4.220051229115610Red Hat Linux 9MuttJay BealeINTERIMJay BealeACCEPTEDBuffer overflow in Mutt 1.4.0 and possibly earlier versions, 1.5.x up to 1.5.3, and other programs that use Mutt code such as Balsa before 2.0.10, allows a remote malicious IMAP server to cause a denial of service (crash) and possibly execute arbitrary code via a crafted folder.CVE-2003-0140ACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTED'The Exchange 2003 Exadmin virtual directory uses only Integrated Windows Authentication.'2.1.6ACCEPTED1Corresponds to item 2.1.6 in the Exchange 2003 BenchmarkRed Hat Linux 9CUPSJay BealeINTERIMJay BealeACCEPTEDCUPS before 1.1.19 allows remote attackers to cause a denial of service via a partial printing request to the IPP port (631), which does not time out.CVE-2003-0195ACCEPTED1Sun Solaris 8kcms_configureDavid Proulxkcms_configure as included with Solaris 7 and 8 allows a local attacker to gain additional privileges via a buffer overflow in a command line argument.CVE-2001-0594ACCEPTED1Sun Solaris 8libnslDavid ProulxInteger overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd.CVE-2002-0391ACCEPTED1Sun Solaris 8xlockDavid ProulxHeap overflow in xlock in Solaris 2.6 through 8 allows local users to gain root privileges via a long (1) XFILESEARCHPATH or (2) XUSERFILESEARCHPATH environmental variable.CVE-2001-0652ACCEPTED1Sun Solaris 8snmpdxDavid ProulxFormat string vulnerability in the logging component of snmpdx for Solaris 5.6 through 8 allows remote attackers to gain root privileges.CVE-2002-0796ACCEPTED1Microsoft Windows 2000Internet Explorer 5.5 Service Pack 2David ProulxInternet Explorer 5.5 and 6.0 allows remote attackers to bypass restrictions for executing scripts via an object that processes asynchronous events after the initial security checks have been made.CVE-2002-0026ACCEPTED3Sun Solaris 8XsunDavid ProulxBuffer overflow in Xsun on Solaris 2.6 through 8 allows local users to gain root privileges via a long -co (color database) command line argument.CVE-2002-0158ACCEPTED1Sun Solaris 8CDEDavid ProulxCDE ToolTalk database server (ttdbserver) allows remote attackers to overwrite arbitrary memory locations with a zero, and possibly gain privileges, via a file descriptor argument in an AUTH_UNIX procedure call, which is used as a table index by the _TT_ISCLOSE procedure.CVE-2002-0677ACCEPTED1Microsoft Windows NTInternet Information Server 4.0Tiffany BergeronACCEPTEDBuffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code.CVE-2002-0079ACCEPTED3Microsoft Windows 2000Internet Explorer 6.0David ProulxChristine WalzerINTERIMACCEPTEDInternet Explorer 5.01, 5.5 and 6.0 allows remote attackers to read arbitrary files via malformed requests to the GetObject function, which bypass some of GetObject's security checks.CVE-2002-0023ACCEPTED4Microsoft Windows NTWindows ShellMatthew BurtonMatthew BurtonDRAFTINTERIMMatthew BurtonACCEPTEDBuffer overflow in Windows Shell (used as the Windows Desktop) allows local and possibly remote attackers to execute arbitrary code via a custom URL handler that has not been removed for an application that has been improperly uninstalled.CVE-2002-0070ACCEPTED1Microsoft Windows 2000Internet Explorer 6.0Andrew ButtnerChristine WalzerINTERIMACCEPTEDCross-site scripting vulnerability in Internet Explorer 6.0 allows remote attackers to execute scripts in the Local Computer zone via a URL that exploits a local HTML resource file, aka the "Cross-Site Scripting in Local HTML Resource" vulnerability.CVE-2002-0189ACCEPTED4Microsoft Windows 2000Distributed Component Object Model (DCOM) interfaceChristine WalzerDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDHeap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed DCERPC DCOM object activation request packet with modified length fields, a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0528.CVE-2003-0715ACCEPTED2Microsoft Windows 2000Internet Information Server 5.0Andrew ButtnerACCEPTEDBuffer overflow in the ASP data transfer mechanism in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code, aka "Microsoft-discovered variant of Chunked Encoding buffer overrun."CVE-2002-0147ACCEPTED4Microsoft Windows 2000Internet Explorer 5.5 or Internet Explorer 5.5 Service Pack 1David ProulxInternet Explorer 5.5 and 6.0 allows remote attackers to bypass restrictions for executing scripts via an object that processes asynchronous events after the initial security checks have been made.CVE-2002-0026ACCEPTED3Microsoft Windows NTFTPTiffany BergeronThe FTP service in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows attackers who have established an FTP session to cause a denial of service via a specially crafted status request containing glob characters.CVE-2002-0073ACCEPTED3Microsoft Windows 2000Internet Information Server 5.0Tiffany BergeronACCEPTEDBuffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code.CVE-2002-0079ACCEPTED3Microsoft Windows 2000Network Connection Manager (NCM)Christine WalzerChristine WalzerINTERIMACCEPTEDA handler routine for the Network Connection Manager (NCM) in Windows 2000 allows local users to gain privileges via a complex attack that causes the handler to run in the LocalSystem context with user-specified code.CVE-2002-0720ACCEPTED2Microsoft Windows 2000Internet Explorer 5.01Tiffany BergeronChristine WalzerINTERIMACCEPTEDMicrosoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that cause the application for the spoofed file type to pass the file back to the operating system for handling rather than raise an error message, aka the first variant of the "Content Disposition" vulnerability.CVE-2002-0193ACCEPTED3Red Hat Linux 9skkJay BealeINTERIMJay BealeACCEPTEDskk (Simple Kana to Kanji conversion program) 12.1 and earlier, and the ddskk package which is based on skk, creates temporary files insecurely, which allows local users to overwrite arbitrary files.CVE-2003-0539ACCEPTED1Microsoft Windows 2000Internet Information Server 5.0Tiffany BergeronACCEPTEDBuffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request sessions, aka "Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise."CVE-2002-0364ACCEPTED4Microsoft Windows 2000SMTPTiffany BergeronAndrew ButtnerSMTP service in Microsoft Windows 2000, Windows XP Professional, and Exchange 2000 to cause a denial of service via a command with a malformed data transfer (BDAT) request.CVE-2002-0055ACCEPTED3Sun Solaris 8cachefsdDavid ProulxBrian SobyINTERIMACCEPTEDHeap-based buffer overflow in cfsd_calloc function of Solaris cachefsd allows remote attackers to execute arbitrary code via a request with a long directory and cache name.CVE-2002-0033ACCEPTED3Microsoft Windows 2000Internet Explorer 6.0David ProulxChristine WalzerINTERIMACCEPTEDInternet Explorer 5.5 and 6.0 allows remote attackers to bypass restrictions for executing scripts via an object that processes asynchronous events after the initial security checks have been made.CVE-2002-0026ACCEPTED4Sun Solaris 7XsunDavid ProulxBuffer overflow in Xsun on Solaris 2.6 through 8 allows local users to gain root privileges via a long -co (color database) command line argument.CVE-2002-0158ACCEPTED1Sun Solaris 7whodoDavid ProulxBuffer overflow in whodo in Solaris SunOS 5.5.1 through 5.8 allows local users to execute arbitrary code via a long (1) SOR or (2) CFIME environment variable.CVE-2001-1076ACCEPTED1Microsoft Windows 2000FTPTiffany BergeronThe FTP service in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows attackers who have established an FTP session to cause a denial of service via a specially crafted status request containing glob characters.CVE-2002-0073ACCEPTED4Microsoft Windows NTInternet Information Server 4.0Tiffany BergeronDirectory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "\" characters twice.CVE-2001-0333ACCEPTED2Microsoft Windows 2000Windows 2000Tiffany BergeronChristine WalzerINTERIMACCEPTEDWindows 2000 allows local users to prevent the application of new group policy settings by opening Group Policy files with exclusive-read access.CVE-2002-0051ACCEPTED3Microsoft Windows 2000Internet Information Server 5.0Tiffany BergeronACCEPTEDBuffer overflow in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers and cause a denial of service or execute arbitrary code via HTTP header field values.CVE-2002-0150ACCEPTED3Microsoft Windows 2000Internet Explorer 5.5 Service Pack 2David ProulxInternet Explorer 5.01, 5.5 and 6.0 allows remote attackers to read arbitrary files via malformed requests to the GetObject function, which bypass some of GetObject's security checks.CVE-2002-0023ACCEPTED3Sun Solaris 7rpc.rwalldDavid ProulxFormat string vulnerability in RPC wall daemon (rpc.rwalld) for Solaris 2.5.1 through 8 allows remote attackers to execute arbitrary code via format strings in a message that is not properly provided to the syslog function when the wall command cannot be executed.CVE-2002-0573ACCEPTED1Sun Solaris 7libnslDavid ProulxInteger overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd.CVE-2002-0391ACCEPTED1Sun Solaris 7cachefsdDavid ProulxBrian SobyINTERIMACCEPTEDBuffer overflow in the fscache_setup function of cachefsd in Solaris 2.6, 7, and 8 allows local users to gain root privileges via a long mount argument.CVE-2002-0084ACCEPTED2Microsoft Windows 2000Internet Information Server 5.0Tiffany BergeronIIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability.CVE-2000-0884ACCEPTED2Microsoft Windows NTInternet Information Server 4.0Tiffany BergeronACCEPTEDBuffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server (IIS) 4.0 and 5.0 allows attackers to cause a denial of service or execute arbitrary code via HTR requests with long variable names.CVE-2002-0071ACCEPTED3Microsoft Windows 2000Internet Information Server 5.0Tiffany BergeronCross-site scripting vulnerability in Help File search facility for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to embed scripts into another user's session.CVE-2002-0074ACCEPTED2Sun Solaris 8whodoDavid ProulxBuffer overflow in whodo in Solaris SunOS 5.5.1 through 5.8 allows local users to execute arbitrary code via a long (1) SOR or (2) CFIME environment variable.CVE-2001-1076ACCEPTED1Sun Solaris 7admintoolDavid ProulxBuffer overflow in admintool in Solaris 2.6, 7, and 8 allows local users to gain root privileges via a long media installation path.CVE-2002-0088ACCEPTED1Microsoft Windows 2000Internet Explorer 5.01David ProulxMicrosoft Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model to run malicious script or arbitrary programs via dialog boxes, aka "Improper Cross Domain Security Validation with dialog box."CVE-2003-1326ACCEPTED2Microsoft Windows 2000Internet Explorer 5.01, Internet Explorer 5.01 Service Pack 1, or Internet Explorer 5.01 Service Pack 2David ProulxInternet Explorer 5.01, 5.5 and 6.0 allows remote attackers to read arbitrary files via malformed requests to the GetObject function, which bypass some of GetObject's security checks.CVE-2002-0023ACCEPTED3Red Hat Linux 9EOGJay BealeINTERIMJay BealeACCEPTEDFormat string vulnerability in Eye Of Gnome (EOG) allows attackers to execute arbitrary code via format string specifiers in a command line argument for the file to display.CVE-2003-0165ACCEPTED1Red Hat Linux 9EtherealJay BealeINTERIMJay BealeACCEPTEDFormat string vulnerability in packet-socks.c of the SOCKS dissector for Ethereal 0.8.7 through 0.9.9 allows remote attackers to execute arbitrary code via SOCKS packets containing format string specifiers.CVE-2003-0081ACCEPTED1Red Hat Linux 9EtherealJay BealeINTERIMJay BealeACCEPTEDHeap-based buffer overflow in the NTLMSSP code for Ethereal 0.9.9 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code.CVE-2003-0159ACCEPTED1Sun Solaris 8rpc.yppasswddDavid ProulxBuffer overflow in rpc.yppasswdd (yppasswd server) in Solaris 2.6, 7 and 8 allows remote attackers to gain root access via a long username.CVE-2001-0779ACCEPTED1Microsoft Windows 2000Internet Explorer 6.0David ProulxChristine WalzerINTERIMACCEPTEDThe showHelp() function in Microsoft Internet Explorer 5.01, 5.5, and 6.0 supports certain types of pluggable protocols that allow remote attackers to bypass the cross-domain security model and execute arbitrary code, aka "Improper Cross Domain Security Validation with ShowHelp functionality."CVE-2003-1328ACCEPTED3Microsoft Windows NTInternet Information Server 4.0Tiffany BergeronCross-site scripting vulnerability for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other web users via the error message used in a URL redirect (""302 Object Moved") message.CVE-2002-0075ACCEPTED1Microsoft Windows 2000Remote Procedure Call (RPC)Tiffany BergeronChristine WalzerINTERIMACCEPTEDThe RPC component in Windows 2000, Windows NT 4.0, and Windows XP allows remote attackers to cause a denial of service (disabled RPC service) via a malformed packet to the RPC Endpoint Mapper at TCP port 135, which triggers a null pointer dereference.CVE-2002-1561ACCEPTED2Sun Solaris 8admintoolDavid ProulxBuffer overflow in admintool in Solaris 2.6, 7, and 8 allows local users to gain root privileges via a long media installation path.CVE-2002-0088ACCEPTED1Microsoft Windows NTRemote Access Service (RAS)Tiffany BergeronBuffer overflow in Remote Access Service (RAS) phonebook for Windows NT 4.0, 2000, XP, and Routing and Remote Access Server (RRAS) allows local users to execute arbitrary code by modifying the rasphone.pbk file to use a long dial-up entry.CVE-2002-0366ACCEPTED1Sun Solaris 7mibiisaDavid ProulxBuffer overflow in the MIB parsing component of mibiisa for Solaris 5.6 through 8 allows remote attackers to gain root privileges.CVE-2002-0797ACCEPTED1Microsoft Windows 2000Remote Access Service (RAS)Tiffany BergeronBuffer overflow in Remote Access Service (RAS) phonebook for Windows NT 4.0, 2000, XP, and Routing and Remote Access Server (RRAS) allows local users to execute arbitrary code by modifying the rasphone.pbk file to use a long dial-up entry.CVE-2002-0366ACCEPTED2Microsoft Windows 2000Windows 2000Tiffany BergeronTiffany BergeronACCEPTEDINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDIn Microsoft Windows NT and Windows 2000, a trusting domain that receives authorization information from a trusted domain does not verify that the trusted domain is authoritative for all listed SIDs, which could allows remote attackers to gain Domain Administrator privileges on the trusting domain by injecting SIDs from untrusted domains into the authorization data that comes from from the trusted domain.CVE-2002-0018ACCEPTED4Sun Solaris 7kcms_configureDavid Proulxkcms_configure as included with Solaris 7 and 8 allows a local attacker to gain additional privileges via a buffer overflow in a command line argument.CVE-2001-0594ACCEPTED1Microsoft Windows 2000Internet Information Server 5.0David ProulxChristine WalzerINTERIMACCEPTEDCross-site scripting vulnerability (XSS) in the ASP function responsible for redirection in Microsoft Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to embed a URL containing script in a redirection message.CVE-2003-0223ACCEPTED2Sun Solaris 8admintoolDavid ProulxBuffer overflow in admintool in Solaris 2.5 through 8 allows local users to gain root privileges via long arguments to (1) the -d command line option, or (2) the PRODVERS argument in the .cdtoc file.CVE-2002-0089ACCEPTED1Sun Solaris 7admintoolDavid ProulxBuffer overflow in admintool in Solaris 2.5 through 8 allows local users to gain root privileges via long arguments to (1) the -d command line option, or (2) the PRODVERS argument in the .cdtoc file.CVE-2002-0089ACCEPTED1Red Hat Linux 9EtherealJay BealeINTERIMJay BealeACCEPTEDMultiple off-by-one vulnerabilities in Ethereal 0.9.11 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) AIM, (2) GIOP Gryphon, (3) OSPF, (4) PPTP, (5) Quake, (6) Quake2, (7) Quake3, (8) Rsync, (9) SMB, (10) SMPP, and (11) TSP dissectors, which do not properly use the tvb_get_nstringz and tvb_get_nstringz0 functions.CVE-2003-0356ACCEPTED1Sun Solaris 8dtspcdDavid ProulxBuffer overflow in the client connection routine of libDtSvc.so.1 in CDE Subprocess Control Service (dtspcd) allows remote attackers to execute arbitrary commandsCVE-2001-0803ACCEPTED1Microsoft Windows 2000Microsoft SQL Server 2000Yi-Fang KohACCEPTEDJonathan BakerJonathan BakerINTERIMACCEPTEDAn SQL query method in Microsoft SQL Server 2000 Gold and 7.0 using Mixed Mode allows local database users to gain privileges by reusing a cached connection of the sa administrator account.CVE-2001-0344ACCEPTED2Microsoft Windows NTInternet Information Server 4.0Tiffany BergeronACCEPTEDBuffer overflow in the ASP data transfer mechanism in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code, aka "Microsoft-discovered variant of Chunked Encoding buffer overrun."CVE-2002-0147ACCEPTED3Red Hat Linux 9EtherealJay BealeINTERIMJay BealeACCEPTEDMultiple integer overflow vulnerabilities in Ethereal 0.9.11 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) Mount and (2) PPP dissectors.CVE-2003-0357ACCEPTED1Sun Solaris 7dtspcdDavid ProulxBuffer overflow in the client connection routine of libDtSvc.so.1 in CDE Subprocess Control Service (dtspcd) allows remote attackers to execute arbitrary commandsCVE-2001-0803ACCEPTED1Red Hat Linux 9EtherealJay BealeINTERIMJay BealeACCEPTEDUnknown vulnerability in the DCERPC (DCE/RPC) dissector in Ethereal 0.9.12 and earlier allows remote attackers to cause a denial of service (memory consumption) via a certain NDR string.CVE-2003-0428ACCEPTED1Microsoft Windows 2000Windows 2000Tiffany Bergeronsmss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges by duplicating a handle to a privileged process, as demonstrated by DebPloit.CVE-2002-0367ACCEPTED2Microsoft Windows 2000Internet Explorer 5.5 or Internet Explorer 5.5 Service Pack 1David ProulxInternet Explorer 5.01, 5.5 and 6.0 allows remote attackers to read arbitrary files via malformed requests to the GetObject function, which bypass some of GetObject's security checks.CVE-2002-0023ACCEPTED3Microsoft Windows 2000Internet Information Server 5.0Tiffany BergeronTiffany BergeronACCEPTEDINTERIMACCEPTEDDirectory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "\" characters twice.CVE-2001-0333ACCEPTED3Sun Solaris 8rpc.rwalldDavid ProulxFormat string vulnerability in RPC wall daemon (rpc.rwalld) for Solaris 2.5.1 through 8 allows remote attackers to execute arbitrary code via format strings in a message that is not properly provided to the syslog function when the wall command cannot be executed.CVE-2002-0573ACCEPTED1Sun Solaris 7CDEDavid ProulxCDE ToolTalk database server (ttdbserver) allows local users to overwrite arbitrary files via a symlink attack on the transaction log file used by the _TT_TRANSACTION RPC procedure.CVE-2002-0678ACCEPTED1Microsoft Windows NTInternet Information Server 4.0Tiffany BergeronCross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page.CVE-2002-0148ACCEPTED1Microsoft Windows 2000Microsoft SQL Server 2000Tiffany BergeronJonathan BakerINTERIMIngrid SkoogACCEPTEDChristine WalzerINTERIMACCEPTEDVulnerabilities in RPC servers in (1) Microsoft Exchange Server 2000 and earlier, (2) Microsoft SQL Server 2000 and earlier, (3) Windows NT 4.0, and (4) Windows 2000 allow remote attackers to cause a denial of service via malformed inputs.CVE-2001-0509ACCEPTED3Microsoft Windows 2000Microsoft SQL ServerYi-Fang KohIngrid SkoogINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDBuffer overflows in Microsoft SQL Server 7.0 and 2000 allow attackers with access to SQL Server to execute arbitrary code through the functions (1) raiserror, (2) formatmessage, or (3) xp_sprintf. NOTE: the C runtime format string vulnerability reported in MS01-060 is identified by CVE-2001-0879.CVE-2001-0542ACCEPTED3Red Hat Linux 9EtherealJay BealeINTERIMJay BealeACCEPTEDThe OSI dissector in Ethereal 0.9.12 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via invalid IPv4 or IPv6 prefix lengths, possibly triggering a buffer overflow.CVE-2003-0429ACCEPTED1Sun Solaris 8lbxproxyDavid ProulxBuffer overflow in Low BandWidth X proxy (lbxproxy) in Solaris 8 allows local users to execute arbitrary code via a long display command line option.CVE-2002-0090ACCEPTED1Microsoft Windows NTSimple Network Management Protocol (SNMP)Harvey RubinovitzVulnerabilities in the SNMPv1 request handling of a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via (1) GetRequest, (2) GetNextRequest, and (3) SetRequest messages, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor. This and other SNMP-related candidates will be updated when more accurate information is available.CVE-2002-0013ACCEPTED1Red Hat Linux 9EtherealJay BealeINTERIMJay BealeACCEPTEDThe SPNEGO dissector in Ethereal 0.9.12 and earlier allows remote attackers to cause a denial of service (crash) via an invalid ASN.1 value.CVE-2003-0430ACCEPTED1Microsoft Windows 2000Multiple UNC Provider (MUP)Tiffany BergeronBuffer overflow in Multiple UNC Provider (MUP) in Microsoft Windows operating systems allows local users to cause a denial of service or possibly gain SYSTEM privileges via a long UNC request.CVE-2002-0151ACCEPTED2Microsoft Windows 2000Internet Information Server 5.0Tiffany BergeronINTERIMIngrid SkoogACCEPTEDIIS 5.0 allows remote attackers to cause a denial of service via a series of malformed WebDAV requests.CVE-2001-0151ACCEPTED3Sun Solaris 7CDEDavid ProulxCDE ToolTalk database server (ttdbserver) allows remote attackers to overwrite arbitrary memory locations with a zero, and possibly gain privileges, via a file descriptor argument in an AUTH_UNIX procedure call, which is used as a table index by the _TT_ISCLOSE procedure.CVE-2002-0677ACCEPTED1Microsoft Windows 2000Internet Information Server 5.0Harvey RubinovitzCross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page.CVE-2002-0148ACCEPTED1Sun Solaris 8mibiisaDavid ProulxBuffer overflow in the MIB parsing component of mibiisa for Solaris 5.6 through 8 allows remote attackers to gain root privileges.CVE-2002-0797ACCEPTED1Microsoft Windows 2000Internet Information Server 5.0Tiffany BergeronACCEPTEDBuffer overflow in ASP Server-Side Include Function in IIS 4.0, 5.0 and 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via long file names.CVE-2002-0149ACCEPTED3Microsoft Windows 2000Internet Explorer 6.0Andrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDThe zone determination function in Microsoft Internet Explorer 5.5 and 6.0 allows remote attackers to run scripts in the Local Computer zone by embedding the script in a cookie, aka the "Cookie-based Script Execution" vulnerability.CVE-2002-0078ACCEPTED5Sun Solaris 8cachefsdDavid ProulxBrian SobyBrian SobyINTERIMACCEPTEDBuffer overflow in the fscache_setup function of cachefsd in Solaris 2.6, 7, and 8 allows local users to gain root privileges via a long mount argument.CVE-2002-0084ACCEPTED2Microsoft Windows 2000Internet Explorer 6.0David ProulxChristine WalzerINTERIMACCEPTEDBuffer overflow in gopher client for Microsoft Internet Explorer 5.1 through 6.0, Proxy Server 2.0, or ISA Server 2000 allows remote attackers to execute arbitrary code via a gopher:// URL that redirects the user to a real or simulated gopher server that sends a long response.CVE-2002-0371ACCEPTED3Microsoft Windows 2000Internet Explorer 6.0Andrew ButtnerChristine WalzerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDMicrosoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that cause the application for the spoofed file type to pass the file back to the operating system for handling rather than raise an error message, aka the first variant of the "Content Disposition" vulnerability.CVE-2002-0193ACCEPTED5Red Hat Linux 9EtherealJay BealeINTERIMJay BealeACCEPTEDThe tvb_get_nstringz0 function in Ethereal 0.9.12 and earlier does not properly handle a zero-length buffer size, with unknown consequences.CVE-2003-0431ACCEPTED1Sun Solaris 7rpc.yppasswddDavid ProulxBuffer overflow in rpc.yppasswdd (yppasswd server) in Solaris 2.6, 7 and 8 allows remote attackers to gain root access via a long username.CVE-2001-0779ACCEPTED1Microsoft Windows NTLocator serviceTiffany BergeronBuffer overflow in the RPC Locator service for Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows local users to execute arbitrary code via an RPC call to the service containing certain parameter information.CVE-2003-0003ACCEPTED1Red Hat Linux 9EtherealJay BealeINTERIMJay BealeACCEPTEDEthereal 0.9.12 and earlier does not handle certain strings properly, with unknown consequences, in the (1) BGP, (2) WTP, (3) DNS, (4) 802.11, (5) ISAKMP, (6) WSP, (7) CLNP, (8) ISIS, and (9) RMI dissectors.CVE-2003-0432ACCEPTED1Red Hat Linux 9Ximian EvolutionJay BealeINTERIMJay BealeACCEPTEDThe try_uudecoding function in mail-format.c for Ximian Evolution Mail User Agent 1.2.2 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a malicious uuencoded (UUE) header, possibly triggering a heap-based buffer overflow.CVE-2003-0128ACCEPTED1Red Hat Linux 9Ximian EvolutionJay BealeINTERIMJay BealeACCEPTEDXimian Evolution Mail User Agent 1.2.2 and earlier allows remote attackers to cause a denial of service (memory consumption) via a mail message that is uuencoded multiple times.CVE-2003-0129ACCEPTED1Microsoft Windows 2000Windows 2000Tiffany BergeronBuffer overflow in ntdll.dll on Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers to execute arbitrary code, as demonstrated via a WebDAV request to IIS 5.0.CVE-2003-0109ACCEPTED2Red Hat Linux 9Ximian EvolutionJay BealeINTERIMJay BealeACCEPTEDThe handle_image function in mail-format.c for Ximian Evolution Mail User Agent 1.2.2 and earlier does not properly escape HTML characters, which allows remote attackers inject arbitrary data and HTML via a MIME Content-ID header in a MIME-encoded image.CVE-2003-0130ACCEPTED1Red Hat Linux 9GDMJay BealeINTERIMACCEPTEDGDM before 2.4.1.6, when using the "examine session errors" feature, allows local users to read arbitrary files via a symlink attack on the ~/.xsession-errors file.CVE-2003-0547ACCEPTED1Red Hat Linux 9GDMJay BealeINTERIMACCEPTEDThe X Display Manager Control Protocol (XDMCP) support for GDM before 2.4.1.6 allows attackers to cause a denial of service (daemon crash) when a chosen host expires, a different issue than CVE-2003-0549.CVE-2003-0548ACCEPTED1Sun Solaris 7snmpdxDavid ProulxFormat string vulnerability in the logging component of snmpdx for Solaris 5.6 through 8 allows remote attackers to gain root privileges.CVE-2002-0796ACCEPTED1Microsoft Windows 2000ISA Server 2000Tiffany BergeronACCEPTEDCross-site scripting (XSS) vulnerability in Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to inject arbitrary web script via a URL containing the script in the domain name portion, which is not properly cleansed in the default error pages (1) 500.htm for "500 Internal Server error" or (2) 404.htm for "404 Not Found."CVE-2003-0526ACCEPTED1Microsoft Windows 2000SMB (Server Message Block)Tiffany BergeronACCEPTEDBuffer overflow in the SMB capability for Microsoft Windows XP, 2000, and NT allows remote attackers to cause a denial of service and possibly execute arbitrary code via an SMB packet that specifies a smaller buffer length than is required.CVE-2003-0345ACCEPTED1Sun Solaris 7kcms_serverDavid ProulxDirectory traversal vulnerability in Sun Kodak Color Management System (KCMS) library service daemon (kcms_server) allows remote attackers to read arbitrary files via the KCS_OPEN_PROFILE procedure.CVE-2003-0027ACCEPTED1Microsoft Windows 2000SQL Server 2000Yi-Fang KohIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogINTERIMACCEPTEDBuffer overflows in extended stored procedures for Microsoft SQL Server 7.0 and 2000 allow remote attackers to cause a denial of service or execute arbitrary code via a database query with certain long arguments.CVE-2002-0154ACCEPTED2Microsoft Windows 2000Windows 2000Tiffany BergeronTiffany BergeronACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.01 through 6.0 does not properly handle object tags returned from a Web server during XML data binding, which allows remote attackers to execute arbitrary code via an HTML e-mail message or web page.CVE-2003-0809ACCEPTED2Sun Solaris 7cachefsdDavid ProulxBrian SobyINTERIMACCEPTEDHeap-based buffer overflow in cfsd_calloc function of Solaris cachefsd allows remote attackers to execute arbitrary code via a request with a long directory and cache name.CVE-2002-0033ACCEPTED2Microsoft Windows 2000Internet Explorer 6.0Andrew ButtnerChristine WalzerINTERIMACCEPTEDMicrosoft Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model to run malicious script or arbitrary programs via dialog boxes, aka "Improper Cross Domain Security Validation with dialog box."CVE-2003-1326ACCEPTED3Microsoft Windows 2000Remote Procedure Call (RPC)Tiffany BergeronACCEPTEDHeap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed RPC request with a long filename parameter, a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0715.CVE-2003-0528ACCEPTED1Red Hat Linux 9GDMJay BealeINTERIMACCEPTEDThe X Display Manager Control Protocol (XDMCP) support for GDM before 2.4.1.6 allows attackers to cause a denial of service (daemon crash) via a short authorization key name.CVE-2003-0549ACCEPTED1Microsoft Windows 2000Internet Information Server 5.0Tiffany BergeronACCEPTEDBuffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server (IIS) 4.0 and 5.0 allows attackers to cause a denial of service or execute arbitrary code via HTR requests with long variable names.CVE-2002-0071ACCEPTED3Sun Solaris 7xlockDavid ProulxHeap overflow in xlock in Solaris 2.6 through 8 allows local users to gain root privileges via a long (1) XFILESEARCHPATH or (2) XUSERFILESEARCHPATH environmental variable.CVE-2001-0652ACCEPTED1Microsoft Windows NTInternet Information Server 4.0Tiffany BergeronACCEPTEDBuffer overflow in ASP Server-Side Include Function in IIS 4.0, 5.0 and 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via long file names.CVE-2002-0149ACCEPTED3Red Hat Linux 9GNU GhostscriptJay BealeINTERIMJay BealeACCEPTEDUnknown vulnerability in GNU Ghostscript before 7.07 allows attackers to execute arbitrary commands, even when -dSAFER is enabled, via a PostScript file that causes the commands to be executed from a malicious print job.CVE-2003-0354ACCEPTED1Microsoft Windows 2000Windows Script Engine for JscriptDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInteger overflow in JsArrayFunctionHeapSort function used by Windows Script Engine for JScript (JScript.dll) on various Windows operating system allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail that uses a large array index value that enables a heap-based buffer overflow attack.CVE-2003-0010ACCEPTED2Red Hat Linux 9GnuPGJay BealeINTERIMJay BealeACCEPTEDThe key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path.CVE-2003-0255ACCEPTED1Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Microsoft Virtual Machine (VM)Tiffany BergeronINTERIMACCEPTEDThe ByteCode Verifier component of Microsoft Virtual Machine (VM) build 5.0.3809 and earlier, as used in Windows and Internet Explorer, allows remote attackers to bypass security checks and execute arbitrary code via a malicious Java applet, aka "Flaw in Microsoft VM Could Enable System Compromise."CVE-2003-0111ACCEPTED1Microsoft Windows NTInternet Information Server 4.0Tiffany BergeronACCEPTEDBuffer overflow in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers and cause a denial of service or execute arbitrary code via HTTP header field values.CVE-2002-0150ACCEPTED3Red Hat Linux 9GtkHTMLJay BealeINTERIMACCEPTEDGtkHTML, as included in Evolution before 1.2.4, allows remote attackers to cause a denial of service (crash) via certain malformed messages.CVE-2003-0133ACCEPTED1Microsoft Windows NTSimple Network Management Protocol (SNMP)Matt BusbyINTERIMACCEPTEDThe default permissions for the SNMP Parameters registry key in Windows NT 4.0 allows remote attackers to read and possibly modify the SNMP community strings to obtain sensitive information or modify network configuration, aka one of the "Registry Permissions" vulnerabilities.CVE-2001-0046ACCEPTED1Microsoft Windows NTMicrosoft Transaction Server (MTS)Matt BusbyINTERIMACCEPTEDThe default permissions for the MTS Package Administration registry key in Windows NT 4.0 allows local users to install or modify arbitrary Microsoft Transaction Server (MTS) packages and gain privileges, aka one of the "Registry Permissions" vulnerabilities.CVE-2001-0047ACCEPTED1Microsoft Windows 2000Internet Explorer 5.01, Internet Explorer 5.01 Service Pack 1Tiffany BergeronAndrew ButtnerACCEPTEDHTML e-mail feature in Internet Explorer 5.5 and earlier allows attackers to execute attachments by setting an unusual MIME type for the attachment, which Internet Explorer does not process correctly.CVE-2001-0154ACCEPTED2Microsoft Windows NTWindows kernelChristine WalzerDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDBuffer overflow in Windows Kernel allows local users to gain privileges by causing certain error messages to be passed to a debugger.CVE-2003-0112ACCEPTED2Microsoft Windows 2000Internet Explorer 6.0Harvey RubinovitzChristine WalzerINTERIMACCEPTEDInternet Explorer 5.01 through 6.0 does not properly perform security checks on certain encoded characters within a URL, which allows a remote attacker to steal potentially sensitive information from a user by redirecting the user to another site that has that information, aka "Encoded Characters Information Disclosure."CVE-2002-1186ACCEPTED2Microsoft Windows 2000Simple Network Management Protocol (SNMP)Harvey RubinovitzVulnerabilities in a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via SNMPv1 trap handling, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor. This and other SNMP-related candidates will be updated when more accurate information is available.CVE-2002-0012ACCEPTED1Microsoft Windows NTMultiple UNC Provider (MUP)Tiffany BergeronBuffer overflow in Multiple UNC Provider (MUP) in Microsoft Windows operating systems allows local users to cause a denial of service or possibly gain SYSTEM privileges via a long UNC request.CVE-2002-0151ACCEPTED1Microsoft Windows NTSMB (Server Message Block)Christine WalzerDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDBuffer overflow in the SMB capability for Microsoft Windows XP, 2000, and NT allows remote attackers to cause a denial of service and possibly execute arbitrary code via an SMB packet that specifies a smaller buffer length than is required.CVE-2003-0345ACCEPTED2Microsoft Windows 2000Windows ShellChristine WalzerChristine WalzerINTERIMACCEPTEDBuffer overflow in Windows Shell (used as the Windows Desktop) allows local and possibly remote attackers to execute arbitrary code via a custom URL handler that has not been removed for an application that has been improperly uninstalled.CVE-2002-0070ACCEPTED2Red Hat Linux 9GtkHTMLJay BealeINTERIMJay BealeACCEPTEDgtkhtml before 1.1.10, as used in Evolution, allows remote attackers to cause a denial of service (crash) via a malformed message that causes a null pointer dereference.CVE-2003-0541ACCEPTED1Sun Solaris 8fs.auto, xfsDavid ProulxBuffer overflow in Dispatch() routine for XFS font server (fs.auto) on Solaris 2.5.1 through 9 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a certain XFS query.CVE-2002-1317ACCEPTED2Red Hat Linux 9ApacheJay BealeINTERIMJay BealeACCEPTEDApache does not filter terminal escape sequences from its error logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences.CVE-2003-0020ACCEPTED1Red Hat Linux 9ApacheJay BealeINTERIMJay BealeACCEPTEDApache 1.3 before 1.3.25 and Apache 2.0 before version 2.0.46 does not filter terminal escape sequences from its access logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences, a different vulnerability than CVE-2003-0020.CVE-2003-0083ACCEPTED1Sun Solaris 7fs.auto, xfsDavid ProulxBuffer overflow in Dispatch() routine for XFS font server (fs.auto) on Solaris 2.5.1 through 9 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a certain XFS query.CVE-2002-1317ACCEPTED2Red Hat Linux 9ApacheJay BealeINTERIMJay BealeACCEPTEDA memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed.CVE-2003-0132ACCEPTED1Microsoft Windows NTWindows NT 4.0Tiffany Bergeronsmss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges by duplicating a handle to a privileged process, as demonstrated by DebPloit.CVE-2002-0367ACCEPTED1Microsoft Windows NTWindows NT 4.0Tiffany BergeronIn Microsoft Windows NT and Windows 2000, a trusting domain that receives authorization information from a trusted domain does not verify that the trusted domain is authoritative for all listed SIDs, which could allows remote attackers to gain Domain Administrator privileges on the trusting domain by injecting SIDs from untrusted domains into the authorization data that comes from from the trusted domain.CVE-2002-0018ACCEPTED1Microsoft Windows NTSimple Network Management Protocol (SNMP)Harvey RubinovitzVulnerabilities in a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via SNMPv1 trap handling, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor. This and other SNMP-related candidates will be updated when more accurate information is available.CVE-2002-0012ACCEPTED1Red Hat Enterprise Linux 3OpenSSLJay BealeDRAFTINTERIMACCEPTEDThe der_chop script in the openssl package in Trustix Secure Linux 1.5 through 2.1 and other operating systems allows local users to overwrite files via a symlink attack on temporary files.CVE-2004-0975ACCEPTED1Microsoft Windows Server 2003Microsoft Outlook ExpressIngrid SkoogDRAFTINTERIMACCEPTEDStack-based buffer overflow in the news reader for Microsoft Outlook Express (MSOE.DLL) 5.5 SP2, 6, and 6 SP1 allows remote malicious NNTP servers to execute arbitrary code via a LIST response with a long second field.CVE-2005-1213ACCEPTED1Red Hat Linux 9ApacheJay BealeINTERIMJay BealeACCEPTEDApache 2 before 2.0.47, and certain versions of mod_ssl for Apache 1.3, do not properly handle "certain sequences of per-directory renegotiations and the SSLCipherSuite directive being used to upgrade from a weak ciphersuite to a strong one," which could cause Apache to use the weak ciphersuite.CVE-2003-0192ACCEPTED1Red Hat Linux 9ApacheJay BealeINTERIMJay BealeACCEPTEDThe prefork MPM in Apache 2 before 2.0.47 does not properly handle certain errors from accept, which could lead to a denial of service.CVE-2003-0253ACCEPTED1Sun Solaris 8CDEDavid ProulxCDE ToolTalk database server (ttdbserver) allows local users to overwrite arbitrary files via a symlink attack on the transaction log file used by the _TT_TRANSACTION RPC procedure.CVE-2002-0678ACCEPTED1Sun Solaris 7CDEDavid ProulxBuffer overflow in Common Desktop Environment (CDE) ToolTalk RPC database server (rpc.ttdbserverd) allows remote attackers to execute arbitrary code via an argument to the _TT_CREATE_FILE procedure.CVE-2002-0679ACCEPTED1Microsoft Windows 2000Internet Explorer 5.5Andrew ButtnerMicrosoft Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model to run malicious script or arbitrary programs via dialog boxes, aka "Improper Cross Domain Security Validation with dialog box."CVE-2003-1326ACCEPTED2Sun Solaris 7lbxproxyDavid ProulxBuffer overflow in Low BandWidth X proxy (lbxproxy) in Solaris 8 allows local users to execute arbitrary code via a long display command line option.CVE-2002-0090ACCEPTED1Microsoft Windows NTInternet Information Server 4.0Tiffany BergeronACCEPTEDBuffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request sessions, aka "Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise."CVE-2002-0364ACCEPTED3Red Hat Linux 9ApacheJay BealeINTERIMJay BealeACCEPTEDApache 2 before 2.0.47, when running on an IPv6 host, allows attackers to cause a denial of service (CPU consumption by infinite loop) when the FTP proxy server fails to create an IPv6 socket.CVE-2003-0254ACCEPTED1Microsoft Windows XPAuthenticodeTiffany BergeronAndrew ButtnerAndrew ButtnerACCEPTEDChristine WalzerChristine WalzerINTERIMACCEPTEDThe Authenticode capability in Microsoft Windows NT through Server 2003 does not prompt the user to download and install ActiveX controls when the system is low on memory, which could allow remote attackers execute arbitrary code without user approval.CVE-2003-0660ACCEPTED2Microsoft Windows 2000Microsoft Word 2000Christine WalzerChristine WalzerChristine WalzerDRAFTINTERIMACCEPTEDIngrid SkoogINTERIMACCEPTEDMicrosoft Word 2002, 2000, 97, and 98(J) does not properly check certain properties of a document, which allows attackers to bypass the macro security model and automatically execute arbitrary macros via a malicious document.CVE-2003-0664ACCEPTED2Microsoft Windows 2000SMB (Server Message Block)Christine WalzerChristine WalzerINTERIMACCEPTEDBuffer overflow in SMB (Server Message Block) protocol in Microsoft Windows NT, Windows 2000, and Windows XP allows attackers to cause a denial of service (crash) via a SMB_COM_TRANSACTION packet with a request for the (1) NetShareEnum, (2) NetServerEnum2, or (3) NetServerEnum3, aka "Unchecked Buffer in Network Share Provider Can Lead to Denial of Service".CVE-2002-0724ACCEPTED2Microsoft Windows 2000Certificate Enrollment ControlChristine WalzerACCEPTEDChristine WalzerINTERIMACCEPTEDUnknown vulnerability in the Certificate Enrollment ActiveX Control in Microsoft Windows 98, Windows 98 Second Edition, Windows Millennium, Windows NT 4.0, Windows 2000, and Windows XP allow remote attackers to delete digital certificates on a user's system via HTML.CVE-2002-0699ACCEPTED2Microsoft Windows 2000Internet Information Server 5.0Tiffany BergeronIIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with operating system commands, aka the "Web Server File Request Parsing" vulnerability.CVE-2000-0886ACCEPTED3Sun Solaris 8CDEDavid ProulxBuffer overflow in Common Desktop Environment (CDE) ToolTalk RPC database server (rpc.ttdbserverd) allows remote attackers to execute arbitrary code via an argument to the _TT_CREATE_FILE procedure.CVE-2002-0679ACCEPTED1Red Hat Linux 9KDMJay BealeINTERIMACCEPTEDKDM in KDE 3.1.3 and earlier does not verify whether the pam_setcred function call succeeds, which may allow attackers to gain root privileges by triggering error conditions within PAM modules, as demonstrated in certain configurations of the MIT pam_krb5 module.CVE-2003-0690ACCEPTED1Microsoft Windows NTRemote Procedure Call (RPC)Christine WalzerDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDBuffer overflow in a certain DCOM interface for RPC in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a malformed message, as exploited by the Blaster/MSblast/LovSAN and Nachi/Welchia worms.CVE-2003-0352ACCEPTED3Sun Solaris 8kcms_serverDavid ProulxDirectory traversal vulnerability in Sun Kodak Color Management System (KCMS) library service daemon (kcms_server) allows remote attackers to read arbitrary files via the KCS_OPEN_PROFILE procedure.CVE-2003-0027ACCEPTED1Microsoft Windows 2000Internet Information Server 5.0Tiffany BergeronTiffany BergeronACCEPTEDBuffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to Internet Data Administration (.ida) and Internet Data Query (.idq) files such as default.ida, as commonly exploited by Code Red.CVE-2001-0500ACCEPTED3Microsoft Windows 2000Windows 2000Tiffany BergeronTiffany BergeronACCEPTEDThe Authenticode capability in Microsoft Windows NT through Server 2003 does not prompt the user to download and install ActiveX controls when the system is low on memory, which could allow remote attackers execute arbitrary code without user approval.CVE-2003-0660ACCEPTED1Microsoft Windows 2000Remote Data Protocol (RDP)Tiffany BergeronChristine WalzerINTERIMACCEPTEDRemote Data Protocol (RDP) version 5.0 in Microsoft Windows 2000 and RDP 5.1 in Windows XP does not encrypt the checksums of plaintext session data, which could allow a remote attacker to determine the contents of encrypted sessions via sniffing, aka "Weak Encryption in RDP Protocol."CVE-2002-0863ACCEPTED3Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPWindows Script Engine for JScript v5.6Tiffany BergeronDavid ProulxDavid ProulxACCEPTEDChristine WalzerChristine WalzerINTERIMACCEPTEDInteger overflow in JsArrayFunctionHeapSort function used by Windows Script Engine for JScript (JScript.dll) on various Windows operating system allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail that uses a large array index value that enables a heap-based buffer overflow attack.CVE-2003-0010ACCEPTED3Microsoft Windows XPWindows XPTiffany BergeronAndrew ButtnerACCEPTEDChristine WalzerINTERIMACCEPTEDChristine WalzerINTERIMINTERIMACCEPTEDBuffer overflow in a function in User32.dll on Windows NT through Server 2003 allows local users to execute arbitrary code via long (1) LB_DIR messages to ListBox or (2) CB_DIR messages to ComboBox controls in a privileged application.CVE-2003-0659ACCEPTED3Microsoft Windows 2000Microsoft Word 2000Ingrid SkoogDRAFTINTERIMACCEPTEDIngrid SkoogINTERIMACCEPTEDMicrosoft Word and Excel allow remote attackers to steal sensitive information via certain field codes that insert the information when the document is returned to the attacker, as demonstrated in Word using (1) INCLUDETEXT or (2) INCLUDEPICTURE, aka "Flaw in Word Fields and Excel External Updates Could Lead to Information Disclosure."CVE-2002-1143ACCEPTED2Microsoft Windows 2000Internet Explorer 6.0Harvey RubinovitzACCEPTEDChristine WalzerINTERIMACCEPTEDCross-site scripting vulnerability (XSS) in Internet Explorer 5.01 through 6.0 allows remote attackers to read and execute files on the local system via web pages using the <frame> or <iframe> element and javascript, aka "Frames Cross Site Scripting," as demonstrated using the PrivacyPolicy.dlg resource.CVE-2002-1187ACCEPTED2Microsoft Windows 2000Windows 2000Tiffany BergeronAndrew ButtnerACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer allows remote attackers to bypass zone restrictions to inject and execute arbitrary programs by creating a popup window and inserting ActiveX object code with a "data" tag pointing to the malicious code, which Internet Explorer treats as HTML or Javascript, but later executes as an HTA application, a different vulnerability than CVE-2003-0532, and as exploited using the QHosts Trojan horse (aka Trojan.Qhosts, QHosts-1, VBS.QHOSTS, or aolfix.exe).CVE-2003-0838ACCEPTED2Microsoft Windows 2000Microsoft Word 2000Ingrid SkoogIngrid SkoogDRAFTINTERIMACCEPTEDIngrid SkoogINTERIMACCEPTEDMicrosoft Outlook 2000 and 2002, when configured to use Microsoft Word as the email editor, does not block scripts that are used while editing email messages in HTML or Rich Text Format (RTF), which could allow remote attackers to execute arbitrary scripts via an email that the user forwards or replies to.CVE-2002-1056ACCEPTED2Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 2Andrew ButtnerDRAFTINTERIMACCEPTEDDouble-free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image.CVE-2003-1048ACCEPTED1Microsoft Windows Server 2003Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003Tiffany BergeronDRAFTINTERIMACCEPTEDHarvey RubinovitzINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDThe WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute code such as Javascript, as demonstrated using (1) delayed HTTP redirect operations, and an HTTP response with a Location: header containing a "URL:" prepended to a "ms-its" protocol URI, or (2) modifying the location attribute of the window, as exploited by the Download.ject (aka Scob aka Toofer) using the ADODB.Stream object.CVE-2004-0549ACCEPTED3Microsoft Windows 2000Simple Network Management Protocol (SNMP)Tiffany BergeronBuffer overflow in SNMP agent service in Windows 95/98/98SE, Windows NT 4.0, Windows 2000, and Windows XP allows remote attackers to cause a denial of service or execute arbitrary code via a malformed management request. NOTE: this candidate may be split or merged with other candidates. This and other PROTOS-related candidates, especially CVE-2002-0012 and CVE-2002-0013, will be updated when more accurate information is available.CVE-2002-0053ACCEPTED1Microsoft Windows 2000Internet Information Server 5.0Harvey RubinovitzCross-site scripting vulnerability for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other web users via the error message used in a URL redirect (""302 Object Moved") message.CVE-2002-0075ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 3Andrew ButtnerDRAFTINTERIMACCEPTEDDouble-free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image.CVE-2003-1048ACCEPTED1Microsoft Windows 2000Messenger ServiceChristine WalzerACCEPTEDAndrew ButtnerACCEPTEDThe Messenger Service for Windows NT through Server 2003 does not properly verify the length of the message, which allows remote attackers to execute arbitrary code via a buffer overflow attack.CVE-2003-0717ACCEPTED2Red Hat Linux 9KDMJay BealeINTERIMACCEPTEDKDM in KDE 3.1.3 and earlier uses a weak session cookie generation algorithm that does not provide 128 bits of entropy, which allows attackers to guess session cookies via brute force methods and gain access to the user session.CVE-2003-0692ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Ingrid SkoogDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInteger overflow in imgbmp.cxx for Windows 2000 allows remote attackers to execute arbitrary code via a BMP image with a large bfOffBits value.CVE-2004-0566ACCEPTED2Microsoft Windows 2000Help and Support Center (HSC)Christine WalzerACCEPTEDChristine WalzerINTERIMACCEPTEDAndrew ButtnerINTERIMACCEPTEDStack-based buffer overflow in the PCHealth system in the Help and Support Center function in Windows XP and Windows Server 2003 allows remote attackers to execute arbitrary code via a long query in an HCP URL.CVE-2003-0711ACCEPTED3Microsoft Windows NTDirectXChristine WalzerDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDMultiple integer overflows in a Microsoft Windows DirectX MIDI library (QUARTZ.DLL) allow remote attackers to execute arbitrary code via a MIDI (.mid) file with (1) large length for a Text or Copyright string, or (2) a large number of tracks, which leads to a heap-based buffer overflow.CVE-2003-0346ACCEPTED2Microsoft Windows 2000Internet Explorer 5.5Harvey RubinovitzACCEPTEDCross-site scripting vulnerability (XSS) in Internet Explorer 5.01 through 6.0 allows remote attackers to read and execute files on the local system via web pages using the <frame> or <iframe> element and javascript, aka "Frames Cross Site Scripting," as demonstrated using the PrivacyPolicy.dlg resource.CVE-2002-1187ACCEPTED1Red Hat Linux 9krb5Jay BealeINTERIMJay BealeACCEPTEDInteger overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, glibc, and dietlibc, allows remote attackers to execute arbitrary code via certain integer values in length fields, a different vulnerability than CVE-2002-0391.CVE-2003-0028ACCEPTED1Microsoft Windows 2000Microsoft SQL ServerTiffany BergeronIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogINTERIMIngrid SkoogACCEPTEDChristine WalzerChristine WalzerChristine WalzerChristine WalzerChristine WalzerINTERIMACCEPTEDThe xp_displayparamstmt function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability.CVE-2000-1081ACCEPTED3Microsoft Windows 2000SQL Server 2000Yi-Fang KohJonathan BakerINTERIMACCEPTEDINTERIMIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogINTERIMACCEPTEDChristine WalzerChristine WalzerChristine WalzerChristine WalzerChristine WalzerChristine WalzerChristine WalzerINTERIMACCEPTEDMicrosoft SQL Server 7, 2000, and MSDE allows local users go gain privileges by hijacking a named pipe during the authentication of another user, aka the "Named Pipe Hijacking" vulnerability.CVE-2003-0230ACCEPTED4Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Internet Explorer 6 Service Pack 1Andrew ButtnerDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDDouble-free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image.CVE-2003-1048ACCEPTED2Microsoft Windows 2000Windows 2000Tiffany BergeronAndrew ButtnerACCEPTEDBuffer overflow in Troubleshooter ActiveX Control (Tshoot.ocx) in Microsoft Windows 2000 SP4 and earlier allows remote attackers to execute arbitrary code via an HTML document with a long argument to the RunQuery2 method.CVE-2003-0662ACCEPTED1Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Internet Explorer 5.5 Service Pack 2Tiffany BergeronDRAFTINTERIMACCEPTEDThe WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute code such as Javascript, as demonstrated using (1) delayed HTTP redirect operations, and an HTTP response with a Location: header containing a "URL:" prepended to a "ms-its" protocol URI, or (2) modifying the location attribute of the window, as exploited by the Download.ject (aka Scob aka Toofer) using the ADODB.Stream object.CVE-2004-0549ACCEPTED1Red Hat Linux 9krb5Jay BealeINTERIMJay BealeACCEPTEDThe Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes the KDC to corrupt its heap (aka "buffer underrun").CVE-2003-0082ACCEPTED1Microsoft Windows Server 2003Network News Transport Protocol (NNTP)Christine WalzerDRAFTINTERIMACCEPTEDThe Network News Transfer Protocol (NNTP) component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an "unchecked buffer," leading to off-by-one and heap-based buffer overflows.CVE-2004-0574ACCEPTED1Red Hat Linux 9krb5Jay BealeINTERIMJay BealeACCEPTEDVersion 4 of the Kerberos protocol (krb4), as used in Heimdal and other packages, allows an attacker to impersonate any principal in a realm via a chosen-plaintext attack.CVE-2003-0138ACCEPTED1Red Hat Linux 9krb5Jay BealeINTERIMJay BealeACCEPTEDCertain weaknesses in the implementation of version 4 of the Kerberos protocol (krb4) in the krb5 distribution, when triple-DES keys are used to key krb4 services, allow an attacker to create krb4 tickets for unauthorized principals using a cut-and-paste attack and "ticket splicing."CVE-2003-0139ACCEPTED1Microsoft Windows 2000Windows 2000Yi-Fang KohFormat string vulnerability in the C runtime functions in SQL Server 7.0 and 2000 allows attackers to cause a denial of service.CVE-2001-0879ACCEPTED1Red Hat Linux 9Linux kernelJay BealeINTERIMJay BealeACCEPTEDThe kernel module loader in Linux kernel 2.2.x before 2.2.25, and 2.4.x before 2.4.21, allows local users to gain root privileges by using ptrace to attach to a child process that is spawned by the kernel.CVE-2003-0127ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 3Harvey RubinovitzDRAFTHarvey RubinovitzINTERIMACCEPTEDBuffer overflow in the PNG image rendering component of Microsoft Internet Explorer allows remote attackers to execute arbitrary code via a crafted PNG file.CVE-2005-1211ACCEPTED1Microsoft Windows Server 2003SMB (Server Message Block)Jonathan BakerDRAFTINTERIMACCEPTEDBuffer overflow in the Server Message Block (SMB) functionality for Microsoft Windows 2000, XP SP1 and SP2, and Server 2003 and SP1 allows remote attackers to execute arbitrary code via unknown vectors, aka the "Server Message Block Vulnerability."CVE-2005-1206ACCEPTED1Red Hat Linux 9NetfilterJay BealeINTERIMJay BealeACCEPTEDThe connection tracking core of Netfilter for Linux 2.4.20, with CONFIG_IP_NF_CONNTRACK enabled or the ip_conntrack module loaded, allows remote attackers to cause a denial of service (resource consumption) due to an inconsistency with Linux 2.4.20's support of linked lists, which causes Netfilter to fail to identify connections with an UNCONFIRMED status and use large timeouts.CVE-2003-0187ACCEPTED1Red Hat Linux 9NetfilterJay BealeINTERIMJay BealeACCEPTEDThe route cache implementation in Linux 2.4, and the Netfilter IP conntrack module, allows remote attackers to cause a denial of service (CPU consumption) via packets with forged source addresses that cause a large number of hash table collisions.CVE-2003-0244ACCEPTED1Microsoft Windows 2000Windows kernelChristine WalzerDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDBuffer overflow in Windows Kernel allows local users to gain privileges by causing certain error messages to be passed to a debugger.CVE-2003-0112ACCEPTED2Red Hat Enterprise Linux 3GaimJay BealeDRAFTINTERIMACCEPTEDGaim before 1.3.1 allows remote attackers to cause a denial of service (crash) via a malformed MSN message that leads to a memory allocation of a large size, possibly due to an integer signedness error.CVE-2005-1934ACCEPTED1Microsoft Windows 2000Windows 2000Tiffany BergeronACCEPTEDHeap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed DCERPC DCOM object activation request packet with modified length fields, a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0528.CVE-2003-0715ACCEPTED1Microsoft Windows XPClient Server Runtime System (CSRSS)Ingrid SkoogDRAFTINTERIMChristine WalzerACCEPTEDStack-based buffer overflow in WINSRV.DLL in the Client Server Runtime System (CSRSS) process of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application that provides console window information with a long FaceName value.CVE-2005-0551ACCEPTED1Microsoft Windows XPWindows XPTiffany BergeronAndrew ButtnerACCEPTEDChristine WalzerINTERIMACCEPTEDThe Messenger Service for Windows NT through Server 2003 does not properly verify the length of the message, which allows remote attackers to execute arbitrary code via a buffer overflow attack.CVE-2003-0717ACCEPTED2Microsoft Windows 2000Microsoft SQL Server 2000Yi-Fang KohIngrid SkoogIngrid SkoogINTERIMACCEPTEDChristine WalzerChristine WalzerINTERIMACCEPTEDBuffer overflow in SQL Server 7.0 and 2000 allows remote attackers to execute arbitrary code via a long OLE DB provider name to (1) OpenDataSource or (2) OpenRowset in an ad hoc