The OVAL Repository 5.3 2007-12-31T09:00:08.584-05:00 Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Operating System Stack-based buffer overflow in the HrShellOpenWithMonikerDisplayName function in Microsoft Hyperlink Object Library (hlink.dll) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long hyperlink, as demonstrated using an Excel worksheet with a long link in Unicode, aka "Hyperlink COM Object Buffer Overflow Vulnerability." NOTE: this is a different issue than CVE-2006-3059. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 9 Sun Solaris 10 X Multiple integer overflows in XFree86 before 4.3.0 allow user-assisted attackers to execute arbitrary code via a crafted pixmap image. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 /proc/tty/driver/serial in Linux 2.4.x reveals the exact number of characters used in serial links, which could allow local users to obtain potentially sensitive information such as the length of passwords. Jay Beale INTERIM INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 File and Print Sharing File and Print Sharing service in Windows 95, Windows 98, and Windows Me does not properly check the password for a file share, which allows remote attackers to bypass share access controls by sending a 1-byte password that matches the first character of the real password, aka the "Share Level Password" vulnerability. Tiffany Bergeron INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 COM Internet Services Buffer overflow in the COM Internet Services and in the RPC over HTTP Proxy components for Microsoft Windows NT Server 4.0, NT 4.0 Terminal Server Edition, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service via a crafted request. Christine Walzer INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 CVS Double-free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code. Jay Beale INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 CVS CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle malformed "Entry" lines, which prevents a NULL terminator from being used and may lead to a denial of service (crash), modification of critical program data, or arbitrary code execution. Jay Beale INTERIM ACCEPTED ACCEPTED HP-UX 11 Operating System Unspecified vulnerability in HP-UX B.11.23 on Itanium platforms allows local users to cause a denial of service due to a "specific stack size." Robert L. Hollis DRAFT Matthew Wojcik INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 MIT Kerberos 5 (krb5) Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Outlook Express The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability." Andrew Buttner INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that cause the application for the spoofed file type to pass the file back to the operating system for handling rather than raise an error message, aka the first variant of the "Content Disposition" vulnerability. Andrew Buttner Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Outlook Express Stack-based buffer overflow in the news reader for Microsoft Outlook Express (MSOE.DLL) 5.5 SP2, 6, and 6 SP1 allows remote malicious NNTP servers to execute arbitrary code via a LIST response with a long second field. Ingrid Skoog DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Buffer overflow in the MMSE dissector for Ethereal 0.10.1 to 0.10.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code. Jay Beale INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 The SPNEGO dissector in Ethereal 0.9.8 to 0.10.3 allows remote attackers to cause a denial of service (crash) via unknown attack vectors that cause a null pointer dereference. Jay Beale INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 The AIM dissector in Ethereal 0.10.3 allows remote attackers to cause a denial of service (assert error) via unknown attack vectors. Jay Beale INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain createTextRange call on a checkbox object, which results in a dereference of an invalid table pointer. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Racoon before 20040408a allows remote attackers to cause a denial of service (memory consumption) via an ISAKMP packet with a large length field. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Information Server (IIS) Unknown vulnerability in the hosting process (dllhost.exe) for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allows remote attackers to gain privileges by executing an out of process application that acquires LocalSystem privileges, aka "Out of Process Privilege Elevation." Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Ethereal 0.10.3 allows remote attackers to cause a denial of service (crash) via certain SIP messages between Hotsip servers and clients. Jay Beale INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Buffer overflow in the ntlm_check_auth (NTLM authentication) function for Squid Web Proxy Cache 2.5.x and 3.x, when compiled with NTLM handlers enabled, allows remote attackers to execute arbitrary code via a long password ("pass" variable). Jay Beale INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Buffer overflow in gopher client for Microsoft Internet Explorer 5.1 through 6.0, Proxy Server 2.0, or ISA Server 2000 allows remote attackers to execute arbitrary code via a gopher:// URL that redirects the user to a real or simulated gopher server that sends a long response. David Proulx Christine Walzer INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Utempter allows device names that contain .. (dot dot) directory traversal sequences, which allows local users to overwrite arbitrary files via a symlink attack on device names in combination with an application that trusts the utmp or wtmp files. Jay Beale INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Multiple directory traversal vulnerabilities in LHA 1.14 allow remote attackers or local users to create arbitrary files via an LHA archive containing filenames with (1) .. sequences or (2) absolute pathnames with double leading slashes ("//absolute/path"). Jay Beale INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Multiple stack-based buffer overflows in the get_header function in header.c for LHA 1.14, as used in products such as Barracuda Spam Firewall, allow remote attackers or local users to execute arbitrary code via long directory or file names in an LHA archive, which triggers the overflow when testing or extracting the archive. Jay Beale INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Integer underflow in the isakmp_id_print for TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with an Identification payload with a length that becomes less than 8 during byte order conversion, which causes an out-of-bounds read, as demonstrated by the Striker ISAKMP Protocol Test Suite. Jay Beale INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 OpenSSL The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference. Matt Busby Matt Busby INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 5.5 and 6.0 allows remote attackers to read certain files and spoof the URL in the address bar by using the Document.open function to pass information between two frames from different domains, a new variant of the "Frame Domain Verification" vulnerability described in MS:MS01-058/CAN-2001-0874. Tiffany Bergeron INTERIM ACCEPTED INTERIM Harvey Rubinovitz ACCEPTED Christine Walzer Christine Walzer INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via ISAKMP packets containing a Delete payload with a large number of SPI's, which causes an out-of-bounds read, as demonstrated by the Striker ISAKMP Protocol Test Suite. Jay Beale INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 The Portable Network Graphics library (libpng) 1.0.15 and earlier allows attackers to cause a denial of service (crash) via a malformed PNG image file that triggers an error that causes an out-of-bounds read when creating the error message. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Heap-based buffer overflow in CVS 1.11.x up to 1.11.15, and 1.12.x up to 1.12.7, when using the pserver mechanism allows remote attackers to execute arbitrary code via Entry lines. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Sun Solaris 8 cachefsd Buffer overflow in the fscache_setup function of cachefsd in Solaris 2.6, 7, and 8 allows local users to gain root privileges via a long mount argument. David Proulx Brian Soby Brian Soby INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows NT COM Internet Services Buffer overflow in the COM Internet Services and in the RPC over HTTP Proxy components for Microsoft Windows NT Server 4.0, NT 4.0 Terminal Server Edition, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service via a crafted request. Christine Walzer INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Jet Database Engine Buffer overflow in Microsoft Jet Database Engine 4.0 allows remote attackers to execute arbitrary code via a specially-crafted database query. Andrew Buttner INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 rsync before 2.6.1 does not properly sanitize paths when running a read/write daemon without using chroot, which allows remote attackers to write files outside of the module's path. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Internet Information Server (IIS) The logging capability for unicast and multicast transmissions in the ISAPI extension for Microsoft Windows Media Services in Microsoft Windows NT 4.0 and 2000, nsiislog.dll, allows remote attackers to cause a denial of service in Internet Information Server (IIS) and execute arbitrary code via a certain network request. Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Microsoft Internet Explorer 5.01 through 6 does not always return the correct IOleClientSite information when dynamically creating an embedded object, which could cause Internet Explorer to run the object in the wrong security context or zone, and allow remote attackers to execute arbitrary code. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows XP H.323 Unknown vulnerability in the H.323 protocol implementation in Windows 98, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code. Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Internet Explorer The file upload control in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to automatically upload files from the local system via a web page containing a script to upload the files. Tiffany Bergeron INTERIM ACCEPTED INTERIM Harvey Rubinovitz ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Data Access Components 2.6 Buffer overflow in a component of SQL-DMO for Microsoft Data Access Components (MDAC) 2.5 through 2.7 allows remote attackers to execute arbitrary code via a long response to a broadcast request to UDP port 1434. Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 MDAC 2.5 Buffer overflow in a component of SQL-DMO for Microsoft Data Access Components (MDAC) 2.5 through 2.7 allows remote attackers to execute arbitrary code via a long response to a broadcast request to UDP port 1434. Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 ImageMagick The XWD Decoder in ImageMagick before 6.2.2.3, and GraphicsMagick before 1.1.6-r1, allows remote attackers to cause a denial of service (infinite loop) via an image with a zero color mask. