CVE-2009-0580

tomcat6 Information disclosure in authentication classes

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.

CVSS 2.0 · 4.3 Medium EPSS 94.4% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Certificate System Enterprise Linux and 5 more

CVE-2009-0581

LittleCms memory leak

Memory leak in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted image file.

CVSS 2.0 · 4.3 Medium EPSS 2.5% KEV · Not listed

Vendors

Gimp Littlecms Mozilla and 2 more

Products

Gimp Little Cms Firefox and 2 more

CVE-2009-0582

evolution-data-server: insufficient checking of NTLM authentication challenge packets

The ntlm_challenge function in the NTLM SASL authentication mechanism in camel/camel-sasl-ntlm.c in Camel in Evolution Data Server (aka evolution-data-server) 2.24.5 and earlier, and 2.25.92 and earlier 2.25.x versions, does not validate whether a certain length value is consistent with the amount of data in a challenge packet, which allows remote mail servers to read information from the process memory of a client, or cause a denial of service (client crash), via an NTLM authentication type 2 packet with a length value that exceeds the amount of packet data.

CVSS 2.0 · 5.8 Medium EPSS 2.3% KEV · Not listed

Vendors

Gnome Redhat

Products

Evolution-data-server Enterprise Linux

CVE-2009-0583

argyllcms: Multiple integer overflows in the International Color Consortium Format Library

Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.

CVSS 2.0 · 9.3 Critical EPSS 4.7% KEV · Not listed

Vendors

Argyllcms Ghostscript Redhat

Products

Argyllcms Ghostscript Enterprise Linux

CVE-2009-0584

argyllcms: Multiple insufficient upper-bounds checks on certain sizes in the International Color Consortium Format Library

icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using a device file for processing a crafted image file associated with large integer values for certain sizes, related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.

CVSS 2.0 · 9.3 Critical EPSS 4.1% KEV · Not listed

Vendors

Argyllcms Ghostscript Redhat

Products

Cms Ghostscript Enterprise Linux

CVE-2009-0585

libsoup: integer overflow in soup_base64_encode()

Integer overflow in the soup_base64_encode function in soup-misc.c in libsoup 2.x.x before 2.2.x, and 2.x before 2.24, allows context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation.

CVSS 2.0 · 7.5 High EPSS 4.0% KEV · Not listed

Vendors

Joe Shaw Redhat

Products

Libsoup Enterprise Linux

CVE-2009-0586

gstreamer-plugins-base: integer overflow in gst_vorbis_tag_add_coverart()

Integer overflow in the gst_vorbis_tag_add_coverart function (gst-libs/gst/tag/gstvorbistag.c) in vorbistag in gst-plugins-base (aka gstreamer-plugins-base) before 0.10.23 in GStreamer allows context-dependent attackers to execute arbitrary code via a crafted COVERART tag that is converted from a base64 representation, which triggers a heap-based buffer overflow.

CVSS 2.0 · 7.5 High EPSS 5.5% KEV · Not listed

Vendors

Canonical Gstreamer Redhat

Products

Ubuntu Linux Gstreamer Enterprise Linux

CVE-2009-0587

evolution-data-server: integer overflow in base64 encoding functions

Multiple integer overflows in Evolution Data Server (aka evolution-data-server) before 2.24.5 allow context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation in (1) addressbook/libebook/e-vcard.c in evc or (2) camel/camel-mime-utils.c in libcamel.

CVSS 2.0 · 7.5 High EPSS 3.3% KEV · Not listed

Vendors

Go-evolution Redhat

Products

Evolution-data-server Enterprise Linux

CVE-2009-0590

openssl: ASN1 printing crash

The ASN1_STRING_print_ex function in OpenSSL before 0.9.8k allows remote attackers to cause a denial of service (invalid memory access and application crash) via vectors that trigger printing of a (1) BMPString or (2) UniversalString with an invalid encoded length.

CVSS 2.0 · 5.0 Medium EPSS 6.7% KEV · Not listed

Vendors

Debian Openssl Redhat

Products

Debian Linux Openssl Enterprise Linux

CVE-2009-0600

wireshark: denial of service (application crash) via a crafted Tektronix K12 text capture file

Wireshark 0.99.6 through 1.0.5 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted Tektronix K12 text capture file, as demonstrated by a file with exactly one frame.

CVSS 2.0 · 4.3 Medium EPSS 1.8% KEV · Not listed

Vendors

Redhat Wireshark

Products

Enterprise Linux Wireshark

CVE-2009-0642

ruby: Incorrect checks for validity of X.509 certificates

ext/openssl/ossl_ocsp.c in Ruby 1.8 and 1.9 does not properly check the return value from the OCSP_basic_verify function, which might allow remote attackers to successfully present an invalid X.509 certificate, possibly involving a revoked certificate.