connection.CVE-2002-0056ACCEPTED3Microsoft Windows 2000Internet Explorer 6.0Harvey RubinovitzACCEPTEDChristine WalzerINTERIMACCEPTEDCross-Frame scripting vulnerability in the WebBrowser control as used in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code, read arbitrary files, or conduct other unauthorized activities via script that accesses the Document property, which bypasses <frame> and <iframe> domain restrictions.CVE-2002-1217ACCEPTED2Microsoft Windows 2000SMB Signing (Server Message Block)Christine WalzerACCEPTEDChristine WalzerINTERIMACCEPTEDThe SMB signing capability in the Server Message Block (SMB) protocol in Microsoft Windows 2000 and Windows XP allows attackers to disable the digital signing settings in an SMB session to force the data to be sent unsigned, then inject data into the session without detection, e.g. by modifying group policy information sent from a domain controller.CVE-2002-1256ACCEPTED2Red Hat Linux 9Linux kernelJay BealeINTERIMJay BealeACCEPTEDThe ioperm system call in Linux kernel 2.4.20 and earlier does not properly restrict privileges, which allows local users to gain read or write access to certain I/O ports.CVE-2003-0246ACCEPTED1Microsoft Windows XPWindows Media Player for Windows XPTiffany BergeronACCEPTEDMicrosoft Windows Media Player versions 6.4 and 7.1 and Media Player for Windows XP allow remote attackers to bypass Internet Explorer's (IE) security mechanisms and run code via an executable .wma media file with a license installation requirement stored in the IE cache, aka the "Cache Path Disclosure via Windows Media Player".CVE-2002-0372ACCEPTED1Red Hat Linux 9Linux kernelJay BealeINTERIMJay BealeACCEPTEDUnknown vulnerability in the TTY layer of the Linux kernel 2.4 allows attackers to cause a denial of service ("kernel oops").CVE-2003-0247ACCEPTED1Microsoft Windows XPWindows Media Player for Windows XPTiffany BergeronACCEPTEDBuffer overflow in Microsoft Windows Media Player 6.4 allows remote attackers to execute arbitrary code via a malformed Advanced Streaming Format (ASF) file.CVE-2001-0719ACCEPTED1Microsoft Windows 2000SQL Server 2000Yi-Fang KohIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogINTERIMACCEPTEDBuffer overflow in the password encryption function of Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, allows remote attackers to gain control of the database and execute arbitrary code via SQL Server Authentication, aka "Unchecked Buffer in Password Encryption Procedure."CVE-2002-0624ACCEPTED2Red Hat Linux 9Linux kernelJay BealeINTERIMJay BealeACCEPTEDThe mxcsr code in Linux kernel 2.4 allows attackers to modify CPU state registers via a malformed address.CVE-2003-0248ACCEPTED1Microsoft Windows 95Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000MDAC 2.6Ingrid SkoogDRAFTINTERIMACCEPTEDAndrew ButtnerINTERIMACCEPTEDHeap-based buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) 2.1 through 2.6, and Internet Explorer 5.01 through 6.0, allows remote attackers to execute code via a malformed HTTP request to the Data Stub.CVE-2002-1142ACCEPTED2Red Hat Linux 9Linux kernelJay BealeINTERIMJay BealeACCEPTEDThe TCP/IP fragment reassembly handling in the Linux kernel 2.4 allows remote attackers to cause a denial of service (CPU consumption) via certain packets that cause a large number of hash table collisions.CVE-2003-0364ACCEPTED1Microsoft Windows 2000Remote Procedure Call (RPC)Tiffany BergeronACCEPTEDBuffer overflow in a certain DCOM interface for RPC in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a malformed message, as exploited by the Blaster/MSblast/LovSAN and Nachi/Welchia worms.CVE-2003-0352ACCEPTED1Microsoft Windows 2000Simple Network Management Protocol (SNMP)Harvey RubinovitzHarvey RubinovitzINTERIMACCEPTEDVulnerabilities in the SNMPv1 request handling of a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via (1) GetRequest, (2) GetNextRequest, and (3) SetRequest messages, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor. This and other SNMP-related candidates will be updated when more accurate information is available.CVE-2002-0013ACCEPTED2Microsoft Windows 2000SQL Server 2000Yi-Fang KohJonathan BakerINTERIMACCEPTEDIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogINTERIMACCEPTEDChristine WalzerChristine WalzerChristine WalzerINTERIMACCEPTEDMicrosoft SQL Server 7, 2000, and MSDE allows local or remote authenticated users to cause a denial of service (crash or hang) via a long request to a named pipe.CVE-2003-0231ACCEPTED4Microsoft Windows 2000SQL Server 2000Yi-Fang KohJonathan BakerINTERIMACCEPTEDIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogINTERIMACCEPTEDChristine WalzerChristine WalzerChristine WalzerINTERIMACCEPTEDMicrosoft SQL Server 7, 2000, and MSDE allows local users to execute arbitrary code via a certain request to the Local Procedure Calls (LPC) port that leads to a buffer overflow.CVE-2003-0232ACCEPTED4Red Hat Linux 9/proc/tty/driver/serialJay BealeINTERIMJay BealeACCEPTED/proc/tty/driver/serial in Linux 2.4.x reveals the exact number of characters used in serial links, which could allow local users to obtain potentially sensitive information such as the length of passwords.CVE-2003-0461ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 3Ingrid SkoogDRAFTINTERIMACCEPTEDInteger overflow in imgbmp.cxx for Windows 2000 allows remote attackers to execute arbitrary code via a BMP image with a large bfOffBits value.CVE-2004-0566ACCEPTED1Microsoft Windows 2000Microsoft FrontPage Server Extensions 2000Tiffany BergeronTiffany BergeronINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDUnknown vulnerability in the SmartHTML interpreter (shtml.dll) in Microsoft FrontPage Server Extensions 2000 and 2002, and Microsoft SharePoint Team Services 2002, allows remote attackers to cause a denial of service (response failure) via a certain request.CVE-2003-0824ACCEPTED2Red Hat Linux 9Linux kernelJay BealeINTERIMJay BealeACCEPTEDA race condition in the way env_start and env_end pointers are initialized in the execve system call and used in fs/proc/base.c on Linux 2.4 allows local users to cause a denial of service (crash).CVE-2003-0462ACCEPTED1Red Hat Linux 9Linux kernelJay BealeINTERIMJay BealeACCEPTEDThe RPC code in Linux kernel 2.4 sets the reuse flag when sockets are created, which could allow local users to bind to UDP ports that are used by privileged services such as nfsd.CVE-2003-0464ACCEPTED1Microsoft Windows 2000SQL Server 2000Yi-Fang KohIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogINTERIMACCEPTEDBuffer overflow in bulk insert procedure of Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, allows attackers with database administration privileges to execute arbitrary code via a long filename in the BULK INSERT query.CVE-2002-0641ACCEPTED2Microsoft Windows NTWindows NT 4.0Tiffany BergeronINTERIMACCEPTEDThe getCanonicalPath function in Windows NT 4.0 may free memory that it does not own and cause heap corruption, which allows attackers to cause a denial of service (crash) via requests that cause a long file name to be passed to getCanonicalPath, as demonstrated on the IBM JVM using a long string to the java.io.getCanonicalPath Java method.CVE-2003-0525ACCEPTED2Microsoft Windows XPWindows Media Player for Windows XPTiffany BergeronACCEPTEDDirectory traversal vulnerability in Microsoft Windows Media Player 7.1 and Windows Media Player for Windows XP allows remote attackers to execute arbitrary code via a skins file with a URL containing hex-encoded backslash characters (%5C) that causes an executable to be placed in an arbitrary location.CVE-2003-0228ACCEPTED1Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Internet Explorer 5.5 Service Pack 2Ingrid SkoogDRAFTINTERIMACCEPTEDInteger overflow in imgbmp.cxx for Windows 2000 allows remote attackers to execute arbitrary code via a BMP image with a large bfOffBits value.CVE-2004-0566ACCEPTED1Red Hat Linux 9Linux kernelJay BealeINTERIMJay BealeACCEPTEDThe execve system call in Linux 2.4.x records the file descriptor of the executable process in the file table of the calling process, which allows local users to gain read access to restricted file descriptors.CVE-2003-0476ACCEPTED1Red Hat Linux 9Linux kernelJay BealeINTERIMJay BealeACCEPTEDThe /proc filesystem in Linux allows local users to obtain sensitive information by opening various entries in /proc/self before executing a setuid program, which causes the program to fail to change the ownership and permissions of those entries.CVE-2003-0501ACCEPTED1Microsoft Windows XPMicrosoft Color Management ModuleChristine WalzerDRAFTINTERIMACCEPTEDBuffer overflow in the Microsoft Color Management Module for Windows allows remote attackers to execute arbitrary code via an image with crafted ICC profile format tags.CVE-2005-1219ACCEPTED1Microsoft Windows XPMicrosoft Windows Workstation ServiceAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDStack-based buffer overflow in a logging function for Windows Workstation Service (WKSSVC.DLL) allows remote attackers to execute arbitrary code via RPC calls that cause long entries to be written to a debug log file ("NetSetup.LOG"), as demonstrated using the NetAddAlternateComputerName API.CVE-2003-0812ACCEPTED2Microsoft Windows 2000Internet Explorer 5.5Harvey RubinovitzACCEPTEDCross-Frame scripting vulnerability in the WebBrowser control as used in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code, read arbitrary files, or conduct other unauthorized activities via script that accesses the Document property, which bypasses <frame> and <iframe> domain restrictions.CVE-2002-1217ACCEPTED1Microsoft Windows 2000Network News Transport Protocol (NNTP)Christine WalzerACCEPTEDMemory leak in NNTP service in Windows NT 4.0 and Windows 2000 allows remote attackers to cause a denial of service (memory exhaustion) via a large number of malformed posts.CVE-2001-0543ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 2Andrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's "href" to the malicious Javascript, then calling execCommand("Refresh") to refresh the page, aka BodyRefreshLoadsJPU or the "ExecCommand Cross Domain" vulnerability.CVE-2003-0814ACCEPTED1Microsoft Windows 95Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Microsoft Word 2000Christine WalzerACCEPTEDIngrid SkoogINTERIMACCEPTEDMicrosoft Word 97, 98(J), 2000, and 2002, and Microsoft Works Suites 2001 through 2004, do not properly check the length of the "Macro names" data value, which could allow remote attackers to execute arbitrary code via a buffer overflow attack.CVE-2003-0820ACCEPTED2Microsoft Windows 2000Windows 2000Tiffany BergeronACCEPTEDChristine WalzerINTERIMACCEPTEDINTERIMChristine WalzerINTERIMACCEPTEDBuffer overflow in a function in User32.dll on Windows NT through Server 2003 allows local users to execute arbitrary code via long (1) LB_DIR messages to ListBox or (2) CB_DIR messages to ComboBox controls in a privileged application.CVE-2003-0659ACCEPTED3Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 3Andrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's "href" to the malicious Javascript, then calling execCommand("Refresh") to refresh the page, aka BodyRefreshLoadsJPU or the "ExecCommand Cross Domain" vulnerability.CVE-2003-0814ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Andrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's "href" to the malicious Javascript, then calling execCommand("Refresh") to refresh the page, aka BodyRefreshLoadsJPU or the "ExecCommand Cross Domain" vulnerability.CVE-2003-0814ACCEPTED1Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Internet Explorer 5.5 Service Pack 2Andrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's "href" to the malicious Javascript, then calling execCommand("Refresh") to refresh the page, aka BodyRefreshLoadsJPU or the "ExecCommand Cross Domain" vulnerability.CVE-2003-0814ACCEPTED1Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Internet Explorer 6 Service Pack 1Andrew ButtnerAndrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's "href" to the malicious Javascript, then calling execCommand("Refresh") to refresh the page, aka BodyRefreshLoadsJPU or the "ExecCommand Cross Domain" vulnerability.CVE-2003-0814ACCEPTED1Red Hat Enterprise Linux 3phpJay BealeDRAFTINTERIMACCEPTEDRace condition in shtool 2.0.1 and earlier allows local users to create or modify arbitrary files via a symlink attack on the .shtool.$$ temporary file, a different vulnerability than CVE-2005-1759.CVE-2005-1751ACCEPTED1Microsoft Windows Server 2003Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003Andrew ButtnerAndrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDHarvey RubinovitzINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's "href" to the malicious Javascript, then calling execCommand("Refresh") to refresh the page, aka BodyRefreshLoadsJPU or the "ExecCommand Cross Domain" vulnerability.CVE-2003-0814ACCEPTED2Red Hat Enterprise Linux 3phpJay BealeDRAFTINTERIMACCEPTEDEval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.CVE-2005-1921ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 2Andrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method and using CreateLink, as demonstrated using LinkillerSaveRef, LinkillerJPU, and Linkiller, or (2) modifying the createRange method and using the FIND dialog to select text, as demonstrated using Findeath, aka the "Function Pointer Override Cross Domain" vulnerability.CVE-2003-0815ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 3Andrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method and using CreateLink, as demonstrated using LinkillerSaveRef, LinkillerJPU, and Linkiller, or (2) modifying the createRange method and using the FIND dialog to select text, as demonstrated using Findeath, aka the "Function Pointer Override Cross Domain" vulnerability.CVE-2003-0815ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Andrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method and using CreateLink, as demonstrated using LinkillerSaveRef, LinkillerJPU, and Linkiller, or (2) modifying the createRange method and using the FIND dialog to select text, as demonstrated using Findeath, aka the "Function Pointer Override Cross Domain" vulnerability.CVE-2003-0815ACCEPTED1Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Internet Explorer 5.5 Service Pack 2Andrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method and using CreateLink, as demonstrated using LinkillerSaveRef, LinkillerJPU, and Linkiller, or (2) modifying the createRange method and using the FIND dialog to select text, as demonstrated using Findeath, aka the "Function Pointer Override Cross Domain" vulnerability.CVE-2003-0815ACCEPTED1Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Internet Explorer 6 Service Pack 1Andrew ButtnerAndrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method and using CreateLink, as demonstrated using LinkillerSaveRef, LinkillerJPU, and Linkiller, or (2) modifying the createRange method and using the FIND dialog to select text, as demonstrated using Findeath, aka the "Function Pointer Override Cross Domain" vulnerability.CVE-2003-0815ACCEPTED1Red Hat Enterprise Linux 3cpioJay BealeDRAFTINTERIMACCEPTEDRace condition in cpio 2.6 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by cpio after the decompression is complete.CVE-2005-1111ACCEPTED1Microsoft Windows Server 2003Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003Andrew ButtnerAndrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDHarvey RubinovitzINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method and using CreateLink, as demonstrated using LinkillerSaveRef, LinkillerJPU, and Linkiller, or (2) modifying the createRange method and using the FIND dialog to select text, as demonstrated using Findeath, aka the "Function Pointer Override Cross Domain" vulnerability.CVE-2003-0815ACCEPTED2Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 2Andrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability.CVE-2003-0816ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 3Andrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability.CVE-2003-0816ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Andrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability.CVE-2003-0816ACCEPTED1Microsoft Windows XPMicrosoft FrontPage Server Extensions 2000Andrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerChristine WalzerINTERIMACCEPTEDBuffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to execute arbitrary code via a crafted chunked encoded request.CVE-2003-0822ACCEPTED2Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft FrontPage Server Extensions 2002Andrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDBuffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to execute arbitrary code via a crafted chunked encoded request.CVE-2003-0822ACCEPTED2Microsoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Microsoft SharePoint Team ServicesAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDBuffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to execute arbitrary code via a crafted chunked encoded request.CVE-2003-0822ACCEPTED2Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 2Andrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick, a different vulnerability than CVE-2003-1027.CVE-2003-0823ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 3Andrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick, a different vulnerability than CVE-2003-1027.CVE-2003-0823ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Andrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick, a different vulnerability than CVE-2003-1027.CVE-2003-0823ACCEPTED1Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Internet Explorer 5.5 Service Pack 2Andrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick, a different vulnerability than CVE-2003-1027.CVE-2003-0823ACCEPTED1Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Internet Explorer 6 Service Pack 1Andrew ButtnerAndrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick, a different vulnerability than CVE-2003-1027.CVE-2003-0823ACCEPTED1Microsoft Windows 2000Internet Information Server 5.0Tiffany BergeronChristine WalzerINTERIMACCEPTEDThe ASP function Response.AddHeader in Microsoft Internet Information Server (IIS) 4.0 and 5.0 does not limit memory requests when constructing headers, which allow remote attackers to generate a large header to cause a denial of service (memory consumption) with an ASP page.CVE-2003-0225ACCEPTED2Microsoft Windows 2000HTML Help ActiveX ControlChristine WalzerAndrew ButtnerACCEPTEDBuffer overflow in the HTML Help ActiveX Control (hhctrl.ocx) in Microsoft Windows 98, 98 Second Edition, Millennium Edition, NT 4.0, NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers to execute code via (1) a long parameter to the Alink function, or (2) script containing a long argument to the showHelp function.CVE-2002-0693ACCEPTED1Red Hat Linux 9Linux kernelJay BealeINTERIMJay BealeACCEPTEDThe STP protocol, as enabled in Linux 2.4.x, does not provide sufficient security by design, which allows attackers to modify the bridge topology.CVE-2003-0550ACCEPTED1Microsoft Windows Server 2003HTML Help FacilityAndrew ButtnerDRAFTINTERIMACCEPTEDInteger overflow in Microsoft Windows 98, 2000, XP SP2 and earlier, and Server 2003 SP1 and earlier allows remote attackers to execute arbitrary code via a crafted compiled Help (.CHM) file with a large size field that triggers a heap-based buffer overflow, as demonstrated using a "ms-its:" URL in Internet Explorer.CVE-2005-1208ACCEPTED1Red Hat Enterprise Linux 3gzipJay BealeDRAFTINTERIMACCEPTEDDirectory traversal vulnerability in gunzip -N in gzip 1.2.4 through 1.3.5 allows remote attackers to write to arbitrary directories via a .. (dot dot) in the original filename within a compressed file.CVE-2005-1228ACCEPTED1Red Hat Linux 9Linux kernelJay BealeINTERIMJay BealeACCEPTEDThe STP protocol implementation in Linux 2.4.x does not properly verify certain lengths, which could allow attackers to cause a denial of service.CVE-2003-0551ACCEPTED1Red Hat Linux 9Linux kernelJay BealeINTERIMJay BealeACCEPTEDLinux 2.4.x allows remote attackers to spoof the bridge Forwarding table via forged packets whose source addresses are the same as the target.CVE-2003-0552ACCEPTED1Red Hat Linux 9Linux kernelJay BealeINTERIMJay BealeACCEPTEDInteger signedness error in the decode_fh function of nfs3xdr.c in Linux kernel before 2.4.21 allows remote attackers to cause a denial of service (kernel panic) via a negative size value within XDR data of an NFSv3 procedure call.CVE-2003-0619ACCEPTED1Red Hat Linux 9Linux kernelJay BealeINTERIMJay BealeACCEPTEDThe C-Media PCI sound driver in Linux before 2.4.21 does not use the get_user function to access userspace, which crosses security boundaries and may facilitate the exploitation of vulnerabilities, a different vulnerability than CVE-2003-0700.CVE-2003-0699ACCEPTED1Microsoft Windows 2000Internet Explorer 6.0Harvey RubinovitzACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model and access information on the local system or in other domains, and possibly execute code, via cached methods and objects, aka "Cross Domain Verification via Cached Methods."CVE-2002-1254ACCEPTED2Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Harvey RubinovitzDRAFTINTERIMACCEPTEDUnknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to execute arbitrary code via a web site or an HTML e-mail containing a crafted JPEG image that causes memory corruption, aka "JPEG Image Rendering Memory Corruption Vulnerability".CVE-2005-1988ACCEPTED1Microsoft Windows XPMicrosoft Internet Explorer 6Tiffany BergeronAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's "href" to the malicious Javascript, then calling execCommand("Refresh") to refresh the page, aka BodyRefreshLoadsJPU or the "ExecCommand Cross Domain" vulnerability.CVE-2003-0814ACCEPTED2Microsoft Windows 2000Internet Explorer 6.0Harvey RubinovitzACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.01 through 6.0 does not properly check certain parameters of a PNG file when opening it, which allows remote attackers to cause a denial of service (crash) by triggering a heap-based buffer overflow using invalid length codes during decompression, aka "Malformed PNG Image File Failure."CVE-2002-1185ACCEPTED2Red Hat Linux 9Linux kernelJay BealeINTERIMJay BealeACCEPTEDThe C-Media PCI sound driver in Linux before 2.4.22 does not use the get_user function to access userspace in certain conditions, which crosses security boundaries and may facilitate the exploitation of vulnerabilities, a different vulnerability than CVE-2003-0699.CVE-2003-0700ACCEPTED1Microsoft Windows NTSimple Network Management Protocol (SNMP)Matt BusbyMatthew BurtonDRAFTINTERIMACCEPTEDBuffer overflow in SNMP agent service in Windows 95/98/98SE, Windows NT 4.0, Windows 2000, and Windows XP allows remote attackers to cause a denial of service or execute arbitrary code via a malformed management request. NOTE: this candidate may be split or merged with other candidates. This and other PROTOS-related candidates, especially CVE-2002-0012 and CVE-2002-0013, will be updated when more accurate information is available.CVE-2002-0053ACCEPTED1Microsoft Windows 2000HTML Help FacilityChristine WalzerACCEPTEDChristine WalzerINTERIMACCEPTEDThe HTML Help facility in Microsoft Windows 98, 98 Second Edition, Millennium Edition, NT 4.0, NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP uses the Local Computer Security Zone when opening .chm files from the Temporary Internet Files folder, which allows remote attackers to execute arbitrary code via HTML mail that references or inserts a malicious .chm file containing shortcuts that can be executed, aka "Code Execution via Compiled HTML Help File."CVE-2002-0694ACCEPTED2Microsoft Windows 2000ISA Server 2000Tiffany BergeronACCEPTEDThe Winsock Proxy service in Microsoft Proxy Server 2.0 and the Microsoft Firewall service in Internet Security and Acceleration (ISA) Server 2000 allow remote attackers to cause a denial of service (CPU consumption or packet storm) via a spoofed, malformed packet to UDP port 1745.CVE-2003-0110ACCEPTED0Microsoft Windows Server 2003Windows ShellHarvey RubinovitzDRAFTINTERIMACCEPTEDThe document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document.CVE-2005-0063ACCEPTED1Microsoft Windows 2000Internet Explorer 5.5Harvey RubinovitzACCEPTEDInternet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model and access information on the local system or in other domains, and possibly execute code, via cached methods and objects, aka "Cross Domain Verification via Cached Methods."CVE-2002-1254ACCEPTED1Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Internet Explorer 5.5 Service Pack 2Andrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability.CVE-2003-0816ACCEPTED1Red Hat Linux 9KonquerorJay BealeINTERIMACCEPTEDKDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites.CVE-2003-0459ACCEPTED1Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Internet Explorer 6 Service Pack 1Andrew ButtnerAndrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability.CVE-2003-0816ACCEPTED1Red Hat Enterprise Linux 4mozillaJay BealeDRAFTINTERIMACCEPTEDFirefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 allows remote attackers to cause a denial of service (access violation and crash), and possibly execute arbitrary code, by calling InstallVersion.compareTo with an object instead of a string.CVE-2005-2265ACCEPTED1Microsoft Windows 95Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Microsoft Word 2003Matthew BurtonDRAFTINTERIMACCEPTEDBuffer overflow in Microsoft Word 2002 (10.6612.6714) SP3, and possibly other versions, allows remote attackers to cause a denial of service (application exception) and possibly execute arbitrary code in winword.exe via certain unexpected values in a .doc file, including (1) an offset that triggers an out-of-bounds memory access, (2) a certain value that causes a large memory copy as triggered by an integer conversion error, and other values.CVE-2004-0963ACCEPTED1Red Hat Linux 9LPRngJay BealeINTERIMJay BealeACCEPTEDpsbanner in the LPRng package allows local users to overwrite arbitrary files via a symbolic link attack on the /tmp/before file.CVE-2003-0136ACCEPTED1Microsoft Windows 2000Telnet protocolChristine WalzerChristine WalzerINTERIMACCEPTEDBuffer overflow in telnet server in Windows 2000 and Interix 2.2 allows remote attackers to execute arbitrary code via malformed protocol options.CVE-2002-0020ACCEPTED2Microsoft Windows 2000Microsoft Word 2002Ingrid SkoogDRAFTINTERIMACCEPTEDJonathan BakerINTERIMACCEPTEDMicrosoft Outlook 2000 and 2002, when configured to use Microsoft Word as the email editor, does not block scripts that are used while editing email messages in HTML or Rich Text Format (RTF), which could allow remote attackers to execute arbitrary scripts via an email that the user forwards or replies to.CVE-2002-1056ACCEPTED2Red Hat Linux 9lvJay BealeINTERIMJay BealeACCEPTEDlv reads a .lv file from the current working directory, which allows local users to execute arbitrary commands as other lv users by placing malicious .lv files into other directories.CVE-2003-0188ACCEPTED1Red Hat Linux 9MuttJay BealeINTERIMACCEPTEDBuffer overflow in Mutt 1.4.0 and possibly earlier versions, 1.5.x up to 1.5.3, and other programs that use Mutt code such as Balsa before 2.0.10, allows a remote malicious IMAP server to cause a denial of service (crash) and possibly execute arbitrary code via a crafted folder.CVE-2003-0140ACCEPTED1Red Hat Linux 9MySQLJay BealeINTERIMJay BealeACCEPTEDDouble-free vulnerability in mysqld for MySQL before 3.23.55 allows attackers with MySQL access to cause a denial of service (crash) via mysql_change_user.CVE-2003-0073ACCEPTED1Microsoft Windows XPMicrosoft Color Management ModuleChristine WalzerDRAFTINTERIMACCEPTEDBuffer overflow in the Microsoft Color Management Module for Windows allows remote attackers to execute arbitrary code via an image with crafted ICC profile format tags.CVE-2005-1219ACCEPTED1Red Hat Linux 9MySQLJay BealeINTERIMJay BealeACCEPTEDMySQL 3.23.55 and earlier creates world-writeable files and allows mysql users to gain root privileges by using the "SELECT * INFO OUTFILE" operator to overwrite a configuration file and cause mysql to run as root upon restart, as demonstrated by modifying my.cnf.CVE-2003-0150ACCEPTED1Red Hat Linux 9nfs-utilsJay BealeINTERIMJay BealeACCEPTEDOff-by-one error in the xlog function of mountd in the Linux NFS utils package (nfs-utils) before 1.0.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain RPC requests to mountd that do not contain newlines.CVE-2003-0252ACCEPTED1Microsoft Windows 2000Internet Explorer 6.0Harvey RubinovitzACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.01 through 6.0 allows remote attackers to identify the path to the Temporary Internet Files folder and obtain user information such as cookies via certain uses of the OBJECT tag, which are not subjected to the proper security checks, aka "Temporary Internet Files folders Name Reading."CVE-2002-1188ACCEPTED2Red Hat Linux 9OpenSSHJay BealeINTERIMJay BealeACCEPTEDOpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.CVE-2003-0190ACCEPTED1Red Hat Linux 9OpenSSHJay BealeINTERIMJay BealeACCEPTED"Memory bugs" in OpenSSH 3.7.1 and earlier, with unknown impact, a different set of vulnerabilities than CVE-2003-0693 and CVE-2003-0695.CVE-2003-0682ACCEPTED1Red Hat Linux 9OpenSSHJay BealeINTERIMJay BealeACCEPTEDA "buffer management error" in buffer_append_space of buffer.c for OpenSSH before 3.7 may allow remote attackers to execute arbitrary code by causing an incorrect amount of memory to be freed and corrupting the heap, a different vulnerability than CVE-2003-0695.CVE-2003-0693ACCEPTED1Sun Solaris 9BindBrian SobyDRAFTINTERIMACCEPTEDBIND 8.3.x through 8.3.3 allows remote attackers to cause a denial of service (termination due to assertion failure) via a request for a subdomain that does not exist, with an OPT resource record with a large UDP payload size.CVE-2002-1220ACCEPTED1Microsoft Windows XPWindows kernelChristine WalzerDRAFTINTERIMACCEPTEDThe Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability."CVE-2004-0893ACCEPTED1Microsoft Windows 2000Utilities Manager/Windows MessagingChristine WalzerACCEPTEDChristine WalzerINTERIMACCEPTEDThe control for listing accessibility options in the Accessibility Utility Manager on Windows 2000 (ListView) does not properly handle Windows messages, which allows local users to execute arbitrary code via a "Shatter" style message to the Utility Manager that references a user-controlled callback function.CVE-2003-0350ACCEPTED2Red Hat Linux 9OpenSSHJay BealeINTERIMJay BealeACCEPTEDMultiple "buffer management errors" in OpenSSH before 3.7.1 may allow attackers to cause a denial of service or execute arbitrary code using (1) buffer_init in buffer.c, (2) buffer_free in buffer.c, or (3) a separate function in channels.c, a different vulnerability than CVE-2003-0693.CVE-2003-0695ACCEPTED1Microsoft Windows Server 2003Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003Andrew ButtnerAndrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDHarvey RubinovitzINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability.CVE-2003-0816ACCEPTED2Red Hat Linux 9OpenSSLJay BealeINTERIMJay BealeJay BealeACCEPTEDThe SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the "Klima-Pokorny-Rosa attack."CVE-2003-0131ACCEPTED1Microsoft Windows 2000HTML Help FacilityAndrew ButtnerDRAFTINTERIMACCEPTEDInteger overflow in Microsoft Windows 98, 2000, XP SP2 and earlier, and Server 2003 SP1 and earlier allows remote attackers to execute arbitrary code via a crafted compiled Help (.CHM) file with a large size field that triggers a heap-based buffer overflow, as demonstrated using a "ms-its:" URL in Internet Explorer.CVE-2005-1208ACCEPTED1Red Hat Linux 9OpenSSLJay BealeINTERIMJay BealeJay BealeACCEPTEDOpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms ("Karatsuba" and normal).CVE-2003-0147ACCEPTED1Microsoft Windows 2000Small Business Server 2000Jonathan BakerDRAFTINTERIMACCEPTEDBuffer overflow in the Server Message Block (SMB) functionality for Microsoft Windows 2000, XP SP1 and SP2, and Server 2003 and SP1 allows remote attackers to execute arbitrary code via unknown vectors, aka the "Server Message Block Vulnerability."CVE-2005-1206ACCEPTED1Microsoft Windows 2000ISA Server 2000Christine WalzerDRAFTINTERIMACCEPTEDJonathan BakerINTERIMACCEPTEDMicrosoft ISA Server 2000 allows remote attackers to connect to services utilizing the NetBIOS protocol via a NetBIOS connection with an ISA Server that uses the NetBIOS (all) predefined packet filter.CVE-2005-1216ACCEPTED2Red Hat Linux 9pam_smbJay BealeINTERIMJay BealeACCEPTEDBuffer overflow in PAM SMB module (pam_smb) 1.1.6 and earlier, when authenticating to a remote service, allows remote attackers to execute arbitrary code.CVE-2003-0686ACCEPTED1Red Hat Linux 9CGI.pmJay BealeINTERIMACCEPTEDCross-site scripting (XSS) vulnerability in start_form() of CGI.pm allows remote attackers to insert web script via a URL that is fed into the form's action parameter.CVE-2003-0615ACCEPTED1Microsoft Windows 2000Internet Explorer 5.01Harvey RubinovitzACCEPTEDInternet Explorer 5.01 through 6.0 does not properly perform security checks on certain encoded characters within a URL, which allows a remote attacker to steal potentially sensitive information from a user by redirecting the user to another site that has that information, aka "Encoded Characters Information Disclosure."CVE-2002-1186ACCEPTED1Microsoft Windows XPMicrosoft Internet Explorer 6Tiffany BergeronAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method and using CreateLink, as demonstrated using LinkillerSaveRef, LinkillerJPU, and Linkiller, or (2) modifying the createRange method and using the FIND dialog to select text, as demonstrated using Findeath, aka the "Function Pointer Override Cross Domain" vulnerability.CVE-2003-0815ACCEPTED2Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Andrew ButtnerINTERIMACCEPTEDMicrosoft Exchange 2003 and Outlook Web Access (OWA), when configured to use NTLM authentication, does not properly reuse HTTP connections, which can cause OWA users to view mailboxes of other users when Kerberos has been disabled as an authentication method for IIS 6.0, e.g. when SharePoint Services 2.0 is installed.CVE-2003-0904ACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Internet Security and Acceleration Server 2000David ProulxINTERIMACCEPTEDBuffer overflow in the H.323 filter of Microsoft Internet Security and Acceleration Server 2000 allows remote attackers to execute arbitrary code in the Microsoft Firewall Service via certain H.323 traffic, as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol.CVE-2003-0819ACCEPTED1Microsoft Windows XPMicrosoft Internet Explorer 6Microsoft Internet Explorer 6 Service Pack 1Tiffany BergeronAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability.CVE-2003-0816ACCEPTED2Microsoft Windows 2000Internet Information Server 5.0Tiffany BergeronACCEPTEDChristine WalzerINTERIMACCEPTEDBuffer overflow in ssinc.dll for Microsoft Internet Information Services (IIS) 5.0 allows local users to execute arbitrary code via a web page with a Server Side Include (SSI) directive with a long filename, aka "Server Side Include Web Pages Buffer Overrun."CVE-2003-0224ACCEPTED2Microsoft Windows 2000Microsoft SQL Server 2000Matthew BurtonMatthew BurtonMatthew BurtonDRAFTINTERIMACCEPTEDIngrid SkoogINTERIMACCEPTEDBuffer overflow in the SQLXML ISAPI extension of Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code via data queries with a long content-type parameter, aka "Unchecked Buffer in SQLXML ISAPI Extension."CVE-2002-0186ACCEPTED2Red Hat Linux 9phpJay BealeINTERIMJay BealeACCEPTEDCross-site scripting (XSS) vulnerability in the transparent SID support capability for PHP before 4.3.2 (session.use_trans_sid) allows remote attackers to insert arbitrary script via the PHPSESSID parameter.CVE-2003-0442ACCEPTED1Microsoft Windows 2000Microsoft SQL Server 2000Matthew BurtonMatthew BurtonDRAFTINTERIMACCEPTEDIngrid SkoogINTERIMACCEPTEDBuffer overflow in the SQLXML ISAPI extension of Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code via data queries with a long content-type parameter, aka "Unchecked Buffer in SQLXML ISAPI Extension."CVE-2002-0186ACCEPTED2Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 2Andrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability."CVE-2003-1025ACCEPTED2Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 3Andrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability."CVE-2003-1025ACCEPTED2Microsoft Windows 2000Remote Procedure Call (RPC)Tiffany BergeronACCEPTEDThe RPC DCOM interface in Windows 2000 SP3 and SP4 allows remote attackers to cause a denial of service (crash), and local attackers to use the DoS to hijack the epmapper pipe to gain privileges, via certain messages to the __RemoteGetClassObject interface that cause a NULL pointer to be passed to the PerformScmStage function.CVE-2003-0605ACCEPTED1Microsoft Windows 2000Internet Explorer 5.5Harvey RubinovitzACCEPTEDInternet Explorer 5.01 through 6.0 does not properly perform security checks on certain encoded characters within a URL, which allows a remote attacker to steal potentially sensitive information from a user by redirecting the user to another site that has that information, aka "Encoded Characters Information Disclosure."CVE-2002-1186ACCEPTED1Red Hat Linux 9pineJay BealeINTERIMJay BealeACCEPTEDBuffer overflow in PINE before 4.58 allows remote attackers to execute arbitrary code via a malformed message/external-body MIME type.CVE-2003-0720ACCEPTED1Microsoft Windows NTRemote Access Service (RAS)Matt BusbyINTERIMACCEPTEDThe default permissions for the RAS Administration key in Windows NT 4.0 allows local users to execute arbitrary commands by changing the value to point to a malicious DLL, aka one of the "Registry Permissions" vulnerabilities.CVE-2001-0045ACCEPTED1Red Hat Linux 9pineJay BealeINTERIMJay BealeACCEPTEDInteger signedness error in rfc2231_get_param from strings.c in PINE before 4.58 allows remote attackers to execute arbitrary code via an email that causes an out-of-bounds array access using a negative number.CVE-2003-0721ACCEPTED1Microsoft Windows XPMicrosoft Internet Explorer 6Ingrid SkoogDRAFTINTERIMACCEPTEDChristine WalzerINTERIMChristine WalzerACCEPTEDInteger overflow in imgbmp.cxx for Windows 2000 allows remote attackers to execute arbitrary code via a BMP image with a large bfOffBits value.CVE-2004-0566ACCEPTED2Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 2Andrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object.CVE-2003-0817ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Andrew ButtnerDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDDouble-free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image.CVE-2003-1048ACCEPTED2Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Andrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability."CVE-2003-1025ACCEPTED2Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Internet Explorer 5.5 Service Pack 2Andrew ButtnerINTERIMACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability."CVE-2003-1025ACCEPTED1Microsoft Windows XPMicrosoft Internet Explorer 6Andrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMChristine WalzerACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability."CVE-2003-1025ACCEPTED2Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Internet Explorer 6 Service Pack 1Andrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability."CVE-2003-1025ACCEPTED2Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 2Ingrid SkoogDRAFTINTERIMACCEPTEDInteger overflow in imgbmp.cxx for Windows 2000 allows remote attackers to execute arbitrary code via a BMP image with a large bfOffBits value.CVE-2004-0566ACCEPTED1Microsoft Windows Server 2003Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003Andrew ButtnerDRAFTINTERIMACCEPTEDHarvey RubinovitzINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDDouble-free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image.CVE-2003-1048ACCEPTED3Microsoft Windows XPMicrosoft Internet Explorer 6Tiffany BergeronDRAFTINTERIMACCEPTEDChristine WalzerINTERIMChristine WalzerACCEPTEDThe WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute code such as Javascript, as demonstrated using (1) delayed HTTP redirect operations, and an HTTP response with a Location: header containing a "URL:" prepended to a "ms-its" protocol URI, or (2) modifying the location attribute of the window, as exploited by the Download.ject (aka Scob aka Toofer) using the ADODB.Stream object.CVE-2004-0549ACCEPTED2Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 3Andrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object.CVE-2003-0817ACCEPTED1Red Hat Linux 9PostfixJay BealeINTERIMACCEPTEDPostfix 1.1.11 and earlier allows remote attackers to use Postfix to conduct "bounce scans" or DDos attacks of other hosts via an email address to the local host containing the target IP address and service name followed by a "!" string, which causes Postfix to attempt to use SMTP to communicate with the target on the associated port.CVE-2003-0468ACCEPTED1Microsoft Windows 95Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Data Access Compnents 2.5Christine WalzerINTERIMACCEPTEDBuffer overflow in a component of Microsoft Data Access Components (MDAC) 2.5 through 2.8 allows remote attackers to execute arbitrary code via a malformed UDP response to a broadcast request.CVE-2003-0903ACCEPTED1Microsoft Windows Server 2003Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003Andrew ButtnerINTERIMACCEPTEDHarvey RubinovitzINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability."CVE-2003-1025ACCEPTED3Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 2Andrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CVE-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability."CVE-2003-1027ACCEPTED2Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 3Andrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CVE-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability."CVE-2003-1027ACCEPTED2Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Andrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CVE-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability."CVE-2003-1027ACCEPTED2Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Internet Explorer 5.5 Service Pack 2Andrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CVE-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability."CVE-2003-1027ACCEPTED1Microsoft Windows XPMicrosoft Internet Explorer 6Andrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMChristine WalzerACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CVE-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability."CVE-2003-1027ACCEPTED2Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Internet Explorer 6 Service Pack 1Andrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CVE-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability."CVE-2003-1027ACCEPTED2Microsoft Windows XPMicrosoft Word for Windows 6.0 ConverterChristine WalzerDRAFTINTERIMACCEPTEDRobert L. HollisMicrosoft Word for Windows 6.0 Converter (MSWRD632.WPC), as used in WordPad, does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CVE-2004-0571.CVE-2004-0901INTERIM1Microsoft Windows 2000Internet Explorer 5.5Harvey RubinovitzACCEPTEDInternet Explorer 5.01 through 6.0 does not properly check certain parameters of a PNG file when opening it, which allows remote attackers to cause a denial of service (crash) by triggering a heap-based buffer overflow using invalid length codes during decompression, aka "Malformed PNG Image File Failure."CVE-2002-1185ACCEPTED1Microsoft Windows XPMicrosoft Internet Explorer 6Microsoft Internet Explorer 6 Service Pack 1Tiffany BergeronAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object.CVE-2003-0817ACCEPTED2Red Hat Linux 9PostfixJay BealeINTERIMACCEPTEDThe address parser code in Postfix 1.1.12 and earlier allows remote attackers to cause a denial of service (lock) via (1) a malformed envelope address to a local host that would generate a bounce and contains the ".!" string in the MAIL FROM or Errors-To headers, which causes nqmgr to lock up, or (2) via a valid MAIL FROM with a RCPT TO containing a ".!" string, which causes an instance of the SMTP listener to lock up.CVE-2003-0540ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Andrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object.CVE-2003-0817ACCEPTED1Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Internet Explorer 5.5 Service Pack 2Andrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object.CVE-2003-0817ACCEPTED1Red Hat Enterprise Linux 4mozillaJay BealeDRAFTINTERIMACCEPTEDFirefox before 1.0.5 and Mozilla before 1.7.9 does not properly clone base objects, which allows remote attackers to execute arbitrary code by navigating the prototype chain to reach a privileged object.CVE-2005-2270ACCEPTED1Microsoft Windows 2000MSDTCRobert L. HollisDRAFTINTERIMACCEPTEDThe MIDL_user_allocate function in the Microsoft Distributed Transaction Coordinator (MSDTC) proxy (MSDTCPRX.DLL) allocates a 4K page of memory regardless of the required size, which allows attackers to overwrite arbitrary memory locations using an incorrect size value that is provided to the NdrAllocate function, which writes management data to memory outside of the allocated buffer.CVE-2005-2119ACCEPTED2Red Hat Linux 9smbdJay BealeINTERIMJay BealeACCEPTEDBuffer overflow in the SMB/CIFS packet fragment re-assembly code for SMB daemon (smbd) in Samba before 2.2.8, and Samba-TNG before 0.3.1, allows remote attackers to execute arbitrary code.CVE-2003-0085ACCEPTED1Microsoft Windows 95Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Data Access Compnents 2.6Christine WalzerINTERIMACCEPTEDBuffer overflow in a component of Microsoft Data Access Components (MDAC) 2.5 through 2.8 allows remote attackers to execute arbitrary code via a malformed UDP response to a broadcast request.CVE-2003-0903ACCEPTED1Red Hat Linux 9SambaJay BealeINTERIMJay BealeACCEPTEDThe code for writing reg files in Samba before 2.2.8 allows local users to overwrite arbitrary files via a race condition involving chown.CVE-2003-0086ACCEPTED1Sun Solaris 7XsunBrian SobyDRAFTINTERIMACCEPTEDBuffer overflow in Xsun in Solaris 8 and earlier allows local users to execute arbitrary commands via a long HOME environmental variable.CVE-2001-0422ACCEPTED1Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Internet Explorer 6 Service Pack 1Andrew ButtnerAndrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object.CVE-2003-0817ACCEPTED1Red Hat Linux 9SambaJay BealeINTERIMJay BealeACCEPTEDMultiple buffer overflows in Samba before 2.2.8a may allow remote attackers to execute arbitrary code or cause a denial of service, as discovered by the Samba team and a different vulnerability than CVE-2003-0201.CVE-2003-0196ACCEPTED1Microsoft Windows Server 2003Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003Andrew ButtnerAndrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDHarvey RubinovitzINTERIMACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object.CVE-2003-0817ACCEPTED2Red Hat Linux 9Samba, Samba-TNGJay BealeINTERIMJay BealeACCEPTEDBuffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x versions, and Samba-TNG before 0.3.2, allows remote attackers to execute arbitrary code.CVE-2003-0201ACCEPTED1Red Hat Linux 9semi MIME libraryJay BealeINTERIMJay BealeACCEPTEDThe (1) semi MIME library 1.14.5 and earlier, and (2) wemi 1.14.0 and possibly other versions, allows local users to overwrite arbitrary files via a symlink attack on temporary files.CVE-2003-0440ACCEPTED1Red Hat Linux 9SendmailJay BealeINTERIMJay BealeACCEPTEDThe prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c.CVE-2003-0694ACCEPTED1Microsoft Windows XPWindows ShellHarvey RubinovitzDRAFTINTERIMACCEPTEDThe document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document.CVE-2005-0063ACCEPTED1Microsoft Windows 2000Microsoft Windows Workstation ServiceTiffany BergeronACCEPTEDStack-based buffer overflow in a logging function for Windows Workstation Service (WKSSVC.DLL) allows remote attackers to execute arbitrary code via RPC calls that cause long entries to be written to a debug log file ("NetSetup.LOG"), as demonstrated using the NetAddAlternateComputerName API.CVE-2003-0812ACCEPTED1Microsoft Windows Server 2003Operating SystemRobert L. HollisDRAFTINTERIMACCEPTEDCOM+ in Microsoft Windows does not properly "create and use memory structures," which allows local users or remote attackers to execute arbitrary code.CVE-2005-1978ACCEPTED2Microsoft Windows Server 2003Operating SystemRobert L. HollisDRAFTINTERIMACCEPTEDBuffer overflow in Collaboration Data Objects (CDO), as used in Microsoft Windows and Microsoft Exchange Server, allows remote attackers to execute arbitrary code when CDOSYS or CDOEX processes an e-mail message with a large header name, as demonstrated using the "Content-Type" string.CVE-2005-1987ACCEPTED2Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Virtual Machine (VM)Tiffany BergeronINTERIMACCEPTEDTwo vulnerabilities in Microsoft Virtual Machine (VM) up to and including build 5.0.3805, as used in Internet Explorer and other applications, allow remote attackers to read files via a Java applet with a spoofed location in the CODEBASE parameter in the APPLET tag, possibly due to a parsing error.CVE-2002-1258ACCEPTED1Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003mozillaRobert L. HollisDRAFTINTERIMThe Mozilla browsers (Firefox and Mozilla Suite) can crash when processing a domain name that contains only soft-hyphen characters. These characters are removed during International Domain Name (IDN) processing. When this processing results in an empty string, the heap overrun can be exploited to install Malware on the affected computer.CAN-2005-2871INTERIM1Microsoft Windows 95Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Microsoft Word 97Andrew ButtnerINTERIMACCEPTEDIngrid SkoogINTERIMIngrid SkoogMicrosoft Word 97, 98(J), 2000, and 2002, and Microsoft Works Suites 2001 through 2004, do not properly check the length of the "Macro names" data value, which could allow remote attackers to execute arbitrary code via a buffer overflow attack.CVE-2003-0820INTERIM1Microsoft Windows 95Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Microsoft Word 98Andrew ButtnerINTERIMACCEPTEDMicrosoft Word 97, 98(J), 2000, and 2002, and Microsoft Works Suites 2001 through 2004, do not properly check the length of the "Macro names" data value, which could allow remote attackers to execute arbitrary code via a buffer overflow attack.CVE-2003-0820ACCEPTED1Microsoft Windows Server 2003Windows ShellHarvey RubinovitzDRAFTINTERIMACCEPTEDThe document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document.CVE-2005-0063ACCEPTED1Microsoft Windows Server 2003Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003Andrew ButtnerAndrew ButtnerAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDHarvey RubinovitzINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick, a different vulnerability than CVE-2003-1027.CVE-2003-0823ACCEPTED2Microsoft Windows NTMicrosoft FrontPage Server Extensions 2000Andrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDUnknown vulnerability in the SmartHTML interpreter (shtml.dll) in Microsoft FrontPage Server Extensions 2000 and 2002, and Microsoft SharePoint Team Services 2002, allows remote attackers to cause a denial of service (response failure) via a certain request.CVE-2003-0824ACCEPTED2Sun Solaris 7Sun Solaris 8Sun Solaris 9Licence Logging ServiceBrian SobyDRAFTINTERIMACCEPTEDUnknown vulnerability in the rwho daemon (in.rwhod) for Solaris 7 through 9 allows remote attackers to execute arbitrary code.CVE-2004-1351ACCEPTED1Microsoft Windows 2000Microsoft Windows XPMSN MessengerChristine WalzerDRAFTINTERIMACCEPTEDRobert L. HollisINTERIMRobert L. HollisMultiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.CVE-2004-0597INTERIM2Red Hat Linux 9SendmailJay BealeINTERIMJay BealeACCEPTEDA "potential buffer overflow in ruleset parsing" for Sendmail 8.12.9, when using the nonstandard rulesets (1) recipient (2), final, or (3) mailer-specific envelope recipients, has unknown consequences.CVE-2003-0681ACCEPTED1Red Hat Linux 9SendmailJay BealeINTERIMJay BealeACCEPTEDThe DNS map code in Sendmail 8.12.8 and earlier, when using the "enhdnsbl" feature, does not properly initialize certain data structures, which allows remote attackers to cause a denial of service (process crash) via an invalid DNS response that causes Sendmail to free incorrect data.CVE-2003-0688ACCEPTED1HP-UX 11remshdRobert L. HollisDRAFTUnknown vulnerability in xterm for HP-UX 11.00, 11.11, and 11.23 allows local users to gain privileges via unknown vectors.CVE-2005-3779DRAFT4Red Hat Linux 9SendmailJay BealeINTERIMJay BealeACCEPTEDThe prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c.CVE-2003-0694ACCEPTED1Microsoft Windows Server 2003Services for UNIXJonathan BakerDRAFTINTERIMACCEPTEDThe Telnet client for Microsoft Windows XP, Windows Server 2003, and Windows Services for UNIX allows remote attackers to read sensitive environment variables via the NEW-ENVIRON option with a SEND ENV_USERVAR command.CVE-2005-1205ACCEPTED1Microsoft Windows XPMicrosoft FrontPage Server Extensions 2000Andrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDUnknown vulnerability in the SmartHTML interpreter (shtml.dll) in Microsoft FrontPage Server Extensions 2000 and 2002, and Microsoft SharePoint Team Services 2002, allows remote attackers to cause a denial of service (response failure) via a certain request.CVE-2003-0824ACCEPTED2Microsoft Windows Server 2003Microsoft Internet Explorer 6.0 for Windows Server 2003Harvey RubinovitzDRAFTINTERIMACCEPTEDThe legacy <script> data-island capability for XML in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to read arbitrary XML files, and portions of other files, via a URL whose "src" attribute redirects to a local file.CVE-2002-0648ACCEPTED1Red Hat Linux 9SquirrelMailJay BealeINTERIMJay BealeACCEPTEDMultiple cross-site scripting (XSS) vulnerabilities in SquirrelMail before 1.2.11 allow remote attackers to inject arbitrary HTML code and steal information from a client's web browser.CVE-2003-0160ACCEPTED1Red Hat Linux 9unzipJay BealeINTERIMJay BealeACCEPTEDDirectory traversal vulnerability in UnZip 5.50 allows attackers to overwrite arbitrary files via invalid characters between two . (dot) characters, which are filtered and result in a ".." sequence.CVE-2003-0282ACCEPTED1Red Hat Enterprise Linux 3sysreportJay BealeDRAFTINTERIMACCEPTEDsysreport 1.3.15 and earlier includes contents of the up2date file in a report, which leaks the password for a proxy server in plaintext and allows local users to gain privileges.CVE-2005-1760ACCEPTED1Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft FrontPage Server Extensions 2002Andrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMUnknown vulnerability in the SmartHTML interpreter (shtml.dll) in Microsoft FrontPage Server Extensions 2000 and 2002, and Microsoft SharePoint Team Services 2002, allows remote attackers to cause a denial of service (response failure) via a certain request.CVE-2003-0824INTERIM1Microsoft Windows Server 2003Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003Andrew ButtnerAndrew ButtnerINTERIMACCEPTEDHarvey RubinovitzINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CVE-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability."CVE-2003-1027ACCEPTED3Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 2Andrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability."CVE-2003-1026ACCEPTED2Red Hat Linux 9up2dateJay BealeINTERIMJay BealeACCEPTEDup2date 3.0.7 and 3.1.23 does not properly verify RPM GPG signatures, which could allow remote attackers to cause unsigned packages to be installed from the Red Hat Network, if that network is compromised.CVE-2003-0546ACCEPTED1Red Hat Linux 9vsftpdJay BealeINTERIMJay BealeACCEPTEDvsftpd FTP daemon in Red Hat Linux 9 is not compiled against TCP wrappers (tcp_wrappers) but is installed as a standalone service, which inadvertently prevents vsftpd from restricting access as intended.CVE-2003-0135ACCEPTED1Microsoft Windows 95Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Microsoft Excel 2000Christine WalzerACCEPTEDIngrid SkoogINTERIMACCEPTEDMicrosoft Excel 97, 2000, and 2002 allows remote attackers to execute arbitrary code via a spreadsheet with a malicious XLM (Excel 4) macro that bypasses the macro security model.CVE-2003-0821ACCEPTED2Red Hat Enterprise Linux 3mozillaJay BealeDRAFTINTERIMACCEPTEDA regression error in Firefox 1.0.3 and Mozilla 1.7.7 allows remote attackers to inject arbitrary Javascript from one page into the frameset of another site, aka the frame injection spoofing vulnerability, a re-introduction of a vulnerability that was originally identified and addressed by CVE-2004-0718.CVE-2005-1937ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 3Andrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability."CVE-2003-1026ACCEPTED2Microsoft Windows NTMDAC 2.8Ingrid SkoogDRAFTINTERIMACCEPTEDThe License Logging service for Windows NT Server, Windows 2000 