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer The zone determination function in Microsoft Internet Explorer 5.5 and 6.0 allows remote attackers to run scripts in the Local Computer zone by embedding the script in a cookie, aka the "Cookie-based Script Execution" vulnerability. Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Enhanced Metafile (EMF) Windows Metafile (WMF) Buffer overflow in the rendering for (1) Windows Metafile (WMF) or (2) Enhanced Metafile (EMF) image formats in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, and XP SP1 allows remote attackers to execute arbitrary code via a malformed WMF or EMF image. Andrew Buttner INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Remote Procedure Call (RPC) An Activation function in the RPCSS Service involved with DCOM activation for Microsoft Windows 2000, XP, and 2003 allows remote attackers to cause a denial of service (memory consumption) via an activation request with a large length field. Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Remote Procedure Call (RPC) An Activation function in the RPCSS Service involved with DCOM activation for Microsoft Windows 2000, XP, and 2003 allows remote attackers to cause a denial of service (memory consumption) via an activation request with a large length field. Christine Walzer Christine Walzer DRAFT Microsoft Windows NT HTML Help Facility Internet Explorer 5.x and 6.0 allows remote attackers to execute arbitrary programs via a modified directory traversal attack using a URL containing ".." (dot dot) sequences and a filename that ends in "::" which is treated as a .chm file even if it does not have a .chm extension. NOTE: this bug may overlap CVE-2004-0475. Andrew Buttner INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Robert L. Hollis INTERIM Robert L. Hollis Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows 2000 Remote Procedure Call (RPC) An Activation function in the RPCSS Service involved with DCOM activation for Microsoft Windows 2000, XP, and 2003 allows remote attackers to cause a denial of service (memory consumption) via an activation request with a large length field. Christine Walzer INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a (1) telnet, (2) rlogin, (3) ssh, or (4) mailto URI, which allows remote attackers to manipulate the options that are passed to the associated programs, possibly to read arbitrary files or execute arbitrary code. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows NT SNMP Memory leak in SNMP agent in Windows NT 4.0 before SP5 allows remote attackers to conduct a denial of service (memory exhaustion) via a large number of queries. Christine Walzer INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Private Communications Transport (PCT) Buffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library, as used in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via PCT 1.0 handshake packets. Andrew Buttner INTERIM ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted BIFF record with an attacker-controlled array index that is used for a function pointer, aka "Malformed OBJECT record Vulnerability." Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Information Server (IIS) Buffer overflow in ASP Server-Side Include Function in IIS 4.0, 5.0 and 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via long file names. Tiffany Bergeron ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to bypass security zone restrictions and execute arbitrary programs via a web document with a large number of duplicate file:// or other requests that point to the program and open multiple file download dialogs, which eventually cause Internet Explorer to execute the program, as demonstrated using a large number of FRAME or IFRAME tags, aka the "File Download Dialog Vulnerability." Tiffany Bergeron INTERIM ACCEPTED INTERIM Harvey Rubinovitz ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 KAME IKE daemon (racoon) does not properly handle hash values, which allows remote attackers to delete certificates via (1) a certain delete message that is not properly handled in isakmp.c or isakmp_inf.c, or (2) a certain INITIAL-CONTACT message that is not properly handled in isakmp_inf.c. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 H.323 Unknown vulnerability in the H.323 protocol implementation in Windows 98, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code. Jonathan Baker INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 The KAME IKE Daemon Racoon, when authenticating a peer during Phase 1, validates the X.509 certificate but does not verify the RSA signature authentication, which allows remote attackers to establish unauthorized IP connections or conduct man-in-the-middle attacks using a valid, trusted X.509 certificate. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Internet Information Server (IIS) Multiple cross-site scripting (XSS) vulnerabilities in the administrative web pages for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allow remote attackers to execute HTML script as other users through (1) a certain ASP file in the IISHELP virtual directory, or (2) possibly other unknown attack vectors. Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Xsun Unspecified vulnerability in the (1) Xsun and (2) Xprt commands in Solaris 7, 8, 9, and 10 allows local users to execute arbitrary code. Robert L. Hollis DRAFT INTERIM ACCEPTED Nabil Ouchn INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Information Server (IIS) Multiple cross-site scripting (XSS) vulnerabilities in the administrative web pages for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allow remote attackers to execute HTML script as other users through (1) a certain ASP file in the IISHELP virtual directory, or (2) possibly other unknown attack vectors. Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass url_regex ACLs via a URL with a NULL ("%00") characterm, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Buffer overflow in the ISO9660 file system component for Linux kernel 2.4.x, 2.5.x and 2.6.x, allows local users with physical access to overflow kernel memory and execute arbitrary code via a malformed CD containing a long symbolic link entry. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Sun Solaris 8 mibiisa Buffer overflow in the MIB parsing component of mibiisa for Solaris 5.6 through 8 allows remote attackers to gain root privileges. David Proulx ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Integer overflow in the ip_setsockopt function in Linux kernel 2.4.22 through 2.4.25 and 2.6.1 through 2.6.3 allows local users to cause a denial of service (crash) or execute arbitrary code via the MCAST_MSFILTER socket option. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Information Server (IIS) Buffer overflow in the streaming media component for logging multicast requests in the ISAPI for the logging capability of Microsoft Windows Media Services (nsiislog.dll), as installed in IIS 5.0, allows remote attackers to execute arbitrary code via a large POST request to nsiislog.dll. Christine Walzer INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Mozilla before 1.4.2 executes Javascript events in the context of a new page while it is being loaded, allowing it to interact with the previous page (zombie document) and enable cross-domain and cross-site scripting (XSS) attacks, as demonstrated using onmousemove events. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Information Server (IIS) The logging capability for unicast and multicast transmissions in the ISAPI extension for Microsoft Windows Media Services in Microsoft Windows NT 4.0 and 2000, nsiislog.dll, allows remote attackers to cause a denial of service in Internet Information Server (IIS) and execute arbitrary code via a certain network request. Christine Walzer INTERIM ACCEPTED ACCEPTED HP-UX 11 Operating System Unknown vulnerability in HP-UX B.11.00, B.11.04, B.11.11, B.11.22, and B.11.23, when running TCP/IP on IPv4, allows remote attackers to cause a denial of service via certain packets, related to the PMTU, a different vulnerability than CVE-2004-1060. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Information Server (IIS) Microsoft Internet Information Services (IIS) 5.0 and 5.1 allows remote attackers to cause a denial of service via a long WebDAV request with a (1) PROPFIND or (2) SEARCH method, which generates an error condition that is not properly handled. Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Internet Information Server (IIS) The showcode.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files. Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Information Server (IIS) A typographical error in the script source access permissions for Internet Information Server (IIS) 5.0 does not properly exclude .COM files, which allows attackers with only write permissions to upload malicious .COM files, aka "Script Source Access Vulnerability." Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Information Server (IIS) Unknown vulnerability in the hosting process (dllhost.exe) for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allows remote attackers to gain privileges by executing an out of process application that acquires LocalSystem privileges, aka "Out of Process Privilege Elevation." Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Internet Information Server (IIS) Unknown vulnerability in the hosting process (dllhost.exe) for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allows remote attackers to gain privileges by executing an out of process application that acquires LocalSystem privileges, aka "Out of Process Privilege Elevation." Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 OpenSSL The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read. Matt Busby Matt Busby INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Information Server (IIS) IIS 5.0 allows remote attackers to obtain source code for .ASP files and other scripts via an HTTP GET request with a "Translate: f" header, aka the "Specialized Header" vulnerability. Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Internet Explorer Buffer overflow in URLMON.DLL in Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to execute arbitrary code via an HTTP response containing long values in (1) Content-type and (2) Content-encoding fields. Tiffany Bergeron INTERIM ACCEPTED INTERIM Harvey Rubinovitz ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Buffer overflow in the implementation of an HTML directive in mshtml.dll in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code via a web page that specifies embedded ActiveX controls in a way that causes 2 Unicode strings to be concatenated. Tiffany Bergeron INTERIM ACCEPTED INTERIM Harvey Rubinovitz ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft ASN.1 Library Double-free vulnerability in the ASN.1 library as used in Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service and possibly execute arbitrary code. David Proulx INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to execute arbitrary code under fewer security restrictions via a malformed web page that requires NetBIOS connectivity, aka "Zone Spoofing through Malformed Web Page" vulnerability. Tiffany Bergeron INTERIM ACCEPTED INTERIM Harvey Rubinovitz ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer Buffer overflow in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to execute arbitrary code via / (slash) characters in the Type property of an Object tag in a web page. Tiffany Bergeron INTERIM ACCEPTED INTERIM Harvey Rubinovitz ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 6.0 allows remote attackers to execute arbitrary code by modifying the Content-Disposition and Content-Type header fields in a way that causes Internet Explorer to believe that the file is safe to open without prompting the user, aka the "File Execution Vulnerability." Tiffany Bergeron INTERIM ACCEPTED INTERIM Harvey Rubinovitz ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.5 and earlier allows remote attackers to obtain the physical location of cached content and open the content in the Local Computer Zone, then use compiled HTML help (.chm) files to execute arbitrary programs. Tiffany Bergeron INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Information Server (IIS) Cross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page. Harvey Rubinovitz ACCEPTED Microsoft Windows Server 2003 Local Security Authority Subsystem Service (LSASS) Stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via a packet that causes the DsRolerUpgradeDownlevelServer function to create long debug entries for the DCPROMO.LOG log file, as exploited by the Sasser worm. Andrew Buttner INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office Unspecified vulnerability in Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and other products, allows user-assisted attackers to execute arbitrary code via an Office file with malformed string that triggers memory corruption related to record lengths, aka "Microsoft Office Parsing Vulnerability," a different vulnerability than CVE-2006-2389. Robert L. Hollis INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Mozilla allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Mozilla to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Sun Solaris 10 Multiple unspecified vulnerabilities in the KSSL kernel module in Sun Solaris 10, when configured with the KSSL proxy, allow remote attackers to cause a denial of service (kernel panic) via unspecified vectors related to "memory buffers" of Secure Socket Layer (SSL) records. Todd Dolinsky DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Internet Information Server (IIS) Buffer overflow in IIS 4.0 allows remote attackers to cause a denial of service via a malformed request for files with .HTR, .IDC, or .STM extensions. Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Multiple vulnerabilities in multiple vendor implementations of the Secure/Multipurpose Internet Mail Extensions (S/MIME) protocol allow remote attackers to cause a denial of service and possibly execute arbitrary code via an S/MIME email message containing certain unexpected ASN.1 constructs, as demonstrated using the NISSC test suite. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Internet Information Server (IIS) In IIS, remote attackers can obtain source code for ASP files by appending "::$DATA" to the URL. Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Unspecified vulnerability in the IP implementation in Sun Solaris 8 and 9 allows remote attackers to cause a denial of service (CPU consumption) via crafted IP packets, probably related to fragmented packets with duplicate or missing fragments. Todd Dolinsky DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Information Server (IIS) IIS 5.0 uses relative paths to find system files that will run in-process, which allows local users to gain privileges via a Trojan horse file, aka the "System file listing privilege elevation" vulnerability. Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Local Descriptor Table (LDT) The NtSetLdtEntries function in the programming interface for the Local Descriptor Table (LDT) in Windows NT 4.0 and Windows 2000 allows local attackers to gain access to kernel memory and execute arbitrary code via an expand-down data segment descriptor descriptor that points to protected memory. Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 NetWare The Client Service for NetWare (CSNW) on Microsoft Windows 2000 SP4, XP SP1 and Sp2, and Server 2003 SP1 and earlier, allows remote attackers to execute arbitrary code due to an "unchecked buffer" when processing certain crafted network messages. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 7 CDE CDE ToolTalk database server (ttdbserver) allows remote attackers to overwrite arbitrary memory locations with a zero, and possibly gain privileges, via a file descriptor argument in an AUTH_UNIX procedure call, which is used as a table index by the _TT_ISCLOSE procedure. David Proulx Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Internet Information Server (IIS) IIS 5.0 uses relative paths to find system files that will run in-process, which allows local users to gain privileges via a Trojan horse file, aka the "System file listing privilege elevation" vulnerability. Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Operating System Stack-based buffer overflow in the NetpManageIPCConnect function in the Workstation service (wkssvc.dll) in Microsoft Windows 2000 SP4 and XP SP2 allows remote attackers to execute arbitrary code via NetrJoinDomain2 RPC messages with a long hostname. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky DEPRECATED DEPRECATED Microsoft Windows 2000 H.323 Unknown vulnerability in the H.323 protocol implementation in Windows 98, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code. Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Agent Microsoft Agent allows remote attackers to spoof trusted Internet content and execute arbitrary code by disguising security prompts on a malicious Web page. Harvey Rubinovitz DRAFT Harvey Rubinovitz INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux3 Ethereal 0.10.1 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a zero-length Presentation protocol selector. Jay Beale Jay Beale Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Help and Support Center (HSC) Help and Support Center in Microsoft Windows XP SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code via quotation marks in an hcp:// URL, which are not quoted when constructing the argument list to HelpCtr.exe. Harvey Rubinovitz Harvey Rubinovitz INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Sun Solaris 10 Unspecified vulnerability in the dynamic tracing framework (DTrace) on Sun Solaris 10 before 20070730 allows local users with PRIV_DTRACE_USER privileges to cause a denial of service (panic or hang) via unspecified use of certain DTrace programs. Todd Dolinsky DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Private Communications Transport (PCT) Buffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library, as used in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via PCT 1.0 handshake packets. Andrew Buttner INTERIM ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 OpenSSL OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the Codenomicon TLS Test Tool. Matt Busby Matt Busby INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 COM Internet Services Windows 2000, XP, and Server 2003 does not properly "validate the use of memory regions" for COM structured storage files, which allows attackers to execute arbitrary code, aka the "COM Structured Storage Vulnerability." Christine Walzer Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Remote Procedure Call (RPC) A multi-threaded race condition in the Windows RPC DCOM functionality with the MS03-039 patch installed allows remote attackers to cause a denial of service (crash or reboot) by causing two threads to process the same RPC request, which causes one thread to use memory after it has been freed, a different vulnerability than CVE-2003-0352 (Blaster/Nachi), CVE-2003-0715, and CVE-2003-0528, and as demonstrated by certain exploits against those vulnerabilities. Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Information Server (IIS) IIS 5.0 allows remote attackers to cause a denial of service via a series of malformed WebDAV requests. Tiffany Bergeron INTERIM Ingrid Skoog ACCEPTED ACCEPTED Sun Solaris 8 libnsl Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd. David Proulx Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED HP-UX 11 Operating System Multiple TCP/IP and ICMP implementations, when using Path MTU (PMTU) discovery (PMTUD), allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via forged ICMP ("Fragmentation Needed and Don't Fragment was Set") packets with a low next-hop MTU value, aka the "Path MTU discovery attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Local Security Authority Subsystem Service (LSASS) Stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via a packet that causes the DsRolerUpgradeDownlevelServer function to create long debug entries for the DCPROMO.LOG log file, as exploited by the Sasser worm. Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Enhanced Metafile (EMF) Windows Metafile (WMF) Buffer overflow in the rendering for (1) Windows Metafile (WMF) or (2) Enhanced Metafile (EMF) image formats in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, and XP SP1 allows remote attackers to execute arbitrary code via a malformed WMF or EMF image. Andrew Buttner INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Windows logon process (winlogon) Buffer overflow in the Windows logon process (winlogon) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, and XP SP1, when a member of a domain, allows remote attackers to execute arbitrary code. Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED John Hoyland Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Windows logon process (winlogon) Buffer overflow in the Windows logon process (winlogon) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, and XP SP1, when a member of a domain, allows remote attackers to execute arbitrary code. Andrew Buttner INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Remote Procedure Call (RPC) A multi-threaded race condition in the Windows RPC DCOM functionality with the MS03-039 patch installed allows remote attackers to cause a denial of service (crash or reboot) by causing two threads to process the same RPC request, which causes one thread to use memory after it has been freed, a different vulnerability than CVE-2003-0352 (Blaster/Nachi), CVE-2003-0715, and CVE-2003-0528, and as demonstrated by certain exploits against those vulnerabilities. Christine Walzer DRAFT Microsoft Windows 2000 Remote Procedure Call (RPC) A multi-threaded race condition in the Windows RPC DCOM functionality with the MS03-039 patch installed allows remote attackers to cause a denial of service (crash or reboot) by causing two threads to process the same RPC request, which causes one thread to use memory after it has been freed, a different vulnerability than CVE-2003-0352 (Blaster/Nachi), CVE-2003-0715, and CVE-2003-0528, and as demonstrated by certain exploits against those vulnerabilities. Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Secure Sockets Layer (SSL) The Microsoft Secure Sockets Layer (SSL) library, as used in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service via malformed SSL messages. David Proulx INTERIM ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 The dissect_attribute_value_pairs function in packet-radius.c for Ethereal 0.8.13 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a malformed RADIUS packet that triggers a null dereference. Jay Beale Jay Beale Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Local Descriptor Table (LDT) The NtSetLdtEntries function in the programming interface for the Local Descriptor Table (LDT) in Windows NT 4.0 and Windows 2000 allows local attackers to gain access to kernel memory and execute arbitrary code via an expand-down data segment descriptor descriptor that points to protected memory. Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Multiple UNC Provider (MUP) Buffer overflow in Multiple UNC Provider (MUP) in Microsoft Windows operating systems allows local users to cause a denial of service or possibly gain SYSTEM privileges via a long UNC request. Tiffany Bergeron ACCEPTED Microsoft Windows XP Private Communications Transport (PCT) Buffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library, as used in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via PCT 1.0 handshake packets. Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Unknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to obtain information and possibly execute code when browsing from a web site to a web folder view using WebDAV, aka "Web Folder Behaviors Cross-Domain Vulnerability". Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Multiple buffer overflows in Ethereal 0.8.13 to 0.10.2 allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) NetFlow, (2) IGAP, (3) EIGRP, (4) PGM, (5) IrDA, (6) BGP, (7) ISUP, or (8) TCAP dissectors. Jay Beale Jay Beale Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Secure Sockets Layer (SSL) The Microsoft Secure Sockets Layer (SSL) library, as used in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service via malformed SSL messages. David Proulx INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Secure Sockets Layer (SSL) The Microsoft Secure Sockets Layer (SSL) library, as used in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service via malformed SSL messages. David Proulx INTERIM ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Local Security Authority Subsystem Service (LSASS) Stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via a packet that causes the DsRolerUpgradeDownlevelServer function to create long debug entries for the DCPROMO.LOG log file, as exploited by the Sasser worm. Tiffany Bergeron INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Outlook Express The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability." Andrew Buttner INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Operating System The Bourne shell (sh) in Solaris 8, 9, and 10 allows local users to cause a denial of service (sh crash) via an unspecified attack vector that causes sh processes to crash during creation of temporary files. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Red Hat 9 Ethereal 0.10.1 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a zero-length Presentation protocol selector. Jay Beale Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Ethereal The SPNEGO dissector in Ethereal 0.9.12 and earlier allows remote attackers to cause a denial of service (crash) via an invalid ASN.1 value. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Red Hat 9 The dissect_attribute_value_pairs function in packet-radius.c for Ethereal 0.8.13 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a malformed RADIUS packet that triggers a null dereference. Jay Beale Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Red Hat 9 Multiple buffer overflows in Ethereal 0.8.13 to 0.10.2 allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) NetFlow, (2) IGAP, (3) EIGRP, (4) PGM, (5) IrDA, (6) BGP, (7) ISUP, or (8) TCAP dissectors. Jay Beale Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Red Hat 9 The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass url_regex ACLs via a URL with a NULL ("%00") characterm, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 httpd Memory leak in ssl_engine_io.c for mod_ssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service (memory consumption) via plain HTTP requests to the SSL port of an SSL-enabled server. Jay Beale Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 libxml2 Buffer overflow in the (1) nanohttp or (2) nanoftp modules in XMLSoft Libxml 2 (Libxml2) 2.6.0 through 2.6.5 allow remote attackers to execute arbitrary code via a long URL. Jay Beale Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 mozilla Mozilla before 1.4.2 executes Javascript events in the context of a new page while it is being loaded, allowing it to interact with the previous page (zombie document) and enable cross-domain and cross-site scripting (XSS) attacks, as demonstrated using onmousemove events. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 mozilla Mozilla allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Mozilla to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 mozilla Multiple vulnerabilities in multiple vendor implementations of the Secure/Multipurpose Internet Mail Extensions (S/MIME) protocol allow remote attackers to cause a denial of service and possibly execute arbitrary code via an S/MIME email message containing certain unexpected ASN.1 constructs, as demonstrated using the NISSC test suite. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 OpenSSL OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the Codenomicon TLS Test Tool. Matt Busby Matt Busby Matt Busby INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 OpenSSL The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference. Matt Busby Matt Busby Matt Busby INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Simple Network Management Protocol (SNMP) Vulnerabilities in the SNMPv1 request handling of a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via (1) GetRequest, (2) GetNextRequest, and (3) SetRequest messages, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor. This and other SNMP-related candidates will be updated when more accurate information is available. Harvey Rubinovitz ACCEPTED Red Hat Enterprise Linux 3 Net-SNMP Net-SNMP before 5.0.9 allows a user or community to access data in MIB objects, even if that data is not allowed to be viewed. Matt Busby Matt Busby INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Linux kernel Unknown vulnerability in the eflags checking in the 32-bit ptrace emulation for the Linux kernel on AMD64 systems allows local users to gain privileges. Matt Busby Matt Busby INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Linux kernel The mremap system call (do_mremap) in Linux kernel 2.4.x before 2.4.21, and possibly other versions before 2.4.24, does not properly perform bounds checks, which allows local users to cause a denial of service and possibly gain privileges by causing a remapping of a virtual memory area (VMA) to create a zero length VMA, a different vulnerability than CAN-2004-0077. Matt Busby Matt Busby INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 CVS server CVS server before 1.11.10 may allow attackers to cause the CVS server to create directories and files in the file system root directory via malformed module requests. Jay Beale Matt Busby INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Sun Solaris 10 Unspecified vulnerability in the TCP Loopback/Fusion implementation in Sun Solaris 10 allows local users to cause a denial of service (resource exhaustion and service hang) via unspecified vectors. Todd Dolinsky DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 KDE Personal Information Management (kdepim) Buffer overflow in the VCF file information reader for KDE Personal Information Management (kdepim) suite in KDE 3.1.0 through 3.1.4 allows attackers to execute arbitrary code via a VCF file. Jay Beale INTERIM Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Apache Multiple stack-based buffer overflows in (1) mod_alias and (2) mod_rewrite for Apache before 1.3.29 allow attackers to create configuration files to cause a denial of service (crash) or execute arbitrary code via a regular expression with more than 9 captures. Jay Beale Matt Busby INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 httpd Multiple stack-based buffer overflows in (1) mod_alias and (2) mod_rewrite for Apache before 1.3.29 allow attackers to create configuration files to cause a denial of service (crash) or execute arbitrary code via a regular expression with more than 9 captures. Jay Beale Matt Busby INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Sysstat The (1) post and (2) trigger scripts in sysstat 4.0.7 and earlier allow local users to overwrite arbitrary files via symlink attacks on temporary files, a different vulnerability than CVE-2004-0108. Jay Beale Matt Busby Matt Busby INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 nfs-utils packages rpc.mountd in nfs-utils after 1.0.3 and before 1.0.6 allows attackers to cause a denial of service (crash) via an NFS mount of a directory from a client whose reverse DNS lookup name is different from the forward lookup name. Jay Beale Matt Busby Matt Busby INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Linux kernel The mremap system call (do_mremap) in Linux kernel 2.4.x before 2.4.21, and possibly other versions before 2.4.24, does not properly perform bounds checks, which allows local users to cause a denial of service and possibly gain privileges by causing a remapping of a virtual memory area (VMA) to create a zero length VMA, a different vulnerability than CAN-2004-0077. Jay Beale Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Sun Solaris 8 lbxproxy Buffer overflow in Low BandWidth X proxy (lbxproxy) in Solaris 8 allows local users to execute arbitrary code via a long display command line option. David Proulx ACCEPTED Red Hat Linux 9 Linux kernel Real time clock (RTC) routines in Linux kernel 2.4.23 and earlier do not properly initialize their structures, which could leak kernel data to user space. Jay Beale Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 KDE Personal Information Management (kdepim) Buffer overflow in the VCF file information reader for KDE Personal Information Management (kdepim) suite in KDE 3.1.0 through 3.1.4 allows attackers to execute arbitrary code via a VCF file. Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Tethereal The Q.931 dissector in Ethereal before 0.10.0, and Tethereal, allows remote attackers to cause a denial of service (crash) via a malformed Q.931, which triggers a null dereference. Jay Beale Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Ethereal The SMB dissector in Ethereal before 0.10.0 allows remote attackers to cause a denial of service via a malformed SMB packet that triggers a segmentation fault during processing of Selected packets. Jay Beale Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 CVS server CVS server before 1.11.10 may allow attackers to cause the CVS server to create directories and files in the file system root directory via malformed module requests. Jay Beale Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 tcpdump The rawprint function in the ISAKMP decoding routines (print-isakmp.c) for tcpdump 3.8.1 and earlier allows remote attackers to cause a denial of service (segmentation fault) via malformed ISAKMP packets that cause invalid "len" or "loc" values to be used in a loop, a different vulnerability than CVE-2003-0989. Jay Beale ACCEPTED Matt Busby INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 tcpdump The print_attr_string function in print-radius.c for tcpdump 3.8.1 and earlier allows remote attackers to cause a denial of service (segmentation fault) via a RADIUS attribute with a large length value. Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 tcpdump tcpdump before 3.8.1 allows remote attackers to cause a denial of service (infinite loop) via certain ISAKMP packets, a different vulnerability than CVE-2004-0057. Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 tcpdump The rawprint function in the ISAKMP decoding routines (print-isakmp.c) for tcpdump 3.8.1 and earlier allows remote attackers to cause a denial of service (segmentation fault) via malformed ISAKMP packets that cause invalid "len" or "loc" values to be used in a loop, a different vulnerability than CVE-2003-0989. Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 tcpdump The print_attr_string function in print-radius.c for tcpdump 3.8.1 and earlier allows remote attackers to cause a denial of service (segmentation fault) via a RADIUS attribute with a large length value. Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 sysstat The (1) post and (2) trigger scripts in sysstat 4.0.7 and earlier allow local users to overwrite arbitrary files via symlink attacks on temporary files, a different vulnerability than CVE-2004-0108. Jay Beale Matt Busby INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Buffer overflow in Collaboration Data Objects (CDO), as used in Microsoft Windows and Microsoft Exchange Server, allows remote attackers to execute arbitrary code when CDOSYS or CDOEX processes an e-mail message with a large header name, as demonstrated using the "Content-Type" string. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 tcpdump tcpdump before 3.8.1 allows remote attackers to cause a denial of service (infinite loop) via certain ISAKMP packets, a different vulnerability than CVE-2004-0057. Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 gdk-pixbuf gdk-pixbuf before 0.20 allows attackers to cause a denial of service (crash) via a malformed bitmap (BMP) file. Jay Beale INTERIM Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 gdk-pixbuf gdk-pixbuf before 0.20 allows attackers to cause a denial of service (crash) via a malformed bitmap (BMP) file. Jay Beale INTERIM Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 MSN Messenger Microsoft MSN Messenger 6.0 and 6.1 does not properly handle certain requests, which allows remote attackers to read arbitrary files. Christine Walzer INTERIM Andrew Buttner ACCEPTED ACCEPTED Microsoft Windows 95 Microsoft Outlook Argument injection vulnerability in Microsoft Outlook 2002 does not sufficiently filter parameters of mailto: URLs when using them as arguments when calling OUTLOOK.EXE, which allows remote attackers to use script code in the Local Machine zone and execute arbitrary programs. Andrew Buttner INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Windows Media Services Unknown vulnerability in Windows Media Station Service and Windows Media Monitor Service components of Windows Media Services 4.1 allows remote attackers to cause a denial of service (disallowing new connections) via a certain sequence of TCP/IP packets. Tiffany Bergeron INTERIM John Hoyland INTERIM John Hoyland Jeff Cheng Jeff Cheng INTERIM Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Operating System Unspecified vulnerability in Microsoft Windows 2000 SP4, XP SP1 and SP2, Server 2003 and 2003 SP1, allows remote attackers to execute arbitrary code via unspecified vectors involving unhandled exceptions, memory resident applications, and incorrectly "unloading chained exception." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Ethereal The OSI dissector in Ethereal 0.9.12 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via invalid IPv4 or IPv6 prefix lengths, possibly triggering a buffer overflow. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 mod_python Unknown vulnerability in mod_python 3.0.x before 3.0.4, and 2.7.x before 2.7.9, allows remote attackers to cause a denial of service (httpd crash) via a certain query string. Jay Beale Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED Robert L. Hollis DEPRECATED DEPRECATED Red Hat Enterprise Linux 3 Mutt Buffer overflow in the index menu code (menu_pad_string of menu.c) for Mutt 1.4.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain mail messages. Jay Beale ACCEPTED Matt Busby INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 mremap The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985. Jay Beale Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Vicam USB driver The Vicam USB driver in Linux before 2.4.25 does not use the copy_from_user function when copying data from userspace to kernel space, which crosses security boundaries and allows local users to cause a denial of service. Jay Beale Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Linux kernel Stack-based buffer overflow in the ncp_lookup function for ncpfs in Linux kernel 2.4.x allows local users to gain privileges. Jay Beale Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Linux kernel Unknown vulnerability in Linux kernel before 2.4.22 allows local users to gain privileges, related to "R128 DRI limits checking." Jay Beale Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Unspecified vulnerability in Low Bandwidth X proxy (lbxproxy) on Sun Solaris 8 through 10 before 20070725 allows local users to read arbitrary files with root group ownership via unknown vectors. Todd Dolinsky DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 XMLSoft Libxml2 Buffer overflow in the (1) nanohttp or (2) nanoftp modules in XMLSoft Libxml 2 (Libxml2) 2.6.0 through 2.6.5 allow remote attackers to execute arbitrary code via a long URL. Jay Beale Matt Busby Matt Busby INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED Robert L. Hollis DEPRECATED DEPRECATED Red Hat Enterprise Linux 3 XFree86 Multiple unknown vulnerabilities in XFree86 4.1.0 to 4.3.0, related to improper handling of font files, a different set of vulnerabilities than CVE-2004-0083 and CVE-2004-0084. Jay Beale Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 XFree86 Buffer overflow in the ReadFontAlias function in XFree86 4.1.0 to 4.3.0, when using the CopyISOLatin1Lowered function, allows local or remote authenticated users to execute arbitrary code via a malformed entry in the font alias (font.alias) file, a different vulnerability than CVE-2004-0083 and CVE-2004-0106. Jay Beale Matt Busby Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 XFree86 Buffer overflow in ReadFontAlias from dirfile.c of XFree86 4.1.0 through 4.3.0 allows local users and remote attackers to execute arbitrary code via a font alias file (font.alias) with a long token, a different vulnerability than CVE-2004-0084 and CVE-2004-0106. Jay Beale Matt Busby Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 MicrosoftSQL Server Buffer overflows in Microsoft SQL Server 7.0 and 2000 allow attackers with access to SQL Server to execute arbitrary code through the functions (1) raiserror, (2) formatmessage, or (3) xp_sprintf. NOTE: the C runtime format string vulnerability reported in MS01-060 is identified by CVE-2001-0879. Yi-Fang Koh Ingrid Skoog INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 SUSE Linux 10.1 SUSE Linux 10.0 SUSE Linux Professional 9.3 SUSE Linux Desktop 1.0 SUSE Linux Enterprise Desktop 10 OpenOffice_org1 OpenOffice_org1-ar OpenOffice_org1-ca OpenOffice_org1-cs OpenOffice_org1-da OpenOffice_org1-de OpenOffice_org1-el OpenOffice_org1-en OpenOffice_org1-es OpenOffice_org1-et OpenOffice_org1-fi OpenOffice_org1-fr OpenOffice_org1-gnome OpenOffice_org1-hu OpenOffice_org1-it OpenOffice_org1-ja OpenOffice_org1-kde OpenOffice_org1-ko OpenOffice_org1-nl OpenOffice_org1-pl OpenOffice_org1-pt OpenOffice_org1-ru OpenOffice_org1-sk OpenOffice_org1-sl OpenOffice_org1-sv OpenOffice_org1-tr OpenOffice_org1-zh-CN OpenOffice_org1-zh-TW OpenOffice_org OpenOffice_org-af OpenOffice_org-be-BY OpenOffice_org-bg OpenOffice_org-ca OpenOffice_org-cs OpenOffice_org-cy OpenOffice_org-da OpenOffice_org-de OpenOffice_org-el OpenOffice_org-en OpenOffice_org-en-GB OpenOffice_org-es OpenOffice_org-et OpenOffice_org-fi OpenOffice_org-fr OpenOffice_org-galleries OpenOffice_org-gnome OpenOffice_org-gu-IN OpenOffice_org-hr OpenOffice_org-hu OpenOffice_org-hunspell OpenOffice_org-it OpenOffice_org-ja OpenOffice_org-kde OpenOffice_org-ko OpenOffice_org-mono OpenOffice_org-nb OpenOffice_org-nl OpenOffice_org-nn OpenOffice_org-officebean OpenOffice_org-pa-IN OpenOffice_org-pl OpenOffice_org-pt OpenOffice_org-pt-BR OpenOffice_org-ru OpenOffice_org-sk OpenOffice_org-sl OpenOffice_org-sv OpenOffice_org-tr OpenOffice_org-vi OpenOffice_org-xh OpenOffice_org-zh-CN OpenOffice_org-zh-TW OpenOffice_org-zu Multiple integer overflows in OpenOffice.org (OOo) 2.0.4 and earlier, and possibly other versions before 2.1.0; and StarOffice 6 through 8; allow user-assisted remote attackers to execute arbitrary code via a crafted (a) WMF or (b) EMF file that triggers heap-based buffer overflows in (1) wmf/winwmf.cxx, during processing of META_ESCAPE records; and wmf/enhwmf.cxx, during processing of (2) EMR_POLYPOLYGON and (3) EMR_POLYPOLYGON16 records. Thomas R. Jones DRAFT Jonathan Baker INTERIM ACCEPTED ACCEPTED cpe://novell:linux_desktop:9 cpe://novell:suse_linux:10.1 cpe://novell:suse_linux:10.0 cpe://novell:suse_linux:9.3:pro cpe://novell:suse_linux:1.0:desktop cpe://novell:suse_linux_enterprise:10:desktop cpe:///novell:OpenOffice_org1 cpe:///novell:OpenOffice_org1-ar cpe:///novell:OpenOffice_org1-ca cpe:///novell:OpenOffice_org1-cs cpe:///novell:OpenOffice_org1-da cpe:///novell:OpenOffice_org1-de cpe:///novell:OpenOffice_org1-el cpe:///novell:OpenOffice_org1-en cpe:///novell:OpenOffice_org1-es cpe:///novell:OpenOffice_org1-et cpe:///novell:OpenOffice_org1-fi cpe:///novell:OpenOffice_org1-fr cpe:///novell:OpenOffice_org1-gnome cpe:///novell:OpenOffice_org1-hu cpe:///novell:OpenOffice_org1-it cpe:///novell:OpenOffice_org1-ja cpe:///novell:OpenOffice_org1-kde cpe:///novell:OpenOffice_org1-ko cpe:///novell:OpenOffice_org1-nl cpe:///novell:OpenOffice_org1-pl cpe:///novell:OpenOffice_org1-pt cpe:///novell:OpenOffice_org1-ru cpe:///novell:OpenOffice_org1-sk cpe:///novell:OpenOffice_org1-sl cpe:///novell:OpenOffice_org1-sv cpe:///novell:OpenOffice_org1-tr cpe:///novell:OpenOffice_org1-zh-CN cpe:///novell:OpenOffice_org1-zh-TW cpe:///novell:OpenOffice_org cpe:///novell:OpenOffice_org-af cpe:///novell:OpenOffice_org-be-BY