CVSS 2.0 · 6.8 Medium EPSS 2.6% KEV · Not listed

Vendors

Redhat Ruby-lang

Products

Enterprise Linux Ruby

CVE-2009-0652

firefox: does not properly prevent the literal rendering of homoglyph characters in IDN domain names (spoof URLs and conduct phishing attacks)

The Internationalized Domain Names (IDN) blacklist in Mozilla Firefox 3.0.6 and other versions before 3.0.9; Thunderbird before 2.0.0.21; and SeaMonkey before 1.1.15 does not include box-drawing characters, which allows remote attackers to spoof URLs and conduct phishing attacks, as demonstrated by homoglyphs of the / (slash) and ? (question mark) characters in a subdomain of a .cn domain name, a different vulnerability than CVE-2005-0233. NOTE: some third parties claim that 3.0.6 is not affected, but much older versions perhaps are affected.

CVSS 2.0 · 5.8 Medium EPSS 1.5% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Seamonkey Thunderbird and 1 more

CVE-2009-0663

perl-DBD-Pg: pg_getline buffer overflow

Heap-based buffer overflow in the DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module 1.49 for Perl might allow context-dependent attackers to execute arbitrary code via unspecified input to an application that uses the getline and pg_getline functions to read database rows.

CVSS 2.0 · 7.5 High EPSS 4.3% KEV · Not listed

Vendors

Cmu Perl Redhat

Products

Dbd\ Perl Enterprise Linux

CVE-2009-0675

kernel: skfp_ioctl inverted logic flaw

The skfp_ioctl function in drivers/net/skfp/skfddi.c in the Linux kernel before 2.6.28.6 permits SKFP_CLR_STATS requests only when the CAP_NET_ADMIN capability is absent, instead of when this capability is present, which allows local users to reset the driver statistics, related to an "inverted logic" issue.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg

CVE-2009-0676

kernel: memory disclosure in SO_BSDCOMPAT gsopt

The sock_getsockopt function in net/core/sock.c in the Linux kernel before 2.6.28.6 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel memory via an SO_BSDCOMPAT getsockopt request.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg

CVE-2009-0688

cyrus-sasl: sasl_encode64() does not reliably null-terminate its output

Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via strings that are used as input to the sasl_encode64 function in lib/saslutil.c.

CVSS 2.0 · 7.5 High EPSS 8.2% KEV · Not listed

Vendors

Carnegie Mellon University Redhat

Products

Cyrus-sasl Enterprise Linux

CVE-2009-0689

array index error in dtoa implementation of many products

Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4, K-Meleon 1.5.3, SeaMonkey 1.1.8, and other products, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large precision value in the format argument to a printf function, which triggers incorrect memory allocation and a heap-based buffer overflow during conversion to a floating-point number.

CVSS 2.0 · 6.8 Medium EPSS 29.4% KEV · Not listed

Vendors

Freebsd K-meleon Project Mozilla and 3 more

Products

Freebsd K-meleon Firefox and 6 more

CVE-2009-0692

dhclient: stack overflow leads to arbitrary code execution as root

Stack-based buffer overflow in the script_write_params method in client/dhclient.c in ISC DHCP dhclient 4.1 before 4.1.0p1, 4.0 before 4.0.1p1, 3.1 before 3.1.2p1, 3.0, and 2.0 allows remote DHCP servers to execute arbitrary code via a crafted subnet-mask option.

CVSS 2.0 · 10.0 Critical EPSS 25.8% KEV · Not listed

Vendors

Isc Redhat

Products

Dhcp Enterprise Linux Rhel Eus

CVE-2009-0696

bind: DoS (assertion failure) via nsupdate packets

The dns_db_findrdataset function in db.c in named in ISC BIND 9.4 before 9.4.3-P3, 9.5 before 9.5.1-P3, and 9.6 before 9.6.1-P1, when configured as a master server, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an ANY record in the prerequisite section of a crafted dynamic update message.

CVSS 2.0 · 4.3 Medium EPSS 12.6% KEV · Not listed

Vendors

Isc Redhat

Products

Bind Enterprise Linux

CVE-2009-0723

LittleCms integer overflow

Multiple integer overflows in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent attackers to execute arbitrary code via a crafted image file that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.

CVSS 2.0 · 9.3 Critical EPSS 5.0% KEV · Not listed

Vendors

Gimp Littlecms Mozilla and 2 more

Products

Gimp Little Cms Firefox and 2 more