Server, and Windows Server 2003 does not properly validate the length of messages, which leads to an "unchecked buffer" and allows remote attackers to cause a denial of service (crash) and possibly execute arbtirary code, aka the "License Logging Service Vulnerability."CVE-2005-0050ACCEPTED1Red Hat Enterprise Linux 3mikmodJay BealeDRAFTINTERIMACCEPTEDBuffer overflow in mikmod 3.1.6 and earlier allows remote attackers to execute arbitrary code via an archive file that contains a file with a long filename.CVE-2003-0427ACCEPTED1Microsoft Windows 2000Microsoft ASN.1 LibraryAndrew ButtnerINTERIMACCEPTEDMultiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 BER encodings with (1) very large length fields that cause arbitrary heap data to be overwritten, or (2) modified bit strings.CVE-2003-0818ACCEPTED1Red Hat Linux 9xinetdJay BealeINTERIMJay BealeJay BealeACCEPTEDMemory leak in xinetd 2.3.10 allows remote attackers to cause a denial of service (memory consumption) via a large number of rejected connections.CVE-2003-0211ACCEPTED1Red Hat Linux 9xpdfJay BealeINTERIMACCEPTEDVarious PDF viewers including (1) Adobe Acrobat 5.06 and (2) Xpdf 1.01 allow remote attackers to execute arbitrary commands via shell metacharacters in an embedded hyperlink.CVE-2003-0434ACCEPTED1Red Hat Linux 9ypservJay BealeINTERIMJay BealeACCEPTEDypserv NIS server before 2.7 allows remote attackers to cause a denial of service via a TCP client request that does not respond to the server, which causes ypserv to block.CVE-2003-0251ACCEPTED1Microsoft Windows 95Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Microsoft Word 2002Andrew ButtnerINTERIMACCEPTEDIngrid SkoogINTERIMACCEPTEDMicrosoft Word 97, 98(J), 2000, and 2002, and Microsoft Works Suites 2001 through 2004, do not properly check the length of the "Macro names" data value, which could allow remote attackers to execute arbitrary code via a buffer overflow attack.CVE-2003-0820ACCEPTED2Microsoft Windows XPMicrosoft Windows Server 2003Operating SystemRobert L. HollisDRAFTINTERIMACCEPTEDA remote Denial of Service vulnerability exists for the rendering of Enhanced Metafile (EMF) images. A EMF image is a 32-bit metafile that can contain both vector and bitmap information. An unchecked buffer in the rendering libraries can allow an attacker to trigger a program crash on the affected system. This action would not result in an opportunity to execute code or elevate privileges. A successful attack would cause a program to stop responding. The user may need to manually kill the process using the Windows Task Manager. Once restarted, the program should operate normally until another attempt is made to open the offending image file.CAN-2005-0803ACCEPTED2Microsoft Windows 95Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Microsoft Excel 97Andrew ButtnerINTERIMACCEPTEDIngrid SkoogINTERIMMicrosoft Excel 97, 2000, and 2002 allows remote attackers to execute arbitrary code via a spreadsheet with a malicious XLM (Excel 4) macro that bypasses the macro security model.CVE-2003-0821INTERIM1Red Hat Enterprise Linux 3postgresqlJay BealeDRAFTINTERIMACCEPTEDPostgreSQL 7.3.x through 8.0.x gives public EXECUTE access to certain character conversion functions, which allows unprivileged users to call those functions with malicious values, with unknown impact, aka the "Character conversion vulnerability."CVE-2005-1409ACCEPTED1Microsoft Windows NTNetDDE AgentIngrid SkoogDRAFTINTERIMACCEPTEDNetDDE Agent on Windows NT 4.0, 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows local users to execute arbitrary code as LocalSystem via "shatter" style attack by sending a WM_COPYDATA message followed by a WM_TIMER message, as demonstrated by GetAd, aka "Flaw in Windows WM_TIMER Message Handling Could Enable Privilege Elevation."CVE-2002-1230ACCEPTED1Microsoft Windows 2000Microsoft AgentHarvey RubinovitzDRAFTHarvey RubinovitzINTERIMACCEPTEDMicrosoft Agent allows remote attackers to spoof trusted Internet content and execute arbitrary code by disguising security prompts on a malicious Web page.CVE-2005-1214ACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDReview blocked recipient list1.2.7ACCEPTED1Corresponds to item 1.2.7 in the Exchange 2003 BenchmarkMicrosoft Windows XPMicrosoft Word for Windows 6.0 ConverterChristine WalzerDRAFTINTERIMJonathan BakerIngrid SkoogACCEPTEDMicrosoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CVE-2004-0901.CVE-2004-0571ACCEPTED1Microsoft Windows Server 2003TIPRobert L. HollisDRAFTINTERIMACCEPTEDDistributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service exception and exit) via an "unexpected protocol command during the reconnection request," which is not properly handled by the Transaction Internet Protocol (TIP) functionality.CVE-2005-1979ACCEPTED2Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Andrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability."CVE-2003-1026ACCEPTED2Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDReview the global accept and deny lists.1.2.1ACCEPTED1Corresponds to item 1.2.1 in the Exchange 2003 BenchmarkMicrosoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Internet Explorer 5.5 Service Pack 2Andrew ButtnerAndrew ButtnerINTERIMACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability."CVE-2003-1026ACCEPTED1Microsoft Windows 2000Internet Explorer 5.5Harvey RubinovitzACCEPTEDInternet Explorer 5.01 through 6.0 allows remote attackers to identify the path to the Temporary Internet Files folder and obtain user information such as cookies via certain uses of the OBJECT tag, which are not subjected to the proper security checks, aka "Temporary Internet Files folders Name Reading."CVE-2002-1188ACCEPTED1Microsoft Windows 95Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Microsoft Excel 2002Andrew ButtnerINTERIMACCEPTEDIngrid SkoogINTERIMACCEPTEDMicrosoft Excel 97, 2000, and 2002 allows remote attackers to execute arbitrary code via a spreadsheet with a malicious XLM (Excel 4) macro that bypasses the macro security model.CVE-2003-0821ACCEPTED2Microsoft Windows 2000Microsoft Windows XPMicrosoft Internet Explorer 6 Service Pack 1Harvey RubinovitzDRAFTINTERIMACCEPTEDUnknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to obtain information and possibly execute code when browsing from a web site to a web folder view using WebDAV, aka "Web Folder Behaviors Cross-Domain Vulnerability".CVE-2005-1989ACCEPTED1Microsoft Windows NTMicrosoft FrontPage Server Extensions 2000Andrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerChristine WalzerINTERIMACCEPTEDBuffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to execute arbitrary code via a crafted chunked encoded request.CVE-2003-0822ACCEPTED2Microsoft Windows XPMicrosoft Windows Server 2003Operating SystemRobert L. HollisDRAFTINTERIMACCEPTEDA remote code execution vulnerability exists for the rendering of Windows Metafile (WMF) images. A WMF image is a 16-bit metafile that can contain both vector and bitmap information. An unchecked buffer in the rendering libraries can allow an attacker to remotely execute arbitrary code on the target system. This action could allow the attacker to install programs, access and alter data, and escalate privileges. A successful attack would thus grant a remote attacker complete control of the affected system.CAN-2005-2123ACCEPTED2Microsoft Windows 2000Windows Internet Naming Service (WINS)Andrew ButtnerINTERIMACCEPTEDThe Windows Internet Naming Service (WINS) for Microsoft Windows Server 2003, and possibly Windows NT and Server 2000, does not properly validate the length of certain packets, which allows attackers to cause a denial of service and possibly execute arbitrary code.CVE-2003-0825ACCEPTED1Microsoft Windows XPOperating SystemRobert L. HollisDRAFTINTERIMACCEPTEDWindows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to execute arbitrary commands via a shortcut (.lnk) file with long font properties that lead to a buffer overflow in the Client/Server Runtime Server Subsystem (CSRSS), a different vulnerabiity than CVE-2005-2118.CVE-2005-2122ACCEPTED2Microsoft Windows XPInternet Explorer 6Harvey RubinovitzDRAFTINTERIMHarvey RubinovitzACCEPTEDInternet Explorer 5.01, 5.5, and 6 does not properly validate buffers when handling certain DHTML methods including the createControlRange Javascript function, which allows remote attackers to execute arbitrary code, aka the "DHTML Method Heap Memory Corruption Vulnerability."CVE-2005-0055ACCEPTED1Red Hat Enterprise Linux 3ImageMagickJay BealeDRAFTINTERIMACCEPTEDHeap-based buffer overflow in the ReadPNMImage function in pnm.c for ImageMagick 6.2.1 and earlier allows remote attackers to cause a denial of service (application crash) via a PNM file with a small colors value.CVE-2005-1275ACCEPTED1Microsoft Windows NTWindows Animated CursorChristine WalzerDRAFTINTERIMACCEPTEDThe Windows Animated Cursor (ANI) capability in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allow remote attackers to cause a denial of service via (1) the frame number set to zero, which causes an invalid memory address to be used and leads to a kernel crash, or (2) the rate number set to zero, which leads to resource exhaustion and hang.CVE-2004-1305ACCEPTED1Microsoft Windows 2000Hyperlink Object LibraryChristine WalzerDRAFTINTERIMACCEPTEDThe Hyperlink Object Library for Windows 98, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a crafted link that triggers an "unchecked buffer" in the library, possibly due to a buffer overflow.CVE-2005-0057ACCEPTED1Red Hat Enterprise Linux 3gftpJay BealeDRAFTINTERIMACCEPTEDDirectory traversal vulnerability in gftp before 2.0.18 for GTK+ allows remote malicious FTP servers to read arbitrary files via .. (dot dot) sequences in filenames returned from a LIST command.CVE-2005-0372ACCEPTED1Microsoft Windows Server 2003Web Client ServiceMatthew BurtonDRAFTINTERIMACCEPTEDBuffer overflow in the Web Client service in Microsoft Windows XP and Windows Server 2003 allows remote authenticated users to execute arbitrary code via a crafted WebDAV request containing special parameters.CVE-2005-1207ACCEPTED1Microsoft Windows 2000Microsoft Windows XPInternet ExplorerRobert L. HollisDRAFTRobert L. HollisMicrosoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Javascript BODY onload event that calls the window function, aka "Mismatched Document Object Model Objects Memory Corruption Vulnerability."CVE-2005-1790DRAFT0Red Hat Enterprise Linux 4mozillaJay BealeDRAFTINTERIMACCEPTEDFirefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 does not properly verify the associated types of DOM node names within the context of their namespaces, which allows remote attackers to modify certain tag properties, possibly leading to execution of arbitrary script or code, as demonstrated using an XHTML document with IMG tags with custom properties ("XHTML node spoofing").CVE-2005-2269ACCEPTED1Microsoft Windows XPMicrosoft Internet Explorer 6Microsoft Internet Explorer 6 Service Pack 1Tiffany BergeronAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick, a different vulnerability than CVE-2003-1027.CVE-2003-0823ACCEPTED2HP-UX 11ApacheRobert L. HollisDRAFTInteger overflow in pcre_compile.c in Perl Compatible Regular Expressions (PCRE) before 6.2, as used in multiple products such as Python, Ethereal, and PHP, allows attackers to execute arbitrary code via quantifier values in regular expressions, which leads to a heap-based buffer overflow.CVE-2005-2491DRAFT2Red Hat Enterprise Linux 3mozillaJay BealeDRAFTINTERIMACCEPTEDThe browser user interface in Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 does not properly distinguish between user-generated events and untrusted synthetic events, which makes it easier for remote attackers to perform dangerous actions that normally could only be performed manually by the user.CVE-2005-2260ACCEPTED1Microsoft Windows 2000Microsoft FrontPage Server Extensions 2000Tiffany BergeronAndrew ButtnerINTERIMACCEPTEDChristine WalzerChristine WalzerINTERIMACCEPTEDBuffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to execute arbitrary code via a crafted chunked encoded request.CVE-2003-0822ACCEPTED2Red Hat Enterprise Linux 3GaimJay BealeDRAFTINTERIMACCEPTEDGaim before 1.3.1 allows remote attackers to cause a denial of service (application crash) via a Yahoo! message with non-ASCII characters in a file name.CVE-2005-1269ACCEPTED1Microsoft Windows XPMicrosoft Internet Explorer 6Andrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMChristine WalzerACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability."CVE-2003-1026ACCEPTED2Red Hat Enterprise Linux 3bzip2Jay BealeDRAFTINTERIMACCEPTEDbzip2 allows remote attackers to cause a denial of service (hard drive consumption) via a crafted bzip2 file that causes an infinite loop (a.k.a "decompression bomb").CVE-2005-1260ACCEPTED1Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Data Access Compnents 2.7Christine WalzerINTERIMACCEPTEDBuffer overflow in a component of Microsoft Data Access Components (MDAC) 2.5 through 2.8 allows remote attackers to execute arbitrary code via a malformed UDP response to a broadcast request.CVE-2003-0903ACCEPTED1Red Hat Enterprise Linux 4mozillaJay BealeDRAFTINTERIMACCEPTEDA regression error in Firefox 1.0.3 and Mozilla 1.7.7 allows remote attackers to inject arbitrary Javascript from one page into the frameset of another site, aka the frame injection spoofing vulnerability, a re-introduction of a vulnerability that was originally identified and addressed by CVE-2004-0718.CVE-2005-1937ACCEPTED1HP-UX 11ApacheRobert L. HollisDRAFTThe byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Range field.CVE-2005-2728DRAFT2Microsoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Microsoft SharePoint Team ServicesAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMUnknown vulnerability in the SmartHTML interpreter (shtml.dll) in Microsoft FrontPage Server Extensions 2000 and 2002, and Microsoft SharePoint Team Services 2002, allows remote attackers to cause a denial of service (response failure) via a certain request.CVE-2003-0824INTERIM1HP-UX 11remshdRobert L. HollisDRAFTUnknown vulnerability in remshd daemon in HP-UX B.11.00, B.11.11, and B.11.23 while running in "Trusted Mode" allows remote attackers to gain unauthorized system access via unknown attack vectors.CVE-2005-3565DRAFT4HP-UX 10ftpdRobert L. HollisDRAFTThe FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in.CVE-2005-3296DRAFT4Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDReview whether anonymous HTTP access is allowed2.1.2ACCEPTED1Corresponds to item 2.1.2 in the Exchange 2003 BenchmarkMicrosoft Windows Server 2003Microsoft Color Management ModuleChristine WalzerDRAFTINTERIMACCEPTEDBuffer overflow in the Microsoft Color Management Module for Windows allows remote attackers to execute arbitrary code via an image with crafted ICC profile format tags.CVE-2005-1219ACCEPTED1Microsoft Windows 2000Microsoft Windows XPMicrosoft Internet Explorer 6 Service Pack 1Harvey RubinovitzDRAFTHarvey RubinovitzINTERIMACCEPTEDBuffer overflow in the PNG image rendering component of Microsoft Internet Explorer allows remote attackers to execute arbitrary code via a crafted PNG file.CVE-2005-1211ACCEPTED1Red Hat Enterprise Linux 3mozillaJay BealeDRAFTINTERIMACCEPTEDFirefox before 1.0.5 and Mozilla before 1.7.9 allows a child frame to call top.focus and other methods in a parent frame, even when the parent is in a different domain, which violates the same origin policy and allows remote attackers to steal sensitive information such as cookies and passwords from web sites whose child frames do not verify that they are in the same domain as their parents.CVE-2005-2266ACCEPTED1Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Internet Explorer 6 Service Pack 1Andrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability."CVE-2003-1026ACCEPTED2Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Microsoft Data Access Compnents 2.8Christine WalzerINTERIMACCEPTEDBuffer overflow in a component of Microsoft Data Access Components (MDAC) 2.5 through 2.8 allows remote attackers to execute arbitrary code via a malformed UDP response to a broadcast request.CVE-2003-0903ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Harvey RubinovitzDRAFTINTERIMACCEPTEDThe legacy <script> data-island capability for XML in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to read arbitrary XML files, and portions of other files, via a URL whose "src" attribute redirects to a local file.CVE-2002-0648ACCEPTED1Microsoft Windows 2000Client Server Runtime System (CSRSS)Ingrid SkoogDRAFTINTERIMChristine WalzerAndrew ButtnerACCEPTEDStack-based buffer overflow in WINSRV.DLL in the Client Server Runtime System (CSRSS) process of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application that provides console window information with a long FaceName value.CVE-2005-0551ACCEPTED1Microsoft Windows 2000Local Security Authority Subsystem Service (LSASS)Christine WalzerDRAFTINTERIMACCEPTEDAndrew ButtnerINTERIMACCEPTEDLSASS (Local Security Authority Subsystem Service) of Windows 2000 Server and Windows Server 2003 does not properly validate connection information, which allows local users to gain privileges via a specially-designed program.CVE-2004-0894ACCEPTED2Microsoft Windows XPWindows kernelChristine WalzerDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDBuffer overflow in Windows Kernel allows local users to gain privileges by causing certain error messages to be passed to a debugger.CVE-2003-0112ACCEPTED2Microsoft Windows Server 2003Microsoft Word 2003Matthew BurtonDRAFTINTERIMACCEPTEDMultiple TCP/IP and ICMP implementations, when using Path MTU (PMTU) discovery (PMTUD), allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via forged ICMP ("Fragmentation Needed and Don't Fragment was Set") packets with a low next-hop MTU value, aka the "Path MTU discovery attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.CVE-2004-1060ACCEPTED1Red Hat Enterprise Linux 3mozillaJay BealeDRAFTINTERIMACCEPTEDFirefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 allows remote attackers to cause a denial of service (access violation and crash), and possibly execute arbitrary code, by calling InstallVersion.compareTo with an object instead of a string.CVE-2005-2265ACCEPTED1Microsoft Windows Server 2003Microsoft Internet Explorer 6Harvey RubinovitzDRAFTHarvey RubinovitzINTERIMACCEPTEDBuffer overflow in the PNG image rendering component of Microsoft Internet Explorer allows remote attackers to execute arbitrary code via a crafted PNG file.CVE-2005-1211ACCEPTED1Microsoft Windows 2000Services for UNIXJonathan BakerDRAFTINTERIMACCEPTEDThe Telnet client for Microsoft Windows XP, Windows Server 2003, and Windows Services for UNIX allows remote attackers to read sensitive environment variables via the NEW-ENVIRON option with a SEND ENV_USERVAR command.CVE-2005-1205ACCEPTED1Microsoft Windows Server 2003Operating SystemRobert L. HollisDRAFTINTERIMACCEPTEDnetman.dll in Microsoft Windows Connections Manager Library allows local users to cause a denial of service (Network Connections Service crash) via a large integer argument to a particular function.CVE-2005-2307ACCEPTED2Microsoft Windows 2000Microsoft Windows XPMicrosoft Internet Explorer 6 Service Pack 1Harvey RubinovitzDRAFTINTERIMACCEPTEDBuffer overflow in the URL processor of Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL with a long hostname, aka "URL Parsing Memory Corruption Vulnerability."CVE-2005-0554ACCEPTED1Microsoft Windows Server 2003Microsoft Internet Explorer 6Harvey RubinovitzDRAFTINTERIMACCEPTEDUnknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to obtain information and possibly execute code when browsing from a web site to a web folder view using WebDAV, aka "Web Folder Behaviors Cross-Domain Vulnerability".CVE-2005-1989ACCEPTED1Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Windows Script Engine for JScript v5.1Tiffany BergeronDavid ProulxINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInteger overflow in JsArrayFunctionHeapSort function used by Windows Script Engine for JScript (JScript.dll) on various Windows operating system allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail that uses a large array index value that enables a heap-based buffer overflow attack.CVE-2003-0010ACCEPTED2Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Windows Script Engine for JScript v5.5Tiffany BergeronDavid ProulxINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInteger overflow in JsArrayFunctionHeapSort function used by Windows Script Engine for JScript (JScript.dll) on various Windows operating system allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail that uses a large array index value that enables a heap-based buffer overflow attack.CVE-2003-0010ACCEPTED2Microsoft Windows NTMicrosoft ASN.1 LibraryAndrew ButtnerINTERIMACCEPTEDMultiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 BER encodings with (1) very large length fields that cause arbitrary heap data to be overwritten, or (2) modified bit strings.CVE-2003-0818ACCEPTED1Microsoft Windows XPMicrosoft ASN.1 LibraryAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDMultiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 BER encodings with (1) very large length fields that cause arbitrary heap data to be overwritten, or (2) modified bit strings.CVE-2003-0818ACCEPTED2Microsoft Windows Server 2003Microsoft ASN.1 LibraryAndrew ButtnerINTERIMACCEPTEDMultiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 BER encodings with (1) very large length fields that cause arbitrary heap data to be overwritten, or (2) modified bit strings.CVE-2003-0818ACCEPTED1Microsoft Windows NTWindows Internet Naming Service (WINS)Andrew ButtnerINTERIMACCEPTEDThe Windows Internet Naming Service (WINS) for Microsoft Windows Server 2003, and possibly Windows NT and Server 2000, does not properly validate the length of certain packets, which allows attackers to cause a denial of service and possibly execute arbitrary code.CVE-2003-0825ACCEPTED1Microsoft Windows NTWindows Internet Naming Service (WINS)Andrew ButtnerINTERIMACCEPTEDThe Windows Internet Naming Service (WINS) for Microsoft Windows Server 2003, and possibly Windows NT and Server 2000, does not properly validate the length of certain packets, which allows attackers to cause a denial of service and possibly execute arbitrary code.CVE-2003-0825ACCEPTED1Microsoft Windows Server 2003Windows Internet Naming Service (WINS)Andrew ButtnerINTERIMACCEPTEDThe Windows Internet Naming Service (WINS) for Microsoft Windows Server 2003, and possibly Windows NT and Server 2000, does not properly validate the length of certain packets, which allows attackers to cause a denial of service and possibly execute arbitrary code.CVE-2003-0825ACCEPTED1Red Hat Linux 9PWLibJay BealeMatt BusbyACCEPTEDMultiple vulnerabilities in PWLib before 1.6.0 allow remote attackers to cause a denial of service and possibly execute arbitrary code, as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol.CVE-2004-0097ACCEPTED1Red Hat Linux 9netpbmJay BealeMatt BusbyACCEPTEDnetpbm 9.25 and earlier does not properly create temporary files, which allows local users to overwrite arbitrary files.CVE-2003-0924ACCEPTED1Microsoft Windows Server 2003Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003Andrew ButtnerAndrew ButtnerINTERIMACCEPTEDHarvey RubinovitzINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability."CVE-2003-1026ACCEPTED3Red Hat Linux 9XFree86Jay BealeMatt BusbyACCEPTEDBuffer overflow in ReadFontAlias from dirfile.c of XFree86 4.1.0 through 4.3.0 allows local users and remote attackers to execute arbitrary code via a font alias file (font.alias) with a long token, a different vulnerability than CVE-2004-0084 and CVE-2004-0106.CVE-2004-0083ACCEPTED1Red Hat Linux 9XFree86Jay BealeMatt BusbyACCEPTEDBuffer overflow in the ReadFontAlias function in XFree86 4.1.0 to 4.3.0, when using the CopyISOLatin1Lowered function, allows local or remote authenticated users to execute arbitrary code via a malformed entry in the font alias (font.alias) file, a different vulnerability than CVE-2004-0083 and CVE-2004-0106.CVE-2004-0084ACCEPTED1Red Hat Enterprise Linux 4mozillaJay BealeDRAFTINTERIMACCEPTEDFirefox before 1.0.5, Thunderbird before 1.0.5, Mozilla before 1.7.9, Netscape 8.0.2, and K-Meleon 0.9 runs XBL scripts even when Javascript has been disabled, which makes it easier for remote attackers to bypass such protection.CVE-2005-2261ACCEPTED1Red Hat Linux 9XFree86Jay BealeMatt BusbyACCEPTEDMultiple unknown vulnerabilities in XFree86 4.1.0 to 4.3.0, related to improper handling of font files, a different set of vulnerabilities than CVE-2004-0083 and CVE-2004-0084.CVE-2004-0106ACCEPTED1Red Hat Enterprise Linux 3netpbmJay BealeMatt BusbyACCEPTEDnetpbm 9.25 and earlier does not properly create temporary files, which allows local users to overwrite arbitrary files.CVE-2003-0924ACCEPTED1Red Hat Linux 9MuttJay BealeACCEPTEDBuffer overflow in the index menu code (menu_pad_string of menu.c) for Mutt 1.4.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain mail messages.CVE-2004-0078ACCEPTED1Red Hat Linux 9MailmanJay BealeACCEPTEDCross-site scripting (XSS) vulnerability in the admin CGI script for Mailman before 2.1.4 allows remote attackers to steal session cookies and conduct unauthorized activities.CVE-2003-0965ACCEPTED1Red Hat Linux 9MailmanJay BealeACCEPTEDCross-site scripting (XSS) vulnerability in the create CGI script for Mailman before 2.1.3 allows remote attackers to steal cookies of other users.CVE-2003-0992ACCEPTED1Microsoft Windows 2000Operating SystemRobert L. HollisDRAFTINTERIMACCEPTEDCOM+ in Microsoft Windows does not properly "create and use memory structures," which allows local users or remote attackers to execute arbitrary code.CVE-2005-1978ACCEPTED2Red Hat Enterprise Linux 3mozillaJay BealeDRAFTINTERIMACCEPTEDFirefox before 1.0.5 and Mozilla before 1.7.9 does not properly clone base objects, which allows remote attackers to execute arbitrary code by navigating the prototype chain to reach a privileged object.CVE-2005-2270ACCEPTED1Red Hat Linux 9GaimJay BealeACCEPTEDMultiple buffer overflows in Gaim 0.75 and earlier, and Ultramagnetic before 0.81, allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) cookies in a Yahoo web connection, (2) a long name parameter in the Yahoo login web page, (3) a long value parameter in the Yahoo login page, (4) a YMSG packet, (5) the URL parser, and (6) HTTP proxy connect.CVE-2004-0006ACCEPTED1Red Hat Linux 9GaimJay BealeACCEPTEDBuffer overflow in the Extract Info Field Function for (1) MSN and (2) YMSG protocol handlers in Gaim 0.74 and earlier, and Ultramagnetic before 0.81, allows remote attackers to cause a denial of service and possibly execute arbitrary code.CVE-2004-0007ACCEPTED1Red Hat Linux 9GaimJay BealeACCEPTEDInteger overflow in Gaim 0.74 and earlier, and Ultramagnetic before 0.81, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a directIM packet that triggers a heap-based buffer overflow.CVE-2004-0008ACCEPTED1Red Hat Linux 9slocateJay BealeMatt BusbyACCEPTEDHeap-based buffer overflow in main.c of slocate 2.6, and possibly other versions, may allow local users to gain privileges via a modified slocate database that causes a negative "pathlen" value to be used.CVE-2003-0848ACCEPTED1Red Hat Linux 9Midnight CommanderJay BealeMatt BusbyACCEPTEDStack-based buffer overflow in vfs_s_resolve_symlink of vfs/direntry.c for Midnight Commander (mc) 4.6.0 and earlier, and possibly later versions, allows remote attackers to execute arbitrary code during symlink conversion.CVE-2003-1023ACCEPTED1Red Hat Linux 9KDEJay BealeINTERIMACCEPTEDKonqueror in KDE 3.1.3 and earlier (kdelibs) allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Konqueror to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application.CVE-2003-0592ACCEPTED1Red Hat Enterprise Linux 3mremapJay BealeMatt BusbyACCEPTEDThe do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985.CVE-2004-0077ACCEPTED1Red Hat Enterprise Linux 3PWLibJay BealeMatt BusbyACCEPTEDMultiple vulnerabilities in PWLib before 1.6.0 allow remote attackers to cause a denial of service and possibly execute arbitrary code, as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol.CVE-2004-0097ACCEPTED1Red Hat Enterprise Linux 3Samba 3.0.0 and 3.0.1Jay BealeMatt BusbyACCEPTEDThe mksmbpasswd shell script (mksmbpasswd.sh) in Samba 3.0.0 and 3.0.1, when creating an account but marking it as disabled, may overwrite the user password with an uninitialized buffer, which could enable the account with a more easily guessable password.CVE-2004-0082ACCEPTED1Red Hat Linux 9mod_pythonJay BealeMatt BusbyACCEPTEDUnknown vulnerability in mod_python 3.0.x before 3.0.4, and 2.7.x before 2.7.9, allows remote attackers to cause a denial of service (httpd crash) via a certain query string.CVE-2003-0973ACCEPTED1Red Hat Enterprise Linux 3XFree86Jay BealeMatt BusbyMatt BusbyACCEPTEDBuffer overflow in ReadFontAlias from dirfile.c of XFree86 4.1.0 through 4.3.0 allows local users and remote attackers to execute arbitrary code via a font alias file (font.alias) with a long token, a different vulnerability than CVE-2004-0084 and CVE-2004-0106.CVE-2004-0083ACCEPTED1Red Hat Enterprise Linux 3XFree86Jay BealeMatt BusbyMatt BusbyACCEPTEDBuffer overflow in the ReadFontAlias function in XFree86 4.1.0 to 4.3.0, when using the CopyISOLatin1Lowered function, allows local or remote authenticated users to execute arbitrary code via a malformed entry in the font alias (font.alias) file, a different vulnerability than CVE-2004-0083 and CVE-2004-0106.CVE-2004-0084ACCEPTED1Red Hat Enterprise Linux 3XFree86Jay BealeMatt BusbyACCEPTEDMultiple unknown vulnerabilities in XFree86 4.1.0 to 4.3.0, related to improper handling of font files, a different set of vulnerabilities than CVE-2004-0083 and CVE-2004-0084.CVE-2004-0106ACCEPTED1Red Hat Enterprise Linux 3XMLSoft Libxml2Jay BealeMatt BusbyMatt BusbyINTERIMACCEPTEDBuffer overflow in the (1) nanohttp or (2) nanoftp modules in XMLSoft Libxml 2 (Libxml2) 2.6.0 through 2.6.5 allow remote attackers to execute arbitrary code via a long URL.CVE-2004-0110ACCEPTED1Red Hat Linux 9Linux kernelJay BealeMatt BusbyACCEPTEDUnknown vulnerability in Linux kernel before 2.4.22 allows local users to gain privileges, related to "R128 DRI limits checking."CVE-2004-0003ACCEPTED1Red Hat Linux 9Linux kernelJay BealeMatt BusbyACCEPTEDStack-based buffer overflow in the ncp_lookup function for ncpfs in Linux kernel 2.4.x allows local users to gain privileges.CVE-2004-0010ACCEPTED1Red Hat Linux 9Vicam USB driverJay BealeMatt BusbyACCEPTEDThe Vicam USB driver in Linux before 2.4.25 does not use the copy_from_user function when copying data from userspace to kernel space, which crosses security boundaries and allows local users to cause a denial of service.CVE-2004-0075ACCEPTED1Red Hat Linux 9mremapJay BealeMatt BusbyACCEPTEDThe do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985.CVE-2004-0077ACCEPTED1Red Hat Enterprise Linux 3MuttJay BealeACCEPTEDMatt BusbyBuffer overflow in the index menu code (menu_pad_string of menu.c) for Mutt 1.4.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain mail messages.CVE-2004-0078ACCEPTED1Red Hat Linux 9mod_pythonJay BealeMatt BusbyACCEPTEDUnknown vulnerability in mod_python 3.0.x before 3.0.4, and 2.7.x before 2.7.9, allows remote attackers to cause a denial of service (httpd crash) via a certain query string.CVE-2003-0973ACCEPTED1HP-UX 11ApacheRobert L. HollisDRAFTApache 2.0.45 and 1.3.29, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."CVE-2005-2088DRAFT2Microsoft Windows 2000Windows Media ServicesTiffany BergeronINTERIMUnknown vulnerability in Windows Media Station Service and Windows Media Monitor Service components of Windows Media Services 4.1 allows remote attackers to cause a denial of service (disallowing new connections) via a certain sequence of TCP/IP packets.CVE-2003-0905INTERIM0Microsoft Windows 95Microsoft OutlookAndrew ButtnerINTERIMACCEPTEDJonathan BakerINTERIMACCEPTEDArgument injection vulnerability in Microsoft Outlook 2002 does not sufficiently filter parameters of mailto: URLs when using them as arguments when calling OUTLOOK.EXE, which allows remote attackers to use script code in the Local Machine zone and execute arbitrary programs.CVE-2004-0121ACCEPTED2Microsoft Windows 95Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003MSN MessengerChristine WalzerINTERIMAndrew ButtnerACCEPTEDMicrosoft MSN Messenger 6.0 and 6.1 does not properly handle certain requests, which allows remote attackers to read arbitrary files.CVE-2004-0122ACCEPTED1Red Hat Enterprise Linux 3gdk-pixbufJay BealeINTERIMMatt BusbyACCEPTEDgdk-pixbuf before 0.20 allows attackers to cause a denial of service (crash) via a malformed bitmap (BMP) file.CVE-2004-0111ACCEPTED1Red Hat Linux 9gdk-pixbufJay BealeINTERIMMatt BusbyACCEPTEDgdk-pixbuf before 0.20 allows attackers to cause a denial of service (crash) via a malformed bitmap (BMP) file.CVE-2004-0111ACCEPTED1Red Hat Linux 9tcpdumpJay BealeACCEPTEDtcpdump before 3.8.1 allows remote attackers to cause a denial of service (infinite loop) via certain ISAKMP packets, a different vulnerability than CVE-2004-0057.CVE-2003-0989ACCEPTED1Microsoft Windows XPOperating SystemRobert L. HollisDRAFTINTERIMACCEPTEDBuffer overflow in Collaboration Data Objects (CDO), as used in Microsoft Windows and Microsoft Exchange Server, allows remote attackers to execute arbitrary code when CDOSYS or CDOEX processes an e-mail message with a large header name, as demonstrated using the "Content-Type" string.CVE-2005-1987ACCEPTED2Red Hat Linux 9sysstatJay BealeMatt BusbyINTERIMACCEPTEDThe (1) post and (2) trigger scripts in sysstat 4.0.7 and earlier allow local users to overwrite arbitrary files via symlink attacks on temporary files, a different vulnerability than CVE-2004-0108.CVE-2004-0107ACCEPTED1Red Hat Linux 9tcpdumpJay BealeACCEPTEDThe print_attr_string function in print-radius.c for tcpdump 3.8.1 and earlier allows remote attackers to cause a denial of service (segmentation fault) via a RADIUS attribute with a large length value.CVE-2004-0055ACCEPTED1Red Hat Linux 9tcpdumpJay BealeACCEPTEDThe rawprint function in the ISAKMP decoding routines (print-isakmp.c) for tcpdump 3.8.1 and earlier allows remote attackers to cause a denial of service (segmentation fault) via malformed ISAKMP packets that cause invalid "len" or "loc" values to be used in a loop, a different vulnerability than CVE-2003-0989.CVE-2004-0057ACCEPTED1Red Hat Enterprise Linux 3tcpdumpJay BealeACCEPTEDtcpdump before 3.8.1 allows remote attackers to cause a denial of service (infinite loop) via certain ISAKMP packets, a different vulnerability than CVE-2004-0057.CVE-2003-0989ACCEPTED1Red Hat Enterprise Linux 3tcpdumpJay BealeACCEPTEDThe print_attr_string function in print-radius.c for tcpdump 3.8.1 and earlier allows remote attackers to cause a denial of service (segmentation fault) via a RADIUS attribute with a large length value.CVE-2004-0055ACCEPTED1Red Hat Enterprise Linux 3tcpdumpJay BealeACCEPTEDMatt BusbyThe rawprint function in the ISAKMP decoding routines (print-isakmp.c) for tcpdump 3.8.1 and earlier allows remote attackers to cause a denial of service (segmentation fault) via malformed ISAKMP packets that cause invalid "len" or "loc" values to be used in a loop, a different vulnerability than CVE-2003-0989.CVE-2004-0057ACCEPTED1Red Hat Linux 9CVS serverJay BealeMatt BusbyACCEPTEDCVS server before 1.11.10 may allow attackers to cause the CVS server to create directories and files in the file system root directory via malformed module requests.CVE-2003-0977ACCEPTED1Red Hat Linux 9EtherealJay BealeMatt BusbyACCEPTEDThe SMB dissector in Ethereal before 0.10.0 allows remote attackers to cause a denial of service via a malformed SMB packet that triggers a segmentation fault during processing of Selected packets.CVE-2003-1012ACCEPTED1Red Hat Linux 9TetherealJay BealeMatt BusbyACCEPTEDThe Q.931 dissector in Ethereal before 0.10.0, and Tethereal, allows remote attackers to cause a denial of service (crash) via a malformed Q.931, which triggers a null dereference.CVE-2003-1013ACCEPTED1Red Hat Linux 9KDE Personal Information Management (kdepim)Jay BealeACCEPTEDBuffer overflow in the VCF file information reader for KDE Personal Information Management (kdepim) suite in KDE 3.1.0 through 3.1.4 allows attackers to execute arbitrary code via a VCF file.CVE-2003-0988ACCEPTED1Red Hat Linux 9Linux kernelJay BealeMatt BusbyACCEPTEDReal time clock (RTC) routines in Linux kernel 2.4.23 and earlier do not properly initialize their structures, which could leak kernel data to user space.CVE-2003-0984ACCEPTED1Red Hat Linux 9Linux kernelJay BealeMatt BusbyACCEPTEDThe mremap system call (do_mremap) in Linux kernel 2.4.x before 2.4.21 does not properly perform bounds checks, which allows local users to cause a denial of service and possibly gain privileges by causing a remapping of a virtual memory area (VMA) to create a zero length VMA, a different vulnerability than CAN-2004-0077.CVE-2003-0985ACCEPTED1Red Hat Enterprise Linux 3nfs-utils packagesJay BealeMatt BusbyMatt BusbyINTERIMACCEPTEDrpc.mountd in nfs-utils after 1.0.3 and before 1.0.6 allows attackers to cause a denial of service (crash) via an NFS mount of a directory from a client whose reverse DNS lookup name is different from the forward lookup name.CVE-2004-0154ACCEPTED1Red Hat Enterprise Linux 3SysstatJay BealeMatt BusbyMatt BusbyINTERIMACCEPTEDThe (1) post and (2) trigger scripts in sysstat 4.0.7 and earlier allow local users to overwrite arbitrary files via symlink attacks on temporary files, a different vulnerability than CVE-2004-0108.CVE-2004-0107ACCEPTED1Red Hat Linux 9httpdJay BealeMatt BusbyINTERIMACCEPTEDMultiple stack-based buffer overflows in (1) mod_alias and (2) mod_rewrite for Apache before 1.3.29 allow attackers to create configuration files to cause a denial of service (crash) or execute arbitrary code via a regular expression with more than 9 captures.CVE-2003-0542ACCEPTED1Red Hat Enterprise Linux 3ApacheJay BealeMatt BusbyINTERIMACCEPTEDMultiple stack-based buffer overflows in (1) mod_alias and (2) mod_rewrite for Apache before 1.3.29 allow attackers to create configuration files to cause a denial of service (crash) or execute arbitrary code via a regular expression with more than 9 captures.CVE-2003-0542ACCEPTED1Red Hat Enterprise Linux 3KDE Personal Information Management (kdepim)Jay BealeINTERIMMatt BusbyACCEPTEDBuffer overflow in the VCF file information reader for KDE Personal Information Management (kdepim) suite in KDE 3.1.0 through 3.1.4 allows attackers to execute arbitrary code via a VCF file.CVE-2003-0988ACCEPTED1Red Hat Enterprise Linux 3CVS serverJay BealeMatt BusbyINTERIMACCEPTEDCVS server before 1.11.10 may allow attackers to cause the CVS server to create directories and files in the file system root directory via malformed module requests.CVE-2003-0977ACCEPTED1Red Hat Enterprise Linux 3Linux kernelMatt BusbyMatt BusbyINTERIMACCEPTEDThe mremap system call (do_mremap) in Linux kernel 2.4.x before 2.4.21 does not properly perform bounds checks, which allows local users to cause a denial of service and possibly gain privileges by causing a remapping of a virtual memory area (VMA) to create a zero length VMA, a different vulnerability than CAN-2004-0077.CVE-2003-0985ACCEPTED1Red Hat Enterprise Linux 3Linux kernelMatt BusbyMatt BusbyINTERIMACCEPTEDUnknown vulnerability in the eflags checking in the 32-bit ptrace emulation for the Linux kernel on AMD64 systems allows local users to gain privileges.CVE-2004-0001ACCEPTED1Red Hat Enterprise Linux 3Net-SNMPMatt BusbyMatt BusbyINTERIMACCEPTEDNet-SNMP before 5.0.9 allows a user or community to access data in MIB objects, even if that data is not allowed to be viewed.CVE-2003-0935ACCEPTED1Red Hat Enterprise Linux 3OpenSSLMatt BusbyMatt BusbyMatt BusbyINTERIMACCEPTEDThe do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference.CVE-2004-0079ACCEPTED1Red Hat Enterprise Linux 3OpenSSLMatt BusbyMatt BusbyMatt BusbyINTERIMACCEPTEDOpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the Codenomicon TLS Test Tool.CVE-2004-0081ACCEPTED1Red Hat Linux 9mozillaJay BealeINTERIMACCEPTEDMultiple vulnerabilities in multiple vendor implementations of the Secure/Multipurpose Internet Mail Extensions (S/MIME) protocol allow remote attackers to cause a denial of service and possibly execute arbitrary code via an S/MIME email message containing certain unexpected ASN.1 constructs, as demonstrated using the NISSC test suite.CVE-2003-0564ACCEPTED1Red Hat Linux 9mozillaJay BealeINTERIMACCEPTEDMozilla allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Mozilla to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application.CVE-2003-0594ACCEPTED1Red Hat Linux 9mozillaJay BealeINTERIMACCEPTEDMozilla before 1.4.2 executes Javascript events in the context of a new page while it is being loaded, allowing it to interact with the previous page (zombie document) and enable cross-domain and cross-site scripting (XSS) attacks, as demonstrated using onmousemove events.CVE-2004-0191ACCEPTED1Red Hat Enterprise Linux 3libxml2Jay BealeJay BealeINTERIMACCEPTEDBuffer overflow in the (1) nanohttp or (2) nanoftp modules in XMLSoft Libxml 2 (Libxml2) 2.6.0 through 2.6.5 allow remote attackers to execute arbitrary code via a long URL.CVE-2004-0110ACCEPTED1Red Hat Enterprise Linux 3httpdJay BealeJay BealeINTERIMACCEPTEDMemory leak in ssl_engine_io.c for mod_ssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service (memory consumption) via plain HTTP requests to the SSL port of an SSL-enabled server.CVE-2004-0113ACCEPTED1Red Hat Linux 9Red Hat 9Jay BealeINTERIMACCEPTEDThe "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass url_regex ACLs via a URL with a NULL ("%00") characterm, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists.CVE-2004-0189ACCEPTED1Red Hat Linux 9Red Hat 9Jay BealeJay BealeINTERIMACCEPTEDMultiple buffer overflows in Ethereal 0.8.13 to 0.10.2 allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) NetFlow, (2) IGAP, (3) EIGRP, (4) PGM, (5) IrDA, (6) BGP, (7) ISUP, or (8) TCAP dissectors.CVE-2004-0176ACCEPTED1Red Hat Linux 9Red Hat 9Jay BealeJay BealeINTERIMACCEPTEDThe dissect_attribute_value_pairs function in packet-radius.c for Ethereal 0.8.13 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a malformed RADIUS packet that triggers a null dereference.CVE-2004-0365ACCEPTED1Red Hat Linux 9Red Hat 9Jay BealeJay BealeINTERIMACCEPTEDEthereal 0.10.1 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a zero-length Presentation protocol selector.CVE-2004-0367ACCEPTED1Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Outlook ExpressAndrew ButtnerINTERIMACCEPTEDThe MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability."CVE-2004-0380ACCEPTED1Microsoft Windows 2000Local Security Authority Subsystem Service (LSASS)Tiffany BergeronINTERIMACCEPTEDStack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via a packet that causes the DsRolerUpgradeDownlevelServer function to create long debug entries for the DCPROMO.LOG log file, as exploited by the Sasser worm.CVE-2003-0533ACCEPTED1Microsoft Windows Server 2003Secure Sockets Layer (SSL)David ProulxINTERIMACCEPTEDThe Microsoft Secure Sockets Layer (SSL) library, as used in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service via malformed SSL messages.CVE-2004-0120ACCEPTED1Microsoft Windows XPSecure Sockets Layer (SSL)David ProulxINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDThe Microsoft Secure Sockets Layer (SSL) library, as used in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service via malformed SSL messages.CVE-2004-0120ACCEPTED2Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeJay BealeJay BealeINTERIMACCEPTEDMultiple buffer overflows in Ethereal 0.8.13 to 0.10.2 allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) NetFlow, (2) IGAP, (3) EIGRP, (4) PGM, (5) IrDA, (6) BGP, (7) ISUP, or (8) TCAP dissectors.CVE-2004-0176ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Harvey RubinovitzDRAFTINTERIMACCEPTEDUnknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to obtain information and possibly execute code when browsing from a web site to a web folder view using WebDAV, aka "Web Folder Behaviors Cross-Domain Vulnerability".CVE-2005-1989ACCEPTED1Microsoft Windows XPPrivate Communications Transport (PCT)Andrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDBuffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library, as used in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via PCT 1.0 handshake packets.CVE-2003-0719ACCEPTED2Microsoft Windows 2000Local Descriptor Table (LDT)Jonathan BakerINTERIMACCEPTEDThe NtSetLdtEntries function in the programming interface for the Local Descriptor Table (LDT) in Windows NT 4.0 and Windows 2000 allows local attackers to gain access to kernel memory and execute arbitrary code via an expand-down data segment descriptor descriptor that points to protected memory.CVE-2003-0910ACCEPTED1Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeJay BealeJay BealeINTERIMACCEPTEDThe dissect_attribute_value_pairs function in packet-radius.c for Ethereal 0.8.13 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a malformed RADIUS packet that triggers a null dereference.CVE-2004-0365ACCEPTED1Microsoft Windows 2000Secure Sockets Layer (SSL)David ProulxINTERIMACCEPTEDThe Microsoft Secure Sockets Layer (SSL) library, as used in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service via malformed SSL messages.CVE-2004-0120ACCEPTED1Microsoft Windows 2000Remote Procedure Call (RPC)Christine WalzerINTERIMACCEPTEDA multi-threaded race condition in the Windows RPC DCOM functionality with the MS03-039 patch installed allows remote attackers to cause a denial of service (crash or reboot) by causing two threads to process the same RPC request, which causes one thread to use memory after it has been freed, a different vulnerability than CVE-2003-0352 (Blaster/Nachi), CVE-2003-0715, and CVE-2003-0528, and as demonstrated by certain exploits against those vulnerabilities.CVE-2003-0813ACCEPTED1Microsoft Windows Server 2003Remote Procedure Call (RPC)Christine WalzerA multi-threaded race condition in the Windows RPC DCOM functionality with the MS03-039 patch installed allows remote attackers to cause a denial of service (crash or reboot) by causing two threads to process the same RPC request, which causes one thread to use memory after it has been freed, a different vulnerability than CVE-2003-0352 (Blaster/Nachi), CVE-2003-0715, and CVE-2003-0528, and as demonstrated by certain exploits against those vulnerabilities.CVE-2003-0813DRAFT0Microsoft Windows NTWindows logon process (winlogon)Andrew ButtnerINTERIMACCEPTEDBuffer overflow in the Windows logon process (winlogon) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, and XP SP1, when a member of a domain, allows remote attackers to execute arbitrary code.CVE-2003-0806ACCEPTED1Microsoft Windows 2000Windows logon process (winlogon)Andrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDBuffer overflow in the Windows logon process (winlogon) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, and XP SP1, when a member of a domain, allows remote attackers to execute arbitrary code.CVE-2003-0806ACCEPTED2Microsoft Windows NTEnhanced Metafile (EMF)Windows Metafile (WMF)Andrew ButtnerINTERIMACCEPTEDBuffer overflow in the rendering for (1) Windows Metafile (WMF) or (2) Enhanced Metafile (EMF) image formats in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, and XP SP1 allows remote attackers to execute arbitrary code via a malformed WMF or EMF image.CVE-2003-0906ACCEPTED1Microsoft Windows XPLocal Security Authority Subsystem Service (LSASS)Andrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDStack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via a packet that causes the DsRolerUpgradeDownlevelServer function to create long debug entries for the DCPROMO.LOG log file, as exploited by the Sasser worm.CVE-2003-0533ACCEPTED2Microsoft Windows XPRemote Procedure Call (RPC)Christine WalzerINTERIMACCEPTEDA multi-threaded race condition in the Windows RPC DCOM functionality with the MS03-039 patch installed allows remote attackers to cause a denial of service (crash or reboot) by causing two threads to process the same RPC request, which causes one thread to use memory after it has been freed, a different vulnerability than CVE-2003-0352 (Blaster/Nachi), CVE-2003-0715, and CVE-2003-0528, and as demonstrated by certain exploits against those vulnerabilities.CVE-2003-0813ACCEPTED1Microsoft Windows Server 2003COM Internet ServicesChristine WalzerChristine WalzerDRAFTINTERIMACCEPTEDWindows 2000, XP, and Server 2003 does not properly "validate the use of memory regions" for COM structured storage files, which allows attackers to execute arbitrary code, aka the "COM Structured Storage Vulnerability."CVE-2005-0047ACCEPTED1Red Hat Linux 9OpenSSLMatt BusbyMatt BusbyINTERIMACCEPTEDOpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the Codenomicon TLS Test Tool.CVE-2004-0081ACCEPTED1Microsoft Windows NTPrivate Communications Transport (PCT)Andrew ButtnerINTERIMACCEPTEDBuffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library, as used in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via PCT 1.0 handshake packets.CVE-2003-0719ACCEPTED1Microsoft Windows Server 2003Help and Support Center (HSC)Harvey RubinovitzHarvey RubinovitzINTERIMACCEPTEDHelp and Support Center in Microsoft Windows XP SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code via quotation marks in an hcp:// URL, which are not quoted when constructing the argument list to HelpCtr.exe.CVE-2003-0907ACCEPTED1Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeJay BealeJay BealeINTERIMACCEPTEDEthereal 0.10.1 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a zero-length Presentation protocol selector.CVE-2004-0367ACCEPTED1Microsoft Windows Server 2003Microsoft AgentHarvey RubinovitzDRAFTHarvey RubinovitzINTERIMACCEPTEDMicrosoft Agent allows remote attackers to spoof trusted Internet content and execute arbitrary code by disguising security prompts on a malicious Web page.CVE-2005-1214ACCEPTED1Microsoft Windows 2000H.323Jonathan BakerINTERIMACCEPTEDUnknown vulnerability in the H.323 protocol implementation in Windows 98, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code.CVE-2004-0117ACCEPTED1Microsoft Windows NTIIS 4.0Christine WalzerINTERIMACCEPTEDIIS 5.0 uses relative paths to find system files that will run in-process, which allows local users to gain privileges via a Trojan horse file, aka the "System file listing privilege elevation" vulnerability.CVE-2001-0507ACCEPTED1Microsoft Windows Server 2003NetWareRobert L. HollisDRAFTINTERIMACCEPTEDThe Client Service for NetWare (CSNW) on Microsoft Windows 2000 SP4, XP SP1 and Sp2, and Server 2003 SP1 and earlier, allows remote attackers to execute arbitrary code due to an "unchecked buffer" when processing certain crafted network messages.CVE-2005-1985ACCEPTED2Microsoft Windows NTLocal Descriptor Table (LDT)Jonathan BakerINTERIMACCEPTEDThe NtSetLdtEntries function in the programming interface for the Local Descriptor Table (LDT) in Windows NT 4.0 and Windows 2000 allows local attackers to gain access to kernel memory and execute arbitrary code via an expand-down data segment descriptor descriptor that points to protected memory.CVE-2003-0910ACCEPTED1Microsoft Windows 2000IIS 5.0Christine WalzerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDIIS 5.0 uses relative paths to find system files that will run in-process, which allows local users to gain privileges via a Trojan horse file, aka the "System file listing privilege elevation" vulnerability.CVE-2001-0507ACCEPTED2Microsoft Windows NTIIS 4.0Christine WalzerINTERIMACCEPTEDIn IIS, remote attackers can obtain source code for ASP files by appending "::$DATA" to the URL.CVE-1999-0278ACCEPTED1Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMJay BealeACCEPTEDMultiple vulnerabilities in multiple vendor implementations of the Secure/Multipurpose Internet Mail Extensions (S/MIME) protocol allow remote attackers to cause a denial of service and possibly execute arbitrary code via an S/MIME email message containing certain unexpected ASN.1 constructs, as demonstrated using the NISSC test suite.CVE-2003-0564ACCEPTED1Microsoft Windows NTIIS 4.0Christine WalzerINTERIMACCEPTEDBuffer overflow in IIS 4.0 allows remote attackers to cause a denial of service via a malformed request for files with .HTR, .IDC, or .STM extensions.CVE-1999-0874ACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDIIS HTTP service uses Integrated Windows authentication.2.1.4ACCEPTED1Corresponds to item 2.1.4 in the Exchange 2003 BenchmarkRed Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMJay BealeACCEPTEDMozilla allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Mozilla to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application.CVE-2003-0594ACCEPTED1Microsoft Windows Server 2003Local Security Authority Subsystem Service (LSASS)Andrew ButtnerINTERIMACCEPTEDStack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via a packet that causes the DsRolerUpgradeDownlevelServer function to create long debug entries for the DCPROMO.LOG log file, as exploited by the Sasser worm.CVE-2003-0533ACCEPTED1Microsoft Windows 98Microsoft Windows NTMicrosoft Windows 2000Internet Explorer 5.5, Internet Explorer 5.5 Service Pack 1Tiffany BergeronINTERIMACCEPTEDInternet Explorer 5.5 and earlier allows remote attackers to obtain the physical location of cached content and open the content in the Local Computer Zone, then use compiled HTML help (.chm) files to execute arbitrary programs.CVE-2001-0002ACCEPTED1Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPInternet Explorer 6Tiffany BergeronINTERIMACCEPTEDINTERIMHarvey RubinovitzACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 6.0 allows remote attackers to execute arbitrary code by modifying the Content-Disposition and Content-Type header fields in a way that causes Internet Explorer to believe that the file is safe to open without prompting the user, aka the "File Execution Vulnerability."CVE-2001-0727ACCEPTED3Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Internet Explorer 5.5Tiffany BergeronINTERIMACCEPTEDINTERIMHarvey RubinovitzACCEPTEDBuffer overflow in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to execute arbitrary code via / (slash) characters in the Type property of an Object tag in a web page.CVE-2003-0344ACCEPTED2Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPInternet Explorer 6Tiffany BergeronINTERIMACCEPTEDINTERIMHarvey RubinovitzACCEPTEDChristine WalzerINTERIMACCEPTEDMicrosoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to execute arbitrary code under fewer security restrictions via a malformed web page that requires NetBIOS connectivity, aka "Zone Spoofing through Malformed Web Page" vulnerability.CVE-2002-0190ACCEPTED3Microsoft Windows Server 2003Microsoft ASN.1 LibraryDavid ProulxINTERIMACCEPTEDDouble-free vulnerability in the ASN.1 library as used in Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service and possibly execute arbitrary code.CVE-2004-0123ACCEPTED1Microsoft Windows 98Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPInternet Explorer 6Tiffany BergeronINTERIMACCEPTEDINTERIMHarvey RubinovitzACCEPTEDChristine WalzerINTERIMACCEPTEDBuffer overflow in the implementation of an HTML directive in mshtml.dll in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code via a web page that specifies embedded ActiveX controls in a way that causes 2 Unicode strings to be concatenated.CVE-2002-0022ACCEPTED3Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Internet Explorer 5.5Tiffany BergeronINTERIMACCEPTEDINTERIMHarvey RubinovitzACCEPTEDBuffer overflow in URLMON.DLL in Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to execute arbitrary code via an HTTP response containing long values in (1) Content-type and (2) Content-encoding fields.CVE-2003-0113ACCEPTED2Microsoft Windows 2000IIS 5.0Christine WalzerINTERIMACCEPTEDIIS 5.0 allows remote attackers to obtain source code for .ASP files and other scripts via an HTTP GET request with a "Translate: f" header, aka the "Specialized Header" vulnerability.CVE-2000-0778ACCEPTED1Red Hat Enterprise Linux 3OpenSSLMatt BusbyMatt BusbyINTERIMACCEPTEDThe SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.CVE-2004-0112ACCEPTED1Microsoft Windows NTIIS 4.0Christine WalzerINTERIMACCEPTEDUnknown vulnerability in the hosting process (dllhost.exe) for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allows remote attackers to gain privileges by executing an out of process application that acquires LocalSystem privileges, aka "Out of Process Privilege Elevation."CVE-2002-0869ACCEPTED1Microsoft Windows 2000IIS 5.0Christine WalzerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDUnknown vulnerability in the hosting process (dllhost.exe) for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allows remote attackers to gain privileges by executing an out of process application that acquires LocalSystem privileges, aka "Out of Process Privilege Elevation."CVE-2002-0869ACCEPTED2Microsoft Windows 2000IIS 5.0Christine WalzerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDA typographical error in the script source access permissions for Internet Information Server (IIS) 5.0 does not properly exclude .COM files, which allows attackers with only write permissions to upload malicious .COM files, aka "Script Source Access Vulnerability."CVE-2002-1180ACCEPTED2Microsoft Windows NTIIS 4.0Christine WalzerINTERIMACCEPTEDThe showcode.