory, a different vulnerability than CVE-2008-4210.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2008-3834

dbus denial of service

The dbus_signature_validate function in the D-bus library (libdbus) before 1.2.4 allows remote attackers to cause a denial of service (application abort) via a message containing a malformed signature, which triggers a failed assertion error.

CVSS 2.0 · 2.1 Low EPSS 4.6% KEV · Not listed

Vendors

Freedesktop Redhat

Products

Dbus Dbus1.0 Dbus1.1.0 and 1 more

CVE-2008-3835

mozilla: nsXMLDocument:: OnChannelRedirect() same-origin violation

The nsXMLDocument::OnChannelRedirect function in Mozilla Firefox before 2.0.0.17, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code via unknown vectors.

CVSS 2.0 · 7.5 High EPSS 2.1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Seamonkey Thunderbird and 1 more

CVE-2008-3837

mozilla: Forced mouse drag

Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, and SeaMonkey before 1.1.12, allow user-assisted remote attackers to move a window during a mouse click, and possibly force a file download or unspecified other drag-and-drop action, via a crafted onmousedown action that calls window.moveBy, a variant of CVE-2003-0823.

CVSS 2.0 · 9.3 Critical EPSS 3.3% KEV · Not listed

Vendors

Canonical Debian Mozilla and 1 more

Products

Ubuntu Linux Debian Linux Firefox and 2 more

CVE-2008-3844

security flaw

Certain Red Hat Enterprise Linux (RHEL) 4 and 5 packages for OpenSSH, as signed in August 2008 using a legitimate Red Hat GPG key, contain an externally introduced modification (Trojan Horse) that allows the package authors to have an unknown impact. NOTE: since the malicious packages were not distributed from any official Red Hat sources, the scope of this issue is restricted to users who may have obtained these packages through unofficial distribution points. As of 20080827, no unofficial distributions of this software are known.

CVSS 2.0 · 9.3 Critical EPSS 2.7% KEV · Not listed

Vendors

Openbsd Redhat

Products

Openssh Enterprise Linux Enterprise Linux Desktop and 1 more