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files.CVE-1999-0736ACCEPTED1Microsoft Windows 2000IIS 5.0Christine WalzerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDMicrosoft Internet Information Services (IIS) 5.0 and 5.1 allows remote attackers to cause a denial of service via a long WebDAV request with a (1) PROPFIND or (2) SEARCH method, which generates an error condition that is not properly handled.CVE-2003-0226ACCEPTED2Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDReview block-list Exception list entries1.2.3ACCEPTED1Microsoft Windows 2000IIS 5.0Christine WalzerINTERIMACCEPTEDThe logging capability for unicast and multicast transmissions in the ISAPI extension for Microsoft Windows Media Services in Microsoft Windows NT 4.0 and 2000, nsiislog.dll, allows remote attackers to cause a denial of service in Internet Information Server (IIS) and execute arbitrary code via a certain network request.CVE-2003-0227ACCEPTED1Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMJay BealeACCEPTEDMozilla before 1.4.2 executes Javascript events in the context of a new page while it is being loaded, allowing it to interact with the previous page (zombie document) and enable cross-domain and cross-site scripting (XSS) attacks, as demonstrated using onmousemove events.CVE-2004-0191ACCEPTED1Microsoft Windows 2000IIS 5.0Christine WalzerINTERIMACCEPTEDBuffer overflow in the streaming media component for logging multicast requests in the ISAPI for the logging capability of Microsoft Windows Media Services (nsiislog.dll), as installed in IIS 5.0, allows remote attackers to execute arbitrary code via a large POST request to nsiislog.dll.CVE-2003-0349ACCEPTED1Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMACCEPTEDInteger overflow in the ip_setsockopt function in Linux kernel 2.4.22 through 2.4.25 and 2.6.1 through 2.6.3 allows local users to cause a denial of service (crash) or execute arbitrary code via the MCAST_MSFILTER socket option.CVE-2004-0424ACCEPTED1Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMACCEPTEDBuffer overflow in the ISO9660 file system component for Linux kernel 2.4.x, 2.5.x and 2.6.x , allows local users with physical access to overflow kernel memory and execute arbitrary code via a malformed CD containing a long symbolic link entry.CVE-2004-0109ACCEPTED1Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMACCEPTEDThe "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass url_regex ACLs via a URL with a NULL ("%00") characterm, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists.CVE-2004-0189ACCEPTED1Microsoft Windows 2000IIS 5.0Christine WalzerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDMultiple cross-site scripting (XSS) vulnerabilities in the administrative web pages for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allow remote attackers to execute HTML script as other users through (1) a certain ASP file in the IISHELP virtual directory, or (2) possibly other unknown attack vectors.CVE-2002-1181ACCEPTED2Microsoft Windows NTIIS 4.0Christine WalzerINTERIMACCEPTEDMultiple cross-site scripting (XSS) vulnerabilities in the administrative web pages for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allow remote attackers to execute HTML script as other users through (1) a certain ASP file in the IISHELP virtual directory, or (2) possibly other unknown attack vectors.CVE-2002-1181ACCEPTED1Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMACCEPTEDThe KAME IKE Daemon Racoon, when authenticating a peer during Phase 1, validates the X.509 certificate but does not verify the RSA signature authentication, which allows remote attackers to establish unauthorized IP connections or conduct man-in-the-middle attacks using a valid, trusted X.509 certificate.CVE-2004-0155ACCEPTED1Microsoft Windows Server 2003H.323Jonathan BakerINTERIMACCEPTEDUnknown vulnerability in the H.323 protocol implementation in Windows 98, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code.CVE-2004-0117ACCEPTED1Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMACCEPTEDKAME IKE daemon (racoon) does not properly handle hash values, which allows remote attackers to delete certificates via (1) a certain delete message that is not properly handled in isakmp.c or isakmp_inf.c, or (2) a certain INITIAL-CONTACT message that is not properly handled in isakmp_inf.c.CVE-2004-0164ACCEPTED1Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Internet Explorer 5.5Tiffany BergeronINTERIMACCEPTEDINTERIMHarvey RubinovitzACCEPTEDInternet Explorer 5.01, 5.5, and 6.0 allows remote attackers to bypass security zone restrictions and execute arbitrary programs via a web document with a large number of duplicate file:// or other requests that point to the program and open multiple file download dialogs, which eventually cause Internet Explorer to execute the program, as demonstrated using a large number of FRAME or IFRAME tags, aka the "File Download Dialog Vulnerability."CVE-2003-0309ACCEPTED2Microsoft Windows 2000Private Communications Transport (PCT)Andrew ButtnerINTERIMACCEPTEDBuffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library, as used in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via PCT 1.0 handshake packets.CVE-2003-0719ACCEPTED1Microsoft Windows NTSNMPChristine WalzerINTERIMACCEPTEDAndrew ButtnerINTERIMACCEPTEDMemory leak in SNMP agent in Windows NT 4.0 before SP5 allows remote attackers to conduct a denial of service (memory exhaustion) via a large number of queries.CVE-1999-0815ACCEPTED2Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMACCEPTEDThe URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a (1) telnet, (2) rlogin, (3) ssh, or (4) mailto URI, which allows remote attackers to manipulate the options that are passed to the associated programs, possibly to read arbitrary files or execute arbitrary code.CVE-2004-0411ACCEPTED1Microsoft Windows 2000Remote Procedure Call (RPC)Christine WalzerINTERIMACCEPTEDAn Activation function in the RPCSS Service involved with DCOM activation for Microsoft Windows 2000, XP, and 2003 allows remote attackers to cause a denial of service (memory consumption) via an activation request with a large length field.CVE-2004-0116ACCEPTED1Microsoft Windows NTHTML Help FacilityAndrew ButtnerINTERIMACCEPTEDHarvey RubinovitzINTERIMACCEPTEDInternet Explorer 5.x and 6.0 allows remote attackers to execute arbitrary programs via a modified directory traversal attack using a URL containing ".." (dot dot) sequences and a filename that ends in "::" which is treated as a .chm file even if it does not have a .chm extension. NOTE: this bug may overlap CVE-2004-0475.CVE-2003-1041ACCEPTED1Microsoft Windows Server 2003Remote Procedure Call (RPC)Christine WalzerChristine WalzerAn Activation function in the RPCSS Service involved with DCOM activation for Microsoft Windows 2000, XP, and 2003 allows remote attackers to cause a denial of service (memory consumption) via an activation request with a large length field.CVE-2004-0116DRAFT0Microsoft Windows XPRemote Procedure Call (RPC)Christine WalzerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDAn Activation function in the RPCSS Service involved with DCOM activation for Microsoft Windows 2000, XP, and 2003 allows remote attackers to cause a denial of service (memory consumption) via an activation request with a large length field.CVE-2004-0116ACCEPTED2Microsoft Windows 2000Enhanced Metafile (EMF)Windows Metafile (WMF)Andrew ButtnerINTERIMACCEPTEDBuffer overflow in the rendering for (1) Windows Metafile (WMF) or (2) Enhanced Metafile (EMF) image formats in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, and XP SP1 allows remote attackers to execute arbitrary code via a malformed WMF or EMF image.CVE-2003-0906ACCEPTED1Red Hat Enterprise Linux 3ImageMagickJay BealeDRAFTINTERIMACCEPTEDThe XWD Decoder in ImageMagick before 6.2.2.3, and GraphicsMagick before 1.1.6-r1, allows remote attackers to cause a denial of service (infinite loop) via an image with a zero color mask.CVE-2005-1739ACCEPTED1Microsoft Windows 95Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000MDAC 2.5Christine WalzerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDBuffer overflow in a component of SQL-DMO for Microsoft Data Access Components (MDAC) 2.5 through 2.7 allows remote attackers to execute arbitrary code via a long response to a broadcast request to UDP port 1434.CVE-2003-0353ACCEPTED2Microsoft Windows XPMicrosoft Data Access Components 2.6Christine WalzerINTERIMACCEPTEDBuffer overflow in a component of SQL-DMO for Microsoft Data Access Components (MDAC) 2.5 through 2.7 allows remote attackers to execute arbitrary code via a long response to a broadcast request to UDP port 1434.CVE-2003-0353ACCEPTED1Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Internet Explorer 5.5Tiffany BergeronINTERIMACCEPTEDINTERIMHarvey RubinovitzACCEPTEDThe file upload control in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to automatically upload files from the local system via a web page containing a script to upload the files.CVE-2003-0114ACCEPTED2Microsoft Windows XPH.323Jonathan BakerINTERIMACCEPTEDUnknown vulnerability in the H.323 protocol implementation in Windows 98, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code.CVE-2004-0117ACCEPTED1Microsoft Windows NTIIS 4.0Christine WalzerINTERIMACCEPTEDThe logging capability for unicast and multicast transmissions in the ISAPI extension for Microsoft Windows Media Services in Microsoft Windows NT 4.0 and 2000, nsiislog.dll, allows remote attackers to cause a denial of service in Internet Information Server (IIS) and execute arbitrary code via a certain network request.CVE-2003-0227ACCEPTED1Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMACCEPTEDrsync before 2.6.1 does not properly sanitize paths when running a read/write daemon without using chroot, which allows remote attackers to write files outside of the module's path.CVE-2004-0426ACCEPTED1Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Microsoft Jet Database EngineAndrew ButtnerINTERIMACCEPTEDBuffer overflow in Microsoft Jet Database Engine 4.0 allows remote attackers to execute arbitrary code via a specially-crafted database query.CVE-2004-0197ACCEPTED1Microsoft Windows NTCOM Internet ServicesChristine WalzerINTERIMACCEPTEDBuffer overflow in the COM Internet Services and in the RPC over HTTP Proxy components for Microsoft Windows NT Server 4.0, NT 4.0 Terminal Server Edition, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service via a crafted request.CVE-2003-0807ACCEPTED1Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMACCEPTEDHeap-based buffer overflow in CVS 1.11.x up to 1.11.15, and 1.12.x up to 1.12.7, when using the pserver mechanism allows remote attackers to execute arbitrary code via Entry lines.CVE-2004-0396ACCEPTED1Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMACCEPTEDThe Portable Network Graphics library (libpng) 1.0.15 and earlier allows attackers to cause a denial of service (crash) via a malformed PNG image file that triggers an error that causes an out-of-bounds read when creating the error message.CVE-2004-0421ACCEPTED1Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMACCEPTEDTCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via ISAKMP packets containing a Delete payload with a large number of SPI's, which causes an out-of-bounds read, as demonstrated by the Striker ISAKMP Protocol Test Suite.CVE-2004-0183ACCEPTED1Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPInternet Explorer 6Tiffany BergeronINTERIMACCEPTEDINTERIMHarvey RubinovitzACCEPTEDChristine WalzerChristine WalzerINTERIMACCEPTEDInternet Explorer 5.5 and 6.0 allows remote attackers to read certain files and spoof the URL in the address bar by using the Document.open function to pass information between two frames from different domains, a new variant of the "Frame Domain Verification" vulnerability described in MS:MS01-058/CAN-2001-0874.CVE-2002-0027ACCEPTED3Red Hat Linux 9OpenSSLMatt BusbyMatt BusbyINTERIMACCEPTEDThe do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference.CVE-2004-0079ACCEPTED1Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMACCEPTEDInteger underflow in the isakmp_id_print for TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with an Identification payload with a length that becomes less than 8 during byte order conversion, which causes an out-of-bounds read, as demonstrated by the Striker ISAKMP Protocol Test Suite.CVE-2004-0184ACCEPTED1Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMACCEPTEDMultiple stack-based buffer overflows in the get_header function in header.c for LHA 1.14 allow remote attackers or local users to execute arbitrary code via long directory or file names in an LHA archive, which triggers the overflow when testing or extracting the archive.CVE-2004-0234ACCEPTED1Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMACCEPTEDMultiple directory traversal vulnerabilities in LHA 1.14 allow remote attackers or local users to create arbitrary files via an LHA archive containing filenames with (1) .. sequences or (2) absolute pathnames with double leading slashes ("//absolute/path").CVE-2004-0235ACCEPTED1Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMACCEPTEDUtempter allows device names that contain .. (dot dot) directory traversal sequences, which allows local users to overwrite arbitrary files via a symlink attack on device names in combination with an application that trusts the utmp or wtmp files.CVE-2004-0233ACCEPTED1Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMACCEPTEDBuffer overflow in the ntlm_check_auth (NTLM authentication) function for Squid Web Proxy Cache 2.5.x and 3.x, when compiled with NTLM handlers enabled, allows remote attackers to execute arbitrary code via a long password ("pass" variable).CVE-2004-0541ACCEPTED1Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMACCEPTEDEthereal 0.10.3 allows remote attackers to cause a denial of service (crash) via certain SIP messages between Hotsip servers and clients.CVE-2004-0504ACCEPTED1Microsoft Windows XPIIS 5.1Christine WalzerINTERIMACCEPTEDUnknown vulnerability in the hosting process (dllhost.exe) for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allows remote attackers to gain privileges by executing an out of process application that acquires LocalSystem privileges, aka "Out of Process Privilege Elevation."CVE-2002-0869ACCEPTED1Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMACCEPTEDRacoon before 20040408a allows remote attackers to cause a denial of service (memory consumption) via an ISAKMP packet with a large length field.CVE-2004-0403ACCEPTED1Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMACCEPTEDThe AIM dissector in Ethereal 0.10.3 allows remote attackers to cause a denial of service (assert error) via unknown attack vectors.CVE-2004-0505ACCEPTED1Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMACCEPTEDThe SPNEGO dissector in Ethereal 0.9.8 to 0.10.3 allows remote attackers to cause a denial of service (crash) via unknown attack vectors that cause a null pointer dereference.CVE-2004-0506ACCEPTED1Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMACCEPTEDBuffer overflow in the MMSE dissector for Ethereal 0.10.1 to 0.10.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code.CVE-2004-0507ACCEPTED1Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Outlook ExpressIngrid SkoogDRAFTINTERIMACCEPTEDStack-based buffer overflow in the news reader for Microsoft Outlook Express (MSOE.DLL) 5.5 SP2, 6, and 6 SP1 allows remote malicious NNTP servers to execute arbitrary code via a LIST response with a long second field.CVE-2005-1213ACCEPTED1Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Outlook ExpressAndrew ButtnerINTERIMACCEPTEDThe MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability."CVE-2004-0380ACCEPTED1Red Hat Enterprise Linux 3MIT Kerberos 5 (krb5)Jay BealeINTERIMACCEPTEDMultiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root.CVE-2004-0523ACCEPTED1Red Hat Enterprise Linux 3CVSJay BealeINTERIMACCEPTEDCVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle malformed "Entry" lines, which prevents a NULL terminator from being used and may lead to a denial of service (crash), modification of critical program data, or arbitrary code execution.CVE-2004-0414ACCEPTED1Red Hat Enterprise Linux 3CVSJay BealeINTERIMACCEPTEDDouble-free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code.CVE-2004-0416ACCEPTED1Microsoft Windows 2000COM Internet ServicesChristine WalzerINTERIMACCEPTEDBuffer overflow in the COM Internet Services and in the RPC over HTTP Proxy components for Microsoft Windows NT Server 4.0, NT 4.0 Terminal Server Edition, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service via a crafted request.CVE-2003-0807ACCEPTED1Microsoft Windows 98File and Print SharingTiffany BergeronINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDFile and Print Sharing service in Windows 95, Windows 98, and Windows Me does not properly check the password for a file share, which allows remote attackers to bypass share access controls by sending a 1-byte password that matches the first character of the real password, aka the "Share Level Password" vulnerability.CVE-2000-0979ACCEPTED2Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMINTERIMACCEPTED/proc/tty/driver/serial in Linux 2.4.x reveals the exact number of characters used in serial links, which could allow local users to obtain potentially sensitive information such as the length of passwords.CVE-2003-0461ACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDReview blocked sender list1.2.8ACCEPTED1Corresponds to item 1.2.8 in the Exchange 2003 BenchmarkMicrosoft Windows XPHelp and Support Center (HSC)Harvey RubinovitzHarvey RubinovitzINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDHelp and Support Center in Microsoft Windows XP SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code via quotation marks in an hcp:// URL, which are not quoted when constructing the argument list to HelpCtr.exe.CVE-2003-0907ACCEPTED2Red Hat Enterprise Linux 3CVSJay BealeINTERIMACCEPTEDInteger overflow in the "Max-dotdot" CVS protocol command (serve_max_dotdot) for CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to cause a server crash, which could cause temporary data to remain undeleted and consume disk space.CVE-2004-0417ACCEPTED1Red Hat Enterprise Linux 3CVSJay BealeINTERIMACCEPTEDserve_notify in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle empty data lines, which may allow remote attackers to perform an "out-of-bounds" write for a single byte to execute arbitrary code or modify critical program data.CVE-2004-0418ACCEPTED1Microsoft Windows XPWindows XPHarvey RubinovitzINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDWindows XP allows local users to execute arbitrary programs by creating a task at an elevated privilege level through the eventtriggers.exe command-line tool or the Task Scheduler service, aka "Windows Management Vulnerability."CVE-2003-0909ACCEPTED2Microsoft Windows 2000Microsoft Windows XPMicrosoft Internet Explorer 6 Service Pack 1Harvey RubinovitzDRAFTINTERIMACCEPTEDInternet Explorer 5.01, 5.5, and 6 does not properly validate buffers when handling certain DHTML methods including the createControlRange Javascript function, which allows remote attackers to execute arbitrary code, aka the "DHTML Method Heap Memory Corruption Vulnerability."CVE-2005-0055ACCEPTED1Red Hat Enterprise Linux 3SquirrelMailJay BealeINTERIMACCEPTEDMultiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php.CVE-2004-0519ACCEPTED0Microsoft Windows XPMicrosoft ASN.1 LibraryDavid ProulxINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDDouble-free vulnerability in the ASN.1 library as used in Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service and possibly execute arbitrary code.CVE-2004-0123ACCEPTED2Microsoft Windows XPHelp and Support Center (HSC)Harvey RubinovitzINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDHelp and Support Center in Microsoft Windows XP and Windows Server 2003 SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code, as demonstrated using certain hcp:// URLs that access the DVD Upgrade capability (dvdupgrd.htm).CVE-2004-0199ACCEPTED2Microsoft Windows XPIIS 5.1Christine WalzerINTERIMACCEPTEDIIS 5.0 and 5.1 allows remote attackers to cause a denial of service (crash) via malformed WebDAV requests that cause a large amount of memory to be assigned.CVE-2002-1182ACCEPTED1Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Outlook ExpressAndrew ButtnerINTERIMACCEPTEDThe MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability."CVE-2004-0380ACCEPTED1Microsoft Windows 2000IIS 5.0Christine WalzerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDIIS 5.0 and 5.1 allows remote attackers to cause a denial of service (crash) via malformed WebDAV requests that cause a large amount of memory to be assigned.CVE-2002-1182ACCEPTED2Red Hat Enterprise Linux 3SquirrelMailJay BealeINTERIMACCEPTEDCross-site scripting (XSS) vulnerability in mime.php for SquirrelMail before 1.4.3 allows remote attackers to insert arbitrary HTML and script via the content-type mail header, as demonstrated using read_body.php.CVE-2004-0520ACCEPTED0Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMACCEPTEDReal time clock (RTC) routines in Linux kernel 2.4.23 and earlier do not properly initialize their structures, which could leak kernel data to user space.CVE-2003-0984ACCEPTED2Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPInternet Explorer 6Tiffany BergeronINTERIMACCEPTEDINTERIMHarvey RubinovitzACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.5 and 6.0 allows remote attackers to cause the File Download dialogue box to misrepresent the name of the file in the dialogue in a way that could fool users into thinking that the file type is safe to download.CVE-2001-0875ACCEPTED3Microsoft Windows XPInternet Explorer 5.01, Internet Explorer 5.01 Service Pack 1, or Internet Explorer 5.01 Service Pack 2Internet Explorer 5.5 Service Pack 2Internet Explorer 6.0Internet Explorer 5.5 or Internet Explorer 5.5 Service Pack 1Internet Explorer 6 SP1Matthew BurtonDRAFTINTERIMACCEPTEDInternet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability."CVE-2005-0053ACCEPTED1Microsoft Windows 2000Lightweight Directory Access Protocol (LDAP)Tiffany BergeronINTERIMACCEPTEDUnknown vulnerability in the Local Security Authority Subsystem Service (LSASS) in Windows 2000 domain controllers allows remote attackers to cause a denial of service via a crafted LDAP message.CVE-2003-0663ACCEPTED1Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMACCEPTEDUnknown vulnerability in Linux kernel before 2.4.22 allows local users to gain privileges, related to "R128 DRI limits checking."CVE-2004-0003ACCEPTED1Microsoft Windows NTIIS 4.0Christine WalzerINTERIMACCEPTEDDirectory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "\" characters twice.CVE-2001-0333ACCEPTED1Microsoft Windows NTMicrosoft Windows NTTiffany BergeronINTERIMACCEPTEDThe Remote Registry server in Windows NT 4.0 allows local authenticated users to cause a denial of service via a malformed request, which causes the winlogon process to fail, aka the "Remote Registry Access Authentication" vulnerability.CVE-2000-0377ACCEPTED1Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Microsoft Exchange 2000Tiffany BergeronINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDMicrosoft Exchange Server 2000 System Attendant gives "Everyone" group privileges to the WinReg key, which could allow remote attackers to read or modify registry keys.CVE-2002-0049ACCEPTED2Microsoft Windows NTMicrosoft Windows NTTiffany BergeronINTERIMACCEPTEDThe registry in Windows NT can be accessed remotely by users who are not administrators.CVE-1999-0562ACCEPTED1Microsoft Windows 2000NetBIOSTiffany BergeronINTERIMACCEPTEDA component service related to NETBIOS is running.CVE-1999-0621ACCEPTED1Microsoft Windows NTSQL Server 2000Tiffany BergeronINTERIMACCEPTEDJonathan BakerINTERIMINTERIMACCEPTEDIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogIngrid SkoogINTERIMACCEPTEDThe registry key containing the SQL Server service account information in Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, has insecure permissions, which allows local users to gain privileges, aka "Incorrect Permission on SQL Server Service Account Registry Key."CVE-2002-0642ACCEPTED3Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 3Harvey RubinovitzDRAFTINTERIMACCEPTEDThe legacy <script> data-island capability for XML in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to read arbitrary XML files, and portions of other files, via a URL whose "src" attribute redirects to a local file.CVE-2002-0648ACCEPTED1Microsoft Windows 2000Microsoft DirectPlayTiffany BergeronINTERIMACCEPTEDIDirectPlay4 Application Programming Interface (API) of Microsoft DirectPlay 7.0a thru 9.0b, as used in Windows Server 2003 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed packet.CVE-2004-0202ACCEPTED1Microsoft Windows Server 2003Microsoft Outlook ExpressAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDThe MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability."CVE-2004-0380ACCEPTED2HP-UX 11ftpdRobert L. HollisDRAFTThe FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in.CVE-2005-3296DRAFT4Microsoft Windows Server 2003COM Internet ServicesChristine WalzerINTERIMACCEPTEDBuffer overflow in the COM Internet Services and in the RPC over HTTP Proxy components for Microsoft Windows NT Server 4.0, NT 4.0 Terminal Server Edition, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service via a crafted request.CVE-2003-0807ACCEPTED1Microsoft Windows Server 2003Help and Support Center (HSC)Harvey RubinovitzINTERIMACCEPTEDHelp and Support Center in Microsoft Windows XP and Windows Server 2003 SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code, as demonstrated using certain hcp:// URLs that access the DVD Upgrade capability (dvdupgrd.htm).CVE-2004-0199ACCEPTED1Red Hat Enterprise Linux 3SquirrelMailJay BealeINTERIMACCEPTEDSQL injection vulnerability in SquirrelMail before 1.4.3 RC1 allows remote attackers to execute unauthorized SQL statements, with unknown impact, probably via abook_database.php.CVE-2004-0521ACCEPTED0Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMACCEPTEDStack-based buffer overflow in the ncp_lookup function for ncpfs in Linux kernel 2.4.x allows local users to gain privileges.CVE-2004-0010ACCEPTED2Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Veritas Backup Exec 8.5Tiffany BergeronINTERIMIngrid SkoogVeritas Backup Exec 8.5 and earlier requires that the "RestrictAnonymous" registry key for Microsoft Exchange 2000 must be set to 0, which enables anonymous listing of the SAM database and shares.CVE-2002-1117INTERIM0Red Hat Enterprise Linux 3fetchmailJay BealeDRAFTINTERIMACCEPTEDBuffer overflow in the POP3 client in Fetchmail before 6.2.5.2 allows remote POP3 servers to cause a denial of service and possibly execute arbitrary code via long UIDL responses. NOTE: a typo in an advisory accidentally used the wrong CVE identifier for the Fetchmail issue. This is the correct identifier.CVE-2005-2335ACCEPTED1Microsoft Windows XPMicrosoft Data Access Components 2.7Christine WalzerChristine WalzerINTERIMACCEPTEDBuffer overflow in a component of SQL-DMO for Microsoft Data Access Components (MDAC) 2.5 through 2.7 allows remote attackers to execute arbitrary code via a long response to a broadcast request to UDP port 1434.CVE-2003-0353ACCEPTED3Microsoft Windows NTRemote Procedure Call (RPC)Christine WalzerINTERIMACCEPTEDThe DCOM RPC interface for Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause network communications via an "alter context" call that contains additional data, aka the "Object Identity Vulnerability."CVE-2004-0124ACCEPTED1Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMACCEPTEDThe client for CVS before 1.11 allows a remote malicious CVS server to create arbitrary files using certain RCS diff files that use absolute pathnames during checkouts or updates, a different vulnerability than CVE-2004-0405.CVE-2004-0180ACCEPTED1Microsoft Windows 2000Print Spooler ServiceMatthew BurtonDRAFTINTERIMACCEPTEDBuffer overflow in the Print Spooler service (Spoolsv.exe) for Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code via a malicious message.CVE-2005-1984ACCEPTED1Microsoft Windows 2000Utility ManagerHarvey RubinovitzINTERIMACCEPTEDThe Utility Manager in Microsoft Windows 2000 executes winhlp32.exe with system privileges, which allows local users to execute arbitrary code via a "Shatter" style attack using a Windows message that accesses the context sensitive help button in the GUI, as demonstrated using the File Open dialog in the Help window, a different vulnerability than CVE-2004-0213.CVE-2003-0908ACCEPTED1Sun Solaris 7Sun Solaris 8snmpdxBrian SobyDRAFTINTERIMACCEPTEDVulnerabilities in a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via SNMPv1 trap handling, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor. This and other SNMP-related candidates will be updated when more accurate information is available.CVE-2002-0012ACCEPTED1Red Hat Linux 9OpenSSLMatt BusbyMatt BusbyINTERIMACCEPTEDThe SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.CVE-2004-0112ACCEPTED1Microsoft Windows 2000IIS 5.0Christine WalzerINTERIMACCEPTEDDirectory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "\" characters twice.CVE-2001-0333ACCEPTED1Microsoft Windows XPCompressed FoldersDavid ProulxDRAFTINTERIMACCEPTEDJonathan BakerINTERIMACCEPTEDMatthew WojcikINTERIMACCEPTEDInteger overflow in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition allows remote attackers to execute arbitrary code via compressed (zipped) folders that involve an "unchecked buffer" and improper length validation.CVE-2004-0575ACCEPTED3Microsoft Windows XPWindows logon process (winlogon)Andrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDBuffer overflow in the Windows logon process (winlogon) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, and XP SP1, when a member of a domain, allows remote attackers to execute arbitrary code.CVE-2003-0806ACCEPTED2Microsoft Windows XPCertGetCertificateChain, CertVerifyCertificateChainPolicy, and WinVerifyTrust APIsChristine WalzerChristine WalzerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDThe (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.CVE-2002-0862ACCEPTED2Microsoft Windows XPHTML Help FacilityAndrew ButtnerDRAFTINTERIMACCEPTEDInteger overflow in Microsoft Windows 98, 2000, XP SP2 and earlier, and Server 2003 SP1 and earlier allows remote attackers to execute arbitrary code via a crafted compiled Help (.CHM) file with a large size field that triggers a heap-based buffer overflow, as demonstrated using a "ms-its:" URL in Internet Explorer.CVE-2005-1208ACCEPTED1Microsoft Windows NTCertificate ValidationChristine WalzerChristine WalzerChristine WalzerINTERIMACCEPTEDINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDMicrosoft Windows 98 and Windows NT 4.0 do not properly verify the Basic Constraints of digital certificates, allowing remote attackers to execute code, aka "New Variant of Certificate Validation Flaw Could Enable Identity Spoofing" (CAN-2002-0862).CVE-2002-1183ACCEPTED2Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMACCEPTEDCVS before 1.11 allows CVS clients to read arbitrary files via .. (dot dot) sequences in filenames via CVS client requests, a different vulnerability than CVE-2004-0180.CVE-2004-0405ACCEPTED1Microsoft Windows XPMicrosoft Internet Explorer 6Harvey RubinovitzDRAFTINTERIMACCEPTEDInternet Explorer 5.0, 5.5, and 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, including (1) devenum.dll, (2) diactfrm.dll, (3) wmm2filt.dll, (4) fsusd.dll, (5) dmdskmgr.dll, (6) browsewm.dll, (7) browseui.dll, (8) shell32.dll, (9) mshtml.dll, (10) inetcfg.dll, (11) infosoft.dll, (12) query.dll, (13) syncui.dll, (14) clbcatex.dll, (15) clbcatq.dll, (16) comsvcs.dll, and (17) msconf.dll, which causes memory corruption, aka "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2087.CVE-2005-1990ACCEPTED1Microsoft Windows 2000Remote Procedure Call (RPC)Christine WalzerINTERIMACCEPTEDThe DCOM RPC interface for Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause network communications via an "alter context" call that contains additional data, aka the "Object Identity Vulnerability."CVE-2004-0124ACCEPTED1Microsoft Windows 2000Operating SystemRobert L. HollisDRAFTINTERIMACCEPTED'A remote code execution vulnerability exists for the rendering of Windows Metafile (WMF) images. A WMF image is a 16-bit metafile that can contain both vector and bitmap information. An unchecked buffer in the rendering libraries can allow an attacker to remotely execute arbitrary code on the target system. This action could allow the attacker to install programs, access and alter data, and escalate privileges. A successful attack would thus grant a remote attacker complete control of the affected system.'CAN-2005-2123ACCEPTED2Microsoft Windows XPEnhanced Metafile (EMF)Windows Metafile (WMF)Andrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDBuffer overflow in the rendering for (1) Windows Metafile (WMF) or (2) Enhanced Metafile (EMF) image formats in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, and XP SP1 allows remote attackers to execute arbitrary code via a malformed WMF or EMF image.CVE-2003-0906ACCEPTED2Red Hat Enterprise Linux 3Red Hat Enteprise Linux 3Jay BealeINTERIMACCEPTEDMatthew WojcikMatthew WojcikMatthew WojcikMatthew WojcikINTERIMACCEPTEDMultiple format string vulnerabilities in (1) neon 0.24.4 and earlier, and other products that use neon including (2) Cadaver, (3) Subversion, and (4) OpenOffice, allow remote malicious WebDAV servers to execute arbitrary code.CVE-2004-0179ACCEPTED2Microsoft Windows Server 2003Remote Procedure Call (RPC)Christine WalzerINTERIMACCEPTEDThe DCOM RPC interface for Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause network communications via an "alter context" call that contains additional data, aka the "Object Identity Vulnerability."CVE-2004-0124ACCEPTED1Microsoft Windows 2000IIS 5.0Christine WalzerINTERIMACCEPTEDIngrid SkoogINTERIMACCEPTEDBuffer overflow in Internet Printing ISAPI extension in Windows 2000 allows remote attackers to gain root privileges via a long print request that is passed to the extension through IIS 5.0.CVE-2001-0241ACCEPTED2Microsoft Windows XPMSDTCRobert L. HollisDRAFTINTERIMACCEPTEDThe MIDL_user_allocate function in the Microsoft Distributed Transaction Coordinator (MSDTC) proxy (MSDTCPRX.DLL) allocates a 4K page of memory regardless of the required size, which allows attackers to overwrite arbitrary memory locations using an incorrect size value that is provided to the NdrAllocate function, which writes management data to memory outside of the allocated buffer.CVE-2005-2119ACCEPTED2Microsoft Windows XPRemote Procedure Call (RPC)Christine WalzerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDThe DCOM RPC interface for Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause network communications via an "alter context" call that contains additional data, aka the "Object Identity Vulnerability."CVE-2004-0124ACCEPTED2Red Hat Enterprise Linux 4mozillaJay BealeDRAFTINTERIMACCEPTEDFirefox before 1.0.5 allows remote attackers to steal information and possibly execute arbitrary code by using standalone applications such as Flash and QuickTime to open a javascript: URL, which is run in the context of the previous page, and may lead to code execution if the standalone application loads a privileged chrome: URL.CVE-2005-2267ACCEPTED1Microsoft Windows XPTelephony ServiceAndrew ButtnerDRAFTINTERIMACCEPTEDBuffer overflow in the Telephony Application Programming Interface (TAPI) for Microsoft Windows 98, Windows 98 SE, Windows ME, Windows 2000, Windows XP, and Windows Server 2003 allows attackers elevate privileges or execute arbitrary code via a crafted message.CVE-2005-0058ACCEPTED1Microsoft Windows NTMicrosoft Windows 2000Microsoft ASN.1 LibraryDavid ProulxINTERIMACCEPTEDDouble-free vulnerability in the ASN.1 library as used in Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service and possibly execute arbitrary code.CVE-2004-0123ACCEPTED1Microsoft Windows NTSQL Server 2000Tiffany BergeronINTERIMACCEPTEDJonathan BakerINTERIMACCEPTEDIngrid SkoogIngrid SkoogINTERIMACCEPTEDMultiple buffer overflows in SQL Server 2000 Resolution Service allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434 in which (1) a 0x04 byte causes the SQL Monitor thread to generate a long registry key name, or (2) a 0x08 byte with a long string causes heap corruption.CVE-2002-0649ACCEPTED3Microsoft Windows 2000NetBIOSTiffany BergeronINTERIMACCEPTEDJonathan BakerINTERIMACCEPTEDInteractions between the CIFS Browser Protocol and NetBIOS as implemented in Microsoft Windows 95, 98, NT, and 2000 allow remote attackers to modify dynamic NetBIOS name cache entries via a spoofed Browse Frame Request in a unicast or UDP broadcast datagram.CVE-2000-1079ACCEPTED2Red Hat Enterprise Linux 3zgrepJay BealeDRAFTINTERIMACCEPTEDzgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script.CVE-2005-0758ACCEPTED1Red Hat Enterprise Linux 3postgresqlJay BealeDRAFTINTERIMACCEPTEDThe tsearch2 module in PostgreSQL 7.4 through 8.0.x declares the (1) dex_init, (2) snb_en_init, (3) snb_ru_init, (4) spell_init, and (5) syn_init functions as "internal" even when they do not take an internal argument, which allows attackers to cause a denial of service (application crash) and possibly have other impacts via SQL commands that call other functions that accept internal arguments.CVE-2005-1410ACCEPTED1Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Outlook ExpressIngrid SkoogDRAFTINTERIMACCEPTEDStack-based buffer overflow in the news reader for Microsoft Outlook Express (MSOE.DLL) 5.5 SP2, 6, and 6 SP1 allows remote malicious NNTP servers to execute arbitrary code via a LIST response with a long second field.CVE-2005-1213ACCEPTED1Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003mozillaRobert L. HollisDRAFTINTERIMFirefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to modify HTTP headers of XML HTTP requests via XMLHttpRequest, and possibly use the client to exploit vulnerabilities in servers or proxies.CAN-2005-2703INTERIM1Microsoft Windows Server 2003Internet ExplorerRobert L. HollisDRAFTRobert L. HollisMicrosoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Javascript BODY onload event that calls the window function, aka "Mismatched Document Object Model Objects Memory Corruption Vulnerability."CVE-2005-1790DRAFT0Microsoft Windows Server 2003Private Communications Transport (PCT)Andrew ButtnerINTERIMACCEPTEDBuffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library, as used in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via PCT 1.0 handshake packets.CVE-2003-0719ACCEPTED1Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Internet Explorer 5.5 Service Pack 2Tiffany BergeronINTERIMACCEPTEDINTERIMHarvey RubinovitzACCEPTEDHeap-based buffer overflow in plugin.ocx for Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to execute arbitrary code via the Load() method, a different vulnerability than CVE-2003-0115.CVE-2003-0233ACCEPTED2Microsoft Windows 98Microsoft Windows MEMicrosoft Windows 2000DirectXRobert L. HollisDRAFTINTERIMACCEPTED'Parameter checking routines in DirectShow are susceptable to a buffer overrun attack. An attacker could exploit this flaw by creating a specially crafted MIDI file and hosting on a web site or send it as an HTML email. A successful attack would cause an application crash (DoS) of DirectShow and could possibly lead to arbitrary code execution within the security context of the user.'http://www.microsoft.com/downloads/details.aspx?FamilyId=49552D6A-4A62-48BA-A2AC-0B237CD5F732&displaylang=enACCEPTED2Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Internet Explorer 5.5, Internet Explorer 5.5 Service Pack 1Tiffany BergeronINTERIMACCEPTEDInternet Explorer 5.5 and earlier allows remote attackers to display a URL in the address bar that is different than the URL that is actually being displayed, which could be used in web site spoofing attacks, aka the "Web page spoofing vulnerability."CVE-2001-0339ACCEPTED1Microsoft Windows 2000Microsoft Windows XPInternet ExplorerRobert L. HollisDRAFTMicrosoft Internet Explorer 5.01, 5.5, and 6, when using an HTTPS proxy server that requires Basic Authentication, sends URLs in cleartext, which allows remote attackers to obtain sensitive information, aka "HTTPS Proxy Vulnerability."CVE-2005-2830DRAFT0Sun Solaris 9CDEBrian SobyDRAFTINTERIMACCEPTEDBrian SobyBrian SobyINTERIMACCEPTEDCDE ToolTalk database server (ttdbserver) allows remote attackers to overwrite arbitrary memory locations with a zero, and possibly gain privileges, via a file descriptor argument in an AUTH_UNIX procedure call, which is used as a table index by the _TT_ISCLOSE procedure.CVE-2002-0677ACCEPTED2Microsoft Windows XPInternet ExplorerRobert L. HollisDRAFTMicrosoft Internet Explorer 5.01, 5.5, and 6, when using an HTTPS proxy server that requires Basic Authentication, sends URLs in cleartext, which allows remote attackers to obtain sensitive information, aka "HTTPS Proxy Vulnerability."CVE-2005-2830DRAFT0Microsoft Windows 98Microsoft Windows MEMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003DirectXRobert L. HollisDRAFTINTERIMACCEPTED'Parameter checking routines in DirectShow are susceptable to a buffer overrun attack. An attacker could exploit this flaw by creating a specially crafted MIDI file and hosting on a web site or send it as an HTML email. A successful attack would cause an application crash (DoS) of DirectShow and could possibly lead to arbitrary code execution within the security context of the user.'http://www.microsoft.com/downloads/details.aspx?familyid=22F990CB-E9F9-4670-8B4F-AC4F6F66C3A2&displaylang=enACCEPTED2Microsoft Windows XPMicrosoft Windows Server 2003GDI+Ingrid SkoogDRAFTINTERIMACCEPTEDRobert L. HollisBuffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.CVE-2004-0200INTERIM1Microsoft Windows XPNetWareRobert L. HollisDRAFTINTERIMACCEPTEDThe Client Service for NetWare (CSNW) on Microsoft Windows 2000 SP4, XP SP1 and Sp2, and Server 2003 SP1 and earlier, allows remote attackers to execute arbitrary code due to an "unchecked buffer" when processing certain crafted network messages.CVE-2005-1985ACCEPTED2Red Hat Enterprise Linux 3gzipJay BealeDRAFTINTERIMACCEPTEDzgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script.CVE-2005-0758ACCEPTED1Sun Solaris 7Sun Solaris 8Sun Solaris 9Solaris Enterprise Authentication Mechanism (SEAM)Brian SobyDRAFTINTERIMACCEPTEDMIT Kerberos V5 Key Distribution Center (KDC) before 1.2.5 allows remote authenticated attackers to cause a denial of service (crash) on KDCs within the same realm via a certain protocol request that causes a null dereference.CVE-2003-0058ACCEPTED1Microsoft Windows Server 2003Internet Explorer 6.0Jonathan BakerDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDThe DHTML Edit Control (dhtmled.ocx) allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as demonstrated by "AbusiveParent" in Internet Explorer 6.0.2900.2180.CVE-2004-1319ACCEPTED2Microsoft Windows XPMicrosoft Internet Explorer 6Harvey RubinovitzDRAFTHarvey RubinovitzINTERIMACCEPTEDBuffer overflow in the PNG image rendering component of Microsoft Internet Explorer allows remote attackers to execute arbitrary code via a crafted PNG file.CVE-2005-1211ACCEPTED1Microsoft Windows XPOperating SystemRobert L. HollisDRAFTINTERIMACCEPTEDWindows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote user-complicit attackers to execute arbitrary commands via a crafted shortcut (.lnk) file with long font properties that lead to a buffer overflow when the user views the file's properties using Windows Explorer, a different vulnerabiity than CVE-2005-2122.CVE-2005-2118ACCEPTED2Red Hat Enterprise Linux 3Linux kernelJay BealeDRAFTINTERIMACCEPTEDThe linux-2.4.21-mlock.patch in Red Hat Enterprise Linux 3 does not properly maintain the mlock page count when one process unlocks pages that belong to another process, which allows local users to mlock more memory than specified by the rlimit.CVE-2004-0491ACCEPTED1Microsoft Windows 2000Remote Procedure Call (RPC)Christine WalzerDRAFTINTERIMACCEPTEDAndrew ButtnerINTERIMACCEPTEDThe RPC DCOM interface in Windows 2000 SP3 and SP4 allows remote attackers to cause a denial of service (crash), and local attackers to use the DoS to hijack the epmapper pipe to gain privileges, via certain messages to the __RemoteGetClassObject interface that cause a NULL pointer to be passed to the PerformScmStage function.CVE-2003-0605ACCEPTED2Microsoft Windows XPOperating SystemRobert L. HollisDRAFTINTERIMACCEPTEDA remote Denial of Service vulnerability exists for the rendering of Enhanced Metafile (EMF) images. A EMF image is a 32-bit metafile that can contain both vector and bitmap information. An unchecked buffer in the rendering libraries can allow an attacker to trigger a program crash on the affected system. This action would not result in an opportunity to execute code or elevate privileges. A successful attack would cause a program to stop responding. The user may need to manually kill the process using the Windows Task Manager. Once restarted, the program should operate normally until another attempt is made to open the offending image file.CAN-2005-0803ACCEPTED2Red Hat Enterprise Linux 3Linux kernelJay BealeDRAFTINTERIMACCEPTEDThe elf_core_dump function in binfmt_elf.c for Linux kernel 2.x.x to 2.2.27-rc2, 2.4.x to 2.4.31-pre1, and 2.6.x to 2.6.12-rc4 allows local users to execute arbitrary code via an ELF binary that, in certain conditions involving the create_elf_tables function, causes a negative length argument to pass a signed integer comparison, leading to a buffer overflow.CVE-2005-1263ACCEPTED1Red Hat Enterprise Linux 4fetchmailJay BealeDRAFTINTERIMACCEPTEDBuffer overflow in the POP3 client in Fetchmail before 6.2.5.2 allows remote POP3 servers to cause a denial of service and possibly execute arbitrary code via long UIDL responses. NOTE: a typo in an advisory accidentally used the wrong CVE identifier for the Fetchmail issue. This is the correct identifier.CVE-2005-2335ACCEPTED1Microsoft Windows Server 2003Microsoft Color Management ModuleChristine WalzerDRAFTINTERIMACCEPTEDBuffer overflow in the Microsoft Color Management Module for Windows allows remote attackers to execute arbitrary code via an image with crafted ICC profile format tags.CVE-2005-1219ACCEPTED1Sun Solaris 7Sun Solaris 8Sun Solaris 9uucpBrian SobyDRAFTINTERIMACCEPTEDMatthew WojcikINTERIMINTERIMACCEPTEDMultiple buffer overflows in uucp for Sun Solaris 2.6, 7, 8, and 9 allow local users to execute arbitrary code as the uucp user.CVE-2004-1359ACCEPTED2Microsoft Windows Server 2003Operating SystemRobert L. HollisDRAFTINTERIMACCEPTEDBuffer overflow in Collaboration Data Objects (CDO), as used in Microsoft Windows and Microsoft Exchange Server, allows remote attackers to execute arbitrary code when CDOSYS or CDOEX processes an e-mail message with a large header name, as demonstrated using the "Content-Type" string.CVE-2005-1987ACCEPTED2Microsoft Windows XPServices for UNIXJonathan BakerDRAFTINTERIMACCEPTEDThe Telnet client for Microsoft Windows XP, Windows Server 2003, and Windows Services for UNIX allows remote attackers to read sensitive environment variables via the NEW-ENVIRON option with a SEND ENV_USERVAR command.CVE-2005-1205ACCEPTED1Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Internet Explorer 6 Service Pack 1Tiffany BergeronDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDThe WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute code such as Javascript, as demonstrated using (1) delayed HTTP redirect operations, and an HTTP response with a Location: header containing a "URL:" prepended to a "ms-its" protocol URI, or (2) modifying the location attribute of the window, as exploited by the Download.ject (aka Scob aka Toofer) using the ADODB.Stream object.CVE-2004-0549ACCEPTED2Microsoft Windows XPTIPRobert L. HollisDRAFTINTERIMACCEPTEDDistributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service exception and exit) via an "unexpected protocol command during the reconnection request," which is not properly handled by the Transaction Internet Protocol (TIP) functionality.CVE-2005-1979ACCEPTED2Microsoft Windows Server 2003TIPRobert L. HollisDRAFTINTERIMACCEPTEDDistributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service hang) via a crafted Transaction Internet Protocol (TIP) message that causes DTC to repeatedly connect to a target IP and port number after an error occurs, aka the "Distributed TIP Vulnerability."CVE-2005-1980ACCEPTED2Red Hat Enterprise Linux 3telnetJay BealeDRAFTINTERIMACCEPTEDCertain BSD-based Telnet clients, including those used on Solaris and SuSE Linux, allow remote malicious Telnet servers to read sensitive environment variables via the NEW-ENVIRON option with a SEND ENV_USERVAR command.CVE-2005-0488ACCEPTED1Microsoft Windows 2000Microsoft Windows XPMicrosoft Internet Explorer 6 Service Pack 1Harvey RubinovitzDRAFTINTERIMACCEPTEDUnknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to execute arbitrary code via a web site or an HTML e-mail containing a crafted JPEG image that causes memory corruption, aka "JPEG Image Rendering Memory Corruption Vulnerability".CVE-2005-1988ACCEPTED1Microsoft Windows XPSMB (Server Message Block)Jonathan BakerDRAFTINTERIMACCEPTEDBuffer overflow in the Server Message Block (SMB) functionality for Microsoft Windows 2000, XP SP1 and SP2, and Server 2003 and SP1 allows remote attackers to execute arbitrary code via unknown vectors, aka the "Server Message Block Vulnerability."CVE-2005-1206ACCEPTED1Microsoft Windows Server 2003Internet ExplorerRobert L. HollisDRAFTMicrosoft Internet Explorer 5.01, 5.5, and 6, when using an HTTPS proxy server that requires Basic Authentication, sends URLs in cleartext, which allows remote attackers to obtain sensitive information, aka "HTTPS Proxy Vulnerability."CVE-2005-2830DRAFT0Microsoft Windows 2000ISA Server 2000Christine WalzerDRAFTINTERIMACCEPTEDJonathan BakerINTERIMACCEPTEDMicrosoft ISA Server 2000 allows remote attackers to poison the ISA cache or bypass content restriction policies via a malformed HTTP request packet containing multiple Content-Length headers.CVE-2005-1215ACCEPTED2Microsoft Windows 2000Operating SystemRobert L. HollisDRAFTINTERIMACCEPTEDThe FTP client in Windows XP SP1 and Server 2003, and Internet Explorer 6 SP1 on Windows 2000 SP4, when "Enable Folder View for FTP Sites" is enabled and the user manually initiates a file transfer, allows user-complicit, remote FTP servers to overwrite files in arbitrary locations via crafted filenames.CVE-2005-2126ACCEPTED2Microsoft Windows XPMicrosoft Internet Explorer 6Harvey RubinovitzDRAFTINTERIMACCEPTEDThe legacy <script> data-island capability for XML in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to read arbitrary XML files, and portions of other files, via a URL whose "src" attribute redirects to a local file.CVE-2002-0648ACCEPTED1Microsoft Windows Server 2003DirectXRobert L. HollisDRAFTINTERIMACCEPTEDQUARTZ.DLL in Microsoft Windows Media Player 9 allows remote attackers to write a null byte to arbitrary memory via an AVI file with a crafted strn element with a modified length value.CVE-2005-2128ACCEPTED2Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003mozillaRobert L. HollisDRAFTINTERIMFirefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via Unicode sequences with "zero-width non-joiner" characters.CVE-2005-2702INTERIM2HP-UX 11remshdRobert L. HollisDRAFTUnknown vulnerability in remshd daemon in HP-UX B.11.00, B.11.11, and B.11.23 while running in "Trusted Mode" allows remote attackers to gain unauthorized system access via unknown attack vectors.CVE-2005-3565DRAFT4Microsoft Windows XPOperating SystemRobert L. HollisDRAFTINTERIMACCEPTEDA remote Denial of Service vulnerability exists for the rendering of Enhanced Metafile (EMF) images. A EMF image is a 32-bit metafile that can contain both vector and bitmap information. An unchecked buffer in the rendering libraries can allow an attacker to trigger a program crash on the affected system. This action would not result in an opportunity to execute code or elevate privileges. A successful attack would cause a program to stop responding. The user may need to manually kill the process using the Windows Task Manager. Once restarted, the program should operate normally until another attempt is made to open the offending image file.CAN-2005-0803ACCEPTED2Red Hat Enterprise Linux 3bzip2Jay BealeDRAFTINTERIMACCEPTEDRace condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by bzip2 after the decompression is complete.CVE-2005-0953ACCEPTED1Microsoft Windows XPInternet ExplorerRobert L. HollisDRAFTINTERIMACCEPTEDMicrosoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, as originally demonstrated using the (1) DDS Library Shape Control (Msdds.dll) COM object, and other objects including (2) Blnmgrps.dll, (3) Ciodm.dll, (4) Comsvcs.dll, (5) Danim.dll, (6) Htmlmarq.ocx, (7) Mdt2dd.dll (as demonstrated using a heap corruption attack with uninitialized memory), (8) Mdt2qd.dll, (9) Mpg4ds32.ax, (10) Msadds32.ax, (11) Msb1esen.dll, (12) Msb1fren.dll, (13) Msb1geen.dll, (14) Msdtctm.dll, (15) Mshtml.dll, (16) Msoeacct.dll, (17) Msosvfbr.dll, (18) Mswcrun.dll, (19) Netshell.dll, (20) Ole2disp.dll, (21) Outllib.dll, (22) Psisdecd.dll, (23) Qdvd.dll, (24) Repodbc.dll, (25) Shdocvw.dll, (26) Shell32.dll, (27) Soa.dll, (28) Srchui.dll, (29) Stobject.dll, (30) Vdt70.dll, (31) Vmhelper.dll, and (32) Wbemads.dll, aka a variant of the "COM Object Instantiation Memory Corruption vulnerability."CVE-2005-2127ACCEPTED2Microsoft Windows 2000Crystal EnterpriseCrystal ReportsAndrew ButtnerJonathan BakerDirectory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers to read and delete arbitrary files via ".." sequences in the dynamicimag argument to crystalimagehandler.aspx.CVE-2004-0204DRAFT0Microsoft Windows 2000COM Internet ServicesChristine WalzerDRAFTINTERIMACCEPTEDAndrew ButtnerINTERIMACCEPTEDWindows 2000, XP, and Server 2003 does not properly "validate the use of memory regions" for COM structured storage files, which allows attackers to execute arbitrary code, aka the "COM Structured Storage Vulnerability."CVE-2005-0047ACCEPTED2Microsoft Windows Server 2003Microsoft Word for Windows 6.0 ConverterChristine WalzerDRAFTINTERIMACCEPTEDIngrid SkoogINTERIMACCEPTEDMicrosoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CVE-2004-0901.CVE-2004-0571ACCEPTED2Red Hat Enterprise Linux 3gzipJay BealeDRAFTINTERIMACCEPTEDRace condition in gzip 1.2.4, 1.3.3, and earlier, when decompressing a gzipped file, allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by gzip after the decompression is complete.CVE-2005-0988ACCEPTED1Red Hat Enterprise Linux 3mozillaJay BealeDRAFTINTERIMACCEPTEDFirefox before 1.0.5 allows remote attackers to steal information and possibly execute arbitrary code by using standalone applications such as Flash and QuickTime to open a javascript: URL, which is run in the context of the previous page, and may lead to code execution if the standalone application loads a privileged chrome: URL.CVE-2005-2267ACCEPTED1Red Hat Enterprise Linux 3libxml2Jay BealeDRAFTINTERIMACCEPTEDMultiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2), and possibly other versions, may allow remote attackers to execute arbitrary code via (1) a long FTP URL that is not properly handled by the xmlNanoFTPScanURL function, (2) a long proxy URL containing FTP data that is not properly handled by the xmlNanoFTPScanProxy function, and other overflows related to manipulation of DNS length values, including (3) xmlNanoFTPConnect, (4) xmlNanoHTTPConnectHost, and (5) xmlNanoHTTPConnectHost.CVE-2004-0989ACCEPTED1Microsoft Windows XPOperating SystemRobert L. HollisDRAFTINTERIMACCEPTEDA remote code execution vulnerability exists for the rendering of Windows Metafile (WMF) images. A WMF image is a 16-bit metafile that can contain both vector and bitmap information. An unchecked buffer in the rendering libraries can allow an attacker to remotely execute arbitrary code on the target system. This action could allow the attacker to install programs, access and alter data, and escalate privileges. A successful attack would thus grant a remote attacker complete control of the affected system.CAN-2005-2123ACCEPTED2Microsoft Windows XPWindows Media Player 9Christine WalzerDRAFTINTERIMACCEPTEDThe OLE component in Windows 98, 2000, XP, and Server 2003, and Exchange Server 5.0 through 2003, does not properly validate the lengths of messages for certain OLE data, which allows remote attackers to execute arbitrary code, aka the "Input Validation Vulnerability."CVE-2005-0044ACCEPTED1Microsoft Windows XPTIPRobert L. HollisDRAFTINTERIMACCEPTEDDistributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service hang) via a crafted Transaction Internet Protocol (TIP) message that causes DTC to repeatedly connect to a target IP and port number after an error occurs, aka the "Distributed TIP Vulnerability."CVE-2005-1980ACCEPTED2Microsoft Windows XPHTML Help FacilityAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.x and 6.0 allows remote attackers to execute arbitrary programs via a modified directory traversal attack using a URL containing ".." (dot dot) sequences and a filename that ends in "::" which is treated as a .chm file even if it does not have a .chm extension. NOTE: this bug may overlap CVE-2004-0475.CVE-2003-1041ACCEPTED1Microsoft Windows XPMicrosoft Office XP SP3Christine WalzerDRAFTINTERIMJonathan BakerACCEPTEDRobert L. HollisStack-based buffer overflow in Microsoft Word 2000 and Word 2002, and Microsoft Works Suites 2000 through 2004, might allow remote attackers to execute arbitrary code via a .doc file with long font information.CVE-2005-0564INTERIM1Microsoft Windows 2000Operating SystemRobert L. HollisDRAFTINTERIMACCEPTEDWindows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote user-complicit attackers to execute arbitrary commands via a crafted shortcut (.lnk) file with long font properties that lead to a buffer overflow when the user views the file's properties using Windows Explorer, a different vulnerabiity than CVE-2005-2122.CVE-2005-2118ACCEPTED2Microsoft Windows XPMicrosoft AgentHarvey RubinovitzDRAFTHarvey RubinovitzINTERIMACCEPTEDMicrosoft Agent allows remote attackers to spoof trusted Internet content and execute arbitrary code by disguising security prompts on a malicious Web page.CVE-2005-1214ACCEPTED1Red Hat Enterprise Linux 3libgdJay BealeDRAFTINTERIMACCEPTEDMultiple buffer overflows in the gd graphics library (libgd) 2.0.21 and earlier may allow remote attackers to execute arbitrary code via malformed image files that trigger the overflows due to improper calls to the gdMalloc function, a different set of vulnerabilities than CVE-2004-0990.CVE-2004-0941ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 3Harvey RubinovitzDRAFTINTERIMACCEPTEDBuffer overflow in the URL processor of Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL with a long hostname, aka "URL Parsing Memory Corruption Vulnerability."CVE-2005-0554ACCEPTED1Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003mozillaRobert L. HollisDRAFTINTERIMAn attack against the vulnerable Mozilla browsers can be setup by opening a window from a reference to a closed window. Although the resulting window is not privileged, the missing browser user interface is missing. An attack can thus construct a spoof page that circumvents safety features intended to alert users to phishing sites.For example, the address bar and status bar can be placed on the constructed page to make a user believe he is at his favorite online banking site.CAN-2005-2707INTERIM1Microsoft Windows 2000Operating SystemRobert L. HollisDRAFTINTERIMACCEPTEDBuffer overflow in Collaboration Data Objects (CDO), as used in Microsoft Windows and Microsoft Exchange Server, allows remote attackers to execute arbitrary code when CDOSYS or CDOEX processes an e-mail message with a large header name, as demonstrated using the "Content-Type" string.CVE-2005-1987ACCEPTED2Microsoft Windows Server 2003Distributed Component Object Model (DCOM) interfaceChristine WalzerDRAFTINTERIMACCEPTEDHeap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed DCERPC DCOM object activation request packet with modified length fields, a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0528.CVE-2003-0715ACCEPTED1Microsoft Windows XPTIPRobert L. HollisDRAFTINTERIMACCEPTEDDistributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service hang) via a crafted Transaction Internet Protocol (TIP) message that causes DTC to repeatedly connect to a target IP and port number after an error occurs, aka the "Distributed TIP Vulnerability."CVE-2005-1980ACCEPTED2Microsoft Windows 2000Microsoft Windows XPMicrosoft Internet Explorer 6 Service Pack 1Harvey RubinovitzDRAFTINTERIMACCEPTEDThe legacy <script> data-island capability for XML in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to read arbitrary XML files, and portions of other files, via a URL whose "src" attribute redirects to a local file.CVE-2002-0648ACCEPTED1Microsoft Windows Server 2003Internet ExplorerRobert L. HollisDRAFTMultiple design errors in Microsoft Internet Explorer 5.01, 5.5, and 6 allow user-complicit attackers to execute arbitrary code by (1) overlaying a malicious new window above a file download box, then (2) using a keyboard shortcut and delaying the display of the file download box until the user hits a shortcut that activates the "Run" button, aka "File Download Dialog Box Manipulation Vulnerability."CVE-2005-2829DRAFT0Microsoft Windows XPNetWareRobert L. HollisDRAFTINTERIMACCEPTEDThe Client Service for NetWare (CSNW) on Microsoft Windows 2000 SP4, XP SP1 and Sp2, and Server 2003 SP1 and earlier, allows remote attackers to execute arbitrary code due to an "unchecked buffer" when processing certain crafted network messages.CVE-2005-1985ACCEPTED2HP-UX 11ftpdRobert L. HollisDRAFTThe FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in.CVE-2005-3296DRAFT4Microsoft Windows 2000Telephony ServiceAndrew ButtnerDRAFTINTERIMACCEPTEDBuffer overflow in the Telephony Application Programming Interface (TAPI) for Microsoft Windows 98, Windows 98 SE, Windows ME, Windows 2000, Windows XP, and Windows Server 2003 allows attackers elevate privileges or execute arbitrary code via a crafted message.CVE-2005-0058ACCEPTED1Microsoft Windows XPMicrosoft Windows Server 2003Operating SystemRobert L. HollisDRAFTINTERIMACCEPTEDA remote Denial of Service vulnerability exists for the rendering of Enhanced Metafile (EMF) images. A EMF image is a 32-bit metafile that can contain both vector and bitmap information. An unchecked buffer in the rendering libraries can allow an attacker to trigger a program crash on the affected system. This action would not result in an opportunity to execute code or elevate privileges. A successful attack would cause a program to stop responding. The user may need to manually kill the process using the Windows Task Manager. Once restarted, the program should operate normally until another attempt is made to open the offending image file.CAN-2005-0803ACCEPTED2Microsoft Windows Server 2003Microsoft Internet Explorer 6.0 for Windows Server 2003Harvey RubinovitzDRAFTINTERIMACCEPTEDUnknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to execute arbitrary code via a web site or an HTML e-mail containing a crafted JPEG image that causes memory corruption, aka "JPEG Image Rendering Memory Corruption Vulnerability".CVE-2005-1988ACCEPTED1Microsoft Windows Server 2003Microsoft Internet Explorer 6.0 for Windows Server 2003Harvey RubinovitzDRAFTINTERIMACCEPTEDInternet Explorer 5.0, 5.5, and 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, including (1) devenum.dll, (2) diactfrm.dll, (3) wmm2filt.dll, (4) fsusd.dll, (5) dmdskmgr.dll, (6) browsewm.dll, (7) browseui.dll, (8) shell32.dll, (9) mshtml.dll, (10) inetcfg.dll, (11) infosoft.dll, (12) query.dll, (13) syncui.dll, (14) clbcatex.dll, (15) clbcatq.dll, (16) comsvcs.dll, and (17) msconf.dll, which causes memory corruption, aka "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2087.CVE-2005-1990ACCEPTED1Microsoft Windows 98Microsoft Windows MEMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Microsoft Interactive TrainingIngrid SkoogDRAFTINTERIMACCEPTEDBuffer overflow in Microsoft Step-by-Step Interactive Training (orun32.exe) allows remote attackers to execute arbitrary code via a bookmark link file (.cbo, cbl, or .cbm extension) with a long User field.CVE-2005-1212ACCEPTED1Red Hat Enterprise Linux 3Linux kernelJay BealeDRAFTINTERIMACCEPTEDThe shmctl function in Linux 2.6.9 and earlier allows local users to unlock the memory of other processes, which could cause sensitive memory to be swapped to disk, which could allow it to be read by other users once it has been released.CVE-2005-0176ACCEPTED1Red Hat Enterprise Linux 4mozillaJay BealeDRAFTINTERIMACCEPTEDThe browser user interface in Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 does not properly distinguish between user-generated events and untrusted synthetic events, which makes it easier for remote attackers to perform dangerous actions that normally could only be performed manually by the user.CVE-2005-2260ACCEPTED1Sun Solaris 8mozillaBrian SobyDRAFTINTERIMACCEPTEDMozilla allows remote attackers to cause Mozilla to open a URI as a different MIME type than expected via a null character (%00) in an FTP URI.CVE-2004-0760ACCEPTED1Microsoft Windows XPDirectXRobert L. HollisDRAFTINTERIMACCEPTEDQUARTZ.DLL in Microsoft Windows Media Player 9 allows remote attackers to write a null byte to arbitrary memory via an AVI file with a crafted strn element with a modified length value.CVE-2005-2128ACCEPTED2Microsoft Windows 2000Microsoft Windows XPMicrosoft Internet Explorer 6 Service Pack 1 for Windows Server 2003Harvey RubinovitzDRAFTINTERIMACCEPTEDInternet Explorer 5.0, 5.5, and 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, including (1) devenum.dll, (2) diactfrm.dll, (3) wmm2filt.dll, (4) fsusd.dll, (5) dmdskmgr.dll, (6) browsewm.dll, (7) browseui.dll, (8) shell32.dll, (9) mshtml.dll, (10) inetcfg.dll, (11) infosoft.dll, (12) query.dll, (13) syncui.dll, (14) clbcatex.dll, (15) clbcatq.dll, (16) comsvcs.dll, and (17) msconf.dll, which causes memory corruption, aka "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2087.CVE-2005-1990ACCEPTED1Microsoft Windows 95Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Microsoft Word 2003Matthew BurtonDRAFTINTERIMACCEPTEDBuffer overflow in Microsoft Word 2000, Word 2002, and Word 2003 allows remote attackers to execute arbitrary code via a crafted document.CVE-2005-0558ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Harvey RubinovitzDRAFTINTERIMACCEPTEDBuffer overflow in the PNG image rendering component of Microsoft Internet Explorer allows remote attackers to execute arbitrary code via a crafted PNG file.CVE-2005-1211ACCEPTED1Microsoft Windows 2000Operating SystemRobert L. HollisDRAFTINTERIMACCEPTED'A remote Denial of Service vulnerability exists for the rendering of Enhanced Metafile (EMF) images. A EMF image is a 32-bit metafile that can contain both vector and bitmap information. An unchecked buffer in the rendering libraries can allow an attacker to trigger a program crash on the affected system. This action would not result in an opportunity to execute code or elevate privileges. A successful attack would cause a program to stop responding. The user may need to manually kill the process using the Windows Task Manager. Once restarted, the program should operate normally until another attempt is made to open the offending image file.'CAN-2005-0803ACCEPTED2Microsoft Windows 2000Microsoft Word for Windows 6.0 ConverterChristine WalzerDRAFTINTERIMACCEPTEDAndrew ButtnerINTERIMACCEPTEDRobert L. HollisMicrosoft Word for Windows 6.0 Converter (MSWRD632.WPC), as used in WordPad, does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CVE-2004-0571.CVE-2004-0901INTERIM2Red Hat Enterprise Linux 3sudoJay BealeDRAFTINTERIMACCEPTEDRace condition in sudo 1.3.1 up to 1.6.8p8, when the ALL pseudo-command is used after a user entry in the sudoers file, allows local users to gain privileges via a symlink attack.CVE-2005-1993ACCEPTED1It appears that we can't parse the vulnerable configuration condition (an ALL in the second field of a line after a line that has no ALL in the second field) with our existing regexp.Microsoft Windows 2000Operating SystemRobert L. HollisDRAFTINTERIMACCEPTEDStack-based buffer overflow in the Plug and Play (PnP) service (UMPNPMGR.DLL) in Microsoft Windows 2000 SP4, and XP SP1 and SP2, allows remote or local authenticated attackers to execute arbitrary code via a large number of "\" (backslash) characters in a registry key name, which triggers the overflow in a wsprintfW function call.CVE-2005-2120ACCEPTED2Red Hat Enterprise Linux 3geditJay BealeDRAFTINTERIMACCEPTEDFormat string vulnerability in gedit 2.10.2 may allow attackers to cause a denial of service (application crash) via a bin file with format string specifiers in the filename. NOTE: while this issue is triggered on the command line by the gedit user, it has been reported that web browsers and email clients could be configured to provide a file name as an argument to gedit, so there is a valid attack that crosses security boundaries.CVE-2005-1686ACCEPTED1Microsoft Windows Server 2003Operating SystemRobert L. HollisDRAFTINTERIMACCEPTEDnetman.dll in Microsoft Windows Connections Manager Library allows local users to cause a denial of service (Network Connections Service crash) via a large integer argument to a particular function.CVE-2005-2307ACCEPTED2Microsoft Windows 2000TIPRobert L. HollisDRAFTINTERIMACCEPTEDDistributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service hang) via a crafted Transaction Internet Protocol (TIP) message that causes DTC to repeatedly connect to a target IP and port number after an error occurs, aka the "Distributed TIP Vulnerability."CVE-2005-1980ACCEPTED2Microsoft Windows XPOperating SystemRobert L. HollisDRAFTINTERIMACCEPTEDnetman.dll in Microsoft Windows Connections Manager Library allows local users to cause a denial of service (Network Connections Service crash) via a large integer argument to a particular function.CVE-2005-2307ACCEPTED2Microsoft Windows XPWeb Client ServiceMatthew BurtonDRAFTINTERIMACCEPTEDBuffer overflow in the Web Client service in Microsoft Windows XP and Windows Server 2003 allows remote authenticated users to execute arbitrary code via a crafted WebDAV request containing special parameters.CVE-2005-1207ACCEPTED1Red Hat Enterprise Linux 3mozillaJay BealeDRAFTINTERIMACCEPTEDFirefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 does not properly verify the associated types of DOM node names within the context of their namespaces, which allows remote attackers to modify certain tag properties, possibly leading to execution of arbitrary script or code, as demonstrated using an XHTML document with IMG tags with custom properties ("XHTML node spoofing").CVE-2005-2269ACCEPTED1Red Hat Enterprise Linux 3libgdJay BealeDRAFTINTERIMACCEPTEDInteger overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary code via PNG image files with large image rows values that lead to a heap-based buffer overflow in the gdImageCreateFromPngCtx function, a different set of vulnerabilities than CVE-2004-0941.CVE-2004-0990ACCEPTED1Microsoft Windows XPOperating SystemRobert L. HollisDRAFTINTERIMACCEPTEDCOM+ in Microsoft Windows does not properly "create and use memory structures," which allows local users or remote attackers to execute arbitrary code.CVE-2005-1978ACCEPTED2Microsoft Windows XPMicrosoft Windows Server 2003Operating SystemRobert L. HollisDRAFTINTERIMACCEPTEDA remote code execution vulnerability exists for the rendering of Windows Metafile (WMF) images. A WMF image is a 16-bit metafile that can contain both vector and bitmap information. An unchecked buffer in the rendering libraries can allow an attacker to remotely execute arbitrary code on the target system. This action could allow the attacker to install programs, access and alter data, and escalate privileges. A successful attack would thus grant a remote attacker complete control of the affected system.CAN-2005-2123ACCEPTED2Microsoft Windows XPWindows kernelChristine WalzerDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDBuffer overflow in Windows Kernel allows local users to gain privileges by causing certain error messages to be passed to a debugger.CVE-2003-0112ACCEPTED2Microsoft Windows 2000DirectXRobert L. HollisDRAFTINTERIMACCEPTEDQUARTZ.DLL in Microsoft Windows Media Player 9 allows remote attackers to write a null byte to arbitrary memory via an AVI file with a crafted strn element with a modified length value.CVE-2005-2128ACCEPTED2Red Hat Enterprise Linux 3mozillaJay BealeDRAFTINTERIMACCEPTEDFirefox before 1.0.5 and Mozilla before 1.7.9 does not clearly associate a Javascript dialog box with the web page that generated it, which allows remote attackers to spoof a dialog box from a trusted site and facilitates phishing attacks, aka the "Dialog Origin Spoofing Vulnerability."CVE-2005-2268ACCEPTED1Microsoft Windows XPOperating SystemRobert L. HollisDRAFTINTERIMACCEPTEDCOM+ in Microsoft Windows does not properly "create and use memory structures," which allows local users or remote attackers to execute arbitrary code.CVE-2005-1978ACCEPTED2Microsoft Windows Server 2003Windows kernelIngrid SkoogDRAFTINTERIMChristine WalzerACCEPTEDBuffer overflow in Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to cause a denial of service (i.e., system crash) via a malformed request, aka "Object Management Vulnerability".CVE-2005-0550ACCEPTED1Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003mozillaRobert L. HollisDRAFTINTERIMFirefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to spoof DOM objects via an XBL control that implements an internal XPCOM interface.CVE-2005-2704INTERIM2Sun Solaris 7Sun Solaris 8Sun Solaris 9SadminBrian SobyBrian SobyDRAFTINTERIMACCEPTEDThe default installation of sadmind on Solaris uses weak authentication (AUTH_SYS), which allows local and remote attackers to spoof Solstice AdminSuite clients and gain root privileges via a certain sequence of RPC packets.CVE-2003-0722ACCEPTED1HP-UX 11ftpdRobert L. HollisDRAFTThe FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in.CVE-2005-3296DRAFT4Microsoft Windows 98Program Group ConverterAndrew ButtnerDRAFTINTERIMACCEPTEDBuffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe.CVE-2004-0572ACCEPTED1Microsoft Windows 2000Microsoft Color Management ModuleChristine WalzerDRAFTINTERIMACCEPTEDBuffer overflow in the Microsoft Color Management Module for Windows allows remote attackers to execute arbitrary code via an image with crafted ICC profile format tags.CVE-2005-1219ACCEPTED1Red Hat Enterprise Linux 3mozillaJay BealeDRAFTINTERIMACCEPTEDThe InstallTrigger.install method in Firefox before 1.0.5 and Mozilla before 1.7.9 allows remote attackers to execute a callback function in the context of another domain by forcing a page navigation after the install method has been called, which causes the callback to be run in the context of the new page and results in a same origin violation.CVE-2005-2263ACCEPTED1Microsoft Windows XPTIPRobert L. HollisDRAFTINTERIMACCEPTEDDistributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service exception and exit) via an "unexpected protocol command during the reconnection request," which is not properly handled by the Transaction Internet Protocol (TIP) functionality.CVE-2005-1979ACCEPTED2Microsoft Windows Server 2003Operating SystemRobert L. HollisDRAFTINTERIMACCEPTEDThe FTP client in Windows XP SP1 and Server 2003, and Internet Explorer 6 SP1 on Windows 2000 SP4, when "Enable Folder View for FTP Sites" is enabled and the user manually initiates a file transfer, allows user-complicit, remote FTP servers to overwrite files in arbitrary locations via crafted filenames.CVE-2005-2126ACCEPTED2HP-UX 11mozillaRobert L. HollisDRAFTBuffer overflow in the International Domain Name (IDN) support in Mozilla Firefox 1.0.6 and earlier, and Netscape 8.0.3.3 and 7.2, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a hostname with all "soft" hyphens (character 0xAD), which is not properly handled by the NormalizeIDN call in nsStandardURL::BuildNormalizedSpec.CVE-2005-2871DRAFT2Microsoft Windows 2000Windows 2000Matthew BurtonDRAFTINTERIMACCEPTEDWindows Server 2003 and XP SP2, with Windows Firewall turned off, allows remote attackers to cause a denial of service (CPU consumption) via a TCP packet with the SYN flag set and the same destination and source address and port, aka a reoccurrence of the "Land" vulnerability (CVE-1999-0016).CVE-2005-0688ACCEPTED1Microsoft Windows 2000Operating SystemRobert L. HollisDRAFTINTERIMACCEPTEDnetman.dll in Microsoft Windows Connections Manager Library allows local users to cause a denial of service (Network Connections Service crash) via a large integer argument to a particular function.CVE-2005-2307ACCEPTED2Microsoft Windows 2000Operating SystemRobert L. HollisDRAFTINTERIMACCEPTEDWeb View in Windows Explorer on Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 does not properly handle certain HTML characters in preview fields, which allows remote user-complicit attackers to execute arbitrary code.CVE-2005-2117ACCEPTED2Microsoft Windows 98Internet Explorer 6Internet Explorer 6 SP1Ingrid SkoogDRAFTINTERIMACCEPTEDIngrid SkoogINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDHeap-based buffer overflow in Internet Explorer 6 allows remote attackers to execute arbitrary code via long (1) SRC or (2) NAME attributes in IFRAME, FRAME, and EMBED elements, as originally discovered using the mangleme utility, aka "the IFRAME vulnerability" or the "HTML Elements Vulnerability."CVE-2004-1050ACCEPTED3Microsoft Windows Server 2003Telephony ServiceAndrew ButtnerDRAFTINTERIMACCEPTEDBuffer overflow in the Telephony Application Programming Interface (TAPI) for Microsoft Windows 98, Windows 98 SE, Windows ME, Windows 2000, Windows XP, and Windows Server 2003 allows attackers elevate privileges or execute arbitrary code via a crafted message.CVE-2005-0058ACCEPTED1Microsoft Windows XPInternet ExplorerRobert L. HollisDRAFTRobert L. HollisMicrosoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Javascript BODY onload event that calls the window function, aka "Mismatched Document Object Model Objects Memory Corruption Vulnerability."CVE-2005-1790DRAFT0Microsoft Windows XPInternet ExplorerRobert L. HollisDRAFTRobert L. HollisMicrosoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Javascript BODY onload event that calls the window function, aka "Mismatched Document Object Model Objects Memory Corruption Vulnerability."CVE-2005-1790DRAFT0Microsoft Windows XPWindows Animated CursorChristine WalzerDRAFTINTERIMACCEPTEDThe Windows Animated Cursor (ANI) capability in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allow remote attackers to cause a denial of service via (1) the frame number set to zero, which causes an invalid memory address to be used and leads to a kernel crash, or (2) the rate number set to zero, which leads to resource exhaustion and hang.CVE-2004-1305ACCEPTED1Microsoft Windows XPWindows Media Player 9Christine WalzerDRAFTChristine WalzerChristine WalzerChristine WalzerChristine WalzerChristine WalzerChristine WalzerChristine WalzerChristine WalzerINTERIMACCEPTEDWindows Media Player 9 allows remote attackers to execute arbitrary code via a PNG file containing large (1) width or (2) height values, aka the "PNG Processing Vulnerability."CVE-2004-1244ACCEPTED1Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003mozillaRobert L. HollisDRAFTINTERIMInteger overflow in the JavaScript engine in Firefox before 1.0.7 and Mozilla Suite before 1.7.12 might allow remote attackers to execute arbitrary code.CAN-2005-2705INTERIM1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Harvey RubinovitzDRAFTINTERIMACCEPTEDInternet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded, which are decoded twice to generate a malicious hostname, aka the "URL Decoding Zone Spoofing Vulnerability."CVE-2005-0054ACCEPTED1Red Hat Enterprise Linux 4Jay BealeDRAFTINTERIMACCEPTEDThe InstallTrigger.install method in Firefox before 1.0.5 and Mozilla before 1.7.9 allows remote attackers to execute a callback function in the context of another domain by forcing a page navigation after the install method has been called, which causes the callback to be run in the context of the new page and results in a same origin violation.CVE-2005-2263ACCEPTED1Red Hat Enterprise Linux 4mozillaJay BealeDRAFTINTERIMACCEPTEDFirefox before 1.0.5 and Mozilla before 1.7.9 does not clearly associate a Javascript dialog box with the web page that generated it, which allows remote attackers to spoof a dialog box from a trusted site and facilitates phishing attacks, aka the "Dialog Origin Spoofing Vulnerability."CVE-2005-2268ACCEPTED1Microsoft Windows XPMicrosoft Windows Server 2003Internet ExplorerRobert L. HollisDRAFTMicrosoft Internet Explorer 5.01, 5.5, and 6, when using an HTTPS proxy server that requires Basic Authentication, sends URLs in cleartext, which allows remote attackers to obtain sensitive information, aka "HTTPS Proxy Vulnerability."CVE-2005-2830DRAFT0Microsoft Windows XPMicrosoft Internet Explorer 6Harvey RubinovitzDRAFTINTERIMACCEPTEDUnknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to obtain information and possibly execute code when browsing from a web site to a web folder view using WebDAV, aka "Web Folder Behaviors Cross-Domain Vulnerability".CVE-2005-1989ACCEPTED1Microsoft Windows NTWindows kernelChristine WalzerDRAFTINTERIMACCEPTEDThe Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability."CVE-2004-0893ACCEPTED1Microsoft Windows XPTIPRobert L. HollisDRAFTINTERIMACCEPTEDDistributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service hang) via a crafted Transaction Internet Protocol (TIP) message that causes DTC to repeatedly connect to a target IP and port number after an error occurs, aka the "Distributed TIP Vulnerability."CVE-2005-1980ACCEPTED2Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Microsoft Internet ExplorerHarvey RubinovitzDRAFTJonathan BakerINTERIMACCEPTEDInternet Explorer 6.0.2900.2180 on Windows XP allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, as demonstrated using the JVIEW Profiler (Javaprxy.dll). NOTE: the researcher says that the vendor could not reproduce this problem.CVE-2005-2087ACCEPTED1Microsoft Windows XPOperating SystemRobert L. HollisDRAFTINTERIMACCEPTEDStack-based buffer overflow in the Plug and Play (PnP) service (UMPNPMGR.DLL) in Microsoft Windows 2000 SP4, and XP SP1 and SP2, allows remote or local authenticated attackers to execute arbitrary code via a large number of "\" (backslash) characters in a registry key name, which triggers the overflow in a wsprintfW function call.CVE-2005-2120ACCEPTED2Microsoft Windows XPOperating SystemRobert L. HollisDRAFTINTERIMACCEPTEDWindows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to execute arbitrary commands via a shortcut (.lnk) file with long font properties that lead to a buffer overflow in the Client/Server Runtime Server Subsystem (CSRSS), a different vulnerabiity than CVE-2005-2118.CVE-2005-2122ACCEPTED2Microsoft Windows 2000IIS 5.0Jonathan BakerDRAFTINTERIMACCEPTEDThe WebDAV Message Handler for Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows remote attackers to cause a denial of service (memory and CPU exhaustion, application crash) via a PROPFIND request with an XML message containing XML elements with a large number of attributes.CVE-2003-0718ACCEPTED1Microsoft Windows 2000Microsoft Office 2000 SP3Christine WalzerDRAFTINTERIMACCEPTEDRobert L. HollisStack-based buffer overflow in Microsoft Word 2000 and Word 2002, and Microsoft Works Suites 2000 through 2004, might allow remote attackers to execute arbitrary code via a .doc file with long font information.CVE-2005-0564INTERIM1Microsoft Windows 2000Certificate ValidationChristine WalzerChristine WalzerChristine WalzerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDThe (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.CVE-2002-0862ACCEPTED2Microsoft Windows Server 2003Microsoft Internet Explorer 6.0 for Windows Server 2003Harvey RubinovitzDRAFTINTERIMHarvey RubinovitzHarvey RubinovitzHarvey RubinovitzACCEPTEDInternet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability."CVE-2005-0053ACCEPTED1Microsoft Windows XPMicrosoft Internet Explorer 6Harvey RubinovitzDRAFTINTERIMACCEPTEDUnknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to execute arbitrary code via a web site or an HTML e-mail containing a crafted JPEG image that causes memory corruption, aka "JPEG Image Rendering Memory Corruption Vulnerability".CVE-2005-1988ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Harvey RubinovitzDRAFTINTERIMACCEPTEDInternet Explorer 5.0, 5.5, and 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, including (1) devenum.dll, (2) diactfrm.dll, (3) wmm2filt.dll, (4) fsusd.dll, (5) dmdskmgr.dll, (6) browsewm.dll, (7) browseui.dll, (8) shell32.dll, (9) mshtml.dll, (10) inetcfg.dll, (11) infosoft.dll, (12) query.dll, (13) syncui.dll, (14) clbcatex.dll, (15) clbcatq.dll, (16) comsvcs.dll, and (17) msconf.dll, which causes memory corruption, aka "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2087.CVE-2005-1990ACCEPTED1Microsoft Windows 2000TIPRobert L. HollisDRAFTINTERIMACCEPTEDDistributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service exception and exit) via an "unexpected protocol command during the reconnection request," which is not properly handled by the Transaction Internet Protocol (TIP) functionality.CVE-2005-1979ACCEPTED2Microsoft Windows XPInternet ExplorerRobert L. HollisDRAFTMultiple design errors in Microsoft Internet Explorer 5.01, 5.5, and 6 allow user-complicit attackers to execute arbitrary code by (1) overlaying a malicious new window above a file download box, then (2) using a keyboard shortcut and delaying the display of the file download box until the user hits a shortcut that activates the "Run" button, aka "File Download Dialog Box Manipulation Vulnerability."CVE-2005-2829DRAFT0Microsoft Windows NTInternet Explorer 6Tiffany BergeronINTERIMACCEPTEDAndrew ButtnerChristine WalzerINTERIMACCEPTEDStack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0, allows local or remote attackers to execute arbitrary code via a .job file containing long parameters, as demonstrated using Internet Explorer and accessing a .job file on an anonymous share.CVE-2004-0212ACCEPTED1HP-UX 11ApacheRobert L. HollisDRAFTOff-by-one error in the mod_ssl Certificate Revocation List (CRL) verification callback in Apache, when configured to use a CRL, allows remote attackers to cause a denial of service (child process crash) via a CRL that causes a buffer overflow of one null byte.CVE-2005-1268DRAFT2Red Hat Enterprise Linux 3FreeRADIUSJay BealeDRAFTINTERIMACCEPTEDFreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (server crash) by sending an Ascend-Send-Secret attribute without the required leading packet.CVE-2004-0938ACCEPTED1Red Hat Enterprise Linux 3mozillaJay BealeDRAFTINTERIMACCEPTEDFirefox before 1.0.5, Thunderbird before 1.0.5, Mozilla before 1.7.9, Netscape 8.0.2, and K-Meleon 0.9 runs XBL scripts even when Javascript has been disabled, which makes it easier for remote attackers to bypass such protection.CVE-2005-2261ACCEPTED1Microsoft Windows Server 2003HTML Help ActiveX ControlMatthew BurtonDRAFTINTERIMACCEPTEDInternet Explorer 6.0 on Windows XP SP2 allows remote attackers to execute arbitrary code by using the "Related Topics" command in the Help ActiveX Control (hhctrl.ocx) to open a Help popup window containing the PCHealth tools.htm file in the local zone and injecting Javascript to be executed, as demonstrated using "writehta.txt" and the ADODB recordset, which saves a .HTA file to the local system, aka the "HTML Help ActiveX control Cross Domain Vulnerability."CVE-2004-1043ACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should disallow execute permissions to the Exchange HTTP virtual directoryACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should only allow digest or integrated windows authentication (NTLM) to connect to the Exchange HTTP virtual directoriesACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should disallow all access to Exchange HTTP virtual directoriesACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should Display the routing groups in the Exchange System ManagerACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should Display the administrative groups in the Exchange System ManagerACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should enable forms based authenticationACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should only allow digest or integrated windows authentication (NTLM) to connect to the Public HTTP virtual directoriesACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should disallow execute permissions to the Public HTTP virtual directoryACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should disallow all access to Public HTTP virtual directoriesACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should zero out deleted database pagesACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should disable all automated message generationACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should only allow basic authentication with TSL encryption to connect to the IMAP4 serviceACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should use SSL when downloading meeting requestsACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should use the default TCP ports for the the IMAP4 servicesACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should archive all messages received by mailboxes on this storeACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should have clients support S/MIMEACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should not delete mailboxes without waiting for the store to be backed upACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should subscribe to a block list to block spamACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should limit the size of messages to and from the server to 30MBACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should limit the number of recipients in outbound messages to 5000ACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should disable the filtering of recipients who are not in Active DirectoryACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDCharles SchmidtINTERIMACCEPTEDMicrosoft Exchange Server 2003 should archive filtered messages1.2.9ACCEPTED2Corresponds to item 1.2.9 in the Exchange 2003 BenchmarkMicrosoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should filter messages with a blank senderACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should drop connections if the address matches filtersACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should accept messages without notifying the sender of filteringACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should disable Outlook Mobile AccessACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should disable ActiveSyncACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should only allow basic authentication with TSL encryption to connect to the POP3 serviceACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should use SSL when downloading meeting requestsACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should use TCP ports 143 and 995 for the POP3 serviceACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should have mailbox store clients support S/MIME signaturesACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should enable subject logging and displayACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should enable message trackingACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should disable automatic log removalACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should not disable all monitoring on this serverACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should change state to critical when any service stopsACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should limit any connector scope to the routing groupACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should disallow unauthenticated entities to relay through this SMTP connectorACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should force outbound connections to use basic authentication with TLS encryptionACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should have any SMTP connectors use a smart hostACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should only allow basic authentication with TSL encryption to connect to the SMTP serverACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should not resolve anonymous emailACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should only allow explicitly listed hosts to relay messages through this severACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should use a smart host to relay SMTP messagesACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should not perform reverse DNS lookups on incoming messagesACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should use port 25 for outbound SMTP connectionsACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should use only basic authentication with TLS encryption for outbound SMTP connectionsACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should enable logging of connections between SMTP hostsACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should use port 25 for inbound SMTP connectionsACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Charles SchmidtDRAFTINTERIMACCEPTEDMicrosoft Exchange Server 2003 should apply sender, recipient, and connection filtersACCEPTED1Microsoft Windows Server 2003Print Spooler ServiceMatthew BurtonDRAFTINTERIMACCEPTEDBuffer overflow in the Print Spooler service (Spoolsv.exe) for Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code via a malicious message.CVE-2005-1984ACCEPTED1Microsoft Windows XPOperating SystemRobert L. HollisDRAFTINTERIMACCEPTEDBuffer overflow in Collaboration Data Objects (CDO), as used in Microsoft Windows and Microsoft Exchange Server, allows remote attackers to execute arbitrary code when CDOSYS or CDOEX processes an e-mail message with a large header name, as demonstrated using the "Content-Type" string.CVE-2005-1987ACCEPTED2Microsoft Windows Server 2003TIPRobert L. HollisDRAFTINTERIMACCEPTEDDistributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service hang) via a crafted Transaction Internet Protocol (TIP) message that causes DTC to repeatedly connect to a target IP and port number after an error occurs, aka the "Distributed TIP Vulnerability."CVE-2005-1980ACCEPTED2Red Hat Enterprise Linux 4mozillaJay BealeDRAFTINTERIMACCEPTEDFirefox before 1.0.5 and Mozilla before 1.7.9 allows a child frame to call top.focus and other methods in a parent frame, even when the parent is in a different domain, which violates the same origin policy and allows remote attackers to steal sensitive information such as cookies and passwords from web sites whose child frames do not verify that they are in the same domain as their parents.CVE-2005-2266ACCEPTED1Microsoft Windows XPOperating SystemRobert L. HollisDRAFTINTERIMACCEPTEDThe FTP client in Windows XP SP1 and Server 2003, and Internet Explorer 6 SP1 on Windows 2000 SP4, when "Enable Folder View for FTP Sites" is enabled and the user manually initiates a file transfer, allows user-complicit, remote FTP servers to overwrite files in arbitrary locations via crafted filenames.CVE-2005-2126ACCEPTED2Microsoft Windows NTMicrosoft Word for Windows 6.0 ConverterChristine WalzerDRAFTINTERIMACCEPTEDRobert L. HollisMicrosoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CVE-2004-0901.CVE-2004-0571INTERIM1Microsoft Windows 2000Operating SystemRobert L. HollisDRAFTINTERIMACCEPTEDBuffer overflow in Collaboration Data Objects (CDO), as used in Microsoft Windows and Microsoft Exchange Server, allows remote attackers to execute arbitrary code when CDOSYS or CDOEX processes an e-mail message with a large header name, as demonstrated using the "Content-Type" string.CVE-2005-1987ACCEPTED2Microsoft Windows Server 2003DirectXRobert L. HollisDRAFTINTERIMACCEPTEDQUARTZ.DLL in Microsoft Windows Media Player 9 allows remote attackers to write a null byte to arbitrary memory via an AVI file with a crafted strn element with a modified length value.CVE-2005-2128ACCEPTED2Microsoft Windows XPInternet ExplorerRobert L. HollisDRAFTMicrosoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, aka a variant of the "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2127.CVE-2005-2831DRAFT0Microsoft Windows XPIIS 5.1Jonathan BakerDRAFTINTERIMACCEPTEDThe WebDAV Message Handler for Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows remote attackers to cause a denial of service (memory and CPU exhaustion, application crash) via a PROPFIND request with an XML message containing XML elements with a large number of attributes.CVE-2003-0718ACCEPTED1HP-UX 11envdRobert L. HollisDRAFTenvd daemon in HP-UX B.11.00 through B.11.11 allows local users to obtain privileges via unknown attack vectors.CVE-2005-3564DRAFT4Microsoft Windows XPMicrosoft Windows Server 2003Operating SystemRobert L. HollisDRAFT'Microsoft Windows allows remote attackers to execute arbitrary code via a crafted Windows Metafile (WMF) format image, possibly related to the Windows Picture and Fax Viewer (SHIMGVW.DLL), a different vulnerability than CVE-2005-2123 and CVE-2005-2124, and as originally discovered in the wild on unionseek.com.'CVE-2005-4560DRAFT0Microsoft Windows XPDirectXRobert L. HollisDRAFTINTERIMACCEPTEDQUARTZ.DLL in Microsoft Windows Media Player 9 allows remote attackers to write a null byte to arbitrary memory via an AVI file with a crafted strn element with a modified length value.CVE-2005-2128ACCEPTED2Microsoft Windows XPInternet ExplorerRobert L. HollisDRAFTMicrosoft Internet Explorer 5.01, 5.5, and 6, when using an HTTPS proxy server that requires Basic Authentication, sends URLs in cleartext, which allows remote attackers to obtain sensitive information, aka "HTTPS Proxy Vulnerability."CVE-2005-2830DRAFT0Sun Solaris 7CDEBrian SobyBrian SobyDRAFTINTERIMACCEPTEDDouble-free vulnerability in dtlogin in CDE on Solaris, HP-UX, and other operating systems allows remote attackers to execute arbitrary code via a crafted XDMCP packet.CVE-2004-0368ACCEPTED1HP-UX 11ftpdRobert L. HollisDRAFTThe FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in.CVE-2005-3296DRAFT4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003mozillaRobert L. HollisDRAFTINTERIMFirefox before 1.0.7 and Mozilla before Suite 1.7.12 allows remote attackers to execute Javascript with chrome privileges via an about: page such as about:mozilla. The exploit involves bypassing the restriction on loading high privileged "chrome" pages from and unprivileged "about:" page. Although the new "about:" page is unprivileged, the process could be combined with a same-origin violation that could lead to arbitrary code execution.CAN-2005-2706INTERIM1Microsoft Windows Server 2003MSDTCRobert L. HollisDRAFTINTERIMACCEPTEDThe MIDL_user_allocate function in the Microsoft Distributed Transaction Coordinator (MSDTC) proxy (MSDTCPRX.DLL) allocates a 4K page of memory regardless of the required size, which allows attackers to overwrite arbitrary memory locations using an incorrect size value that is provided to the NdrAllocate function, which writes management data to memory outside of the allocated buffer.CVE-2005-2119ACCEPTED2Microsoft Windows Server 2003Internet ExplorerRobert L. HollisDRAFTINTERIMACCEPTEDMicrosoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, as originally demonstrated using the (1) DDS Library Shape Control (Msdds.dll) COM object, and other objects including (2) Blnmgrps.dll, (3) Ciodm.dll, (4) Comsvcs.dll, (5) Danim.dll, (6) Htmlmarq.ocx, (7) Mdt2dd.dll (as demonstrated using a heap corruption attack with uninitialized memory), (8) Mdt2qd.dll, (9) Mpg4ds32.ax, (10) Msadds32.ax, (11) Msb1esen.dll, (12) Msb1fren.dll, (13) Msb1geen.dll, (14) Msdtctm.dll, (15) Mshtml.dll, (16) Msoeacct.dll, (17) Msosvfbr.dll, (18) Mswcrun.dll, (19) Netshell.dll, (20) Ole2disp.dll, (21) Outllib.dll, (22) Psisdecd.dll, (23) Qdvd.dll, (24) Repodbc.dll, (25) Shdocvw.dll, (26) Shell32.dll, (27) Soa.dll, (28) Srchui.dll, (29) Stobject.dll, (30) Vdt70.dll, (31) Vmhelper.dll, and (32) Wbemads.dll, aka a variant of the "COM Object Instantiation Memory Corruption vulnerability."CVE-2005-2127ACCEPTED2Microsoft Windows NTCertificate ValidationChristine WalzerChristine WalzerChristine WalzerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDMicrosoft Windows 98 and Windows NT 4.0 do not properly verify the Basic Constraints of digital certificates, allowing remote attackers to execute code, aka "New Variant of Certificate Validation Flaw Could Enable Identity Spoofing" (CAN-2002-0862).CVE-2002-1183ACCEPTED1Microsoft Windows Server 2003Internet ExplorerRobert L. HollisDRAFTMultiple design errors in Microsoft Internet Explorer 5.01, 5.5, and 6 allow user-complicit attackers to execute arbitrary code by (1) overlaying a malicious new window above a file download box, then (2) using a keyboard shortcut and delaying the display of the file download box until the user hits a shortcut that activates the "Run" button, aka "File Download Dialog Box Manipulation Vulnerability."CVE-2005-2829DRAFT0Microsoft Windows Server 2003Internet ExplorerRobert L. HollisDRAFTINTERIMACCEPTEDMicrosoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, as originally demonstrated using the (1) DDS Library Shape Control (Msdds.dll) COM object, and other objects including (2) Blnmgrps.dll, (3) Ciodm.dll, (4) Comsvcs.dll, (5) Danim.dll, (6) Htmlmarq.ocx, (7) Mdt2dd.dll (as demonstrated using a heap corruption attack with uninitialized memory), (8) Mdt2qd.dll, (9) Mpg4ds32.ax, (10) Msadds32.ax, (11) Msb1esen.dll, (12) Msb1fren.dll, (13) Msb1geen.dll, (14) Msdtctm.dll, (15) Mshtml.dll, (16) Msoeacct.dll, (17) Msosvfbr.dll, (18) Mswcrun.dll, (19) Netshell.dll, (20) Ole2disp.dll, (21) Outllib.dll, (22) Psisdecd.dll, (23) Qdvd.dll, (24) Repodbc.dll, (25) Shdocvw.dll, (26) Shell32.dll, (27) Soa.dll, (28) Srchui.dll, (29) Stobject.dll, (30) Vdt70.dll, (31) Vmhelper.dll, and (32) Wbemads.dll, aka a variant of the "COM Object Instantiation Memory Corruption vulnerability."CVE-2005-2127ACCEPTED2Microsoft Windows Server 2003Operating SystemRobert L. HollisDRAFTINTERIMACCEPTEDCOM+ in Microsoft Windows does not properly "create and use memory structures," which allows local users or remote attackers to execute arbitrary code.CVE-2005-1978ACCEPTED2Sun Solaris 9SambaBrian SobyDRAFTINTERIMACCEPTEDBuffer overflow in samba 2.2.2 through 2.2.6 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an encrypted password that causes the overflow during decryption in which a DOS codepage string is converted to a little-endian UCS2 unicode string.CVE-2002-1318ACCEPTED1Microsoft Windows XPInternet ExplorerRobert L. HollisDRAFTINTERIMACCEPTEDMicrosoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, as originally demonstrated using the (1) DDS Library Shape Control (Msdds.dll) COM object, and other objects including (2) Blnmgrps.dll, (3) Ciodm.dll, (4) Comsvcs.dll, (5) Danim.dll, (6) Htmlmarq.ocx, (7) Mdt2dd.dll (as demonstrated using a heap corruption attack with uninitialized memory), (8) Mdt2qd.dll, (9) Mpg4ds32.ax, (10) Msadds32.ax, (11) Msb1esen.dll, (12) Msb1fren.dll, (13) Msb1geen.dll, (14) Msdtctm.dll, (15) Mshtml.dll, (16) Msoeacct.dll, (17) Msosvfbr.dll, (18) Mswcrun.dll, (19) Netshell.dll, (20) Ole2disp.dll, (21) Outllib.dll, (22) Psisdecd.dll, (23) Qdvd.dll, (24) Repodbc.dll, (25) Shdocvw.dll, (26) Shell32.dll, (27) Soa.dll, (28) Srchui.dll, (29) Stobject.dll, (30) Vdt70.dll, (31) Vmhelper.dll, and (32) Wbemads.dll, aka a variant of the "COM Object Instantiation Memory Corruption vulnerability."CVE-2005-2127ACCEPTED2HP-UX 10ftpdRobert L. HollisDRAFTThe FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in.CVE-2005-3296DRAFT4Microsoft Windows Server 2003Internet ExplorerRobert L. HollisDRAFTMicrosoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, aka a variant of the "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2127.CVE-2005-2831DRAFT0Sun Solaris 7libpngBrian SobyDRAFTINTERIMACCEPTEDMultiple integer overflows in the (1) png_read_png in pngread.c or (2) png_handle_sPLT functions in pngrutil.c or (3) progressive display image reading capability in libpng 1.2.5 and earlier allow remote attackers to cause a denial of service (application crash) via a malformed PNG image.CVE-2004-0599ACCEPTED1Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003mozillaRobert L. HollisDRAFTINTERIMA specially crafted XMB image can be constructed to end with space characters rather than the expected end tag. This can lead to a heap overrun that can be exploited to install or run malicious code on the user's machine.CAN-2005-2701INTERIM1Sun Solaris 8Sun Solaris 9Solaris Management Console (SMC)Brian SobyDRAFTINTERIMACCEPTEDMatthew WojcikINTERIMINTERIMACCEPTEDThe Solaris Management Console (SMC) in Sun Solaris 8 and 9 generates different 404 error messages when a file does not exist versus when a file exists but is otherwise inacessible, which could allow remote attackers to obtain sensitive information in conjunction with a directory traversal (..) attack.CVE-2004-1354ACCEPTED2Microsoft Windows 2000Operating SystemRobert L. HollisDRAFTINTERIMACCEPTEDWindows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to execute arbitrary commands via a shortcut (.lnk) file with long font properties that lead to a buffer overflow in the Client/Server Runtime Server Subsystem (CSRSS), a different vulnerabiity than CVE-2005-2118.CVE-2005-2122ACCEPTED2Microsoft Windows 2000Internet ExplorerRobert L. HollisDRAFTRobert L. HollisMicrosoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Javascript BODY onload event that calls the window function, aka "Mismatched Document Object Model Objects Memory Corruption Vulnerability."CVE-2005-1790DRAFT0Microsoft Windows 2000Internet ExplorerRobert L. HollisDRAFTMultiple design errors in Microsoft Internet Explorer 5.01, 5.5, and 6 allow user-complicit attackers to execute arbitrary code by (1) overlaying a malicious new window above a file download box, then (2) using a keyboard shortcut and delaying the display of the file download box until the user hits a shortcut that activates the "Run" button, aka "File Download Dialog Box Manipulation Vulnerability."CVE-2005-2829DRAFT0Microsoft Windows XPOperating SystemRobert L. HollisDRAFTINTERIMACCEPTEDCOM+ in Microsoft Windows does not properly "create and use memory structures," which allows local users or remote attackers to execute arbitrary code.CVE-2005-1978ACCEPTED2Microsoft Windows 2000HTML Help FacilityAndrew ButtnerINTERIMACCEPTEDHeap-based buffer overflow in the HtmlHelp program (hh.exe) in HTML Help for Microsoft Windows 98, Me, NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary commands via a .CHM file with a large length field, a different vulnerability than CVE-2003-1041.CVE-2004-0201ACCEPTED0Microsoft Windows 2000Microsoft Windows XPInternet ExplorerRobert L. HollisDRAFTMultiple design errors in Microsoft Internet Explorer 5.01, 5.5, and 6 allow user-complicit attackers to execute arbitrary code by (1) overlaying a malicious new window above a file download box, then (2) using a keyboard shortcut and delaying the display of the file download box until the user hits a shortcut that activates the "Run" button, aka "File Download Dialog Box Manipulation Vulnerability."CVE-2005-2829DRAFT0Microsoft Windows XPInternet ExplorerRobert L. HollisDRAFTMultiple design errors in Microsoft Internet Explorer 5.01, 5.5, and 6 allow user-complicit attackers to execute arbitrary code by (1) overlaying a malicious new window above a file download box, then (2) using a keyboard shortcut and delaying the display of the file download box until the user hits a shortcut that activates the "Run" button, aka "File Download Dialog Box Manipulation Vulnerability."CVE-2005-2829DRAFT0Microsoft Windows Server 2003Internet ExplorerRobert L. HollisDRAFTRobert L. HollisMicrosoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Javascript BODY onload event that calls the window function, aka "Mismatched Document Object Model Objects Memory Corruption Vulnerability."CVE-2005-1790DRAFT0Microsoft Windows NTVDMIngrid SkoogIngrid SkoogACCEPTEDThe component for the Virtual DOS Machine (VDM) subsystem in Windows NT 4.0 and Windows 2000 does not properly validate system structures, which allows local users to access protected kernel memory and execute arbitrary code.CVE-2004-0118ACCEPTED2Microsoft Windows XPTIPRobert L. HollisDRAFTINTERIMACCEPTEDDistributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service exception and exit) via an "unexpected protocol command during the reconnection request," which is not properly handled by the Transaction Internet Protocol (TIP) functionality.CVE-2005-1979ACCEPTED2Microsoft Windows XPOperating SystemRobert L. HollisDRAFTINTERIMACCEPTEDBuffer overflow in Collaboration Data Objects (CDO), as used in Microsoft Windows and Microsoft Exchange Server, allows remote attackers to execute arbitrary code when CDOSYS or CDOEX processes an e-mail message with a large header name, as demonstrated using the "Content-Type" string.CVE-2005-1987ACCEPTED2Microsoft Windows XPOperating SystemRobert L. HollisDRAFTINTERIMACCEPTEDWindows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to execute arbitrary commands via a shortcut (.lnk) file with long font properties that lead to a buffer overflow in the Client/Server Runtime Server Subsystem (CSRSS), a different vulnerabiity than CVE-2005-2118.CVE-2005-2122ACCEPTED2Microsoft Windows XPOperating SystemRobert L. HollisDRAFTINTERIMACCEPTEDStack-based buffer overflow in the Plug and Play (PnP) service (UMPNPMGR.DLL) in Microsoft Windows 2000 SP4, and XP SP1 and SP2, allows remote or local authenticated attackers to execute arbitrary code via a large number of "\" (backslash) characters in a registry key name, which triggers the overflow in a wsprintfW function call.CVE-2005-2120ACCEPTED2Microsoft Windows XPInternet ExplorerRobert L. HollisDRAFTMicrosoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, aka a variant of the "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2127.CVE-2005-2831DRAFT0Microsoft Windows 2000Internet ExplorerRobert L. HollisDRAFTMicrosoft Internet Explorer 5.01, 5.5, and 6, when using an HTTPS proxy server that requires Basic Authentication, sends URLs in cleartext, which allows remote attackers to obtain sensitive information, aka "HTTPS Proxy Vulnerability."CVE-2005-2830DRAFT0Microsoft Windows 2000Microsoft Windows XPOperating SystemRobert L. HollisDRAFTINTERIMACCEPTED'As Service Packs released by Microsft mature, earlier versions and releases become unspported. This equates to a cessation in software and security patches for that baseline. Using an unsupported version of Windows represents a severe security risk.'http://www.microsoft.com/spACCEPTED3Sun Solaris 8tcshBrian SobyDRAFTINTERIMACCEPTEDMatthew WojcikINTERIMDRAFTINTERIMACCEPTEDUnknown vulnerability in the ls-F builtin function in tcsh on Solaris 8 allows local users to create or delete files as other users, and gain privileges.CVE-2003-1024ACCEPTED2Microsoft Windows XPHTML Help FacilityAndrew ButtnerAndrew ButtnerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDHeap-based buffer overflow in the HtmlHelp program (hh.exe) in HTML Help for Microsoft Windows 98, Me, NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary commands via a .CHM file with a large length field, a different vulnerability than CVE-2003-1041.CVE-2004-0201ACCEPTED1Microsoft Windows XPOperating SystemRobert L. HollisDRAFTINTERIMACCEPTEDnetman.dll in Microsoft Windows Connections Manager Library allows local users to cause a denial of service (Network Connections Service crash) via a large integer argument to a particular function.CVE-2005-2307ACCEPTED2Microsoft Windows 2000Internet ExplorerRobert L. HollisDRAFTINTERIMACCEPTEDMicrosoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, as originally demonstrated using the (1) DDS Library Shape Control (Msdds.dll) COM object, and other objects including (2) Blnmgrps.dll, (3) Ciodm.dll, (4) Comsvcs.dll, (5) Danim.dll, (6) Htmlmarq.ocx, (7) Mdt2dd.dll (as demonstrated using a heap corruption attack with uninitialized memory), (8) Mdt2qd.dll, (9) Mpg4ds32.ax, (10) Msadds32.ax, (11) Msb1esen.dll, (12) Msb1fren.dll, (13) Msb1geen.dll, (14) Msdtctm.dll, (15) Mshtml.dll, (16) Msoeacct.dll, (17) Msosvfbr.dll, (18) Mswcrun.dll, (19) Netshell.dll, (20) Ole2disp.dll, (21) Outllib.dll, (22) Psisdecd.dll, (23) Qdvd.dll, (24) Repodbc.dll, (25) Shdocvw.dll, (26) Shell32.dll, (27) Soa.dll, (28) Srchui.dll, (29) Stobject.dll, (30) Vdt70.dll, (31) Vmhelper.dll, and (32) Wbemads.dll, aka a variant of the "COM Object Instantiation Memory Corruption vulnerability."CVE-2005-2127ACCEPTED2Microsoft Windows 2000NetWareRobert L. HollisDRAFTINTERIMACCEPTEDThe Client Service for NetWare (CSNW) on Microsoft Windows 2000 SP4, XP SP1 and Sp2, and Server 2003 SP1 and earlier, allows remote attackers to execute arbitrary code due to an "unchecked buffer" when processing certain crafted network messages.CVE-2005-1985ACCEPTED4Microsoft Windows Server 2003Operating SystemRobert L. HollisDRAFTINTERIMACCEPTEDWindows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to execute arbitrary commands via a shortcut (.lnk) file with long font properties that lead to a buffer overflow in the Client/Server Runtime Server Subsystem (CSRSS), a different vulnerabiity than CVE-2005-2118.CVE-2005-2122ACCEPTED2Microsoft Windows 2000Microsoft Windows XPInternet ExplorerRobert L. HollisDRAFTINTERIMACCEPTEDMicrosoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, as originally demonstrated using the (1) DDS Library Shape Control (Msdds.dll) COM object, and other objects including (2) Blnmgrps.dll, (3) Ciodm.dll, (4) Comsvcs.dll, (5) Danim.dll, (6) Htmlmarq.ocx, (7) Mdt2dd.dll (as demonstrated using a heap corruption attack with uninitialized memory), (8) Mdt2qd.dll, (9) Mpg4ds32.ax, (10) Msadds32.ax, (11) Msb1esen.dll, (12) Msb1fren.dll, (13) Msb1geen.dll, (14) Msdtctm.dll, (15) Mshtml.dll, (16) Msoeacct.dll, (17) Msosvfbr.dll, (18) Mswcrun.dll, (19) Netshell.dll, (20) Ole2disp.dll, (21) Outllib.dll, (22) Psisdecd.dll, (23) Qdvd.dll, (24) Repodbc.dll, (25) Shdocvw.dll, (26) Shell32.dll, (27) Soa.dll, (28) Srchui.dll, (29) Stobject.dll, (30) Vdt70.dll, (31) Vmhelper.dll, and (32) Wbemads.dll, aka a variant of the "COM Object Instantiation Memory Corruption vulnerability."CVE-2005-2127ACCEPTED3Microsoft Windows Server 2003Internet ExplorerRobert L. HollisDRAFTMicrosoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, aka a variant of the "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2127.CVE-2005-2831DRAFT0Microsoft Windows Server 2003NetWareRobert L. HollisDRAFTINTERIMACCEPTEDThe Client Service for NetWare (CSNW) on Microsoft Windows 2000 SP4, XP SP1 and Sp2, and Server 2003 SP1 and earlier, allows remote attackers to execute arbitrary code due to an "unchecked buffer" when processing certain crafted network messages.CVE-2005-1985ACCEPTED2Microsoft Windows XPOperating SystemRobert L. HollisDRAFTINTERIMACCEPTEDA remote code execution vulnerability exists for the rendering of Windows Metafile (WMF) images. A WMF image is a 16-bit metafile that can contain both vector and bitmap information. An unchecked buffer in the rendering libraries can allow an attacker to remotely execute arbitrary code on the target system. This action could allow the attacker to install programs, access and alter data, and escalate privileges. A successful attack would thus grant a remote attacker complete control of the affected system.CAN-2005-2123ACCEPTED2Microsoft Windows Server 2003Windows Internet Naming Service (WINS)Matthew BurtonDRAFTINTERIMACCEPTEDThe WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 allows remote attackers to write to arbitrary memory locations and possibly execute arbitrary code via a modified memory pointer in a WINS replication packet to TCP port 42, aka the "Association Context Vulnerability."CVE-2004-1080ACCEPTED1Microsoft Windows Server 2003TIPRobert L. HollisDRAFTINTERIMACCEPTEDDistributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service exception and exit) via an "unexpected protocol command during the reconnection request," which is not properly handled by the Transaction Internet Protocol (TIP) functionality.CVE-2005-1979ACCEPTED2Microsoft Windows Server 2003Operating SystemRobert L. HollisDRAFTINTERIMACCEPTEDWindows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to execute arbitrary commands via a shortcut (.lnk) file with long font properties that lead to a buffer overflow in the Client/Server Runtime Server Subsystem (CSRSS), a different vulnerabiity than CVE-2005-2118.CVE-2005-2122ACCEPTED2Microsoft Windows 2000Internet ExplorerRobert L. HollisDRAFTMicrosoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, aka a variant of the "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2127.CVE-2005-2831DRAFT0Microsoft Windows 2000Windows kernelChristine WalzerDRAFTINTERIMACCEPTEDAndrew ButtnerINTERIMACCEPTEDThe Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability."CVE-2004-0893ACCEPTED2Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPInternet Explorer 6 SP1Harvey RubinovitzDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer in Windows XP SP2, and other versions including 5.01 and 5.5, allows remote attackers to install arbitrary programs via a web page that uses certain styles and the AnchorClick behavior, popup windows, and drag-and-drop capabilities to drop the program in the local startup folder, as demonstrated by "wottapoop.html".CVE-2004-0839ACCEPTED2Microsoft Windows Server 2003Windows Media Player 9Christine WalzerChristine WalzerChristine WalzerChristine WalzerChristine WalzerChristine WalzerChristine WalzerChristine WalzerChristine WalzerDRAFTINTERIMACCEPTEDWindows Media Player 9 allows remote attackers to execute arbitrary code via a PNG file containing large (1) width or (2) height values, aka the "PNG Processing Vulnerability."CVE-2004-1244ACCEPTED1HP-UX 11envdRobert L. HollisDRAFTenvd daemon in HP-UX B.11.00 through B.11.11 allows local users to obtain privileges via unknown attack vectors.CVE-2005-3564DRAFT4HP-UX 11remshdRobert L. HollisDRAFTUnknown vulnerability in remshd daemon in HP-UX B.11.00, B.11.11, and B.11.23 while running in "Trusted Mode" allows remote attackers to gain unauthorized system access via unknown attack vectors.CVE-2005-3565DRAFT4Microsoft Windows XPWindows kernelChristine WalzerDRAFTINTERIMACCEPTEDThe Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability."CVE-2004-0893ACCEPTED1Microsoft Windows 2000Operating SystemRobert L. HollisDRAFTThe thread termination routine in the kernel for Windows NT 4.0 and 2000 (NTOSKRNL.EXE) allows local users to modify kernel memory and execution flow via steps in which a terminating thread causes Asynchronous Procedure Call (APC) entries to free the wrong data, aka the "Windows Kernel Vulnerability."CVE-2005-2827DRAFT0Microsoft Windows 2000Microsoft Windows XPInternet ExplorerRobert L. HollisDRAFTMicrosoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, aka a variant of the "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2127.CVE-2005-2831DRAFT0Microsoft Windows MEWindows ShellAndrew ButtnerDRAFTINTERIMACCEPTEDBuffer overflow in Microsoft Internet Explorer and Explorer on Windows XP SP1, WIndows 2000, Windows 98, and Windows Me may allow remote malicious servers to cause a denial of service (application crash) and possibly execute arbitrary code via long share names, as demonstrated using Samba.CVE-2004-0214ACCEPTED1Microsoft Windows XPHyperTerminalHarvey RubinovitzDRAFTHarvey RubinovitzHarvey RubinovitzINTERIMChristine WalzerDavid ProulxACCEPTEDHyperTerminal application for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value that is saved in a session file, which allows remote attackers to execute arbitrary code via a malicious HyperTerminal session file (.ht), web site, or Telnet URL contained in an e-mail message, triggering a buffer overflow.CVE-2004-0568ACCEPTED1Microsoft Windows XPSMB (Server Message Block)Christine WalzerDRAFTINTERIMACCEPTEDThe Server Message Block (SMB) implementation for Windows NT 4.0, 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allows remote attackers to execute arbitrary code via Transaction responses containing (1) Trans or (2) Trans2 commands, aka the "Server Message Block Vulnerability," and as demonstrated using Trans2 FIND_FIRST2 responses with large file name length fields.CVE-2005-0045ACCEPTED1Sun Solaris 8Licence Logging ServiceBrian SobyDRAFTINTERIMACCEPTEDgzip before 1.3 in Solaris 8, when called with the -f or -force flags, will change the permissions of files that are hard linked to the target files, which allows local users to view or modify these files.CVE-2004-1349ACCEPTED1Microsoft Windows Server 2003Microsoft Word for Windows 6.0 ConverterChristine WalzerDRAFTINTERIMACCEPTEDRobert L. HollisMicrosoft Word for Windows 6.0 Converter (MSWRD632.WPC), as used in WordPad, does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CVE-2004-0571.CVE-2004-0901INTERIM1Microsoft Windows XPWindows kernelIngrid SkoogDRAFTINTERIMChristine WalzerACCEPTEDThe kernel of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via certain access requests.CVE-2005-0061ACCEPTED1Sun Solaris 8Sun Solaris 9sendfilev()Brian SobyDRAFTINTERIMACCEPTEDINTERIMDRAFTINTERIMACCEPTEDUnknown vulnerability in the sendfilev function in Sun Solaris 8 and 9 allows local users to cause a denial of service (system panic) via unknown vectors.CVE-2004-1356ACCEPTED2Microsoft Windows XPWindows XPMatthew BurtonDRAFTINTERIMACCEPTEDWindows Server 2003 and XP SP2, with Windows Firewall turned off, allows remote attackers to cause a denial of service (CPU consumption) via a TCP packet with the SYN flag set and the same destination and source address and port, aka a reoccurrence of the "Land" vulnerability (CVE-1999-0016).CVE-2005-0688ACCEPTED1Microsoft Windows XPMicrosoft Internet Explorer 6Harvey RubinovitzDRAFTINTERIMACCEPTEDRace condition in the memory management routines in the DHTML object processor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail, aka "DHTML Object Memory Corruption Vulnerability".CVE-2005-0553ACCEPTED1Microsoft Windows XPInternet Explorer 6.0Jonathan BakerDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDThe DHTML Edit Control (dhtmled.ocx) allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as demonstrated by "AbusiveParent" in Internet Explorer 6.0.2900.2180.CVE-2004-1319ACCEPTED2Sun Solaris 8Sun Enterprise Storage Manager (ESM)Brian SobyDRAFTINTERIMACCEPTEDACCEPTED1Microsoft Windows NTVDMIngrid SkoogACCEPTEDThe component for the Virtual DOS Machine (VDM) subsystem in Windows NT 4.0 and Windows 2000 does not properly validate system structures, which allows local users to access protected kernel memory and execute arbitrary code.CVE-2004-0118ACCEPTED2Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Visual Studio .NET 2003Ingrid SkoogDRAFTIngrid SkoogINTERIMACCEPTEDBuffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.CVE-2004-0200ACCEPTED1Sun Solaris 7Sun Solaris 8Sun Solaris 9/usr/lib/print/conv_fixBrian SobyDRAFTINTERIMACCEPTEDINTERIMDRAFTINTERIMACCEPTEDUnknown vulnerability in conv_fix in Sun Solaris 7 through 9, when invoked by conv_lpd, allows local users to overwrite arbitrary files.CVE-2004-1360ACCEPTED2Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 3Harvey RubinovitzDRAFTINTERIMACCEPTEDInternet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded, which are decoded twice to generate a malicious hostname, aka the "URL Decoding Zone Spoofing Vulnerability."CVE-2005-0054ACCEPTED1Microsoft Windows XPWindows XPMatthew BurtonDRAFTINTERIMACCEPTEDMicrosoft Windows XP SP2 and earlier, 2000 SP3 and SP4, Server 2003, and older operating systems allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IP packets with malformed options, aka the "IP Validation Vulnerability."CVE-2005-0048ACCEPTED1Microsoft Windows NTWindows ShellAndrew ButtnerDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDBuffer overflow in Microsoft Internet Explorer and Explorer on Windows XP SP1, WIndows 2000, Windows 98, and Windows Me may allow remote malicious servers to cause a denial of service (application crash) and possibly execute arbitrary code via long share names, as demonstrated using Samba.CVE-2004-0214ACCEPTED2Microsoft Windows XPMicrosoft Windows Server 2003VDMIngrid SkoogIngrid SkoogDRAFTINTERIMACCEPTEDThe Virtual DOS Machine (VDM) subsystem of Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows local users to access kernel memory and gain privileges via a malicious program that modified some system structures in a way that is not properly validated by privileged operating system functions.CVE-2004-0208ACCEPTED1Microsoft Windows Server 2003Windows kernelIngrid SkoogDRAFTINTERIMChristine WalzerACCEPTEDThe kernel of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via certain access requests.CVE-2005-0061ACCEPTED1Microsoft Windows XPTask SchedulerTiffany BergeronINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDStack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0, allows local or remote attackers to execute arbitrary code via a .job file containing long parameters, as demonstrated using Internet Explorer and accessing a .job file on an anonymous share.CVE-2004-0212ACCEPTED1Microsoft Windows XPMicrosoft Internet Explorer 6Andrew ButtnerDRAFTINTERIMACCEPTEDChristine WalzerINTERIMChristine WalzerACCEPTEDDouble-free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image.CVE-2003-1048ACCEPTED2Microsoft Windows 95Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003SambaMatthew BurtonDRAFTINTERIMACCEPTEDBuffer overflow in Microsoft Word 2002 (10.6612.6714) SP3, and possibly other versions, allows remote attackers to cause a denial of service (application exception) and possibly execute arbitrary code in winword.exe via certain unexpected values in a .doc file, including (1) an offset that triggers an out-of-bounds memory access, (2) a certain value that causes a large memory copy as triggered by an integer conversion error, and other values.CVE-2004-0963ACCEPTED1Microsoft Windows 2000Negotiate SSP interfaceIngrid SkoogINTERIMACCEPTEDJonathan BakerINTERIMACCEPTEDThe Negotiate Security Software Provider (SSP) interface in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service (crash from null dereference) or execute arbitrary code via a crafted SPNEGO NegTokenInit request during authentication protocol selection.CVE-2004-0119ACCEPTED2Microsoft Windows XPDistributed Component Object Model (DCOM) interfaceChristine WalzerDRAFTINTERIMACCEPTEDHeap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed DCERPC DCOM object activation request packet with modified length fields, a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0528.CVE-2003-0715ACCEPTED1Microsoft Windows Server 2003Client Server Runtime System (CSRSS)Ingrid SkoogDRAFTINTERIMChristine WalzerACCEPTEDStack-based buffer overflow in WINSRV.DLL in the Client Server Runtime System (CSRSS) process of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application that provides console window information with a long FaceName value.CVE-2005-0551ACCEPTED1Microsoft Windows XPProgram Group ConverterAndrew ButtnerDRAFTINTERIMACCEPTEDBuffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe.CVE-2004-0572ACCEPTED1Microsoft Windows XPProgram Group ConverterAndrew ButtnerDRAFTINTERIMACCEPTEDBuffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe.CVE-2004-0572ACCEPTED1Sun Solaris 7NISBrian SobyDRAFTINTERIMACCEPTEDBuffer overflow in ypbind daemon in Solaris 5.4 through 8 allows remote attackers to execute arbitrary code.CVE-2001-1328ACCEPTED1Microsoft Windows Server 2003SMB (Server Message Block)Christine WalzerDRAFTINTERIMACCEPTEDThe Server Message Block (SMB) implementation for Windows NT 4.0, 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allows remote attackers to execute arbitrary code via Transaction responses containing (1) Trans or (2) Trans2 commands, aka the "Server Message Block Vulnerability," and as demonstrated using Trans2 FIND_FIRST2 responses with large file name length fields.CVE-2005-0045ACCEPTED1Microsoft Windows NTNetDDEJonathan BakerDRAFTINTERIMACCEPTEDNetwork Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an "unchecked buffer," possibly a buffer overflow.CVE-2004-0206ACCEPTED1Microsoft Windows XPEnhanced Metafile (EMF)Ingrid SkoogDRAFTINTERIMACCEPTEDUnknown vulnerability in the Graphics Rendering Engine processes of Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code via (1) Windows Metafile (WMF) or (2) Enhanced Metafile (EMF) image formats that involve "an unchecked buffer."CVE-2004-0209ACCEPTED1Sun Solaris 7dtspcdBrian SobyDRAFTINTERIMACCEPTEDThe CDE dtspcd daemon allows local users to execute arbitrary commands via a symlink attack.CVE-1999-0689ACCEPTED1Microsoft Windows XPWindows kernelChristine WalzerDRAFTINTERIMACCEPTEDIngrid SkoogINTERIMACCEPTEDThe Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability."CVE-2004-0893ACCEPTED2Microsoft Windows Server 2003Local Security Authority Subsystem Service (LSASS)Christine WalzerDRAFTINTERIMACCEPTEDLSASS (Local Security Authority Subsystem Service) of Windows 2000 Server and Windows Server 2003 does not properly validate connection information, which allows local users to gain privileges via a specially-designed program.CVE-2004-0894ACCEPTED1Microsoft Windows XPSMB (Server Message Block)Christine WalzerDRAFTINTERIMACCEPTEDThe Server Message Block (SMB) implementation for Windows NT 4.0, 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allows remote attackers to execute arbitrary code via Transaction responses containing (1) Trans or (2) Trans2 commands, aka the "Server Message Block Vulnerability," and as demonstrated using Trans2 FIND_FIRST2 responses with large file name length fields.CVE-2005-0045ACCEPTED1Sun Solaris 7Sun Solaris 8Sun Solaris 9CDEBrian SobyDRAFTINTERIMACCEPTEDHeap-based buffer overflow in dtsession for Solaris 2.5.1 through Solaris 9 allows local users to gain root privileges via a long HOME environment variable.CVE-2003-0092ACCEPTED1Microsoft Windows XPWindows XPMatthew BurtonDRAFTINTERIMACCEPTEDMultiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the "blind connection-reset attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.CVE-2004-0790ACCEPTED1Microsoft Windows 2000HTML Help FacilityAndrew ButtnerINTERIMACCEPTEDInternet Explorer 5.x and 6.0 allows remote attackers to execute arbitrary programs via a modified directory traversal attack using a URL containing ".." (dot dot) sequences and a filename that ends in "::" which is treated as a .chm file even if it does not have a .chm extension. NOTE: this bug may overlap CVE-2004-0475.CVE-2003-1041ACCEPTED0Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Outlook ExpressJonathan BakerDRAFTINTERIMACCEPTEDMicrosoft Outlook Express 5.5 and 6 allows attackers to cause a denial of service (application crash) via a malformed e-mail header.CVE-2004-0215ACCEPTED1Microsoft Windows XPMicrosoft Word for Windows 6.0 ConverterChristine WalzerDRAFTINTERIMChristine WalzerACCEPTEDIngrid SkoogINTERIMACCEPTEDRobert L. HollisMicrosoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CVE-2004-0901.CVE-2004-0571INTERIM2Microsoft Windows Server 2003Negotiate Security Software ProviderIngrid SkoogINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDThe Negotiate Security Software Provider (SSP) interface in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service (crash from null dereference) or execute arbitrary code via a crafted SPNEGO NegTokenInit request during authentication protocol selection.CVE-2004-0119ACCEPTED2Microsoft Windows XPWindows XPMatthew BurtonDRAFTINTERIMACCEPTEDInternet Explorer 6.0 on Windows XP SP2 allows remote attackers to execute arbitrary code by using the "Related Topics" command in the Help ActiveX Control (hhctrl.ocx) to open a Help popup window containing the PCHealth tools.htm file in the local zone and injecting Javascript to be executed, as demonstrated using "writehta.txt" and the ADODB recordset, which saves a .HTA file to the local system, aka the "HTML Help ActiveX control Cross Domain Vulnerability."CVE-2004-1043ACCEPTED1Microsoft Windows XPTask SchedulerTiffany BergeronTiffany BergeronINTERIMACCEPTEDStack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0, allows local or remote attackers to execute arbitrary code via a .job file containing long parameters, as demonstrated using Internet Explorer and accessing a .job file on an anonymous share.CVE-2004-0212ACCEPTED0Sun Solaris 9Solaris Management Console (SMC)Brian SobyDRAFTINTERIMACCEPTEDOff-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.CVE-2003-0466ACCEPTED1Microsoft Windows XPMicrosoft Word for Windows 6.0 ConverterChristine WalzerDRAFTINTERIMACCEPTEDRobert L. HollisMicrosoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CVE-2004-0901.CVE-2004-0571INTERIM1Sun Solaris 8Sun Solaris 9ApacheBrian SobyBrian SobyBrian SobyDRAFTINTERIMACCEPTEDApache 1.4.x before 1.3.30, and 2.0.x before 2.0.49, when using multiple listening sockets on certain platforms, allows remote attackers to cause a denial of service (blocked new connections) via a "short-lived connection on a rarely-accessed listening socket."CVE-2004-0174ACCEPTED1Microsoft Windows XPNegotiate SSP interfaceIngrid SkoogIngrid SkoogIngrid SkoogACCEPTEDChristine WalzerINTERIMACCEPTEDThe Negotiate Security Software Provider (SSP) interface in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service (crash from null dereference) or execute arbitrary code via a crafted SPNEGO NegTokenInit request during authentication protocol selection.CVE-2004-0119ACCEPTED1Sun Solaris 7Solaris Enterprise Authentication Mechanism (SEAM)Brian SobyDRAFTBrian SobyINTERIMACCEPTEDMultiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root.CVE-2004-0523ACCEPTED1Microsoft Windows XPWindows kernelChristine WalzerDRAFTINTERIMACCEPTEDIngrid SkoogINTERIMACCEPTEDThe Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability."CVE-2004-0893ACCEPTED2Sun Solaris 7BindBrian SobyDRAFTINTERIMACCEPTEDBrian SobyBrian SobyINTERIMACCEPTEDISC BIND 8.3.x before 8.3.7, and 8.4.x before 8.4.3, allows remote attackers to poison the cache via a malicious name server that returns negative responses with a large TTL (time-to-live) value.CVE-2003-0914ACCEPTED2Microsoft Windows NTOutlook Web AccessChristine WalzerDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDCross-site scripting (XSS) vulnerability in Outlook Web Access for Exchange Server 5.5 Service Pack 4 allows remote attackers to insert arbitrary script and spoof content in HTML email or web caches via an HTML redirect query.CVE-2004-0203ACCEPTED2Microsoft Windows NTWindows kernelChristine WalzerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDBuffer overflow in Windows Kernel allows local users to gain privileges by causing certain error messages to be passed to a debugger.CVE-2003-0112ACCEPTED1Sun Solaris 7loginBrian SobyDRAFTINTERIMACCEPTEDBuffer overflow in login in various System V based operating systems allows remote attackers to execute arbitrary commands via a large number of arguments through services such as telnet and rlogin.CVE-2001-0797ACCEPTED1Microsoft Windows XPWindows kernelIngrid SkoogDRAFTINTERIMChristine WalzerACCEPTEDBuffer overflow in Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to cause a denial of service (i.e., system crash) via a malformed request, aka "Object Management Vulnerability".CVE-2005-0550ACCEPTED1Microsoft Windows 2000Windows 2000Matthew BurtonDRAFTINTERIMACCEPTEDInternet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability."CVE-2005-0053ACCEPTED1Microsoft Windows XPLocal Security Authority Subsystem Service (LSASS)Christine WalzerDRAFTINTERIMACCEPTEDLSASS (Local Security Authority Subsystem Service) of Windows 2000 Server and Windows Server 2003 does not properly validate connection information, which allows local users to gain privileges via a specially-designed program.CVE-2004-0894ACCEPTED1Sun Solaris 9pam_krb5Brian SobyDRAFTBrian SobyINTERIMACCEPTEDSolaris 9, when configured as a Kerberos client with patch 112908-12 or 115168-03 and using pam_krb5 as an "auth" module with the debug feature enabled, records passwords in plaintext, which could allow local users to gain other user's passwords by reading log files.CVE-2004-0653ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 3Harvey RubinovitzDRAFTINTERIMACCEPTEDInternet Explorer in Windows XP SP2, and other versions including 5.01 and 5.5, allows remote attackers to install arbitrary programs via a web page that uses certain styles and the AnchorClick behavior, popup windows, and drag-and-drop capabilities to drop the program in the local startup folder, as demonstrated by "wottapoop.html".CVE-2004-0839ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 3Harvey RubinovitzDRAFTINTERIMACCEPTEDBuffer overflow in the Content Advisor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a crafted Content Advisor file, aka "Content Advisor Memory Corruption Vulnerability."CVE-2005-0555ACCEPTED1Sun Solaris 7BindBrian SobyDRAFTINTERIMACCEPTEDBIND 8.x through 8.3.3 allows remote attackers to cause a denial of service (crash) via SIG RR elements with invalid expiry times, which are removed from the internal BIND database and later cause a null dereference.CVE-2002-1221ACCEPTED1Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Internet Explorer 5.5 Service Pack 2Andrew ButtnerDRAFTINTERIMACCEPTEDDouble-free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image.CVE-2003-1048ACCEPTED1Microsoft Windows 95Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Microsoft Word 2002Matthew BurtonDRAFTINTERIMACCEPTEDBuffer overflow in Microsoft Word 2002 (10.6612.6714) SP3, and possibly other versions, allows remote attackers to cause a denial of service (application exception) and possibly execute arbitrary code in winword.exe via certain unexpected values in a .doc file, including (1) an offset that triggers an out-of-bounds memory access, (2) a certain value that causes a large memory copy as triggered by an integer conversion error, and other values.CVE-2004-0963ACCEPTED1Microsoft Windows NTCertificate ValidationChristine WalzerChristine WalzerChristine WalzerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDMicrosoft Windows 98 and Windows NT 4.0 do not properly verify the Basic Constraints of digital certificates, allowing remote attackers to execute code, aka "New Variant of Certificate Validation Flaw Could Enable Identity Spoofing" (CAN-2002-0862).CVE-2002-1183ACCEPTED1Microsoft Windows 2000Enhanced Metafile (EMF)Ingrid SkoogDRAFTINTERIMACCEPTEDUnknown vulnerability in the Graphics Rendering Engine processes of Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code via (1) Windows Metafile (WMF) or (2) Enhanced Metafile (EMF) image formats that involve "an unchecked buffer."CVE-2004-0209ACCEPTED1Microsoft Windows Server 2003Indexing ServiceHarvey RubinovitzDRAFTINTERIMACCEPTEDThe Indexing Service for Microsoft Windows XP and Server 2003 does not properly validate the length of a message, which allows remote attackers to execute arbitrary code via a buffer overflow attack.CVE-2004-0897ACCEPTED1Microsoft Windows 2000Microsoft Outlook ExpressJonathan BakerDRAFTINTERIMACCEPTEDMicrosoft Outlook Express 5.5 and 6 allows attackers to cause a denial of service (application crash) via a malformed e-mail header.CVE-2004-0215ACCEPTED1Sun Solaris 9Kerberos5Brian SobyDRAFTBrian SobyINTERIMACCEPTEDThe asn1buf_skiptail function in the ASN.1 decoder library for MIT Kerberos 5 (krb5) 1.2.2 through 1.3.4 allows remote attackers to cause a denial of service (infinite loop) via a certain BER encoding.CVE-2004-0644ACCEPTED1Microsoft Windows Server 2003HTML Help FacilityAndrew ButtnerINTERIMACCEPTEDHeap-based buffer overflow in the HtmlHelp program (hh.exe) in HTML Help for Microsoft Windows 98, Me, NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary commands via a .CHM file with a large length field, a different vulnerability than CVE-2003-1041.CVE-2004-0201ACCEPTED0Sun Solaris 9SambaBrian SobyDRAFTINTERIMACCEPTEDBuffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x versions, and Samba-TNG before 0.3.2, allows remote attackers to execute arbitrary code.CVE-2003-0201ACCEPTED1Microsoft Windows NTPOSIXIngrid SkoogIngrid SkoogINTERIMACCEPTEDThe POSIX component of Microsoft Windows NT and Windows 2000 allows local users to execute arbitrary code via certain parameters, possibly by modifying message length values and causing a buffer overflow.CVE-2004-0210ACCEPTED0Sun Solaris 9SendmailBrian SobyDRAFTBrian SobyINTERIMACCEPTEDBuffer overflow in Sendmail before 8.12.5, when configured to use a custom DNS map to query TXT records, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malicious DNS server.CVE-2002-0906ACCEPTED1Microsoft Windows XPWindows ShellHarvey RubinovitzDRAFTINTERIMACCEPTEDThe document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document.CVE-2005-0063ACCEPTED1Microsoft Windows 2000Windows 2000Matthew BurtonDRAFTINTERIMACCEPTEDMultiple TCP/IP and ICMP implementations, when using Path MTU (PMTU) discovery (PMTUD), allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via forged ICMP ("Fragmentation Needed and Don't Fragment was Set") packets with a low next-hop MTU value, aka the "Path MTU discovery attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.CVE-2004-1060ACCEPTED1Microsoft Windows XPDirectXTiffany BergeronTiffany BergeronTiffany BergeronTiffany BergeronINTERIMACCEPTEDIDirectPlay4 Application Programming Interface (API) of Microsoft DirectPlay 7.0a thru 9.0b, as used in Windows Server 2003 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed packet.CVE-2004-0202ACCEPTED1Microsoft Windows NTIIS 4.0David ProulxINTERIMACCEPTEDBuffer overflow in Microsoft Internet Information Server (IIS) 4.0 allows local users to execute arbitrary code via the redirect function.CVE-2004-0205ACCEPTED0Microsoft Windows 95Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Microsoft Word 2000Matthew BurtonDRAFTINTERIMACCEPTEDBuffer overflow in Microsoft Word 2002 (10.6612.6714) SP3, and possibly other versions, allows remote attackers to cause a denial of service (application exception) and possibly execute arbitrary code in winword.exe via certain unexpected values in a .doc file, including (1) an offset that triggers an out-of-bounds memory access, (2) a certain value that causes a large memory copy as triggered by an integer conversion error, and other values.CVE-2004-0963ACCEPTED1Microsoft Windows XPInternet Explorer 6Harvey RubinovitzDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.01, 5.5, and 6 does not properly cache SSL content, which allows remote attackers to obtain information or spoof content via a web site with the same host name as the target web site, whose content is cached and reused when the user visits the target web site.CVE-2004-0845ACCEPTED2Sun Solaris 7Sun Solaris 8Sun Solaris 9SendmailBrian SobyDRAFTINTERIMACCEPTEDBuffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.CVE-2002-1337ACCEPTED1Microsoft Windows XPOperating SystemChristine WalzerINTERIMACCEPTEDINTERIMACCEPTEDRobert L. HollisThe Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP.CVE-2004-0420INTERIM1Sun Solaris 7libcBrian SobyDRAFTINTERIMACCEPTEDThe Sun RPC functionality in multiple libc implementations does not provide a time-out mechanism when reading data from TCP connections, which allows remote attackers to cause a denial of service (hang).CVE-2002-1265ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Harvey RubinovitzDRAFTINTERIMACCEPTEDBuffer overflow in the URL processor of Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL with a long hostname, aka "URL Parsing Memory Corruption Vulnerability."CVE-2005-0554ACCEPTED1Microsoft Windows NTWindows kernelChristine WalzerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDBuffer overflow in Windows Kernel allows local users to gain privileges by causing certain error messages to be passed to a debugger.CVE-2003-0112ACCEPTED1Microsoft Windows 2000MDAC 2.8Christine WalzerDRAFTINTERIMACCEPTEDMultiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.CVE-2004-0597ACCEPTED1Microsoft Windows NTDHCPIngrid SkoogDRAFTIngrid SkoogIngrid SkoogINTERIMACCEPTEDThe DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition, with DHCP logging enabled, does not properly validate the length of certain messages, which allows remote attackers to cause a denial of service (application crash) via a malformed DHCP message, aka "Logging Vulnerability."CVE-2004-0899ACCEPTED1Microsoft Windows XPJonathan BakerDRAFTINTERIMACCEPTEDJonathan BakerINTERIMACCEPTEDThe Server service (srvsvc.dll) in Windows XP SP1 and SP2 allows remote attackers to obtain sensitive information (users who are accessing resources) via an anonymous logon using a named pipe, which is not properly authenticated, aka the "Named Pipe Vulnerability."CVE-2005-0051ACCEPTED2Microsoft Windows Server 2003SMTPChristine WalzerDRAFTChristine WalzerINTERIMACCEPTEDThe SMTP (Simple Mail Transfer Protocol) component of Microsoft Windows XP 64-bit Edition, Windows Server 2003, Windows Server 2003 64-bit Edition, and the Exchange Routing Engine component of Exchange Server 2003, allows remote attackers to execute arbitrary code via a malicious DNS response message containing length values that are not properly validated.CVE-2004-0840ACCEPTED1Microsoft Windows XPDistributed Component Object Model (DCOM) interfaceChristine WalzerDRAFTINTERIMACCEPTEDBuffer overflow in a certain DCOM interface for RPC in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a malformed message, as exploited by the Blaster/MSblast/LovSAN and Nachi/Welchia worms.CVE-2003-0352ACCEPTED1This bulletin has been superceded by MS03-039. Definition reflects updated information.Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Project Professional 2002Ingrid SkoogDRAFTINTERIMACCEPTEDBuffer overflow in Microsoft Office XP allows remote attackers to execute arbitrary code via a link with a URL file location containing long inputs after (1) "%00 (null byte) in .doc filenames or (2) "%0a" (carriage return) in .rtf filenames.CVE-2004-0848ACCEPTED1Microsoft Windows XPCOM Internet ServicesChristine WalzerDRAFTINTERIMACCEPTEDWindows 2000, XP, and Server 2003 does not properly "validate the use of memory regions" for COM structured storage files, which allows attackers to execute arbitrary code, aka the "COM Structured Storage Vulnerability."CVE-2005-0047ACCEPTED1Sun Solaris 7libpngBrian SobyDRAFTINTERIMACCEPTEDMultiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.CVE-2004-0597ACCEPTED1Microsoft Windows 2000Windows Media Player 9Christine WalzerChristine WalzerChristine WalzerChristine WalzerChristine WalzerChristine WalzerChristine WalzerChristine WalzerDRAFTINTERIMACCEPTEDWindows Media Player 9 allows remote attackers to execute arbitrary code via a PNG file containing large (1) width or (2) height values, aka the "PNG Processing Vulnerability."CVE-2004-1244ACCEPTED1Microsoft Windows Server 2003Operating SystemChristine WalzerINTERIMACCEPTEDRobert L. HollisThe Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP.CVE-2004-0420INTERIM0Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 3Harvey RubinovitzDRAFTINTERIMACCEPTEDInternet Explorer 5.01, 5.5, and 6 does not properly validate certain URLs in Channel Definition Format (CDF) files, which allows remote attackers to obtain sensitive information or execute arbitrary code, aka the "Channel Definition Format (CDF) Cross Domain Vulnerability."CVE-2005-0056ACCEPTED1Microsoft Windows NTNetDDEJonathan BakerDRAFTINTERIMACCEPTEDNetwork Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an "unchecked buffer," possibly a buffer overflow.CVE-2004-0206ACCEPTED1Microsoft Windows XPDirectXTiffany BergeronTiffany BergeronTiffany BergeronINTERIMACCEPTEDChristine WalzerChristine WalzerChristine WalzerINTERIMACCEPTEDIDirectPlay4 Application Programming Interface (API) of Microsoft DirectPlay 7.0a thru 9.0b, as used in Windows Server 2003 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed packet.CVE-2004-0202ACCEPTED2Microsoft Windows 95Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Microsoft Word 2002Matthew BurtonDRAFTINTERIMACCEPTEDBuffer overflow in Microsoft Word 2000, Word 2002, and Word 2003 allows remote attackers to execute arbitrary code via a crafted document.CVE-2005-0558ACCEPTED1Sun Solaris 8mozillaBrian SobyDRAFTINTERIMACCEPTEDMozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the "chrome" flag and XML User Interface Language (XUL) files.CVE-2004-0764ACCEPTED1Sun Solaris 7NISBrian SobyDRAFTINTERIMACCEPTEDThe getdbm procedure in ypxfrd allows local users to read arbitrary files, and remote attackers to read databases outside /var/yp, via a directory traversal and symlink attack on the domain and map arguments.CVE-2002-1199ACCEPTED1Sun Solaris 7Sun Solaris 8Sun Solaris 9Basic Security ModuleBrian SobyDRAFTUnknown vulnerability in the Basic Security Module (BSM), when configured to audit either the Administrative (ad) or the System-Wide Administration (as) audit class in Solaris 7, 8, and 9, allows local users to cause a denial of service (kernel panic).CVE-2004-0654DRAFT0Microsoft Windows XPMicrosoft Windows Server 2003Enhanced Metafile (EMF)Ingrid SkoogIngrid SkoogDRAFTINTERIMACCEPTEDUnknown vulnerability in the Graphics Rendering Engine processes of Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code via (1) Windows Metafile (WMF) or (2) Enhanced Metafile (EMF) image formats that involve "an unchecked buffer."CVE-2004-0209ACCEPTED1Microsoft Windows XPIndexing ServiceHarvey RubinovitzDRAFTINTERIMACCEPTEDThe Indexing Service for Microsoft Windows XP and Server 2003 does not properly validate the length of a message, which allows remote attackers to execute arbitrary code via a buffer overflow attack.CVE-2004-0897ACCEPTED1Microsoft Windows Server 2003Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003Harvey RubinovitzDRAFTINTERIMACCEPTEDHarvey RubinovitzINTERIMACCEPTEDInternet Explorer 6 on Double Byte Character Set (DBCS) systems allows remote attackers to alter displayed address bars and spoof web pages via a URL containing special characters, facilitating phishing attacks, aka the "Address Bar Spoofing on Double Byte Character Set Systems Vulnerability."CVE-2004-0844ACCEPTED2Microsoft Windows XPMicrosoft Internet Explorer 6Harvey RubinovitzDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.5 and 6 does not properly handle plug-in navigation, which allows remote attackers to alter displayed address bars and thereby spoof web pages, facilitating phishing attacks, aka the "Plug-in Navigation Address Bar Spoofing Vulnerability."CVE-2004-0843ACCEPTED2Microsoft Windows 2000Utility ManagerJonathan BakerINTERIMACCEPTEDUtility Manager in Windows 2000 launches winhlp32.exe while Utility Manager is running with raised privileges, which allows local users to gain system privileges via a "Shatter" style attack that sends a Windows message to cause Utility Manager to launch winhlp32 by directly accessing the context sensitive help and bypassing the GUI, then sending another message to winhlp32 in order to open a user-selected file, a different vulnerability than CVE-2003-0908.CVE-2004-0213ACCEPTED0Microsoft Windows NTRemote Procedure Call (RPC)Matthew BurtonDRAFTINTERIMACCEPTEDThe RPC Runtime Library for Microsoft Windows NT 4.0 allows remote attackers to read active memory or cause a denial of service (system crash) via a malicious message, possibly related to improper length values.CVE-2004-0569ACCEPTED1Microsoft Windows Server 2003DirectXTiffany BergeronTiffany BergeronTiffany BergeronINTERIMACCEPTEDIDirectPlay4 Application Programming Interface (API) of Microsoft DirectPlay 7.0a thru 9.0b, as used in Windows Server 2003 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed packet.CVE-2004-0202ACCEPTED1Sun Solaris 8Kerberos5Brian SobyDRAFTINTERIMACCEPTEDThe Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes the KDC to corrupt its heap (aka "buffer underrun").CVE-2003-0082ACCEPTED1Vulnerability exists in standard Solaris kerberos and SEAM. This definition only covers Solaris kerberosMicrosoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Harvey RubinovitzDRAFTINTERIMACCEPTEDInternet Explorer 5.5 and 6 does not properly handle plug-in navigation, which allows remote attackers to alter displayed address bars and thereby spoof web pages, facilitating phishing attacks, aka the "Plug-in Navigation Address Bar Spoofing Vulnerability."CVE-2004-0843ACCEPTED1Sun Solaris 7BindBrian SobyDRAFTINTERIMACCEPTEDBuffer overflow in named in BIND 4 versions 4.9.10 and earlier, and 8 versions 8.3.3 and earlier, allows remote attackers to execute arbitrary code via a certain DNS server response containing SIG resource records (RR).CVE-2002-1219ACCEPTED1Microsoft Windows 2000Windows 2000Matthew BurtonDRAFTINTERIMACCEPTEDThe WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 allows remote attackers to write to arbitrary memory locations and possibly execute arbitrary code via a modified memory pointer in a WINS replication packet to TCP port 42, aka the "Association Context Vulnerability."CVE-2004-1080ACCEPTED1Microsoft Windows XPHyperTerminalHarvey RubinovitzDRAFTINTERIMHarvey RubinovitzACCEPTEDChristine WalzerDavid ProulxINTERIMACCEPTEDHyperTerminal application for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value that is saved in a session file, which allows remote attackers to execute arbitrary code via a malicious HyperTerminal session file (.ht), web site, or Telnet URL contained in an e-mail message, triggering a buffer overflow.CVE-2004-0568ACCEPTED2Microsoft Windows Server 2003Internet Explorer 6Harvey RubinovitzDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDBuffer overflow in the URL processor of Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL with a long hostname, aka "URL Parsing Memory Corruption Vulnerability."CVE-2005-0554ACCEPTED2Microsoft Windows 2000Windows kernelIngrid SkoogDRAFTINTERIMChristine WalzerAndrew ButtnerACCEPTEDBuffer overflow in the font processing component of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application.CVE-2005-0060ACCEPTED1Microsoft Windows 2000MDAC 2.8Ingrid SkoogDRAFTINTERIMACCEPTEDThe License Logging service for Windows NT Server, Windows 2000 Server, and Windows Server 2003 does not properly validate the length of messages, which leads to an "unchecked buffer" and allows remote attackers to cause a denial of service (crash) and possibly execute arbtirary code, aka the "License Logging Service Vulnerability."CVE-2005-0050ACCEPTED1Microsoft Windows XPHyperlink Object LibraryAndrew ButtnerDRAFTINTERIMACCEPTEDThe Hyperlink Object Library for Windows 98, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a crafted link that triggers an "unchecked buffer" in the library, possibly due to a buffer overflow.CVE-2005-0057ACCEPTED1Sun Solaris 7libpngBrian SobyDRAFTINTERIMACCEPTEDThe png_handle_iCCP function in libpng 1.2.5 and earlier allows remote attackers to cause a denial of service (application crash) via a certain PNG image that triggers a null dereference.CVE-2004-0598ACCEPTED1Microsoft Windows Server 2003Windows Animated CursorChristine WalzerDRAFTINTERIMACCEPTEDThe Windows Animated Cursor (ANI) capability in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allow remote attackers to cause a denial of service via (1) the frame number set to zero, which causes an invalid memory address to be used and leads to a kernel crash, or (2) the rate number set to zero, which leads to resource exhaustion and hang.CVE-2004-1305ACCEPTED1Sun Solaris 8Sun Solaris 9Sun ClusterBrian SobyDRAFTINTERIMACCEPTEDDouble-free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an SSL client certificate with a certain invalid ASN.1 encoding.CVE-2003-0545ACCEPTED1Sun Solaris 7kcms_serverBrian SobyDRAFTINTERIMACCEPTEDDirectory traversal vulnerability in Sun Kodak Color Management System (KCMS) library service daemon (kcms_server) allows remote attackers to read arbitrary files via the KCS_OPEN_PROFILE procedure.CVE-2003-0027ACCEPTED1Microsoft Windows XPInternet Explorer 6Harvey RubinovitzDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the Popup.show method and use drag-and-drop actions in a popup window, aka "HijackClick 3" and the "Script in Image Tag File Download Vulnerability."CVE-2004-0841ACCEPTED2Sun Solaris 8Sun Crypto Accelerator 4000Brian SobyDRAFTINTERIMACCEPTEDThe do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference.CVE-2004-0079ACCEPTED1Microsoft Windows 98Windows ShellAndrew ButtnerDRAFTINTERIMACCEPTEDBuffer overflow in Microsoft Internet Explorer and Explorer on Windows XP SP1, WIndows 2000, Windows 98, and Windows Me may allow remote malicious servers to cause a denial of service (application crash) and possibly execute arbitrary code via long share names, as demonstrated using Samba.CVE-2004-0214ACCEPTED1Microsoft Windows Server 2003Microsoft Outlook ExpressJonathan BakerDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDMicrosoft Outlook Express 5.5 and 6 allows attackers to cause a denial of service (application crash) via a malformed e-mail header.CVE-2004-0215ACCEPTED2Sun Solaris 7Sun Am7990 Ethernet DriverBrian SobyDRAFTMultiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain information from previous packets or kernel memory by using malformed packets, as demonstrated by Etherleak.CVE-2003-0001DRAFT0Microsoft Windows 2000Microsoft Office 2000 SP3Christine WalzerDRAFTINTERIMACCEPTEDIngrid SkoogINTERIMACCEPTEDBuffer overflow in the converter for Microsoft WordPerfect 5.x on Office 2000, Office XP, Office 2003, and Works Suites 2001 through 2004 allows remote attackers to execute arbitrary code via a malicious document or website.CVE-2004-0573ACCEPTED2Microsoft Windows 2000Certificate ValidationChristine WalzerChristine WalzerChristine WalzerChristine WalzerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDThe (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.CVE-2002-0862ACCEPTED1Microsoft Windows 95Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Microsoft Excel 2000Matthew BurtonDRAFTINTERIMACCEPTEDUnknown vulnerability in Microsoft Excel 2000, 2002, 2001 for Mac, and v.X for Mac allows remote attackers to execute arbitrary code via a malicious file containing certain parameters that are not properly validated.CVE-2004-0846ACCEPTED1Microsoft Windows 95Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Microsoft Word 2000Matthew BurtonDRAFTINTERIMACCEPTEDBuffer overflow in Microsoft Word 2000, Word 2002, and Word 2003 allows remote attackers to execute arbitrary code via a crafted document.CVE-2005-0558ACCEPTED1Microsoft Windows Server 2003Microsoft Word 2003Matthew BurtonDRAFTINTERIMACCEPTEDTCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP.CVE-2004-0230ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 3Harvey RubinovitzDRAFTINTERIMACCEPTEDInternet Explorer 5.01, 5.5, and 6 does not properly validate buffers when handling certain DHTML methods including the createControlRange Javascript function, which allows remote attackers to execute arbitrary code, aka the "DHTML Method Heap Memory Corruption Vulnerability."CVE-2005-0055ACCEPTED1Microsoft Windows XPMicrosoft Windows Server 2003DirectXTiffany BergeronTiffany BergeronTiffany BergeronINTERIMACCEPTEDIDirectPlay4 Application Programming Interface (API) of Microsoft DirectPlay 7.0a thru 9.0b, as used in Windows Server 2003 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed packet.CVE-2004-0202ACCEPTED1Microsoft Windows 2000Microsoft Windows XPMicrosoft Office 2003Ingrid SkoogIngrid SkoogDRAFTINTERIMACCEPTEDIngrid SkoogINTERIMACCEPTEDBuffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.CVE-2004-0200ACCEPTED2Sun Solaris 9OpenSSHBrian SobyDRAFTINTERIMACCEPTEDA "buffer management error" in buffer_append_space of buffer.c for OpenSSH before 3.7 may allow remote attackers to execute arbitrary code by causing an incorrect amount of memory to be freed and corrupting the heap, a different vulnerability than CVE-2003-0695.CVE-2003-0693ACCEPTED1Microsoft Windows 95Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000MDAC 2.5Ingrid SkoogDRAFTINTERIMACCEPTEDAndrew ButtnerINTERIMACCEPTEDHeap-based buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) 2.1 through 2.6, and Internet Explorer 5.01 through 6.0, allows remote attackers to execute code via a malformed HTTP request to the Data Stub.CVE-2002-1142ACCEPTED2Microsoft Windows Server 2003Windows kernelIngrid SkoogDRAFTINTERIMChristine WalzerACCEPTEDBuffer overflow in the font processing component of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application.CVE-2005-0060ACCEPTED1Microsoft Windows NTWindows Internet Naming Service (WINS)Matthew BurtonDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDThe WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 allows remote attackers to write to arbitrary memory locations and possibly execute arbitrary code via a modified memory pointer in a WINS replication packet to TCP port 42, aka the "Association Context Vulnerability."CVE-2004-1080ACCEPTED2Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Visio Professional 2002Ingrid SkoogDRAFTINTERIMACCEPTEDBuffer overflow in Microsoft Office XP allows remote attackers to execute arbitrary code via a link with a URL file location containing long inputs after (1) "%00 (null byte) in .doc filenames or (2) "%0a" (carriage return) in .rtf filenames.CVE-2004-0848ACCEPTED1Microsoft Windows 2000Program Group ConverterAndrew ButtnerDRAFTINTERIMACCEPTEDBuffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe.CVE-2004-0572ACCEPTED1Sun Solaris 9CDEBrian SobyDRAFTINTERIMACCEPTEDBrian SobyBrian SobyINTERIMACCEPTEDCDE ToolTalk database server (ttdbserver) allows local users to overwrite arbitrary files via a symlink attack on the transaction log file used by the _TT_TRANSACTION RPC procedure.CVE-2002-0678ACCEPTED2Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Harvey RubinovitzDRAFTINTERIMACCEPTEDBuffer overflow in the Content Advisor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a crafted Content Advisor file, aka "Content Advisor Memory Corruption Vulnerability."CVE-2005-0555ACCEPTED1Sun Solaris 9fs.auto, xfsBrian SobyDRAFTINTERIMACCEPTEDBuffer overflow in Dispatch() routine for XFS font server (fs.auto) on Solaris 2.5.1 through 9 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a certain XFS query.CVE-2002-1317ACCEPTED1Microsoft Windows Server 2003Microsoft Internet Explorer 6.0 for Windows Server 2003Harvey RubinovitzDRAFTINTERIMHarvey RubinovitzHarvey RubinovitzHarvey RubinovitzACCEPTEDInternet Explorer 5.01, 5.5, and 6 does not properly validate certain URLs in Channel Definition Format (CDF) files, which allows remote attackers to obtain sensitive information or execute arbitrary code, aka the "Channel Definition Format (CDF) Cross Domain Vulnerability."CVE-2005-0056ACCEPTED1Red Hat Enterprise Linux 3Linux kernelJay BealeDRAFTINTERIMACCEPTEDThe do_fork function in Linux 2.4.x before 2.4.26, and 2.6.x before 2.6.6, does not properly decrement the mm_count counter when an error occurs after the mm_struct for a child process has been activated, which triggers a memory leak that allows local users to cause a denial of service (memory exhaustion) via the clone (CLONE_VM) system call.CVE-2004-0427ACCEPTED1Microsoft Windows 2000Windows 2000Matthew BurtonDRAFTMatthew BurtonMatthew BurtonINTERIMACCEPTEDInternet Explorer 6.0 on Windows XP SP2 allows remote attackers to execute arbitrary code by using the "Related Topics" command in the Help ActiveX Control (hhctrl.ocx) to open a Help popup window containing the PCHealth tools.htm file in the local zone and injecting Javascript to be executed, as demonstrated using "writehta.txt" and the ADODB recordset, which saves a .HTA file to the local system, aka the "HTML Help ActiveX control Cross Domain Vulnerability."CVE-2004-1043ACCEPTED1Microsoft Windows 2000POSIXIngrid SkoogINTERIMACCEPTEDThe POSIX component of Microsoft Windows NT and Windows 2000 allows local users to execute arbitrary code via certain parameters, possibly by modifying message length values and causing a buffer overflow.CVE-2004-0210ACCEPTED0Microsoft Windows XPDistributed Component Object Model (DCOM) interfaceChristine WalzerDRAFTINTERIMACCEPTEDHeap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed RPC request with a long filename parameter, a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0715.CVE-2003-0528ACCEPTED1Microsoft Windows XPCOM Internet ServicesChristine WalzerDRAFTINTERIMACCEPTEDWindows 2000, XP, and Server 2003 does not properly "validate the use of memory regions" for COM structured storage files, which allows attackers to execute arbitrary code, aka the "COM Structured Storage Vulnerability."CVE-2005-0047ACCEPTED1Microsoft Windows XPOperating SystemChristine WalzerINTERIMACCEPTEDRobert L. HollisThe Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP.CVE-2004-0420INTERIM0Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Harvey RubinovitzDRAFTINTERIMACCEPTEDInternet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory corruption") via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the "<STYLE>@;/*" string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the "CSS Heap Memory Corruption Vulnerability."CVE-2004-0842ACCEPTED1Red Hat Enterprise Linux 3Linux kernelJay BealeDRAFTINTERIMACCEPTEDLinux kernel 2.4.x and 2.6.x for x86 allows local users to cause a denial of service (system crash), possibly via an infinite loop that triggers a signal handler with a certain sequence of fsave and frstor instructions, as originally demonstrated using a "crash.c" program.CVE-2004-0554ACCEPTED1Microsoft Windows 2000Windows Media Player 9Christine WalzerDRAFTINTERIMACCEPTEDAndrew ButtnerINTERIMACCEPTEDThe OLE component in Windows 98, 2000, XP, and Server 2003, and Exchange Server 5.0 through 2003, does not properly validate the lengths of messages for certain OLE data, which allows remote attackers to execute arbitrary code, aka the "Input Validation Vulnerability."CVE-2005-0044ACCEPTED2Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPAdobe Acrobat ReaderMatthew WojcikDRAFTINTERIMACCEPTEDFormat string vulnerability in Adobe Acrobat Reader 6.0.0 through 6.0.2 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an .ETD document containing format string specifiers in (1) title or (2) baseurl fields.CVE-2004-1153ACCEPTED1iDEFENSE reports that deleting eBook.api from the plug_ins directory is a workaround. See http://www.idefense.com/application/poi/display?id=163&type=vulnerabilitiesMicrosoft Windows XPMicrosoft Internet Explorer 6Harvey RubinovitzDRAFTINTERIMHarvey RubinovitzACCEPTEDInternet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability."CVE-2005-0053ACCEPTED1Microsoft Windows XPCursor and Icon FormattingChristine WalzerDRAFTINTERIMACCEPTEDInteger overflow in the LoadImage API of the USER32 Lib for Microsoft Windows allows remote attackers to execute arbitrary code via a .bmp, .cur, .ico or .ani file with a large image size field, which leads to a buffer overflow, aka the "Cursor and Icon Format Handling Vulnerability."CVE-2004-1049ACCEPTED1Red Hat Enterprise Linux 3Linux kernelJay BealeDRAFTINTERIMACCEPTEDMultiple unknown vulnerabilities in Linux kernel 2.4 and 2.6 allow local users to gain privileges or access kernel memory, as found by the Sparse source code checking tool.CVE-2004-0495ACCEPTED1Microsoft Windows XPDistributed Component Object Model (DCOM) interfaceChristine WalzerDRAFTINTERIMACCEPTEDHeap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed RPC request with a long filename parameter, a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0715.CVE-2003-0528ACCEPTED1Sun Solaris 8Sun Solaris 9TCP/IPBrian SobyDRAFTINTERIMACCEPTEDINTERIMDRAFTINTERIMACCEPTEDUnknown vulnerability in the TCP/IP stack for Sun Solaris 8 and 9 allows local users to cause a denial of service (system panic) via unknown vectors.CVE-2004-1355ACCEPTED2Sun Solaris 7SendmailBrian SobyDRAFTINTERIMACCEPTEDThe prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c.CVE-2003-0694ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 3Harvey RubinovitzDRAFTINTERIMACCEPTEDInternet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability."CVE-2005-0053ACCEPTED1Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Project Professional 2002Ingrid SkoogDRAFTIngrid SkoogINTERIMACCEPTEDIngrid SkoogINTERIMACCEPTEDBuffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.CVE-2004-0200ACCEPTED2Microsoft Windows XPJonathan BakerDRAFTINTERIMACCEPTEDThe Server service (srvsvc.dll) in Windows XP SP1 and SP2 allows remote attackers to obtain sensitive information (users who are accessing resources) via an anonymous logon using a named pipe, which is not properly authenticated, aka the "Named Pipe Vulnerability."CVE-2005-0051ACCEPTED1Microsoft Windows Server 2003Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003Harvey RubinovitzDRAFTINTERIMHarvey RubinovitzHarvey RubinovitzHarvey RubinovitzACCEPTEDInternet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded, which are decoded twice to generate a malicious hostname, aka the "URL Decoding Zone Spoofing Vulnerability."CVE-2005-0054ACCEPTED1Microsoft Windows NTProgram Group ConverterAndrew ButtnerDRAFTINTERIMACCEPTEDBuffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe.CVE-2004-0572ACCEPTED1Sun Solaris 7CDEBrian SobyDRAFTINTERIMACCEPTEDBuffer overflow in the AddSuLog function of the CDE dtaction utility allows local users to gain root privileges via a long user name.CVE-1999-0691ACCEPTED1Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Visio Professional 2002Ingrid SkoogDRAFTIngrid SkoogINTERIMACCEPTEDIngrid SkoogINTERIMACCEPTEDBuffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.CVE-2004-0200ACCEPTED2Microsoft Windows XPExplorer.exeIngrid SkoogIngrid SkoogINTERIMACCEPTEDBuffer overflow in EXPLORER.EXE on Windows XP allows attackers to execute arbitrary code as the XP user via a desktop.ini file with a long .ShellClassInfo parameter.CVE-2003-0306ACCEPTED0Microsoft Windows NTCursor and Icon FormattingChristine WalzerDRAFTINTERIMACCEPTEDInteger overflow in the LoadImage API of the USER32 Lib for Microsoft Windows allows remote attackers to execute arbitrary code via a .bmp, .cur, .ico or .ani file with a large image size field, which leads to a buffer overflow, aka the "Cursor and Icon Format Handling Vulnerability."CVE-2004-1049ACCEPTED1Microsoft Windows Server 2003Internet Explorer 6Harvey RubinovitzDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDRace condition in the memory management routines in the DHTML object processor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail, aka "DHTML Object Memory Corruption Vulnerability".CVE-2005-0553ACCEPTED2Microsoft Windows 2000NetDDEJonathan BakerDRAFTINTERIMACCEPTEDNetwork Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an "unchecked buffer," possibly a buffer overflow.CVE-2004-0206ACCEPTED1Sun Solaris 8mozillaBrian SobyDRAFTINTERIMACCEPTEDMozilla 1.5 through 1.7 allows a CA certificate to be imported even when their DN is the same as that of the built-in CA root certificate, which allows remote attackers to cause a denial of service to SSL pages because the malicious certificate is treated as invalid.CVE-2004-0758ACCEPTED1Microsoft Windows Server 2003Microsoft Internet Explorer 6.0 for Windows Server 2003Harvey RubinovitzDRAFTINTERIMHarvey RubinovitzHarvey RubinovitzHarvey RubinovitzACCEPTEDInternet Explorer 5.01, 5.5, and 6 does not properly validate buffers when handling certain DHTML methods including the createControlRange Javascript function, which allows remote attackers to execute arbitrary code, aka the "DHTML Method Heap Memory Corruption Vulnerability."CVE-2005-0055ACCEPTED1Microsoft Windows Server 2003HyperTerminalHarvey RubinovitzDRAFTHarvey RubinovitzHarvey RubinovitzINTERIMACCEPTEDHyperTerminal application for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value that is saved in a session file, which allows remote attackers to execute arbitrary code via a malicious HyperTerminal session file (.ht), web site, or Telnet URL contained in an e-mail message, triggering a buffer overflow.CVE-2004-0568ACCEPTED1Microsoft Windows 2000Windows kernelChristine WalzerChristine WalzerINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDBuffer overflow in Windows Kernel allows local users to gain privileges by causing certain error messages to be passed to a debugger.CVE-2003-0112ACCEPTED1Microsoft Windows XPMicrosoft Internet Explorer 6Harvey RubinovitzDRAFTINTERIMACCEPTEDBuffer overflow in the Content Advisor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a crafted Content Advisor file, aka "Content Advisor Memory Corruption Vulnerability."CVE-2005-0555ACCEPTED1Microsoft Windows XPVDMIngrid SkoogDRAFTINTERIMACCEPTEDThe Virtual DOS Machine (VDM) subsystem of Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows local users to access kernel memory and gain privileges via a malicious program that modified some system structures in a way that is not properly validated by privileged operating system functions.CVE-2004-0208ACCEPTED1Microsoft Windows NTHTML Help FacilityAndrew ButtnerINTERIMACCEPTEDHarvey RubinovitzINTERIMACCEPTEDHeap-based buffer overflow in the HtmlHelp program (hh.exe) in HTML Help for Microsoft Windows 98, Me, NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary commands via a .CHM file with a large length field, a different vulnerability than CVE-2003-1041.CVE-2004-0201ACCEPTED1Microsoft Windows XPMicrosoft Internet Explorer 6Harvey RubinovitzDRAFTINTERIMHarvey RubinovitzACCEPTEDInternet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded, which are decoded twice to generate a malicious hostname, aka the "URL Decoding Zone Spoofing Vulnerability."CVE-2005-0054ACCEPTED1Microsoft Windows Server 2003Hyperlink Object LibraryChristine WalzerDRAFTINTERIMACCEPTEDThe Hyperlink Object Library for Windows 98, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a crafted link that triggers an "unchecked buffer" in the library, possibly due to a buffer overflow.CVE-2005-0057ACCEPTED1Microsoft Windows 2000Windows Animated CursorChristine WalzerDRAFTINTERIMACCEPTEDAndrew ButtnerINTERIMACCEPTEDThe Windows Animated Cursor (ANI) capability in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allow remote attackers to cause a denial of service via (1) the frame number set to zero, which causes an invalid memory address to be used and leads to a kernel crash, or (2) the rate number set to zero, which leads to resource exhaustion and hang.CVE-2004-1305ACCEPTED2Microsoft Windows Server 2003Cursor and Icon FormattingChristine WalzerDRAFTINTERIMACCEPTEDInteger overflow in the LoadImage API of the USER32 Lib for Microsoft Windows allows remote attackers to execute arbitrary code via a .bmp, .cur, .ico or .ani file with a large image size field, which leads to a buffer overflow, aka the "Cursor and Icon Format Handling Vulnerability."CVE-2004-1049ACCEPTED1Microsoft Windows XPNetDDEJonathan BakerDRAFTINTERIMACCEPTEDNetwork Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an "unchecked buffer," possibly a buffer overflow.CVE-2004-0206ACCEPTED1Sun Solaris 8mozillaBrian SobyDRAFTINTERIMACCEPTEDHeap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to execute arbitrary code.CVE-2004-0757ACCEPTED1Microsoft Windows NTMicrosoft Word for Windows 6.0 ConverterChristine WalzerDRAFTINTERIMACCEPTEDRobert L. HollisMicrosoft Word for Windows 6.0 Converter (MSWRD632.WPC), as used in WordPad, does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CVE-2004-0571.CVE-2004-0901INTERIM1Microsoft Windows XPMicrosoft Office 2003Christine WalzerDRAFTINTERIMACCEPTEDIngrid SkoogINTERIMACCEPTEDIngrid SkoogINTERIMACCEPTEDBuffer overflow in the converter for Microsoft WordPerfect 5.x on Office 2000, Office XP, Office 2003, and Works Suites 2001 through 2004 allows remote attackers to execute arbitrary code via a malicious document or website.CVE-2004-0573ACCEPTED3Microsoft Windows XPLocal Security Authority Subsystem Service (LSASS)Ingrid SkoogDRAFTINTERIMACCEPTEDLSASS (Local Security Authority Subsystem Service) of Windows 2000 Server and Windows Server 2003 does not properly validate connection information, which allows local users to gain privileges via a specially-designed program.CVE-2004-0894ACCEPTED1Microsoft Windows 2000Microsoft Windows XPMicrosoft Internet Explorer 6 Service Pack 1Harvey RubinovitzDRAFTINTERIMACCEPTEDInternet Explorer 5.01, 5.5, and 6 does not properly validate certain URLs in Channel Definition Format (CDF) files, which allows remote attackers to obtain sensitive information or execute arbitrary code, aka the "Channel Definition Format (CDF) Cross Domain Vulnerability."CVE-2005-0056ACCEPTED1Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Visio Professional 2003Ingrid SkoogDRAFTIngrid SkoogINTERIMACCEPTEDIngrid SkoogINTERIMACCEPTEDBuffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.CVE-2004-0200ACCEPTED2Sun Solaris 9Kerberos5Brian SobyDRAFTBrian SobyINTERIMACCEPTEDDouble-free vulnerability in the krb5_rd_cred function for MIT Kerberos 5 (krb5) 1.3.1 and earlier may allow local users to execute arbitrary code.CVE-2004-0643ACCEPTED1Microsoft Windows XPLocal Security Authority Subsystem Service (LSASS)Christine WalzerDRAFTINTERIMACCEPTEDLSASS (Local Security Authority Subsystem Service) of Windows 2000 Server and Windows Server 2003 does not properly validate connection information, which allows local users to gain privileges via a specially-designed program.CVE-2004-0894ACCEPTED1Microsoft Windows XPMicrosoft Office XP SP3Christine WalzerDRAFTINTERIMACCEPTEDIngrid SkoogINTERIMACCEPTEDBuffer overflow in the converter for Microsoft WordPerfect 5.x on Office 2000, Office XP, Office 2003, and Works Suites 2001 through 2004 allows remote attackers to execute arbitrary code via a malicious document or website.CVE-2004-0573ACCEPTED2Microsoft Windows NTCursor and Icon FormattingChristine WalzerDRAFTINTERIMACCEPTEDInteger overflow in the LoadImage API of the USER32 Lib for Microsoft Windows allows remote attackers to execute arbitrary code via a .bmp, .cur, .ico or .ani file with a large image size field, which leads to a buffer overflow, aka the "Cursor and Icon Format Handling Vulnerability."CVE-2004-1049ACCEPTED1Microsoft Windows Server 2003Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003Harvey RubinovitzDRAFTINTERIMACCEPTEDHarvey RubinovitzINTERIMACCEPTEDInternet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory corruption") via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the "<STYLE>@;/*" string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the "CSS Heap Memory Corruption Vulnerability."CVE-2004-0842ACCEPTED2Microsoft Windows XPMicrosoft Outlook ExpressJonathan BakerDRAFTINTERIMChristine WalzerACCEPTEDMicrosoft Outlook Express 5.5 and 6 allows attackers to cause a denial of service (application crash) via a malformed e-mail header.CVE-2004-0215ACCEPTED1Microsoft Windows 2000Operating SystemChristine WalzerDRAFTINTERIMACCEPTEDRobert L. HollisThe Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP.CVE-2004-0420INTERIM1Microsoft Windows XPSMB (Server Message Block)Ingrid SkoogINTERIMACCEPTEDBuffer overflow in the SMB capability for Microsoft Windows XP, 2000, and NT allows remote attackers to cause a denial of service and possibly execute arbitrary code via an SMB packet that specifies a smaller buffer length than is required.CVE-2003-0345ACCEPTED0Sun Solaris 7Sun Solaris 8Sun Solaris 9Licence Logging ServiceBrian SobyDRAFTINTERIMACCEPTEDBuffer overflow in the ping daemon of Sun Solaris 7 through 9 may allow local users to execute arbitrary code.CVE-2004-1352ACCEPTED1Microsoft Windows 2000Microsoft Word for Windows 6.0 ConverterChristine WalzerDRAFTINTERIMACCEPTEDAndrew ButtnerINTERIMACCEPTEDRobert L. HollisMicrosoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CVE-2004-0901.CVE-2004-0571INTERIM2Microsoft Windows 2000Task SchedulerTiffany BergeronINTERIMACCEPTEDStack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0, allows local or remote attackers to execute arbitrary code via a .job file containing long parameters, as demonstrated using Internet Explorer and accessing a .job file on an anonymous share.CVE-2004-0212ACCEPTED0Microsoft Windows XPWindows ShellHarvey RubinovitzDRAFTINTERIMACCEPTEDThe document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document.CVE-2005-0063ACCEPTED1Microsoft Windows 2000Windows 2000Matthew BurtonDRAFTINTERIMACCEPTEDMultiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the "blind connection-reset attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.CVE-2004-0790ACCEPTED1Microsoft Windows Server 2003SMTPChristine WalzerDRAFTINTERIMACCEPTEDThe SMTP (Simple Mail Transfer Protocol) component of Microsoft Windows XP 64-bit Edition, Windows Server 2003, Windows Server 2003 64-bit Edition, and the Exchange Routing Engine component of Exchange Server 2003, allows remote attackers to execute arbitrary code via a malicious DNS response message containing length values that are not properly validated.CVE-2004-0840ACCEPTED1Microsoft Windows XPInternet Explorer 6.0Jonathan BakerDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDThe DHTML Edit Control (dhtmled.ocx) allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as demonstrated by "AbusiveParent" in Internet Explorer 6.0.2900.2180.CVE-2004-1319ACCEPTED2Sun Solaris 9Solaris Volume Manager (SVM)Brian SobyDRAFTINTERIMACCEPTEDINTERIMDRAFTINTERIMACCEPTEDThe Sun Solaris Volume Manager (SVM) on Solaris 9 allows local users to cause a denial of service (kernel panic) via a malformed probe request to the SVM.CVE-2004-1346ACCEPTED2Microsoft Windows XPNetBT Name ServiceIngrid SkoogIngrid SkoogIngrid SkoogINTERIMACCEPTEDThe NetBT Name Service (NBNS) for NetBIOS in Windows NT 4.0, 2000, XP, and Server 2003 may include random memory in a response to a NBNS query, which could allow remote attackers to obtain sensitive information.CVE-2003-0661ACCEPTED0Microsoft Windows NTHTML Help ActiveX ControlMatthew BurtonDRAFTINTERIMACCEPTEDInternet Explorer 6.0 on Windows XP SP2 allows remote attackers to execute arbitrary code by using the "Related Topics" command in the Help ActiveX Control (hhctrl.ocx) to open a Help popup window containing the PCHealth tools.htm file in the local zone and injecting Javascript to be executed, as demonstrated using "writehta.txt" and the ADODB recordset, which saves a .HTA file to the local system, aka the "HTML Help ActiveX control Cross Domain Vulnerability."CVE-2004-1043ACCEPTED1Sun Solaris 9sshdBrian SobyDRAFTINTERIMACCEPTEDINTERIMDRAFTINTERIMACCEPTEDThe Secure Shell (SSH) Daemon (SSHD) in Sun Solaris 9 does not properly log IP addresses when SSHD is configured with the ListenAddress as 0.0.0.0, which makes it easier for remote attackers to hide the source of their activities.CVE-2004-1357ACCEPTED2Microsoft Windows XPWindows XPMatthew BurtonDRAFTINTERIMACCEPTEDTCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP.CVE-2004-0230ACCEPTED1Microsoft Windows Server 2003HTML Help FacilityAndrew ButtnerINTERIMACCEPTEDInternet Explorer 5.x and 6.0 allows remote attackers to execute arbitrary programs via a modified directory traversal attack using a URL containing ".." (dot dot) sequences and a filename that ends in "::" which is treated as a .chm file even if it does not have a .chm extension. NOTE: this bug may overlap CVE-2004-0475.CVE-2003-1041ACCEPTED0Microsoft Windows XPOperating SystemChristine WalzerINTERIMACCEPTEDRobert L. HollisThe Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP.CVE-2004-0420INTERIM0Microsoft Windows XPClient Server Runtime System (CSRSS)Ingrid SkoogDRAFTINTERIMChristine WalzerACCEPTEDStack-based buffer overflow in WINSRV.DLL in the Client Server Runtime System (CSRSS) process of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application that provides console window information with a long FaceName value.CVE-2005-0551ACCEPTED1Microsoft Windows XPMicrosoft Windows Server 2003MDAC 2.7Matthew BurtonDRAFTINTERIMACCEPTEDThe Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a (1) "\" (backslash) or (2) "%5C" (encoded backslash), aka "Path Validation Vulnerability."CVE-2004-0847ACCEPTED1Sun Solaris 9Basic Security ModuleBrian SobyDRAFTINTERIMACCEPTEDThe patches (1) 114332-08 and (2) 114929-06 for Sun Solaris 9 disable the auditing functionality of the Basic Security Module (BSM), which allows attackers to avoid having their activity logged.CVE-2004-1358ACCEPTED1Microsoft Windows Server 2003OLEChristine WalzerChristine WalzerDRAFTINTERIMACCEPTEDThe OLE component in Windows 98, 2000, XP, and Server 2003, and Exchange Server 5.0 through 2003, does not properly validate the lengths of messages for certain OLE data, which allows remote attackers to execute arbitrary code, aka the "Input Validation Vulnerability."CVE-2005-0044ACCEPTED1Microsoft Windows 95Microsoft Windows 98Microsoft Windows NTMDAC 2.1Ingrid SkoogDRAFTINTERIMACCEPTEDAndrew ButtnerINTERIMACCEPTEDHeap-based buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) 2.1 through 2.6, and Internet Explorer 5.01 through 6.0, allows remote attackers to execute code via a malformed HTTP request to the Data Stub.CVE-2002-1142ACCEPTED2Microsoft Windows NTDHCPIngrid SkoogDRAFTINTERIMACCEPTEDThe DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition does not properly validate the length of certain messages, which allows remote attackers to execute arbitrary code via a malformed DHCP message, aka the "DHCP Request Vulnerability."CVE-2004-0900ACCEPTED1Microsoft Windows Server 2003MDAC 2.8Ingrid SkoogDRAFTINTERIMACCEPTEDIngrid SkoogINTERIMACCEPTEDThe License Logging service for Windows NT Server, Windows 2000 Server, and Windows Server 2003 does not properly validate the length of messages, which leads to an "unchecked buffer" and allows remote attackers to cause a denial of service (crash) and possibly execute arbtirary code, aka the "License Logging Service Vulnerability."CVE-2005-0050ACCEPTED2Microsoft Windows 2000Windows ExplorerIngrid SkoogDRAFTAndrew ButtnerINTERIMACCEPTEDThe Web View DLL (webvw.dll), as used in Windows Explorer on Windows 2000 systems, does not properly filter an apostrophe ("'") in the author name in a document, which allows attackers to execute arbitrary script via extra attributes when Web View constructs a mailto: link for the preview pane when the user selects the file.CVE-2005-1191ACCEPTED1Microsoft Windows 2000Microsoft Windows XPInternet Explorer 6 SP1Harvey RubinovitzDRAFTINTERIMACCEPTEDInternet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded, which are decoded twice to generate a malicious hostname, aka the "URL Decoding Zone Spoofing Vulnerability."CVE-2005-0054ACCEPTED1Sun Solaris 7Solaris Runtime LinkerBrian SobyDRAFTINTERIMACCEPTEDStack-based buffer overflow in the runtime linker, ld.so.1, on Solaris 2.6 through 9 allows local users to gain root privileges via a long LD_PRELOAD environment variable.CVE-2003-0609ACCEPTED1Sun Solaris 8mozillaBrian SobyDRAFTINTERIMACCEPTEDMozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote attackers to use certain redirect sequences to spoof the security lock icon that makes a web page appear to be encrypted.CVE-2004-0761ACCEPTED1Microsoft Windows NTInternet Explorer 6Christine WalzerDRAFTINTERIMACCEPTEDRobert L. HollisThe Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP.CVE-2004-0420INTERIM1Sun Solaris 7Sun Solaris 8Sun Solaris 9SendmailBrian SobyDRAFTA "potential buffer overflow in ruleset parsing" for Sendmail 8.12.9, when using the nonstandard rulesets (1) recipient (2), final, or (3) mailer-specific envelope recipients, has unknown consequences.CVE-2003-0681DRAFT0Sun Solaris 7Sun Solaris 8Sun Solaris 9priocntl()Brian SobyDRAFTINTERIMACCEPTEDDirectory traversal vulnerability in priocntl system call in Solaris does allows local users to execute arbitrary code via ".." sequences in the pc_clname field of a pcinfo_t structure, which cause priocntl to load a malicious kernel module.CVE-2002-1296ACCEPTED1Red Hat Enterprise Linux 3libpngJay BealeDRAFTINTERIMACCEPTEDPortable Network Graphics (PNG) library libpng 1.2.5 and earlier does not correctly calculate offsets, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a buffer overflow attack on the row buffers.CVE-2002-1363ACCEPTED1Microsoft Windows Server 2003Windows Internet Naming Service (WINS)Matthew BurtonDRAFTINTERIMACCEPTEDThe WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 allows remote attackers to write to arbitrary memory locations and possibly execute arbitrary code via a modified memory pointer in a WINS replication packet to TCP port 42, aka the "Association Context Vulnerability."CVE-2004-1080ACCEPTED1Microsoft Windows XPHelp and Support Center (HSC)Christine WalzerDRAFTINTERIMACCEPTEDStack-based buffer overflow in the PCHealth system in the Help and Support Center function in Windows XP and Windows Server 2003 allows remote attackers to execute arbitrary code via a long query in an HCP URL.CVE-2003-0711ACCEPTED1Microsoft Windows Server 2003Microsoft Word for Windows 6.0 ConverterChristine WalzerDRAFTINTERIMACCEPTEDRobert L. HollisMicrosoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CVE-2004-0901.CVE-2004-0571INTERIM1Microsoft Windows 2000Microsoft Windows XPMicrosoft Internet Explorer 6 Service Pack 1Harvey RubinovitzDRAFTINTERIMACCEPTEDRace condition in the memory management routines in the DHTML object processor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail, aka "DHTML Object Memory Corruption Vulnerability".CVE-2005-0553ACCEPTED1Microsoft Windows MEProgram Group ConverterAndrew ButtnerDRAFTINTERIMACCEPTEDBuffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe.CVE-2004-0572ACCEPTED1Microsoft Windows MEInternet Explorer 5.5 Service Pack 2Harvey RubinovitzDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer in Windows XP SP2, and other versions including 5.01 and 5.5, allows remote attackers to install arbitrary programs via a web page that uses certain styles and the AnchorClick behavior, popup windows, and drag-and-drop capabilities to drop the program in the local startup folder, as demonstrated by "wottapoop.html".CVE-2004-0839ACCEPTED2Sun Solaris 8Sun Solaris 9ApacheBrian SobyDRAFTINTERIMACCEPTEDMultiple stack-based buffer overflows in (1) mod_alias and (2) mod_rewrite for Apache before 1.3.29 allow attackers to create configuration files to cause a denial of service (crash) or execute arbitrary code via a regular expression with more than 9 captures.CVE-2003-0542ACCEPTED1Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Project Professional 2003Ingrid SkoogDRAFTIngrid SkoogINTERIMACCEPTEDIngrid SkoogINTERIMACCEPTEDBuffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.CVE-2004-0200ACCEPTED2Microsoft Windows XPMicrosoft Internet Explorer 6Harvey RubinovitzDRAFTINTERIMACCEPTEDBuffer overflow in the URL processor of Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL with a long hostname, aka "URL Parsing Memory Corruption Vulnerability."CVE-2005-0554ACCEPTED1Microsoft Windows XPWindows ShellAndrew ButtnerDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDBuffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe.CVE-2004-0572ACCEPTED2Microsoft Windows 2000Windows 2000Matthew BurtonDRAFTINTERIMACCEPTEDMicrosoft Windows XP SP2 and earlier, 2000 SP3 and SP4, Server 2003, and older operating systems allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IP packets with malformed options, aka the "IP Validation Vulnerability."CVE-2005-0048ACCEPTED1Microsoft Windows XPWindows XPMatthew BurtonDRAFTINTERIMACCEPTEDMultiple TCP/IP and ICMP implementations, when using Path MTU (PMTU) discovery (PMTUD), allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via forged ICMP ("Fragmentation Needed and Don't Fragment was Set") packets with a low next-hop MTU value, aka the "Path MTU discovery attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.CVE-2004-1060ACCEPTED1Sun Solaris 7Sun Solaris 8sendfilev()Brian SobyDRAFTINTERIMACCEPTEDBuffer overflow in ntpd ntp daemon 4.0.99k and earlier (aka xntpd and xntp3) allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long readvar argument.CVE-2001-0414ACCEPTED1Microsoft Windows 2000Internet Explorer 6.0Jonathan BakerDRAFTINTERIMACCEPTEDChristine WalzerINTERIMAndrew ButtnerACCEPTEDThe DHTML Edit Control (dhtmled.ocx) allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as demonstrated by "AbusiveParent" in Internet Explorer 6.0.2900.2180.CVE-2004-1319ACCEPTED2Microsoft Windows Server 2003Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003Harvey RubinovitzDRAFTINTERIMACCEPTEDHarvey RubinovitzINTERIMACCEPTEDInternet Explorer 5.01, 5.5, and 6 does not properly cache SSL content, which allows remote attackers to obtain information or spoof content via a web site with the same host name as the target web site, whose content is cached and reused when the user visits the target web site.CVE-2004-0845ACCEPTED2Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Office XP SP2Ingrid SkoogDRAFTINTERIMACCEPTEDIngrid SkoogINTERIMACCEPTEDBuffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.CVE-2004-0200ACCEPTED2Microsoft Windows XPMicrosoft Word for Windows 6.0 ConverterChristine WalzerDRAFTINTERIMACCEPTEDRobert L. HollisMicrosoft Word for Windows 6.0 Converter (MSWRD632.WPC), as used in WordPad, does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CVE-2004-0571.CVE-2004-0901INTERIM1Microsoft Windows XPWindows Help and Support CenterChristine WalzerDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDStack-based buffer overflow in the PCHealth system in the Help and Support Center function in Windows XP and Windows Server 2003 allows remote attackers to execute arbitrary code via a long query in an HCP URL.CVE-2003-0711ACCEPTED2Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Harvey RubinovitzDRAFTINTERIMACCEPTEDInternet Explorer 5.01, 5.5, and 6 does not properly validate buffers when handling certain DHTML methods including the createControlRange Javascript function, which allows remote attackers to execute arbitrary code, aka the "DHTML Method Heap Memory Corruption Vulnerability."CVE-2005-0055ACCEPTED1Microsoft Windows Server 2003Compressed FoldersDavid ProulxDRAFTINTERIMACCEPTEDJonathan BakerINTERIMACCEPTEDMatthew WojcikINTERIMACCEPTEDInteger overflow in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition allows remote attackers to execute arbitrary code via compressed (zipped) folders that involve an "unchecked buffer" and improper length validation.CVE-2004-0575ACCEPTED3Microsoft Windows 2000Microsoft Windows XPMicrosoft Internet Explorer 6 Service Pack 1Harvey RubinovitzDRAFTINTERIMACCEPTEDBuffer overflow in the Content Advisor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a crafted Content Advisor file, aka "Content Advisor Memory Corruption Vulnerability."CVE-2005-0555ACCEPTED1Microsoft Windows XPWindows kernelIngrid SkoogDRAFTINTERIMChristine WalzerACCEPTEDBuffer overflow in the font processing component of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application.CVE-2005-0060ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 3Harvey RubinovitzDRAFTINTERIMACCEPTEDInternet Explorer 5.5 and 6 does not properly handle plug-in navigation, which allows remote attackers to alter displayed address bars and thereby spoof web pages, facilitating phishing attacks, aka the "Plug-in Navigation Address Bar Spoofing Vulnerability."CVE-2004-0843ACCEPTED1Microsoft Windows NTVDMIngrid SkoogDRAFTINTERIMACCEPTEDThe Virtual DOS Machine (VDM) subsystem of Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows local users to access kernel memory and gain privileges via a malicious program that modified some system structures in a way that is not properly validated by privileged operating system functions.CVE-2004-0208ACCEPTED1Microsoft Windows NTWindows Animated CursorChristine WalzerDRAFTINTERIMACCEPTEDThe Windows Animated Cursor (ANI) capability in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allow remote attackers to cause a denial of service via (1) the frame number set to zero, which causes an invalid memory address to be used and leads to a kernel crash, or (2) the rate number set to zero, which leads to resource exhaustion and hang.CVE-2004-1305ACCEPTED1Sun Solaris 8BindBrian SobyDRAFTINTERIMACCEPTEDUnknown vulnerability in in.named on Solaris 8 allows remote attackers to cause a denial of service (process crash).CVE-2004-1348ACCEPTED1Microsoft Windows Server 2003Distributed Component Object Model (DCOM) interfaceChristine WalzerDRAFTINTERIMACCEPTEDHeap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed RPC request with a long filename parameter, a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0715.CVE-2003-0528ACCEPTED1Microsoft Windows NTHyperTerminalHarvey RubinovitzDRAFTINTERIMHarvey RubinovitzACCEPTEDHyperTerminal application for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value that is saved in a session file, which allows remote attackers to execute arbitrary code via a malicious HyperTerminal session file (.ht), web site, or Telnet URL contained in an e-mail message, triggering a buffer overflow.CVE-2004-0568ACCEPTED1Sun Solaris 8mozillaBrian SobyDRAFTINTERIMACCEPTEDMozilla Firefox 0.9.1 and 0.9.2 allows remote web sites to spoof certificates of trusted web sites via redirects and Javascript that uses the "onunload" method.CVE-2004-0763ACCEPTED1Microsoft Windows XPWindows kernelIngrid SkoogDRAFTINTERIMChristine WalzerACCEPTEDThe kernel of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via certain access requests.CVE-2005-0061ACCEPTED1Microsoft Windows XPGDI+Ingrid SkoogDRAFTINTERIMACCEPTEDBuffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.CVE-2004-0200ACCEPTED1Microsoft Windows XPMicrosoft Office XP SP2Ingrid SkoogDRAFTINTERIMACCEPTEDIngrid SkoogINTERIMACCEPTEDBuffer overflow in the converter for Microsoft WordPerfect 5.x on Office 2000, Office XP, Office 2003, and Works Suites 2001 through 2004 allows remote attackers to execute arbitrary code via a malicious document or website.CVE-2004-0573ACCEPTED2Microsoft Windows NTWindows kernelChristine WalzerDRAFTINTERIMACCEPTEDThe Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability."CVE-2004-0893ACCEPTED1Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Microsoft Office XP SP3Ingrid SkoogIngrid SkoogIngrid SkoogDRAFTINTERIMACCEPTEDBuffer overflow in Microsoft Office XP allows remote attackers to execute arbitrary code via a link with a URL file location containing long inputs after (1) "%00 (null byte) in .doc filenames or (2) "%0a" (carriage return) in .rtf filenames.CVE-2004-0848ACCEPTED1Sun Solaris 8Sun Solaris 9DtMailBrian SobyDRAFTINTERIMACCEPTEDFormat string vulnerability in CDE Mailer (dtmail) on Solaris 8 and 9 allows local users to gain privileges via format strings in the argv[0] value.CVE-2004-0800ACCEPTED1Microsoft Windows 2000Microsoft Windows Server 2003Microsoft Exchange Server 2003Christine WalzerDRAFTINTERIMACCEPTEDHeap-based buffer overflow in the SvrAppendReceivedChunk function in xlsasink.dll in the SMTP service of Exchange Server 2000 and 2003 allows remote attackers to execute arbitrary code via a crafted X-LINK2STATE extended verb request to the SMTP port.CVE-2005-0560ACCEPTED1Microsoft Windows 2000SMB (Server Message Block)Christine WalzerDRAFTINTERIMACCEPTEDAndrew ButtnerINTERIMACCEPTEDThe Server Message Block (SMB) implementation for Windows NT 4.0, 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allows remote attackers to execute arbitrary code via Transaction responses containing (1) Trans or (2) Trans2 commands, aka the "Server Message Block Vulnerability," and as demonstrated using Trans2 FIND_FIRST2 responses with large file name length fields.CVE-2005-0045ACCEPTED2Sun Solaris 7bash, tcsh, cash, sh, kshBrian SobyDRAFTINTERIMACCEPTEDMultiple shell programs on various Unix systems, including (1) tcsh, (2) csh, (3) sh, and (4) bash, follow symlinks when processing << redirects (aka here-documents or in-here documents), which allows local users to overwrite files of other users via a symlink attack.CVE-2000-1134ACCEPTED1Microsoft Windows Server 2003Microsoft Word for Windows 6.0 ConverterChristine WalzerDRAFTINTERIMACCEPTEDIngrid SkoogINTERIMACCEPTEDMicrosoft Word for Windows 6.0 Converter (MSWRD632.WPC), as used in WordPad, does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CVE-2004-0571.CVE-2004-0901ACCEPTED2Microsoft Windows XPMicrosoft Internet Explorer 6Harvey RubinovitzDRAFTINTERIMHarvey RubinovitzACCEPTEDInternet Explorer 5.01, 5.5, and 6 does not properly validate certain URLs in Channel Definition Format (CDF) files, which allows remote attackers to obtain sensitive information or execute arbitrary code, aka the "Channel Definition Format (CDF) Cross Domain Vulnerability."CVE-2005-0056ACCEPTED1Sun Solaris 7lpstat, libprintBrian SobyDRAFTINTERIMACCEPTEDUnknown multiple vulnerabilities in (1) lpstat and (2) the libprint library in Solaris 2.6 through 9 may allow attackers to execute arbitrary code or read or write arbitrary files.CVE-2003-0999ACCEPTED1Sun Solaris 8Sun Solaris 9ApacheBrian SobyBrian SobyBrian SobyDRAFTINTERIMACCEPTEDApache does not filter terminal escape sequences from its error logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences.CVE-2003-0020ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Harvey RubinovitzDRAFTINTERIMACCEPTEDInternet Explorer in Windows XP SP2, and other versions including 5.01 and 5.5, allows remote attackers to install arbitrary programs via a web page that uses certain styles and the AnchorClick behavior, popup windows, and drag-and-drop capabilities to drop the program in the local startup folder, as demonstrated by "wottapoop.html".CVE-2004-0839ACCEPTED1Microsoft Windows XPInternet Explorer 6Harvey RubinovitzDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory corruption") via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the "<STYLE>@;/*" string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the "CSS Heap Memory Corruption Vulnerability."CVE-2004-0842ACCEPTED2Sun Solaris 7BindBrian SobyDRAFTINTERIMACCEPTEDBuffer overflow in the DNS resolver code used in libc, glibc, and libbind, as derived from ISC BIND, allows remote malicious DNS servers to cause a denial of service and possibly execute arbitrary code via the stub resolvers.CVE-2002-0651ACCEPTED1Microsoft Windows 2000Internet Explorer 6 SP1Ingrid SkoogDRAFTINTERIMACCEPTEDBuffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.CVE-2004-0200ACCEPTED1Microsoft Windows XPDistributed Component Object Model (DCOM) interfaceChristine WalzerDRAFTINTERIMACCEPTEDHeap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed DCERPC DCOM object activation request packet with modified length fields, a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0528.CVE-2003-0715ACCEPTED1Microsoft Windows 95Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Microsoft Excel 2002Matthew BurtonDRAFTUnknown vulnerability in Microsoft Excel 2000, 2002, 2001 for Mac, and v.X for Mac allows remote attackers to execute arbitrary code via a malicious file containing certain parameters that are not properly validated.CVE-2004-0846DRAFT0Microsoft Windows 95Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003SambaMatthew BurtonDRAFTINTERIMACCEPTEDBuffer overflow in Microsoft Word 2000, Word 2002, and Word 2003 allows remote attackers to execute arbitrary code via a crafted document.CVE-2005-0558ACCEPTED1Microsoft Windows Server 2003Program Group ConverterAndrew ButtnerDRAFTINTERIMACCEPTEDBuffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe.CVE-2004-0572ACCEPTED1Sun Solaris 8Sun Solaris 9Sun ClusterBrian SobyDRAFTINTERIMACCEPTEDInteger overflow in OpenSSL 0.9.6 and 0.9.7 allows remote attackers to cause a denial of service (crash) via an SSL client certificate with certain ASN.1 tag values.CVE-2003-0543ACCEPTED1Microsoft Windows 2000ISA Server 2000Christine WalzerDRAFTINTERIMACCEPTEDMicrosoft Proxy Server 2.0 and Microsoft ISA Server 2000 (which is included in Small Business Server 2000 and Small Business Server 2003 Premium Edition) allows remote attackers to spoof trusted Internet content on a specially crafted webpage via spoofed reverse DNS lookup results.CVE-2004-0892ACCEPTED1Microsoft Windows Server 2003Compressed FoldersDavid ProulxDRAFTINTERIMACCEPTEDJonathan BakerINTERIMACCEPTEDMatthew WojcikINTERIMACCEPTEDInteger overflow in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition allows remote attackers to execute arbitrary code via compressed (zipped) folders that involve an "unchecked buffer" and improper length validation.CVE-2004-0575ACCEPTED3Microsoft Windows NTDHCPIngrid SkoogDRAFTINTERIMACCEPTEDThe DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition, with DHCP logging enabled, does not properly validate the length of certain messages, which allows remote attackers to cause a denial of service (application crash) via a malformed DHCP message, aka "Logging Vulnerability."CVE-2004-0899ACCEPTED1Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Visual Studio .NET 2002Ingrid SkoogDRAFTINTERIMACCEPTEDBuffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.CVE-2004-0200ACCEPTED1Microsoft Windows 2000VDMIngrid SkoogDRAFTINTERIMACCEPTEDThe Virtual DOS Machine (VDM) subsystem of Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows local users to access kernel memory and gain privileges via a malicious program that modified some system structures in a way that is not properly validated by privileged operating system functions.CVE-2004-0208ACCEPTED1Microsoft Windows NTMicrosoft Word for Windows 6.0 ConverterChristine WalzerDRAFTINTERIMACCEPTEDRobert L. HollisMicrosoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CVE-2004-0901.CVE-2004-0571INTERIM1Sun Solaris 7Sun Solaris 8Sun Solaris 9cachefsdBrian SobyDRAFTINTERIMACCEPTEDcachefsd in Solaris 2.6, 7, and 8 allows remote attackers to cause a denial of service (crash) via an invalid procedure call in an RPC request.CVE-2002-0085ACCEPTED1Microsoft Windows 2000Windows ShellAndrew ButtnerDRAFTINTERIMACCEPTEDBuffer overflow in Microsoft Internet Explorer and Explorer on Windows XP SP1, WIndows 2000, Windows 98, and Windows Me may allow remote malicious servers to cause a denial of service (application crash) and possibly execute arbitrary code via long share names, as demonstrated using Samba.CVE-2004-0214ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 3Harvey RubinovitzDRAFTINTERIMACCEPTEDInternet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the Popup.show method and use drag-and-drop actions in a popup window, aka "HijackClick 3" and the "Script in Image Tag File Download Vulnerability."CVE-2004-0841ACCEPTED1Microsoft Windows XPLocal Security Authority Subsystem Service (LSASS)Christine WalzerDRAFTINTERIMACCEPTEDLSASS (Local Security Authority Subsystem Service) of Windows 2000 Server and Windows Server 2003 does not properly validate connection information, which allows local users to gain privileges via a specially-designed program.CVE-2004-0894ACCEPTED1Microsoft Windows NTWindows Internet Naming Service (WINS)Matthew BurtonDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDThe WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 allows remote attackers to write to arbitrary memory locations and possibly execute arbitrary code via a modified memory pointer in a WINS replication packet to TCP port 42, aka the "Association Context Vulnerability."CVE-2004-1080ACCEPTED2Sun Solaris 7CDEBrian SobyDRAFTINTERIMACCEPTEDBuffer overflow in TT_SESSION environment variable in ToolTalk shared library allows local users to gain root privileges.CVE-1999-0693ACCEPTED1Sun Solaris 7lpstatBrian SobyDRAFTINTERIMACCEPTEDStack-based buffer overflow in the bsd_queue() function for lpq on Solaris 2.6 and 7 allows local users to gain root privilege.CVE-2003-0091ACCEPTED1Microsoft Windows XPMessage QueuingIngrid SkoogDRAFTINTERIMACCEPTEDBuffer overflow in the Message Queuing component of Microsoft Windows 2000 and Windows XP SP1 allows remote attackers to execute arbitrary code via a crafted message.CVE-2005-0059ACCEPTED1Microsoft Windows Server 2003Network News Transport Protocol (NNTP)Christine WalzerDRAFTINTERIMACCEPTEDThe Network News Transfer Protocol (NNTP) component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an "unchecked buffer," leading to off-by-one and heap-based buffer overflows.CVE-2004-0574ACCEPTED1Microsoft Windows XPWindows kernelIngrid SkoogDRAFTINTERIMChristine WalzerACCEPTEDBuffer overflow in Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to cause a denial of service (i.e., system crash) via a malformed request, aka "Object Management Vulnerability".CVE-2005-0550ACCEPTED1Sun Solaris 8mozillaBrian SobyDRAFTINTERIMACCEPTEDMozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to install arbitrary extensions by using interactive events to manipulate the XPInstall Security dialog box.CVE-2004-0762ACCEPTED1Sun Solaris 8Sun Solaris 9ApacheBrian SobyBrian SobyBrian SobyDRAFTINTERIMACCEPTEDmod_digest for Apache before 1.3.31 does not properly verify the nonce of a client response by using a AuthNonce secret.CVE-2003-0987ACCEPTED1Sun Solaris 7Solaris Enterprise Authentication Mechanism (SEAM)Brian SobyDRAFTINTERIMACCEPTEDThe Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes the KDC to corrupt its heap (aka "buffer underrun").CVE-2003-0082ACCEPTED1Vulnerability exists in standard Solaris kerberos and SEAM. This definition only covers SEAMMicrosoft Windows Server 2003Windows kernelChristine WalzerDRAFTINTERIMACCEPTEDThe Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability."CVE-2004-0893ACCEPTED1Microsoft Windows 98Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPAdobe Acrobat ReaderMatthew WojcikDRAFTINTERIMACCEPTEDMultiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.CVE-2004-0597ACCEPTED1Microsoft Windows Server 2003Program Group ConverterAndrew ButtnerDRAFTINTERIMACCEPTEDBuffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe.CVE-2004-0572ACCEPTED1Microsoft Windows XPunknownChristine WalzerDRAFTINTERIMACCEPTEDThe OLE component in Windows 98, 2000, XP, and Server 2003, and Exchange Server 5.0 through 2003, does not properly validate the lengths of messages for certain OLE data, which allows remote attackers to execute arbitrary code, aka the "Input Validation Vulnerability."CVE-2005-0044ACCEPTED1Microsoft Windows NTHyperTerminalHarvey RubinovitzDRAFTINTERIMHarvey RubinovitzACCEPTEDHyperTerminal application for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value that is saved in a session file, which allows remote attackers to execute arbitrary code via a malicious HyperTerminal session file (.ht), web site, or Telnet URL contained in an e-mail message, triggering a buffer overflow.CVE-2004-0568ACCEPTED1Microsoft Windows Server 2003Microsoft Word 2003Matthew BurtonDRAFTINTERIMACCEPTEDMicrosoft Windows XP SP2 and earlier, 2000 SP3 and SP4, Server 2003, and older operating systems allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IP packets with malformed options, aka the "IP Validation Vulnerability."CVE-2005-0048ACCEPTED1Sun Solaris 7Sun Solaris 8Sun Solaris 9kernelBrian SobyDRAFTINTERIMACCEPTEDINTERIMDRAFTINTERIMACCEPTEDUnknown vulnerability in Solaris 2.6 through 9 causes a denial of service (system panic) via "a rare race condition" or an attack by local users.CVE-2003-0669ACCEPTED2Sun Solaris 8Sun Solaris 9Sun ClusterBrian SobyDRAFTINTERIMACCEPTEDOpenSSL 0.9.6 and 0.9.7 does not properly track the number of characters in certain ASN.1 inputs, which allows remote attackers to cause a denial of service (crash) via an SSL client certificate that causes OpenSSL to read past the end of a buffer when the long form is used.CVE-2003-0544ACCEPTED1Microsoft Windows NTMicrosoft Word for Windows 6.0 ConverterChristine WalzerDRAFTINTERIMACCEPTEDRobert L. HollisMicrosoft Word for Windows 6.0 Converter (MSWRD632.WPC), as used in WordPad, does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CVE-2004-0571.CVE-2004-0901INTERIM1Microsoft Windows Server 2003NetDDEJonathan BakerDRAFTINTERIMACCEPTEDNetwork Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an "unchecked buffer," possibly a buffer overflow.CVE-2004-0206ACCEPTED1Microsoft Windows 2000Windows kernelIngrid SkoogDRAFTINTERIMChristine WalzerAndrew ButtnerACCEPTEDThe kernel of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via certain access requests.CVE-2005-0061ACCEPTED1Sun Solaris 8mozillaBrian SobyDRAFTINTERIMACCEPTEDInteger overflow in the SOAPParameter object constructor in (1) Netscape version 7.0 and 7.1 and (2) Mozilla 1.6, and possibly earlier versions, allows remote attackers to execute arbitrary code.CVE-2004-0722ACCEPTED1Sun Solaris 9Kerberos5Brian SobyDRAFTINTERIMACCEPTEDDouble-free vulnerabilities in error handling code in krb524d for MIT Kerberos 5 (krb5) 1.2.8 and earlier may allow remote attackers to execute arbitrary code.CVE-2004-0772ACCEPTED1Sun Solaris 8Sun Solaris 9ApacheBrian SobyBrian SobyBrian SobyDRAFTINTERIMACCEPTEDmod_access in Apache 1.3 before 1.3.30, when running big-endian 64-bit platforms, does not properly parse Allow/Deny rules using IP addresses without a netmask, which could allow remote attackers to bypass intended access restrictions.CVE-2003-0993ACCEPTED1Microsoft Windows 2000Cursor and Icon FormattingChristine WalzerDRAFTINTERIMACCEPTEDAndrew ButtnerINTERIMACCEPTEDInteger overflow in the LoadImage API of the USER32 Lib for Microsoft Windows allows remote attackers to execute arbitrary code via a .bmp, .cur, .ico or .ani file with a large image size field, which leads to a buffer overflow, aka the "Cursor and Icon Format Handling Vulnerability."CVE-2004-1049ACCEPTED2Microsoft Windows Server 2003Internet Explorer 6.0Harvey RubinovitzDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDBuffer overflow in the Content Advisor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a crafted Content Advisor file, aka "Content Advisor Memory Corruption Vulnerability."CVE-2005-0555ACCEPTED2Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Harvey RubinovitzDRAFTINTERIMACCEPTEDMicrosoft Internet Explorer 6.0.2800.1106 on Microsoft Windows XP SP2, and other versions including 5.01 and 5.5, allows remote web servers to bypass zone restrictions and execute arbitrary code in the local computer zone by redirecting a function to another function with the same name, as demonstrated by SimilarMethodNameRedir, aka the "Similar Method Name Redirection Cross Domain Vulnerability."CVE-2004-0727ACCEPTED1Microsoft Windows Server 2003Help and Support Center (HSC)Christine WalzerDRAFTINTERIMACCEPTEDStack-based buffer overflow in the PCHealth system in the Help and Support Center function in Windows XP and Windows Server 2003 allows remote attackers to execute arbitrary code via a long query in an HCP URL.CVE-2003-0711ACCEPTED1Microsoft Windows 2000Windows ShellHarvey RubinovitzDRAFTINTERIMAndrew ButtnerACCEPTEDThe document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document.CVE-2005-0063ACCEPTED1Microsoft Windows Server 2003Windows MessengerMatthew BurtonDRAFTINTERIMACCEPTEDInternet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability."CVE-2005-0053ACCEPTED1Sun Solaris 7Sun RPCBrian SobyDRAFTINTERIMACCEPTEDInteger overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd.CVE-2002-0391ACCEPTED1Specific applications using this library are not tested for because Suns advisory only provides a sample of known vulnerable applications and states that they are still investigating.Microsoft Windows 2000HyperTerminalHarvey RubinovitzDRAFTINTERIMHarvey RubinovitzACCEPTEDHyperTerminal application for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value that is saved in a session file, which allows remote attackers to execute arbitrary code via a malicious HyperTerminal session file (.ht), web site, or Telnet URL contained in an e-mail message, triggering a buffer overflow.CVE-2004-0568ACCEPTED1Microsoft Windows XPMicrosoft Word for Windows 6.0 ConverterChristine WalzerDRAFTINTERIMACCEPTEDMicrosoft Word for Windows 6.0 Converter (MSWRD632.WPC), as used in WordPad, does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CVE-2004-0571.CVE-2004-0901ACCEPTED1Sun Solaris 8mozillaBrian SobyDRAFTINTERIMACCEPTEDThe (1) Mozilla 1.6, (2) Firebird 0.7, (3) Firefox 0.8, and (4) Netscape 7.1 web browsers do not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability.CVE-2004-0718ACCEPTED1Microsoft Windows Server 2003Internet Explorer 6.0Jonathan BakerDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDThe DHTML Edit Control (dhtmled.ocx) allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as demonstrated by "AbusiveParent" in Internet Explorer 6.0.2900.2180.CVE-2004-1319ACCEPTED2Microsoft Windows NTVDMIngrid SkoogDRAFTINTERIMACCEPTEDThe Virtual DOS Machine (VDM) subsystem of Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows local users to access kernel memory and gain privileges via a malicious program that modified some system structures in a way that is not properly validated by privileged operating system functions.CVE-2004-0208ACCEPTED1Microsoft Windows Server 2003IIS 6.0Jonathan BakerDRAFTINTERIMACCEPTEDThe WebDAV Message Handler for Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows remote attackers to cause a denial of service (memory and CPU exhaustion, application crash) via a PROPFIND request with an XML message containing XML elements with a large number of attributes.CVE-2003-0718ACCEPTED1Microsoft Windows NTMDAC 2.8Ingrid SkoogDRAFTINTERIMACCEPTEDThe License Logging service for Windows NT Server, Windows 2000 Server, and Windows Server 2003 does not properly validate the length of messages, which leads to an "unchecked buffer" and allows remote attackers to cause a denial of service (crash) and possibly execute arbtirary code, aka the "License Logging Service Vulnerability."CVE-2005-0050ACCEPTED1Microsoft Windows 2000Windows 2000Matthew BurtonDRAFTINTERIMACCEPTEDTCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP.CVE-2004-0230ACCEPTED1Microsoft Windows XPWindows kernelIngrid SkoogDRAFTINTERIMChristine WalzerACCEPTEDBuffer overflow in the font processing component of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application.CVE-2005-0060ACCEPTED1Microsoft Windows Server 2003Microsoft Word 2003Matthew BurtonDRAFTINTERIMACCEPTEDMultiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the "blind connection-reset attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.CVE-2004-0790ACCEPTED1Microsoft Windows NTWindows NT 4.0Matthew BurtonDRAFTINTERIMACCEPTEDThe WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 allows remote attackers to write to arbitrary memory locations and possibly execute arbitrary code via a modified memory pointer in a WINS replication packet to TCP port 42, aka the "Association Context Vulnerability."CVE-2004-1080ACCEPTED1Microsoft Windows 2000Windows kernelIngrid SkoogDRAFTINTERIMChristine WalzerAndrew ButtnerACCEPTEDBuffer overflow in Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to cause a denial of service (i.e., system crash) via a malformed request, aka "Object Management Vulnerability".CVE-2005-0550ACCEPTED1Sun Solaris 8Sun Solaris 9LDAPBrian SobyDRAFTINTERIMACCEPTEDINTERIMDRAFTINTERIMACCEPTEDUnknown vulnerability in LDAP on Sun Solaris 8 and 9, when using Role Based Access Control (RBAC), allows local users to execute certain commands with additional privileges.CVE-2004-1353ACCEPTED2Microsoft Windows NTDHCPIngrid SkoogDRAFTINTERIMACCEPTEDThe DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition does not properly validate the length of certain messages, which allows remote attackers to execute arbitrary code via a malformed DHCP message, aka the "DHCP Request Vulnerability."CVE-2004-0900ACCEPTED1Microsoft Windows NTProxy Server 2.0 SP1Christine WalzerDRAFTINTERIMChristine WalzerIngrid SkoogACCEPTEDMicrosoft Proxy Server 2.0 and Microsoft ISA Server 2000 (which is included in Small Business Server 2000 and Small Business Server 2003 Premium Edition) allows remote attackers to spoof trusted Internet content on a specially crafted webpage via spoofed reverse DNS lookup results.CVE-2004-0892ACCEPTED1Sun Solaris 8Sun Solaris 9ApacheBrian SobyBrian SobyBrian SobyDRAFTINTERIMACCEPTEDHeap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied.CVE-2004-0492ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Harvey RubinovitzDRAFTINTERIMACCEPTEDInternet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability."CVE-2005-0053ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 3Harvey RubinovitzDRAFTINTERIMACCEPTEDRace condition in the memory management routines in the DHTML object processor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail, aka "DHTML Object Memory Corruption Vulnerability".CVE-2005-0553ACCEPTED1Microsoft Windows XPMicrosoft Windows Server 2003Windows kernelIngrid SkoogIngrid SkoogDRAFTINTERIMACCEPTEDThe kernel for Microsoft Windows Server 2003 does not reset certain values in CPU data structures, which allows local users to cause a denial of service (system crash) via a malicious program.CVE-2004-0211ACCEPTED1Microsoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003MSN MessengerChristine WalzerDRAFTINTERIMACCEPTEDRobert L. HollisINTERIMRobert L. HollisGIF file validation error in MSN Messenger 6.2 allows remote attackers in a user's contact list to execute arbitrary code via a GIF image with an improper height and width.CVE-2005-0562INTERIM2Sun Solaris 9Kerberos5Brian SobyDRAFTBrian SobyINTERIMACCEPTEDDouble-free vulnerabilities in the error handling code for ASN.1 decoders in the (1) Key Distribution Center (KDC) library and (2) client library for MIT Kerberos 5 (krb5) 1.3.4 and earlier may allow remote attackers to execute arbitrary code.CVE-2004-0642ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Harvey RubinovitzDRAFTINTERIMACCEPTEDInternet Explorer 5.01, 5.5, and 6 does not properly validate certain URLs in Channel Definition Format (CDF) files, which allows remote attackers to obtain sensitive information or execute arbitrary code, aka the "Channel Definition Format (CDF) Cross Domain Vulnerability."CVE-2005-0056ACCEPTED1Microsoft Windows Server 2003Microsoft Word 2003Matthew BurtonDRAFTINTERIMACCEPTEDWindows Server 2003 and XP SP2, with Windows Firewall turned off, allows remote attackers to cause a denial of service (CPU consumption) via a TCP packet with the SYN flag set and the same destination and source address and port, aka a reoccurrence of the "Land" vulnerability (CVE-1999-0016).CVE-2005-0688ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Harvey RubinovitzDRAFTINTERIMACCEPTEDRace condition in the memory management routines in the DHTML object processor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail, aka "DHTML Object Memory Corruption Vulnerability".CVE-2005-0553ACCEPTED1Microsoft Windows XPMicrosoft Windows Server 2003MDAC 2.7Matthew BurtonDRAFTINTERIMACCEPTEDThe Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a (1) "\" (backslash) or (2) "%5C" (encoded backslash), aka "Path Validation Vulnerability."CVE-2004-0847ACCEPTED1Microsoft Windows 2000Message QueuingIngrid SkoogDRAFTINTERIMChristine WalzerAndrew ButtnerACCEPTEDBuffer overflow in the Message Queuing component of Microsoft Windows 2000 and Windows XP SP1 allows remote attackers to execute arbitrary code via a crafted message.CVE-2005-0059ACCEPTED1Microsoft Windows Server 2003Network News Transport Protocol (NNTP)Christine WalzerDRAFTINTERIMACCEPTEDBuffer overflow in the converter for Microsoft WordPerfect 5.x on Office 2000, Office XP, Office 2003, and Works Suites 2001 through 2004 allows remote attackers to execute arbitrary code via a malicious document or website.CVE-2004-0573ACCEPTED1Microsoft Windows NTNetwork News Transport Protocol (NNTP)Christine WalzerDRAFTINTERIMACCEPTEDThe Network News Transfer Protocol (NNTP) component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an "unchecked buffer," leading to off-by-one and heap-based buffer overflows.CVE-2004-0574ACCEPTED1Microsoft Windows XPNetDDEJonathan BakerDRAFTINTERIMACCEPTEDNetwork Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an "unchecked buffer," possibly a buffer overflow.CVE-2004-0206ACCEPTED1Sun Solaris 7Sun Solaris 8Sun Solaris 9CDEBrian SobyDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDBuffer overflow in CDE libDtHelp library allows local users to execute arbitrary code via (1) a modified DTHELPUSERSEARCHPATH environment variable and the Help feature, (2) DTSEARCHPATH, or (3) LOGNAME.CVE-2003-0834ACCEPTED2Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Harvey RubinovitzDRAFTINTERIMACCEPTEDInternet Explorer 5.01, 5.5, and 6 does not properly cache SSL content, which allows remote attackers to obtain information or spoof content via a web site with the same host name as the target web site, whose content is cached and reused when the user visits the target web site.CVE-2004-0845ACCEPTED1Microsoft Windows NTRemote Procedure Call (RPC)Matthew BurtonDRAFTINTERIMACCEPTEDMatthew BurtonINTERIMACCEPTEDThe RPC Runtime Library for Microsoft Windows NT 4.0 allows remote attackers to read active memory or cause a denial of service (system crash) via a malicious message, possibly related to improper length values.CVE-2004-0569ACCEPTED2Microsoft Windows XPWindows ShellAndrew ButtnerDRAFTINTERIMACCEPTEDBuffer overflow in Microsoft Internet Explorer and Explorer on Windows XP SP1, WIndows 2000, Windows 98, and Windows Me may allow remote malicious servers to cause a denial of service (application crash) and possibly execute arbitrary code via long share names, as demonstrated using Samba.CVE-2004-0214ACCEPTED1Microsoft Windows Server 2003Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003Harvey RubinovitzDRAFTINTERIMACCEPTEDHarvey RubinovitzINTERIMACCEPTEDInteger overflow in the Install Engine (inseng.dll) for Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious website or HTML email with a long .CAB file name, which triggers the integer overflow when calculating a buffer length and leads to a heap-based buffer overflow.CVE-2004-0216ACCEPTED2Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPInternet Explorer 6 SP1Harvey RubinovitzDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInteger overflow in the Install Engine (inseng.dll) for Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious website or HTML email with a long .CAB file name, which triggers the integer overflow when calculating a buffer length and leads to a heap-based buffer overflow.CVE-2004-0216ACCEPTED2Microsoft Windows Server 2003SMTPChristine WalzerDRAFTINTERIMACCEPTEDThe SMTP (Simple Mail Transfer Protocol) component of Microsoft Windows XP 64-bit Edition, Windows Server 2003, Windows Server 2003 64-bit Edition, and the Exchange Routing Engine component of Exchange Server 2003, allows remote attackers to execute arbitrary code via a malicious DNS response message containing length values that are not properly validated.CVE-2004-0840ACCEPTED1Microsoft Windows MEInternet Explorer 5.5 Service Pack 2Harvey RubinovitzDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.01, 5.5, and 6 does not properly cache SSL content, which allows remote attackers to obtain information or spoof content via a web site with the same host name as the target web site, whose content is cached and reused when the user visits the target web site.CVE-2004-0845ACCEPTED2Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Internet Explorer 5.5 Service Pack 2Harvey RubinovitzDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory corruption") via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the "<STYLE>@;/*" string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the "CSS Heap Memory Corruption Vulnerability."CVE-2004-0842ACCEPTED2Microsoft Windows Server 2003Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003Harvey RubinovitzDRAFTINTERIMACCEPTEDHarvey RubinovitzINTERIMACCEPTEDInternet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the Popup.show method and use drag-and-drop actions in a popup window, aka "HijackClick 3" and the "Script in Image Tag File Download Vulnerability."CVE-2004-0841ACCEPTED2Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPInternet Explorer 6 SP1Harvey RubinovitzDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.01, 5.5, and 6 does not properly cache SSL content, which allows remote attackers to obtain information or spoof content via a web site with the same host name as the target web site, whose content is cached and reused when the user visits the target web site.CVE-2004-0845ACCEPTED2Microsoft Windows 2000Network News Transport Protocol (NNTP)Christine WalzerDRAFTINTERIMACCEPTEDThe Network News Transfer Protocol (NNTP) component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an "unchecked buffer," leading to off-by-one and heap-based buffer overflows.CVE-2004-0574ACCEPTED1Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Internet Explorer 5.5 Service Pack 2Harvey RubinovitzDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the Popup.show method and use drag-and-drop actions in a popup window, aka "HijackClick 3" and the "Script in Image Tag File Download Vulnerability."CVE-2004-0841ACCEPTED2Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Harvey RubinovitzDRAFTINTERIMACCEPTEDInternet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the Popup.show method and use drag-and-drop actions in a popup window, aka "HijackClick 3" and the "Script in Image Tag File Download Vulnerability."CVE-2004-0841ACCEPTED1Microsoft Windows MEInternet Explorer 5.5 Service Pack 2Harvey RubinovitzDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInteger overflow in the Install Engine (inseng.dll) for Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious website or HTML email with a long .CAB file name, which triggers the integer overflow when calculating a buffer length and leads to a heap-based buffer overflow.CVE-2004-0216ACCEPTED2Microsoft Windows Server 2003Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003Harvey RubinovitzDRAFTINTERIMACCEPTEDHarvey RubinovitzINTERIMACCEPTEDInternet Explorer in Windows XP SP2, and other versions including 5.01 and 5.5, allows remote attackers to install arbitrary programs via a web page that uses certain styles and the AnchorClick behavior, popup windows, and drag-and-drop capabilities to drop the program in the local startup folder, as demonstrated by "wottapoop.html".CVE-2004-0839ACCEPTED2Microsoft Windows Server 2003Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003Harvey RubinovitzDRAFTINTERIMACCEPTEDHarvey RubinovitzINTERIMACCEPTEDInternet Explorer 5.5 and 6 does not properly handle plug-in navigation, which allows remote attackers to alter displayed address bars and thereby spoof web pages, facilitating phishing attacks, aka the "Plug-in Navigation Address Bar Spoofing Vulnerability."CVE-2004-0843ACCEPTED2Microsoft Windows XPCompressed FoldersDavid ProulxDRAFTINTERIMACCEPTEDJonathan BakerINTERIMACCEPTEDMatthew WojcikINTERIMACCEPTEDInteger overflow in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition allows remote attackers to execute arbitrary code via compressed (zipped) folders that involve an "unchecked buffer" and improper length validation.CVE-2004-0575ACCEPTED3Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPInternet Explorer 6 SP1Harvey RubinovitzDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory corruption") via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the "<STYLE>@;/*" string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the "CSS Heap Memory Corruption Vulnerability."CVE-2004-0842ACCEPTED2Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 4Harvey RubinovitzDRAFTINTERIMACCEPTEDInteger overflow in the Install Engine (inseng.dll) for Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious website or HTML email with a long .CAB file name, which triggers the integer overflow when calculating a buffer length and leads to a heap-based buffer overflow.CVE-2004-0216ACCEPTED1Microsoft Windows Server 2003NetDDEJonathan BakerDRAFTINTERIMACCEPTEDNetwork Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an "unchecked buffer," possibly a buffer overflow.CVE-2004-0206ACCEPTED1Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows XPInternet Explorer 6 SP1Harvey RubinovitzDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDMicrosoft Internet Explorer 6.0.2800.1106 on Microsoft Windows XP SP2, and other versions including 5.01 and 5.5, allows remote web servers to bypass zone restrictions and execute arbitrary code in the local computer zone by redirecting a function to another function with the same name, as demonstrated by SimilarMethodNameRedir, aka the "Similar Method Name Redirection Cross Domain Vulnerability."CVE-2004-0727ACCEPTED2Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 3Harvey RubinovitzDRAFTINTERIMACCEPTEDMicrosoft Internet Explorer 6.0.2800.1106 on Microsoft Windows XP SP2, and other versions including 5.01 and 5.5, allows remote web servers to bypass zone restrictions and execute arbitrary code in the local computer zone by redirecting a function to another function with the same name, as demonstrated by SimilarMethodNameRedir, aka the "Similar Method Name Redirection Cross Domain Vulnerability."CVE-2004-0727ACCEPTED1Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Internet Explorer 5.5 Service Pack 2Harvey RubinovitzDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.5 and 6 does not properly handle plug-in navigation, which allows remote attackers to alter displayed address bars and thereby spoof web pages, facilitating phishing attacks, aka the "Plug-in Navigation Address Bar Spoofing Vulnerability."CVE-2004-0843ACCEPTED2Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPInternet Explorer 6 SP1Harvey RubinovitzDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 5.5 and 6 does not properly handle plug-in navigation, which allows remote attackers to alter displayed address bars and thereby spoof web pages, facilitating phishing attacks, aka the "Plug-in Navigation Address Bar Spoofing Vulnerability."CVE-2004-0843ACCEPTED2Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPInternet Explorer 5.5 Service Pack 2Harvey RubinovitzDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDHarvey RubinovitzMatthew WojcikINTERIMMicrosoft Internet Explorer 6.0.2800.1106 on Microsoft Windows XP SP2, and other versions including 5.01 and 5.5, allows remote web servers to bypass zone restrictions and execute arbitrary code in the local computer zone by redirecting a function to another function with the same name, as demonstrated by SimilarMethodNameRedir, aka the "Similar Method Name Redirection Cross Domain Vulnerability."CVE-2004-0727INTERIM2Microsoft Windows Server 2003Microsoft Internet Explorer 6 Service Pack 1 for Windows Server 2003Harvey RubinovitzDRAFTINTERIMACCEPTEDMicrosoft Internet Explorer 6.0.2800.1106 on Microsoft Windows XP SP2, and other versions including 5.01 and 5.5, allows remote web servers to bypass zone restrictions and execute arbitrary code in the local computer zone by redirecting a function to another function with the same name, as demonstrated by SimilarMethodNameRedir, aka the "Similar Method Name Redirection Cross Domain Vulnerability."CVE-2004-0727ACCEPTED1Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 3Harvey RubinovitzDRAFTINTERIMACCEPTEDInternet Explorer 5.01, 5.5, and 6 does not properly cache SSL content, which allows remote attackers to obtain information or spoof content via a web site with the same host name as the target web site, whose content is cached and reused when the user visits the target web site.CVE-2004-0845ACCEPTED1Microsoft Windows XPInternet Explorer 6Harvey RubinovitzDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInteger overflow in the Install Engine (inseng.dll) for Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious website or HTML email with a long .CAB file name, which triggers the integer overflow when calculating a buffer length and leads to a heap-based buffer overflow.CVE-2004-0216ACCEPTED2Microsoft Windows XPInternet Explorer 6Harvey RubinovitzDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer in Windows XP SP2, and other versions including 5.01 and 5.5, allows remote attackers to install arbitrary programs via a web page that uses certain styles and the AnchorClick behavior, popup windows, and drag-and-drop capabilities to drop the program in the local startup folder, as demonstrated by "wottapoop.html".CVE-2004-0839ACCEPTED2Microsoft Windows 2000Microsoft Internet Explorer 5.01 Service Pack 3Harvey RubinovitzDRAFTINTERIMACCEPTEDInteger overflow in the Install Engine (inseng.dll) for Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious website or HTML email with a long .CAB file name, which triggers the integer overflow when calculating a buffer length and leads to a heap-based buffer overflow.CVE-2004-0216ACCEPTED1Microsoft Windows XPInternet Explorer 6Harvey RubinovitzDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDMicrosoft Internet Explorer 6.0.2800.1106 on Microsoft Windows XP SP2, and other versions including 5.01 and 5.5, allows remote web servers to bypass zone restrictions and execute arbitrary code in the local computer zone by redirecting a function to another function with the same name, as demonstrated by SimilarMethodNameRedir, aka the "Similar Method Name Redirection Cross Domain Vulnerability."CVE-2004-0727ACCEPTED2Microsoft Windows MEInternet Explorer 6 SP1Harvey RubinovitzDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the Popup.show method and use drag-and-drop actions in a popup window, aka "HijackClick 3" and the "Script in Image Tag File Download Vulnerability."CVE-2004-0841ACCEPTED2Microsoft Windows MEMicrosoft Windows NTMicrosoft Windows 2000Microsoft Windows XPInternet Explorer 6 SP1Harvey RubinovitzDRAFTINTERIMACCEPTEDChristine WalzerINTERIMACCEPTEDInternet Explorer 6 on Double Byte Character Set (DBCS) systems allows remote attackers to alter displayed address bars and spoof web pages via a URL containing special characters, facilitating phishing attacks, aka the "Address Bar Spoofing on Double Byte Character Set Systems Vulnerability."CVE-2004-0844ACCEPTED2Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003mozillaRobert L. HollisJonathan BakerINTERIMMatthew WojcikACCEPTEDThe install function in Firefox 1.0.3 allows remote web sites on the browser's whitelist, such as update.mozilla.org or addon.mozilla.org, to execute arbitrary Javascript with chrome privileges, leading to arbitrary code execution on the system when combined with vulnerabilities such as CVE-2005-1476, as demonstrated using a javascript: URL as the package icon and a cross-site scripting (XSS) attack on a vulnerable whitelist site.CVE-2005-1477ACCEPTED3Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003mozillaRobert L. HollisJonathan BakerINTERIMMatthew WojcikACCEPTEDFirefox 1.0.3 allows remote attackers to execute arbitrary Javascript in other domains by using an IFRAME and causing the browser to navigate to a previous javascript: URL, which can lead to arbitrary code execution when combined with CVE-2005-1477.CVE-2005-1476ACCEPTED2Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisJonathan BakerINTERIMACCEPTEDINTERIMACCEPTEDFirefox before 1.0.5 and Mozilla before 1.7.9 does not properly clone base objects, which allows remote attackers to execute arbitrary code by navigating the prototype chain to reach a privileged object.CVE-2005-2270ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisJonathan BakerINTERIMACCEPTEDINTERIMACCEPTEDFirefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 does not properly verify the associated types of DOM node names within the context of their namespaces, which allows remote attackers to modify certain tag properties, possibly leading to execution of arbitrary script or code, as demonstrated using an XHTML document with IMG tags with custom properties ("XHTML node spoofing").CVE-2005-2269ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisChristine WalzerJonathan BakerMatthew WojcikINTERIMACCEPTEDINTERIMACCEPTEDFirefox before 1.0.5 and Mozilla before 1.7.9 does not clearly associate a Javascript dialog box with the web page that generated it, which allows remote attackers to spoof a dialog box from a trusted site and facilitates phishing attacks, aka the "Dialog Origin Spoofing Vulnerability."CVE-2005-2268ACCEPTED5Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisChristine WalzerJonathan BakerINTERIMMatthew WojcikACCEPTEDINTERIMACCEPTEDFirefox before 1.0.5 allows remote attackers to steal information and possibly execute arbitrary code by using standalone applications such as Flash and QuickTime to open a javascript: URL, which is run in the context of the previous page, and may lead to code execution if the standalone application loads a privileged chrome: URL.CVE-2005-2267ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisJonathan BakerChristine WalzerINTERIMACCEPTEDINTERIMACCEPTEDA regression error in Firefox 1.0.3 and Mozilla 1.7.7 allows remote attackers to inject arbitrary Javascript from one page into the frameset of another site, aka the frame injection spoofing vulnerability, a re-introduction of a vulnerability that was originally identified and addressed by CVE-2004-0718.CVE-2005-1937ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisJonathan BakerINTERIMACCEPTEDINTERIMACCEPTEDFirefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 allows remote attackers to cause a denial of service (access violation and crash), and possibly execute arbitrary code, by calling InstallVersion.compareTo with an object instead of a string.CVE-2005-2265ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDFirefox before 1.0.5 allows remote attackers to steal sensitive information by opening a malicious link in the Firefox sidebar using the _search target, then injecting script into other pages via a data: URL.CVE-2005-2264ACCEPTED5Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisChristine WalzerINTERIMACCEPTEDINTERIMACCEPTEDThe InstallTrigger.install method in Firefox before 1.0.5 and Mozilla before 1.7.9 allows remote attackers to execute a callback function in the context of another domain by forcing a page navigation after the install method has been called, which causes the callback to be run in the context of the new page and results in a same origin violation.CVE-2005-2263ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMMatthew WojcikMatthew WojcikACCEPTEDINTERIMACCEPTEDFirefox 1.0.3 and 1.0.4, and Netscape 8.0.2, allows remote attackers to execute arbitrary code by tricking the user into using the "Set As Wallpaper" (in Firefox) or "Set as Background" (in Netscape) context menu on an image URL that is really a javascript: URL with an eval statement, aka "Firewalling."CVE-2005-2262ACCEPTED5Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisJonathan BakerINTERIMACCEPTEDINTERIMACCEPTEDFirefox before 1.0.5, Thunderbird before 1.0.5, Mozilla before 1.7.9, Netscape 8.0.2, and K-Meleon 0.9 runs XBL scripts even when Javascript has been disabled, which makes it easier for remote attackers to bypass such protection.CVE-2005-2261ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisJonathan BakerINTERIMACCEPTEDINTERIMACCEPTEDThe browser user interface in Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 does not properly distinguish between user-generated events and untrusted synthetic events, which makes it easier for remote attackers to perform dangerous actions that normally could only be performed manually by the user.CVE-2005-2260ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisJonathan BakerINTERIMMatthew WojcikACCEPTEDINTERIMACCEPTEDFirefox before 1.0.4 and Mozilla Suite before 1.7.8 does not properly limit privileges of Javascript eval and Script objects in the calling context, which allows remote attackers to conduct unauthorized activities via "non-DOM property overrides," a variant of CVE-2005-1160.CVE-2005-1532ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisJonathan BakerINTERIMMatthew WojcikACCEPTEDINTERIMACCEPTEDFirefox before 1.0.4 and Mozilla Suite before 1.7.8 does not properly implement certain security checks for script injection, which allows remote attackers to execute script via "Wrapped" javascript: URLs, as demonstrated using (1) a javascript: URL in a view-source: URL, (2) a javascript: URL in a jar: URL, or (3) "a nested variant."CVE-2005-1531ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisChristine WalzerJonathan BakerINTERIMACCEPTEDINTERIMACCEPTEDThe InstallTrigger.install method in Firefox before 1.0.5 and Mozilla before 1.7.9 allows remote attackers to execute a callback function in the context of another domain by forcing a page navigation after the install method has been called, which causes the callback to be run in the context of the new page and results in a same origin violation.CVE-2005-2263ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMMatthew WojcikMatthew WojcikACCEPTEDINTERIMACCEPTEDThe privileged "chrome" UI code in Firefox before 1.0.3 and Mozilla Suite before 1.7.7 allows remote attackers to gain privileges by overriding certain properties or methods of DOM nodes, as demonstrated using multiple attacks involving the eval function or the Script object.CVE-2005-1160ACCEPTED5Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMMatthew WojcikACCEPTEDINTERIMACCEPTEDThe native implementations of InstallTrigger and other functions in Firefox before 1.0.3 and Mozilla Suite before 1.7.7 do not properly verify the types of objects being accessed, which causes the Javascript interpreter to continue execution at the wrong memory address, which may allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code by passing objects of the wrong type.CVE-2005-1159ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMMatthew WojcikACCEPTEDINTERIMACCEPTEDMultiple "missing security checks" in Firefox before 1.0.3 allow remote attackers to inject arbitrary Javascript into privileged pages using the _search target of the Firefox sidebar.CVE-2005-1158ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMMatthew WojcikACCEPTEDINTERIMACCEPTEDFirefox before 1.0.3, Mozilla Suite before 1.7.7, and Netscape 7.2 allows remote attackers to execute arbitrary script and code via a new search plugin using sidebar.addSearchEngine, aka "Firesearching 1."CVE-2005-1156ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMMatthew WojcikACCEPTEDINTERIMACCEPTEDThe favicon functionality in Firefox before 1.0.3 and Mozilla Suite before 1.7.7 allows remote attackers to execute arbitrary code via a <LINK rel="icon"> tag with a javascript: URL in the href attribute, aka "Firelinking."CVE-2005-1155ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMMatthew WojcikACCEPTEDINTERIMACCEPTEDFirefox before 1.0.3 and Mozilla Suite before 1.7.7 allows remote attackers to execute arbitrary script in other domains via a setter function for a variable in the target domain, which is executed when the user visits that domain, aka "Cross-site scripting through global scope pollution."CVE-2005-1154ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMMatthew WojcikMatthew WojcikACCEPTEDINTERIMACCEPTEDFirefox before 1.0.3 and Mozilla Suite before 1.7.7, when blocking a popup, allows remote attackers to execute arbitrary code via a javascript: URL that is executed when the user selects the "Show javascript" option.CVE-2005-1153ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMMatthew WojcikACCEPTEDINTERIMACCEPTEDThe Plugin Finder Service (PFS) in Firefox before 1.0.3 allows remote attackers to execute arbitrary code via a javascript: URL in the PLUGINSPAGE attribute of an EMBED tag.CVE-2005-0752ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMMatthew WojcikACCEPTEDINTERIMACCEPTEDThe find_replen function in jsstr.c in the the Javascript engine for Mozilla Suite 1.7.6, Firefox 1.0.1 and 1.0.2, and Netscape 7.2 allows remote attackers to read portions of heap memory in a Javascript string via the lambda replace method.CVE-2005-0989ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDFireFox 1.0.1 and Mozilla before 1.7.6 do not sufficiently address all attack vectors for loading chrome files and hijacking drag and drop events, which allows remote attackers to execute arbitrary XUL code by tricking a user into dragging a scrollbar, a variant of CVE-2005-0527, aka "Firescrolling 2."CVE-2005-0401ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDFirefox before 1.0.2 allows remote attackers to execute arbitrary code by tricking a user into saving a page as a Firefox sidebar panel, then using the sidebar panel to inject Javascript into a privileged page.CVE-2005-0402ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDHeap-based buffer overflow in GIF2.cpp in Firefox before 1.0.2, Mozilla before to 1.7.6, and Thunderbird before 1.0.2, and possibly other applications that use the same library, allows remote attackers to execute arbitrary code via a GIF image with a crafted Netscape extension 2 block and buffer size.CVE-2005-0399ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisChristine WalzerINTERIMACCEPTEDINTERIMACCEPTEDThe International Domain Name (IDN) support in Firefox 1.0, Camino .8.5, and Mozilla before 1.7.6 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.CVE-2005-0233ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDFirefox 1.0 allows remote attackers to execute arbitrary code via plugins that load "privileged content" into frames, as demonstrated using certain XUL events when a user drags a scrollbar two times, aka "Firescrolling."CVE-2005-0527ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDFirefox 1.0 does not invoke the Javascript Security Manager when a user drags a javascript: or data: URL to a tab, which allows remote attackers to bypass the security model, aka "firetabbing."CVE-2005-0231ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDFirefox 1.0 does not prevent the user from dragging an executable file to the desktop when it has an image/gif content type but has a dangerous extension such as .bat or .exe, which allows remote attackers to bypass the intended restriction and execute arbitrary commands via malformed GIF files that can still be parsed by the Windows batch file parser, aka "firedragging."CVE-2005-0230ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDFirefox before 1.0.1 and Mozilla before 1.7.6, when displaying the HTTP Authentication dialog, do not change the focus to the tab that generated the prompt, which could facilitate spoofing and phishing attacks.CVE-2005-0584ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDFirefox before 1.0.1 and Mozilla before 1.7.6 truncates long sub-domains or paths for display, which may allow remote malicious web sites to spoof legitimate sites and facilitate phishing attacks.CVE-2005-0585ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDFirefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to spoof the extensions of files to download via the Content-Disposition header, which could be used to trick users into downloading dangerous content.CVE-2005-0586ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDFirefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to overwrite arbitrary files by tricking the user into downloading a .LNK (link) file twice, which overwrites the file that was referenced in the first .LNK file.CVE-2005-0587ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDFirefox before 1.0.1 and Mozilla before 1.7.6 does not restrict xsl:include and xsl:import tags in XSLT stylesheets to the current domain, which allows remote attackers to determine the existence of files on the local system.CVE-2005-0588ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDThe Form Fill feature in Firefox before 1.0.1 allows remote attackers to steal potentially sensitive information via an input control that monitors the values that are generated by the autocomplete capability.CVE-2005-0589ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDString handling functions in Mozilla 1.7.3, Firefox 1.0, and Thunderbird before 1.0.2, such as the nsTSubstring_CharT::Replace function, do not properly check the return values of other functions that resize the string, which allows remote attackers to cause a denial of service and possibly execute arbitrary code by forcing an out-of-memory state that causes a reallocation to fail and return a pointer to a fixed address, which leads to heap corruption.CVE-2005-0255ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDThe installation confirmation dialog in Firefox before 1.0.1, Thunderbird before 1.0.1, and Mozilla before 1.7.6 allows remote attackers to use InstallTrigger to spoof the hostname of the host performing the installation via a long "user:pass" sequence in the URL, which appears before the real hostname.CVE-2005-0590ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDhttp://www.mozilla.org/security/announce/mfsa2005-16.htmlACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDHeap-based buffer overflow in the UTF8ToNewUnicode function for Firefox before 1.0.1 and Mozilla before 1.7.6 might allow remote attackers to cause a denial of service (crash) or execute arbitrary code via invalid sequences in a UTF8 encoded string that result in a zero length value.CVE-2005-0592ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDFirefox before 1.0.1 and Mozilla before 1.7.6 allows remote attackers to spoof the SSL "secure site" lock icon via (1) a web site that does not finish loading, which shows the lock of the previous site, (2) a non-HTTP server that uses SSL, which causes the lock to be displayed when the SSL handshake is completed, or (3) a URL that generates an HTTP 204 error, which updates the icon and location information but does not change the display of the original site.CVE-2005-0593ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDMozilla before 1.7.6, and Firefox before 1.0.1, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability.CVE-2004-1156ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDFirefox before 1.0 allows the user to store a (1) javascript: or (2) data: URLs as a Livefeed bookmark, then executes it in the security context of the currently loaded page when the user later accesses the bookmark, which could allow remote attackers to execute arbitrary code.CVE-2005-0150ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDThunderbird 0.6 through 0.9 and Mozilla 1.7 through 1.7.3 does not obey the network.cookie.disableCookieForMailNews preference, which could allow remote attackers bypass the user's intended privacy and security policy by using cookies in e-mail messages.CVE-2005-0149ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDThunderbird before 0.9, when running on Windows systems, uses the default handler when processing javascript: links, which invokes Internet Explorer and may expose the Thunderbird user to vulnerabilities in the version of Internet Explorer that is installed on the user's system. NOTE: since the invocation between multiple products is a common practice, and the vulnerabilities inherent in multi-product interactions are not easily enumerable, this issue might be REJECTED in the future.CVE-2005-0148ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDFirefox before 1.0 and Mozilla before 1.7.5, when configured to use a proxy, respond to 407 proxy auth requests from arbitrary servers, which allows remote attackers to steal NTLM or SPNEGO credentials.CVE-2005-0147ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDFirefox before 1.0 and Mozilla before 1.7.5 allows inactive (background) tabs to launch dialog boxes, which can allow remote attackers to spoof the dialog boxes from web sites in other windows and facilitate phishing attacks, aka the "Dialog Box Spoofing Vulnerability."CVE-2004-1380ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDFirefox before 1.0 does not properly distinguish between user-generated and synthetic click events, which allows remote attackers to use Javascript to bypass the file download prompt when the user uses the Alt-click feature.CVE-2005-0145ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisChristine WalzerINTERIMACCEPTEDINTERIMACCEPTEDHeap-based buffer overflow in MSG_UnEscapeSearchUrl in nsNNTPProtocol.cpp for Mozilla 1.7.3 and earlier allows remote attackers to cause a denial of service (application crash) via an NNTP URL (news:) with a trailing '\' (backslash) character, which prevents a string from being NULL terminated.CVE-2004-1316ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDFirefox before 1.0 and Mozilla before 1.7.5 allow inactive (background) tabs to focus on input being entered in the active tab, as originally reported using form fields, which allows remote attackers to steal sensitive data that is intended for other sites, which could facilitate phishing attacks.CVE-2004-1381ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDFirefox before 1.0 and Mozilla before 1.7.5 display the secure site lock icon when a view-source: URL references a secure SSL site while an insecure page is being loaded, which could facilitate phishing attacks.CVE-2005-0144ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003Robert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDFirefox before 1.0 and Mozilla before 1.7.5 display the SSL lock icon when an insecure page loads a binary file from a trusted site, which could facilitate phishing attacks.CVE-2005-0143ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003mozillaRobert L. HollisJonathan BakerINTERIMACCEPTEDINTERIMACCEPTEDFirefox 0.9, Thunderbird 0.6 and other versions before 0.9, and Mozilla 1.7 before 1.7.5 save temporary files with world-readable permissions, which allows local users to read certain web content or attachments that belong to other users, e.g. content that is managed by helper applications such as PDF.CVE-2005-0142ACCEPTED4Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003mozillaRobert L. HollisINTERIMACCEPTEDINTERIMACCEPTEDFirefox before 1.0 and Mozilla before 1.7.5 allow remote attackers to load local files via links "with a custom getter and toString method" that are middle-clicked by the user to be opened in a new tab.CVE-2005-0141ACCEPTED4Microsoft Windows XPOperating SystemRobert L. HollisINTERIMACCEPTEDStack-based buffer overflow in the Plug and Play (PnP) service for Microsoft Windows 2000 and Windows XP Service Pack 1 allows remote attackers to execute arbitrary code via a crafted packet, and local users to gain privileges via a malicious application, as exploited by the Zotob (aka Mytob) worm.CVE-2005-1983ACCEPTED2Microsoft Windows XPOperating SystemRobert L. HollisINTERIMACCEPTEDBuffer overflow in the Print Spooler service (Spoolsv.exe) for Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code via a malicious message.CVE-2005-1984ACCEPTED2Microsoft Windows Server 2003Internet ExplorerRobert L. HollisINTERIMACCEPTEDUnknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to obtain information and possibly execute code when browsing from a web site to a web folder view using WebDAV, aka "Web Folder Behaviors Cross-Domain Vulnerability".CVE-2005-1989ACCEPTED3Microsoft Windows Server 2003Internet ExplorerRobert L. HollisINTERIMACCEPTEDUnknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to obtain information and possibly execute code when browsing from a web site to a web folder view using WebDAV, aka "Web Folder Behaviors Cross-Domain Vulnerability".CVE-2005-1989ACCEPTED3Microsoft Windows XPOperating SystemRobert L. HollisINTERIMACCEPTEDBuffer overflow in the Telephony Application Programming Interface (TAPI) for Microsoft Windows 98, Windows 98 SE, Windows ME, Windows 2000, Windows XP, and Windows Server 2003 allows attackers elevate privileges or execute arbitrary code via a crafted message.CVE-2005-0058ACCEPTED2Microsoft Windows XPOperating SystemRobert L. HollisINTERIMACCEPTEDBuffer overflow in the Telephony Application Programming Interface (TAPI) for Microsoft Windows 98, Windows 98 SE, Windows ME, Windows 2000, Windows XP, and Windows Server 2003 allows attackers elevate privileges or execute arbitrary code via a crafted message.CVE-2005-0058ACCEPTED2Microsoft Windows XPOperating SystemRobert L. HollisINTERIMACCEPTEDBuffer overflow in the Telephony Application Programming Interface (TAPI) for Microsoft Windows 98, Windows 98 SE, Windows ME, Windows 2000, Windows XP, and Windows Server 2003 allows attackers elevate privileges or execute arbitrary code via a crafted message.CVE-2005-0058ACCEPTED2Microsoft Windows Server 2003Operating SystemRobert L. HollisINTERIMACCEPTEDBuffer overflow in the Telephony Application Programming Interface (TAPI) for Microsoft Windows 98, Windows 98 SE, Windows ME, Windows 2000, Windows XP, and Windows Server 2003 allows attackers elevate privileges or execute arbitrary code via a crafted message.CVE-2005-0058ACCEPTED2Microsoft Windows XPOperating SystemRobert L. HollisINTERIMACCEPTEDThe Microsoft Windows kernel in Microsoft Windows 2000 Server, Windows XP, and Windows Server 2003 allows remote attackers to cause a denial of service (crash) via crafted Remote Desktop Protocol (RDP) requests.CVE-2005-1218ACCEPTED2Microsoft Windows 2000Operating SystemRobert L. HollisINTERIMACCEPTEDUnknown vulnerability in Microsoft Windows 2000 Server and Windows Server 2003 domain controllers allows remote authenticated users to cause a denial of service (system crash) via a crafted Kerberos message.CVE-2005-1981ACCEPTED2Microsoft Windows 2000Operating SystemRobert L. HollisINTERIMACCEPTEDUnknown vulnerability in the PKINIT Protocol for Microsoft Windows 2000, Windows XP, and Windows Server 2003 could allow a local user to obtain information and spoof a server via a man-in-the-middle (MITM) attack between a client and a domain controller when PKINIT smart card authentication is being used.CVE-2005-1982ACCEPTED2Microsoft Windows XPOperating SystemRobert L. HollisINTERIMACCEPTEDUnknown vulnerability in Microsoft Windows 2000 Server and Windows Server 2003 domain controllers allows remote authenticated users to cause a denial of service (system crash) via a crafted Kerberos message.CVE-2005-1981ACCEPTED2Microsoft Windows XPOperating SystemRobert L. HollisINTERIMACCEPTEDUnknown vulnerability in the PKINIT Protocol for Microsoft Windows 2000, Windows XP, and Windows Server 2003 could allow a local user to obtain information and spoof a server via a man-in-the-middle (MITM) attack between a client and a domain controller when PKINIT smart card authentication is being used.CVE-2005-1982ACCEPTED2Microsoft Windows XPOperating SystemRobert L. HollisINTERIMACCEPTEDUnknown vulnerability in Microsoft Windows 2000 Server and Windows Server 2003 domain controllers allows remote authenticated users to cause a denial of service (system crash) via a crafted Kerberos message.CVE-2005-1981ACCEPTED2Microsoft Windows XPOperating SystemRobert L. HollisINTERIMACCEPTEDUnknown vulnerability in the PKINIT Protocol for Microsoft Windows 2000, Windows XP, and Windows Server 2003 could allow a local user to obtain information and spoof a server via a man-in-the-middle (MITM) attack between a client and a domain controller when PKINIT smart card authentication is being used.CVE-2005-1982ACCEPTED2Microsoft Windows XPOperating SystemRobert L. HollisINTERIMACCEPTEDUnknown vulnerability in Microsoft Windows 2000 Server and Windows Server 2003 domain controllers allows remote authenticated users to cause a denial of service (system crash) via a crafted Kerberos message.CVE-2005-1981ACCEPTED2Microsoft Windows XPOperating SystemRobert L. HollisINTERIMACCEPTEDUnknown vulnerability in the PKINIT Protocol for Microsoft Windows 2000, Windows XP, and Windows Server 2003 could allow a local user to obtain information and spoof a server via a man-in-the-middle (MITM) attack between a client and a domain controller when PKINIT smart card authentication is being used.CVE-2005-1982ACCEPTED2Microsoft Windows Server 2003Operating SystemRobert L. HollisINTERIMACCEPTEDUnknown vulnerability in Microsoft Windows 2000 Server and Windows Server 2003 domain controllers allows remote authenticated users to cause a denial of service (system crash) via a crafted Kerberos message.CVE-2005-1981ACCEPTED2Microsoft Windows Server 2003Operating SystemRobert L. HollisINTERIMACCEPTEDUnknown vulnerability in the PKINIT Protocol for Microsoft Windows 2000, Windows XP, and Windows Server 2003 could allow a local user to obtain information and spoof a server via a man-in-the-middle (MITM) attack between a client and a domain controller when PKINIT smart card authentication is being used.CVE-2005-1982ACCEPTED2Microsoft Windows Server 2003Operating SystemRobert L. HollisINTERIMACCEPTEDUnknown vulnerability in Microsoft Windows 2000 Server and Windows Server 2003 domain controllers allows remote authenticated users to cause a denial of service (system crash) via a crafted Kerberos message.CVE-2005-1981ACCEPTED2Microsoft Windows Server 2003Operating SystemRobert L. HollisINTERIMACCEPTEDUnknown vulnerability in the PKINIT Protocol for Microsoft Windows 2000, Windows XP, and Windows Server 2003 could allow a local user to obtain information and spoof a server via a man-in-the-middle (MITM) attack between a client and a domain controller when PKINIT smart card authentication is being used.CVE-2005-1982ACCEPTED2Microsoft Windows NTMicrosoft Windows 2000Microsoft Windows XPMicrosoft Windows Server 2003mozillaRobert L. HollisChristine WalzerJonathan BakerINTERIMACCEPTEDFirefox before 1.0.5 and Mozilla before 1.7.9 allows a child frame to call top.focus and other methods in a parent frame, even when the parent is in a different domain, which violates the same origin policy and allows remote attackers to steal sensitive information such as cookies and passwords from web sites whose child frames do not verify that they are in the same domain as their parents.CVE-2005-2266ACCEPTED4Sun Solaris 8Sun Solaris 9ApacheRobert L. HollisDRAFTINTERIMACCEPTEDmod_digest for Apache before 1.3.31 does not properly verify the nonce of a client response by using a AuthNonce secret.CVE-2003-0987ACCEPTED5Sun Solaris 8Sun Solaris 9ApacheRobert L. HollisDRAFTINTERIMACCEPTEDApache does not filter terminal escape sequences from its error logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences.CVE-2003-0020ACCEPTED5Sun Solaris 8Sun Solaris 9ApacheRobert L. HollisDRAFTINTERIMACCEPTEDApache 1.4.x before 1.3.30, and 2.0.x before 2.0.49, when using multiple listening sockets on certain platforms, allows remote attackers to cause a denial of service (blocked new connections) via a "short-lived connection on a rarely-accessed listening socket."CVE-2004-0174ACCEPTED5Sun Solaris 8Sun Solaris 9ApacheRobert L. HollisDRAFTINTERIMACCEPTEDmod_access in Apache 1.3 before 1.3.30, when running big-endian 64-bit platforms, does not properly parse Allow/Deny rules using IP addresses without a netmask, which could allow remote attackers to bypass intended access restrictions.CVE-2003-0993ACCEPTED5Sun Solaris 8Sun Solaris 9ApacheRobert L. HollisDRAFTINTERIMACCEPTEDHeap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied.CVE-2004-0492ACCEPTED5Sun Solaris 7Sun Solaris 8Sun Solaris 9XDMRobert L. HollisChristine WalzerDRAFTINTERIMACCEPTEDX Display Manager (XDM) on Solaris 8 allows remote attackers to cause a denial of service (XDM crash) via an invalid X Display Manager Control Protocol (XDMCP) request.CVE-2004-1347ACCEPTED5Sun Solaris 7Sun Solaris 8Sun Solaris 9Sun Solaris 10libtiffRobert L. HollisDRAFTINTERIMACCEPTEDMultiple vulnerabilities in the RLE (run length encoding) decoders for libtiff 3.6.1 and earlier, related to buffer overflows and integer overflows, allow remote attackers to execute arbitrary code via TIFF files.CVE-2004-0803ACCEPTED5Sun Solaris 7Sun Solaris 8Sun Solaris 9Sun Solaris 10libtiffRobert L. HollisDRAFTINTERIMACCEPTEDVulnerability in tif_dirread.c for libtiff allows remote attackers to cause a denial of service (application crash) via a TIFF image that causes a divide-by-zero error when the number of row bytes is zero, a different vulnerability than CVE-2005-2452.CVE-2004-0804ACCEPTED5Sun Solaris 7Sun Solaris 8Sun Solaris 9Sun Solaris 10libtiffRobert L. HollisDRAFTINTERIMACCEPTEDMultiple integer overflows in libtiff 3.6.1 and earlier allow remote attackers to cause a denial of service (crash or memory corruption) via TIFF images that lead to incorrect malloc calls.CVE-2004-0886ACCEPTED5Sun Solaris 7Sun Solaris 8Sun Solaris 9Sun Solaris 10libtiffRobert L. HollisDRAFTINTERIMACCEPTEDInteger overflow in (1) tif_dirread.c and (2) tif_fax3.c for libtiff 3.5.7 and 3.7.0 allows remote attackers to execute arbitrary code via a TIFF file containing a TIFF_ASCII or TIFF_UNDEFINED directory entry with a -1 entry count, which leads to a heap-based buffer overflow.CVE-2004-1308ACCEPTED50101SunOS5.1011111010020227380303040502^i.*8602[Ss][Pp][Aa][Rr][Cc]52379034752379024645126002698512600170150219570535237902465523790248351260027165126001715603790249151260016995237902477Mozilla Thunderbird \(0\.[6-8]\)0\.[6-8]($|\s).*Mozilla Firefox \(0\.9.*\)0\.9($|\s).*Mozilla (\([0-1]\.[0-7]\)|\([0-1]\.[0-7]\.[0-4]\))[0-1]\.[0-7]($|\s).*|[0-1]\.[0-7]\.[0-4]($|\s).*Mozilla Thunderbird \(0\.[0-8]\)0\.[0-8]($|\s).*Mozilla (\(1\.7\)|\(1\.[0-7]\.[0-3]\))1\.7($|\s).*|1\.7\.[0-3]($|\s).*Mozilla Thunderbird \(0\.[6-9]\)0\.[6-9]($|\s).*Mozilla Firefox \(0\.[0-9].*\)0\.[0-9]($|\s).*Mozilla Firefox (\(0\.[0-9].*\)|\(1\.0\))[0-1]\.0($|\s).*Mozilla (\([0-1]\.[0-7]\)|\([0-1]\.[0-7]\.[0-5]\))[0-1]\.[0-7]($|\s).*|[0-1]\.[0-7]\.[0-5]($|\s).*Mozilla Thunderbird (\(0\.[0-9]\)|\(1\.0\))[0-1]\.0($|\s).*Mozilla Firefox (\(0\.[0-9].*\)|\(1\.0\)|\(1\.0\.[0-1]\))[0-1]\.0($|\s).*|[0-1]\.0\.[0-1]($|\s).*Mozilla (\([0-1]\.[0-7]\)|\([0-1]\.[0-7]\.[0-6]\))[0-1]\.[0-7]($|\s).*|[0-1]\.[0-7]\.[0-6]($|\s).*Mozilla (\([0-1]\.[0-7]\)|\([0-1]\.[0-7]\.[0-7]\))Mozilla Firefox (\(0\.[0-9].*\)|\(1\.0\)|\(1\.0\.[0-3]\))Mozilla Thunderbird (\(0\.[0-9]\)|\(1\.0\)|\(1\.0\.[0-2]\))[0-1]\.0($|\s).*|[0-1]\.0\.[0-2]($|\s).*Mozilla Firefox (\(0\.[0-9].*\)|\(1\.0\)|\(1\.0\.[0-2]\))[0-1]\.0($|\s).*|[0-1]\.0\.[0-2]($|\s).*Mozilla (\([0-1]\.[0-7]\)|\([0-1]\.[0-7]\.[0-8]\))[0-1]\.[0-7]($|\s).*|[0-1]\.[0-7]\.[0-8]($|\s).*Mozilla Firefox (\(0\.[0-9].*\)|\(1\.0\)|\(1\.0\.[0-4]\))[0-1]\.0($|\s).*|[0-1]\.0\.[0-4]($|\s).*[0-1]\.[0-7]($|\s).*|[0-1]\.[0-7]\.[0-7]($|\s).*[0-1]\.0($|\s).*|[0-1]\.0\.[0-3]($|\s).*1602900252460290025236.00.2900.218052379019352379019360280015841502195697260275016640138133578010803512600158512600149155187779500799110370560211,0,3705,31,0,3705,2103705556126.2.020812039016173840138173294013817345603790212401381335666109231502195700002010660379024150390070325237901845237901730519254013818425237902050104070411510104412055039006970502195694640138133587603790198KB888258301200408523790205Service Pack 2 or less for Windows Office XP needs regex involving strings and less thanQ83398902090602071303020102040350219570236569813060710.0.6626.040138133591512600136314013817323The presence of /etc/named.conf indicates that system system is probably configured as a DNS server16401381727060379019810.0.4330.004046028001580602800158011.0.5614.00355049452800earlierearlierearlierearlier04181111egrep "^[Srecipient=2|S2]|^[^#]*\$>2|^[^#]*\$>recipient|^[^#]*\$>4|^[^#]*\$>final" /etc/mail/sendmail.cf True if any lines returned472384111000907141503900703652379024221251180^2\.1.*$100811143221085111432220371,0,4322,0512600163460280015170515126001243512600117111361092321471219569200302015126001193512600112503900692260274220011.0.3216.5614Installed401381731251260015555126001555512600156751260015675021957017523790227srv03_qfe523790225srv03_qfe50219561595237902335021956922502195695240138133630602600115602800123310140138133577401381728651260016131006714005101003013651260016195021956929earlierearlierearlier025021956966110.2.51104013813361825362020046032640Installed11.0.6252.7^5\.[1-2]$9.00.93279.00.9327Installed2003110062520010202603790185603790181040203010101020252379024550219570216037902795126002563502195700515035342800100203030809SUNWkrbu - 32bit, SUNWkrbux - 64bit523790163140138172991005502195692816037902195126001596egrep ^flags:.*a[sd] /etc/security/audit_control True if any lines returnedgrep c2audit /etc/system True if "set c2audit:audit_load = 1" or similiar121833010324Package which contains /usr/lib/netsvc/yp/ypxfrd523790163401381728040138172686037901681.110.0.8326.01006735010.0.8326.0512600109160379021115126002577140138173045106395.1.06394013813354515038262400CVE-2002-126501CVE-2002-126501CVE-2002-126501CVE-2002-126501CVE-2002-126501CVE-2002-126501CVE-2002-126503CVE-2002-126503CVE-2002-126509CVE-2002-126514CVE-2002-126501CVE-2002-126501CVE-2002-1265016028001556030808116027452800900892916384HttpRedirect
^http:*,PERMANENT,*
427881151260015171^4\.08\.01.*$5126001481^4\.09.*$5309031^4\.08\.02.*$52367714460280016430140138172694013813356710215550494240052379022050219569451006754010071503821280012135126001597503900700902012552558102653SUNWcsu = 32bit, SUNWcsxu = 64bit06130809110516512600136451260013705010251260015645126001555237901280523790142512600160601602800144101191251260016205126001605015126001560140138133574401381335655237902520102512600166512600158051260015805126001254502195690211065020151260015555237901981401381335640138172674723843310011503528700050914140138133563401381726501610923260290026275126002685512600169312270215126002598C:\Program Files\Windows NT\hypertrm.exe /t %15126001609Windows ME5021957071523790220B.11.23B.11.23B.11.11B.11.111.11602800147650219569926037902534152379023952379038660280015236028001522603790413502195706550383320051260027430251260027446029002763624050219569025038352200Solaris Management Console web interface0102B.10.20B.10.20HP-UXB.10.2060290027690160379041831092164260017386426000B.11.00B.11.0060260016560260015796437903996437900613940424013813359860280017245237903745237903746110020523790346^Service Pack [1-9]|\d{2,}$ADSTYPE_PRINTABLE_STRING.+ADSTYPE_PRINTABLE_STRING\:3$ADSTYPE_INTEGER25ADSTYPE_INTEGER1ADSTYPE_INTEGER268ADSTYPE_INTEGER25ADSTYPE_INTEGER1ADSTYPE_PRINTABLE_STRING.+ADSTYPE_INTEGER0ADSTYPE_INTEGER1ADSTYPE_INTEGER131072ADSTYPE_INTEGER2ADSTYPE_PRINTABLE_STRING.+ADSTYPE_INTEGER270ADSTYPE_INTEGER4096ADSTYPE_PRINTABLE_STRING^local\:ADSTYPE_PRINTABLE_STRING^\d+\:1\:ADSTYPE_INTEGER0ADSTYPE_INTEGER0ADSTYPE_INTEGER1ADSTYPE_INTEGER262144ADSTYPE_INTEGER1ADSTYPE_INTEGER995ADSTYPE_INTEGER110ADSTYPE_PRINTABLE_STRING^https\:\/\/ADSTYPE_INTEGER4ADSTYPE_INTEGER1ADSTYPE_INTEGER2ADSTYPE_INTEGER4ADSTYPE_INTEGER2ADSTYPE_INTEGER1ADSTYPE_INTEGER8ADSTYPE_INTEGER2ADSTYPE_PRINTABLE_STRINGFilterADSTYPE_INTEGER5000ADSTYPE_INTEGER30720ADSTYPE_INTEGER30720ADSTYPE_INTEGER2ADSTYPE_INTEGER0ADSTYPE_DN_STRING.+ADSTYPE_INTEGER993ADSTYPE_INTEGER143ADSTYPE_PRINTABLE_STRING^https\:\/\/ADSTYPE_INTEGER4ADSTYPE_INTEGER1ADSTYPE_INTEGER2ADSTYPE_INTEGER0ADSTYPE_INTEGER1ADSTYPE_INTEGER2147483648ADSTYPE_INTEGER16ADSTYPE_INTEGER2ADSTYPE_INTEGER1ADSTYPE_INTEGER512ADSTYPE_INTEGER4ADSTYPE_INTEGER64ADSTYPE_INTEGER1ADSTYPE_INTEGER1ADSTYPE_INTEGER2147483648ADSTYPE_INTEGER16ADSTYPE_INTEGER2ADSTYPE_INTEGER1ADSTYPE_INTEGER4ADSTYPE_INTEGER51252379023311812udpearlier147119791This will match any KB834707 rather give a list such as KB834707-ie501sp3-20040929.121357,etc160379025950155866089008930150219569585126001734is the path given as: %windir%\system32\javaprxy.dll or
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot\
%windir%\system32
Deny Everyone: full control, modify, read&exec, Read, Writetruetruetruetrue401381726815038257001.190032509.00.00.2980512600161760290028025237903661150219570615021957035((1\.7\.12\..*)|(1\.(([8-9])|(\d{2,}))\..*)|(1\.7\.((1[3-9])|([2-9]\d+))\..*))HP-UXB.11.226037903835021957054-S 2010102523790280619732619726512600115152379016735126001733523790396111earlier50219570691earlier5021956991652600274965260000202350117As stated in the iDefense security advisory, if this key exists and contains a value, then the system has Interactive Training installed, and it will process .cbo files.5021957057HP-UXB.10.245126002736523790766066178615035392400earlierearlier50390070711000676405126002595earlierearlier2004102501502195702149198009603790254151260013315126001755B.11.11B.11.11^4\.[0]*9\..*63188965379025196537900550495650051260026735126001683111earlier5126002726512600272651260016846567490020304523790359earlier5126002770earlierearlierearlier6028001751602900266816109231Rough translation of the Sun recommended test of: % grep default_realm /etc/krb5/krb5.conf | grep -v ___default_realm___ default_realm = EXAMPLE.COM070704021115126001727523790121^4\.[0]*9\.[0]+\.[0]*901^4\.[0]*9\.[0]+\.[0]*9006037902577025504701240055046162001^4\.[0]*8\..*116037904496\..*55049522800regularearlier11124^Windows.*200080636020008063605021956905415237902483512600271651260017152001124414535126001720512600172050219529562001124720130111111111111111earlier512600133151260013250219568985021957069200023511060290027225015586072523790245315131260011235126001343512600128.*zipfldr\.dll.*1602800158460275016750219536491518100415021957059^Service Pack [0-4]$earlier401381335624013817263^2\.7.*200081904140200081900140111earlier08.5We think, but are not sure that the affected version of bkupexec.exe is 3.60.1.298 The file should be found in C:\Program Files\VERITAS\Backup Exec\NT\bkupexec.exe523790161523790141srv03_qfe523790137srv03_qfeHP-UXB.11.04B.11.04B.11.04B.11.04160037901371530903^4\.09\.00.*1523677144^4\.08\.02.*1512600891^4\.08\.01.*1502258410^4\.08\.00.*15021956927^4\.07.*200080628020008060602000806060200080606020008060602000806060200080650000060570021Microsoft Exchange 200014013817058427641earlier31^Service Pack [0-2]$60028001409151260015155126001375126001362512600137earlier16028001492602800149151260013635126001365126001340512600128Non-perjoritive check.*1111earlier141020010Windows 985021956904earlierearlier60027393006,0,2600,000060280015066,0,2800,110651260011251earlierearlierearlier1111earlier111earlier111earlierearlierearlierearlierearlier111earlierY401381335594013817255140861804086180earlier410386151260013485126001342000807460^2\.6.*13701140The ImageMagick-* RPMs all require that the main ImageMagick RPM have the same version and release number.earlier5021956898512600136151260013552379014215237901855021956906111111111111111111earlier401381133523790132UDPearlierearlier11earlierearlierearlier4103932114103931Non-perjoritive test.*1502195667214013812795021955807427801550492721003602713110052379013960271622005504926250031111602712030011550461317005.50.4522.18005.50.4134.06005.50.4134.0100523790134earlier^Service Pack [6-9]|\d{2,}$4013811645021953649513118801452379025064276915021956901523790124152379012548719641880earlierearlierearlierearlierearlier152379025051260013615126001355126001361512600134401381335624013817263502195689524013813355940138172551502195690451219568995131219568241earlierearlier512600134751260013652379013215021956902155049393005,50,4807,1700111111111earlierearlierearlierearlier111earlierearlierearlierearlierearlierearlierearlierearlierx86_64earlierearlierearlierearlierearlierearlierearlierearlierearlierearlierearlierearlier111earlier111111111earlierearlier1earlierearlierearlier111earlierearlierearlierearlierearlierearlierearlier610211600010.0.6626.010.0.4333.0100057090000441410393441039344.1earlierearlierearlierearlierearlierearlierearlierearlierTCPearlierearlierearlierearlierearlierearlierearlier111earlier11earlier111earlierTCPearlierearlierearlierearlierearlier111earlier111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111earlierearlierearlier1720earlier5237909940138133554401381725552379088512600127451260011950219568246037902491603790373602800149960280014985237902516801969333.5701701443.02.25300020731301523790336512600160150219569875021957035503828270012000851025020008510250^2\.8.*$602800150660280015055237902476Non-pejorative checkHP-UXB.10.10HP-UXB.10.01B.10.10B.10.10B.10.01B.10.01B.11.00B.11.00Installed2000819042020008190420^2\.71.*$2000819002020008190020111earlier(((A|B)\.2\.0\.55\.\d+)|((A|B)\.[3-9]\..*)|((A|B)\.[1-9]\d+\..*)|((A|B)\.2\.[1-9]\d*\..*)|((A|B)\.2\.\d+\.[6-9]\d+\..*)|((A|B)\.2\.\d+\.5[6-9]\d*\..*)|((A|B)\.2\.\d+\.\d{3,}\..*))60280015281523790316111earlier15237902274013817342The ImageMagick-devel, ImageMagick-c++-devel, and ImageMagick-c++ RPMs all require that the exact same version of the ImageMagick RPM is present. As such, we can test for a vulnerable version of the former alone, rather than testing for the presence of each of these RPMs in particular.earlier60290026046.0.2900.21806037902521415021956870^.*ServerNT.*$52379025426028001516602800151510058150Non-perjorative test.*Non-perjorative test.*11008032Non-pejorative test.*1200342314013817207401381720240138171774013817177earlier800019904523790419.*10058150earlier111earlierearlier15021956823111earlier4401381336321Multiple RPMs were updated in this release, but all but mozilla-nspr have mozilla-with-their-same-version as an installation dependency. So, if mozilla is up to date, mozilla-chat, mozilla-devel, ... , mozilla-js-debugger are all up to date. Mozilla itself requires that mozilla-nspr and mozilla-nss be installed with the same version as itself. This closes the loop -- if mozilla is up to date, so are the other mozilla-FOO RPMs.earlier^.*3.S9008216TCPearlierearlierFor "/tmp is readable by non-root users," use a compound test.1earlier111earlierearlier603790244060379032715237902442523790329HP-UXB.11.23HP-UXB.11.00\d+/8\d+HP-UXHP-UXB.11.11\d+/7\d+HP-UXearlierearlier6\.2\.020[5-9]MSN Messenger 6.201010160379027480097168009315We think, but are not sure that the affected version of bkupexec.exe is 3.60.1.298 The file should be found in C:Program Files\VERITAS\Backup Exec\NT\bkupexec.exeMozilla Firefox (\(0\.[0-9].*\)|\(1\.0\)|\(1\.0\.[0-6]\))(0\.[0-9].*|1\.0($|\s).*|1\.0\.[1-6]($|\s).*)([0-1]\.[0-7]($|\s).*|[0-1]\.[0-7]\.[0-8]($|\s).*|1\.7\.10($|\s).*)Mozilla (\([0-1]\.[0-7]\)|\([0-1]\.[0-7]\.[0-9]\)|\(1\.7\.10\))50380906567560523790249252379024921500219568626029002620TCP1111earlier111111earlierearlierearlier302520008074702000807470TCPearlier50219570595021957059^Service Pack 45237902241603790118137011463701146^2\.5.*$earlier60280014006027378005504937800503813800602743600111earlier1503526800^2\.70.*$8.00.194earlier2000807600200080309050219566244113012002910656980575035101100earlierearlierKB899753301200430Microsoft ISA Server 2000 Updates5021957044523790309earlierearlierearlierearlierearlier1100350219567131512600252503earlierearlierearlier5126001710earlier111earlierearlier1002609041503366811earlier11065060111Multiple RPMs were updated in this release, but all but mozilla-nspr have mozilla-with-their-same-version as an installation dependency. So, if mozilla is up to date, mozilla-chat, mozilla-devel, ... , mozilla-js-debugger are all up to date. Mozilla itself requires that mozilla-nspr and mozilla-nss be installed with the same version as itself. This closes the loop -- if mozilla is up to date, so are the other mozilla-FOO RPMs.earlier^.*4.S111earlier6037902802331066301200257301200257602734160015038311800111111earlier15237902435523790242752379031515236440523644052364405236690100042050000100042050000400027523400275231earlier160379094earlier6028001276550493416005038101700502195679990082165035231700150219538814151260027091800449014013817224WinNT200080650011400027523earlier20008076502000807650200080765020008081805021956753126291191^2\.6.*$200080650016491121earlier180044828004482649112464911218.0.0.4477115021956110200080561020008057805126001301512600120512600130151260012015126002622111earlier5021956011earlier1x645237902437523790324ia64x86This test should fail if the 64-bit (x64 architecture) version of Windows is installed.CoPNGFilter Class150354127002.4.20-6NULL62.4.201earlierearlier416037902065.255049434001101212560280014582000807650200080765020008079802000807650200080778020008080002000808160200080818020008081802000808180200080818020008076502000808110200080818020008081802000802230200080223020008022302000802230earlier55049229001615132^Service Pack [5-9]|\d{2,}$1523790805038193005.00.3700.1000415021956861502195686116037901916.00.3790.00001503532300900632890069264115126001255512600118334150219558805.0513121956758
^.*idq\.dll.*$
1502195364540138172241111earlier105021952784015131365902150219559719007924^Service Pack [2-9]|\d{2,}$5.1331513126001243Service Pack 1513126001171427761105504923250020earlier16037903266,0,3790,01earlierearlierearlierearlier^3.S401381709240138171526earlier1113111earlier503502471840138172141140138171255021954919602722900140138172031331150321420004140138170974013817064earlier503810011earlier5,5,0,85135,1,0,85135,6,0,8513560851355085135108513111earlier30Y5021956802.hta3360280012646.00.2800.11062000806280200080606020008060602000806060200080606020008060602000806080111150219566998164563earlier15021956685earlier4140138172022gopher://60271922000233331602715400110939402015021955080414013817134115120008042802000803840200080213020008021301915021953407150219556954220008029608.00.1941117earlierearlier21502195667221508931105502195498319414013817140RASPHONE.PBK11502195610660272325002earlier111earlier503502485615035139005.00.3502.1000111Service Pack 2111502195210302622111115021954980^.*LanmanNT.*$11142764111138SunOS5.711101SunOS5.92415021954905
^.*ism\.dll.*$
15021955671earlierearlier50350425005.00.3315.10005.00.3314.21015.00.3105.01065.00.3103.10005.00.2920.00005.00.2919.63075.00.2919.38005.00.2919.80015021955974^Service Pack [4-9]|\d{2,}$
4
550472521005.50.4522.18005.50.4134.06005.50.4134.0100^Service Pack [3-9]|\d{2,}$5021955269515021956810^Service Pack [4-9]|\d{2,}$5.06027162200140138171164.0^6\.0+\.2600\.0+$6027131100
^.*asp\.dll.*$
111427751Terminal Server0411191152111111111111550491311005.50.4807.2300161138111root630111SunOS5.8earlier465111earlier^i.*869