cpe:///novell:OpenOffice_org-bg cpe:///novell:OpenOffice_org-ca cpe:///novell:OpenOffice_org-cs cpe:///novell:OpenOffice_org-cy cpe:///novell:OpenOffice_org-da cpe:///novell:OpenOffice_org-de cpe:///novell:OpenOffice_org-el cpe:///novell:OpenOffice_org-en cpe:///novell:OpenOffice_org-en-GB cpe:///novell:OpenOffice_org-es cpe:///novell:OpenOffice_org-et cpe:///novell:OpenOffice_org-fi cpe:///novell:OpenOffice_org-fr cpe:///novell:OpenOffice_org-galleries cpe:///novell:OpenOffice_org-gnome cpe:///novell:OpenOffice_org-gu-IN cpe:///novell:OpenOffice_org-hr cpe:///novell:OpenOffice_org-hu cpe:///novell:OpenOffice_org-hunspell cpe:///novell:OpenOffice_org-it cpe:///novell:OpenOffice_org-ja cpe:///novell:OpenOffice_org-kde cpe:///novell:OpenOffice_org-ko cpe:///novell:OpenOffice_org-mono cpe:///novell:OpenOffice_org-nb cpe:///novell:OpenOffice_org-nl cpe:///novell:OpenOffice_org-nn cpe:///novell:OpenOffice_org-officebean cpe:///novell:OpenOffice_org-pa-IN cpe:///novell:OpenOffice_org-pl cpe:///novell:OpenOffice_org-pt cpe:///novell:OpenOffice_org-pt-BR cpe:///novell:OpenOffice_org-ru cpe:///novell:OpenOffice_org-sk cpe:///novell:OpenOffice_org-sl cpe:///novell:OpenOffice_org-sv cpe:///novell:OpenOffice_org-tr cpe:///novell:OpenOffice_org-vi cpe:///novell:OpenOffice_org-xh cpe:///novell:OpenOffice_org-zh-CN cpe:///novell:OpenOffice_org-zh-TW cpe:///novell:OpenOffice_org-zu Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package OpenOffice_org-kde is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop SUSE Linux Professional 9.3 Package OpenOffice_org1-nl is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 Package OpenOffice_org-sl is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 SUSE Linux Professional 9.3 Package OpenOffice_org1-ja is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro SUSE Linux Professional 9.3 Package OpenOffice_org1-ru is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro SUSE Linux Professional 9.3 Package OpenOffice_org1-sv is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package OpenOffice_org-zh-TW is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package OpenOffice_org-it is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop SUSE Linux Professional 9.3 Package OpenOffice_org1-ko is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro SUSE Linux Professional 9.3 Package OpenOffice_org1-zh-TW is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 Package OpenOffice_org-da is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package OpenOffice_org-galleries is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package OpenOffice_org-zh-CN is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package OpenOffice_org-ja is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 Package OpenOffice_org-af is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 SUSE Linux Professional 9.3 Package OpenOffice_org1-en is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro SUSE Linux Professional 9.3 Package OpenOffice_org1-ca is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package OpenOffice_org-gnome is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop SUSE Linux Professional 9.3 Package OpenOffice_org1-pt is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro SUSE Linux Professional 9.3 Package OpenOffice_org1-sk is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro SUSE Linux 10.0 Package OpenOffice_org-hunspell is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 Package OpenOffice_org-ca is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package OpenOffice_org-pt-BR is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 Package OpenOffice_org-pa-IN is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package OpenOffice_org is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 Package OpenOffice_org-sv is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 Package OpenOffice_org-en-GB is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 SUSE Linux Professional 9.3 Package OpenOffice_org1-fi is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 Package OpenOffice_org-nb is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 Package OpenOffice_org-el is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package OpenOffice_org-pl is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop SUSE Linux Professional 9.3 Package OpenOffice_org1-ar is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro SUSE Linux Professional 9.3 Package OpenOffice_org1-kde is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro SUSE Linux Professional 9.3 Package OpenOffice_org1-sl is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package OpenOffice_org-cs is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 Package OpenOffice_org-hr is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 Package OpenOffice_org-tr is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 SUSE Linux Professional 9.3 Package OpenOffice_org1-es is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro SUSE Linux Professional 9.3 Package OpenOffice_org1-it is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package OpenOffice_org-de is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop SUSE Linux Professional 9.3 Package OpenOffice_org1-et is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 Package OpenOffice_org-et is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 SUSE Linux Professional 9.3 Package OpenOffice_org1-fr is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package OpenOffice_org-pt is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 Package OpenOffice_org-ar is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 SUSE Linux Professional 9.3 Package OpenOffice_org1-el is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package OpenOffice_org-nl is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop SUSE Linux Professional 9.3 Package OpenOffice_org1-zh-CN is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package OpenOffice_org-es is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop openSUSE 10.2 SUSE Linux 10.1 Package OpenOffice_org-officebean is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 SUSE Linux Professional 9.3 Package OpenOffice_org1-de is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro SUSE Linux Professional 9.3 Package OpenOffice_org1-pl is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 Package OpenOffice_org-nn is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 Package OpenOffice_org-xh is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 Package OpenOffice_org-fi is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 Package OpenOffice_org-be-BY is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 Package OpenOffice_org-bg is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 Package OpenOffice_org-ru is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 SUSE Linux Professional 9.3 Package OpenOffice_org1-hu is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro SUSE Linux Professional 9.3 Package OpenOffice_org1-cs is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 Package OpenOffice_org-ko is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 SUSE Linux Professional 9.3 Package OpenOffice_org1-gnome is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 Package OpenOffice_org-gu-IN is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 Package OpenOffice_org-cy is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 SUSE Linux Professional 9.3 Package OpenOffice_org1-tr is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro SUSE Linux Professional 9.3 Package OpenOffice_org1-da is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 Package OpenOffice_org-vi is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 Red Hat Linux 9 mod_python Unknown vulnerability in mod_python 3.0.x before 3.0.4, and 2.7.x before 2.7.9, allows remote attackers to cause a denial of service (httpd crash) via a certain query string. Jay Beale Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Race condition in recursive directory deletion with the (1) -r or (2) -R option in rm in Solaris 8 through 10 before 20070208 allows local users to delete files and directories as the user running rm by moving a low-level directory to a higher level as it is being deleted, which causes rm to chdir to a ".." directory that is higher than expected, possibly up to the root file system, a related issue to CVE-2002-0435. Todd Dolinsky DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Samba 3.0.0 and 3.0.1 The mksmbpasswd shell script (mksmbpasswd.sh) in Samba 3.0.0 and 3.0.1, when creating an account but marking it as disabled, may overwrite the user password with an uninitialized buffer, which could enable the account with a more easily guessable password. Jay Beale Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 Package OpenOffice_org-zu is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 SUSE Linux Professional 9.3 Package OpenOffice_org1 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9.3::pro Red Hat Enterprise Linux 3 PWLib Multiple vulnerabilities in PWLib before 1.6.0 allow remote attackers to cause a denial of service and possibly execute arbitrary code, as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol. Jay Beale Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 mremap The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985. Jay Beale Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package OpenOffice_org-sk is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop Red Hat Linux 9 KDE Konqueror in KDE 3.1.3 and earlier (kdelibs) allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Konqueror to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package OpenOffice_org-hu is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package OpenOffice_org-mono is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop Red Hat Linux 9 Midnight Commander Stack-based buffer overflow in vfs_s_resolve_symlink of vfs/direntry.c for Midnight Commander (mc) 4.6.0 and earlier, and possibly later versions, allows remote attackers to execute arbitrary code during symlink conversion. Jay Beale Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package OpenOffice_org-fr is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop Red Hat Linux 9 slocate Heap-based buffer overflow in main.c of slocate 2.6, and possibly other versions, may allow local users to gain privileges via a modified slocate database that causes a negative "pathlen" value to be used. Jay Beale Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Gaim Integer overflow in Gaim 0.74 and earlier, and Ultramagnetic before 0.81, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a directIM packet that triggers a heap-based buffer overflow. Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft SQL Server 2000 Vulnerabilities in RPC servers in (1) Microsoft Exchange Server 2000 and earlier, (2) Microsoft SQL Server 2000 and earlier, (3) Windows NT 4.0, and (4) Windows 2000 allow remote attackers to cause a denial of service via malformed inputs. Tiffany Bergeron Jonathan Baker INTERIM Ingrid Skoog ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Gaim Buffer overflow in the Extract Info Field Function for (1) MSN and (2) YMSG protocol handlers in Gaim 0.74 and earlier, and Ultramagnetic before 0.81, allows remote attackers to cause a denial of service and possibly execute arbitrary code. Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Gaim Multiple buffer overflows in Gaim 0.75 and earlier, and Ultramagnetic before 0.81, allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) cookies in a Yahoo web connection, (2) a long name parameter in the Yahoo login web page, (3) a long value parameter in the Yahoo login page, (4) a YMSG packet, (5) the URL parser, and (6) HTTP proxy connect. Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 mozilla Firefox before 1.0.5 and Mozilla before 1.7.9 does not properly clone base objects, which allows remote attackers to execute arbitrary code by navigating the prototype chain to reach a privileged object. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System COM+ in Microsoft Windows does not properly "create and use memory structures," which allows local users or remote attackers to execute arbitrary code. Robert L. Hollis DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Mailman Cross-site scripting (XSS) vulnerability in the create CGI script for Mailman before 2.1.3 allows remote attackers to steal cookies of other users. Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Mailman Cross-site scripting (XSS) vulnerability in the admin CGI script for Mailman before 2.1.4 allows remote attackers to steal session cookies and conduct unauthorized activities. Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 6 on Double Byte Character Set (DBCS) systems allows remote attackers to alter displayed address bars and spoof web pages via a URL containing special characters, facilitating phishing attacks, aka the "Address Bar Spoofing on Double Byte Character Set Systems Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Outlook Express Buffer overflow in Microsoft Outlook Express 5.5 and 6 allows remote attackers to execute arbitrary code via a crafted Windows Address Book (WAB) file containing "certain Unicode strings" and modified length values. Robert L. Hollis DRAFT INTERIM ACCEPTED John Hoyland Anna Min INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Mutt Buffer overflow in the index menu code (menu_pad_string of menu.c) for Mutt 1.4.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain mail messages. Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 netpbm netpbm 9.25 and earlier does not properly create temporary files, which allows local users to overwrite arbitrary files. Jay Beale Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Internet Information Server (IIS) Cross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page. Tiffany Bergeron ACCEPTED Red Hat Linux 9 XFree86 Multiple unknown vulnerabilities in XFree86 4.1.0 to 4.3.0, related to improper handling of font files, a different set of vulnerabilities than CVE-2004-0083 and CVE-2004-0084. Jay Beale Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 4 mozilla Firefox before 1.0.5, Thunderbird before 1.0.5, Mozilla before 1.7.9, Netscape 8.0.2, and K-Meleon 0.9 runs XBL scripts even when Javascript has been disabled, which makes it easier for remote attackers to bypass such protection. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows ME Microsoft Internet Explorer Internet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the Popup.show method and use drag-and-drop actions in a popup window, aka "HijackClick 3" and the "Script in Image Tag File Download Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 XFree86 Buffer overflow in the ReadFontAlias function in XFree86 4.1.0 to 4.3.0, when using the CopyISOLatin1Lowered function, allows local or remote authenticated users to execute arbitrary code via a malformed entry in the font alias (font.alias) file, a different vulnerability than CVE-2004-0083 and CVE-2004-0106. Jay Beale Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 XFree86 Buffer overflow in ReadFontAlias from dirfile.c of XFree86 4.1.0 through 4.3.0 allows local users and remote attackers to execute arbitrary code via a font alias file (font.alias) with a long token, a different vulnerability than CVE-2004-0084 and CVE-2004-0106. Jay Beale Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability." Andrew Buttner Andrew Buttner INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 netpbm netpbm 9.25 and earlier does not properly create temporary files, which allows local users to overwrite arbitrary files. Jay Beale Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 PWLib Multiple vulnerabilities in PWLib before 1.6.0 allow remote attackers to cause a denial of service and possibly execute arbitrary code, as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol. Jay Beale Matt Busby ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Windows Internet Naming Service (WINS) The Windows Internet Naming Service (WINS) for Microsoft Windows Server 2003, and possibly Windows NT and Server 2000, does not properly validate the length of certain packets, which allows attackers to cause a denial of service and possibly execute arbitrary code. Andrew Buttner INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Windows Internet Naming Service (WINS) The Windows Internet Naming Service (WINS) for Microsoft Windows Server 2003, and possibly Windows NT and Server 2000, does not properly validate the length of certain packets, which allows attackers to cause a denial of service and possibly execute arbitrary code. Andrew Buttner INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Windows Internet Naming Service (WINS) The Windows Internet Naming Service (WINS) for Microsoft Windows Server 2003, and possibly Windows NT and Server 2000, does not properly validate the length of certain packets, which allows attackers to cause a denial of service and possibly execute arbitrary code. Andrew Buttner INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Sun Solaris 7 CDE CDE ToolTalk database server (ttdbserver) allows local users to overwrite arbitrary files via a symlink attack on the transaction log file used by the _TT_TRANSACTION RPC procedure. David Proulx Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Operating System Unspecified vulnerability in the Server service in Microsoft Windows 2000 SP4, Server 2003 SP1 and earlier, and XP SP2 and earlier allows remote attackers to execute arbitrary code via a crafted packet, aka "SMB Rename Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft ASN.1 Library Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 BER encodings with (1) very large length fields that cause arbitrary heap data to be overwritten, or (2) modified bit strings. Andrew Buttner INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office Buffer overflow in Microsoft Office 2000 SP3, XP SP3, and other versions and packages, allows user-assisted attackers to execute arbitrary code via a routing slip that is longer than specified by the provided length field, as exploited by malware such as TROJ_MDROPPER.BH and Trojan.PPDropper.E in attacks against PowerPoint. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft ASN.1 Library Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 BER encodings with (1) very large length fields that cause arbitrary heap data to be overwritten, or (2) modified bit strings. Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft ASN.1 Library Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 BER encodings with (1) very large length fields that cause arbitrary heap data to be overwritten, or (2) modified bit strings. Andrew Buttner INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Windows Script Engine for JScript v5.5 Integer overflow in JsArrayFunctionHeapSort function used by Windows Script Engine for JScript (JScript.dll) on various Windows operating system allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail that uses a large array index value that enables a heap-based buffer overflow attack. Tiffany Bergeron David Proulx INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Windows Script Engine for JScript v5.1 Integer overflow in JsArrayFunctionHeapSort function used by Windows Script Engine for JScript (JScript.dll) on various Windows operating system allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail that uses a large array index value that enables a heap-based buffer overflow attack. Tiffany Bergeron David Proulx INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 5.01 SP4 up to 6 on various Windows operating systems, including IE 6.0.2900.2180 on Windows XP, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, as demonstrated using the JVIEW Profiler (Javaprxy.dll). NOTE: the researcher says that the vendor could not reproduce this problem. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Buffer overflow in URLMON.DLL in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via a crafted URL with an International Domain Name (IDN) using double-byte character sets (DBCS), aka the "Double Byte Character Parsing Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via by instantiating the (1) Mdt2gddr.dll, (2) Mdt2dd.dll, and (3) Mdt2gddo.dll COM objects as ActiveX controls, which leads to memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Microsoft Internet Explorer 6.0.2800.1106 on Microsoft Windows XP SP2, and other versions including 5.01 and 5.5, allows remote web servers to bypass zone restrictions and execute arbitrary code in the local computer zone by redirecting a function to another function with the same name, as demonstrated by SimilarMethodNameRedir, aka the "Similar Method Name Redirection Cross Domain Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Unknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to obtain information and possibly execute code when browsing from a web site to a web folder view using WebDAV, aka "Web Folder Behaviors Cross-Domain Vulnerability". Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Sun Solaris 8 rpc.rwalld Format string vulnerability in RPC wall daemon (rpc.rwalld) for Solaris 2.5.1 through 8 allows remote attackers to execute arbitrary code via format strings in a message that is not properly provided to the syslog function when the wall command cannot be executed. David Proulx Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Buffer overflow in the URL processor of Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL with a long hostname, aka "URL Parsing Memory Corruption Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Jason Spashett INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via certain invalid HTML that causes memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Integer overflow in the Install Engine (inseng.dll) for Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious website or HTML email with a long .CAB file name, which triggers the integer overflow when calculating a buffer length and leads to a heap-based buffer overflow. Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System netman.dll in Microsoft Windows Connections Manager Library allows local users to cause a denial of service (Network Connections Service crash) via a large integer argument to a particular function, aka "Network Connection Manager Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Unspecified vulnerability in usermod in HP-UX B.11.00, B.11.11, and B.11.23, when run with certain options that involve a new home directory, might cause usermod to change the ownership of all directories and files under the new directory, which might result in less secure permissions than intended. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Services for UNIX The Telnet client for Microsoft Windows XP, Windows Server 2003, and Windows Services for UNIX allows remote attackers to read sensitive environment variables via the NEW-ENVIRON option with a SEND ENV_USERVAR command. Jonathan Baker DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System Stack-based buffer overflow in the Plug and Play (PnP) service for Microsoft Windows 2000 and Windows XP Service Pack 1 allows remote attackers to execute arbitrary code via a crafted packet, and local users to gain privileges via a malicious application, as exploited by the Zotob (aka Mytob) worm. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Buffer overflow in the PNG image rendering component of Microsoft Internet Explorer allows remote attackers to execute arbitrary code via a crafted PNG file. Harvey Rubinovitz DRAFT Harvey Rubinovitz INTERIM ACCEPTED Anna Min INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 mozilla Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 allows remote attackers to cause a denial of service (access violation and crash), and possibly execute arbitrary code, by calling InstallVersion.compareTo with an object instead of a string. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Word 2003 Multiple TCP/IP and ICMP implementations, when using Path MTU (PMTU) discovery (PMTUD), allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via forged ICMP ("Fragmentation Needed and Don't Fragment was Set") packets with a low next-hop MTU value, aka the "Path MTU discovery attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Information Server (IIS) Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "\" characters twice. Tiffany Bergeron Tiffany Bergeron ACCEPTED INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Windows kernel Buffer overflow in Windows Kernel allows local users to gain privileges by causing certain error messages to be passed to a debugger. Christine Walzer DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Local Security Authority Subsystem Service (LSASS) LSASS (Local Security Authority Subsystem Service) of Windows 2000 Server and Windows Server 2003 does not properly validate connection information, which allows local users to gain privileges via a specially-designed program. Christine Walzer DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Client Server Runtime System (CSRSS) Stack-based buffer overflow in WINSRV.DLL in the Client Server Runtime System (CSRSS) process of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application that provides console window information with a long FaceName value. Ingrid Skoog DRAFT INTERIM Christine Walzer Andrew Buttner ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer The legacy <script> data-island capability for XML in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to read arbitrary XML files, and portions of other files, via a URL whose "src" attribute redirects to a local file. Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Data Access Compnents 2.8 Buffer overflow in a component of Microsoft Data Access Components (MDAC) 2.5 through 2.8 allows remote attackers to execute arbitrary code via a malformed UDP response to a broadcast request. Christine Walzer INTERIM ACCEPTED Jeff Cheng INTERIM Jeff Cheng ACCEPTED ACCEPTED Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability." Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 mozilla Firefox before 1.0.5 and Mozilla before 1.7.9 allows a child frame to call top.focus and other methods in a parent frame, even when the parent is in a different domain, which violates the same origin policy and allows remote attackers to steal sensitive information such as cookies and passwords from web sites whose child frames do not verify that they are in the same domain as their parents. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Internet Explorer in Windows XP SP2, and other versions including 5.01 and 5.5, allows remote attackers to install arbitrary programs via a web page that uses certain styles and the AnchorClick behavior, popup windows, and drag-and-drop capabilities to drop the program in the local startup folder, as demonstrated by "wottapoop.html". Harvey Rubinovitz DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Unspecified vulnerability in usermod in HP-UX B.11.00, B.11.11, and B.11.23, when run with certain options that involve a new home directory, might cause usermod to change the ownership of all directories and files under the new directory, which might result in less secure permissions than intended. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM Nabil Ouchn ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Integer overflow in the Install Engine (inseng.dll) for Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious website or HTML email with a long .CAB file name, which triggers the integer overflow when calculating a buffer length and leads to a heap-based buffer overflow. Harvey Rubinovitz DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Buffer overflow in the PNG image rendering component of Microsoft Internet Explorer allows remote attackers to execute arbitrary code via a crafted PNG file. Harvey Rubinovitz DRAFT Harvey Rubinovitz INTERIM ACCEPTED Anna Min INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to read arbitrary files via malformed requests to the GetObject function, which bypass some of GetObject's security checks. David Proulx ACCEPTED Microsoft Windows Server 2003 Microsoft Color Management Module Buffer overflow in the Microsoft Color Management Module for Windows allows remote attackers to execute arbitrary code via an image with crafted ICC profile format tags. Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel Microsoft Excel 2000, 2002, 2003, Viewer 2003, Office 2004 for Mac, and Office v.X for Mac does not properly handle certain opcodes, which allows user-assisted remote attackers to execute arbitrary code via a crafted XLS file, which results in an "Improper Memory Access Vulnerability." NOTE: an early disclosure of this issue used CVE-2006-3432, but only CVE-2007-0028 should be used. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 10 ftpd The FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED HP-UX 11 remshd Unknown vulnerability in remshd daemon in HP-UX B.11.00, B.11.11, and B.11.23 while running in "Trusted Mode" allows remote attackers to gain unauthorized system access via unknown attack vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 gzip Race condition in gzip 1.2.4, 1.3.3, and earlier, when decompressing a gzipped file, allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by gzip after the decompression is complete. Robert L. Hollis DRAFT INTERIM ACCEPTED Nabil Ouchn INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office Stack-based buffer overflow in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed record with a modified length value, which leads to memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft SharePoint Team Services Unknown vulnerability in the SmartHTML interpreter (shtml.dll) in Microsoft FrontPage Server Extensions 2000 and 2002, and Microsoft SharePoint Team Services 2002, allows remote attackers to cause a denial of service (response failure) via a certain request. Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM Glenn Strickland INTERIM Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6 does not properly cache SSL content, which allows remote attackers to obtain information or spoof content via a web site with the same host name as the target web site, whose content is cached and reused when the user visits the target web site. Harvey Rubinovitz DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Internet Explorer Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code by using JavaScript to cause certain errors simultaneously, which results in the access of previously freed memory, aka "Script Error Handling Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM Matthew Wojcik ACCEPTED ACCEPTED HP-UX 11 Apache The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Range field. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Windows 2000 smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges by duplicating a handle to a privileged process, as demonstrated by DebPloit. Tiffany Bergeron ACCEPTED Red Hat Enterprise Linux 4 mozilla A regression error in Firefox 1.0.3 and Mozilla 1.7.7 allows remote attackers to inject arbitrary Javascript from one page into the frameset of another site, aka the frame injection spoofing vulnerability, a re-introduction of a vulnerability that was originally identified and addressed by CVE-2004-0718. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 10 Sun Solaris 9 Access Manager Unspecified vulnerability in Sun Java System Access Manager 7.0 allows local users logged in as "root" to bypass authentication and gain top-level administrator privileges via the amadmin CLI tool. Robert L. Hollis DRAFT INTERIM ACCEPTED Nabil Ouchn INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel Heap-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows user-assisted remote attackers to execute arbitrary code via a BIFF8 spreadsheet with a PALETTE record that contains a large number of entries. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted LABEL record that triggers memory corruption. Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Data Access Compnents 2.7 Buffer overflow in a component of Microsoft Data Access Components (MDAC) 2.5 through 2.8 allows remote attackers to execute arbitrary code via a malformed UDP response to a broadcast request. Christine Walzer INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Ethereal Unknown vulnerability in the DCERPC (DCE/RPC) dissector in Ethereal 0.9.12 and earlier allows remote attackers to cause a denial of service (memory consumption) via a certain NDR string. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Microsoft Internet Explorer 6.0.2800.1106 on Microsoft Windows XP SP2, and other versions including 5.01 and 5.5, allows remote web servers to bypass zone restrictions and execute arbitrary code in the local computer zone by redirecting a function to another function with the same name, as demonstrated by SimilarMethodNameRedir, aka the "Similar Method Name Redirection Cross Domain Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM John Hoyland ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 bzip2 bzip2 allows remote attackers to cause a denial of service (hard drive consumption) via a crafted bzip2 file that causes an infinite loop (a.k.a "decompression bomb"). Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer 7 The patch IE7-KB928090-WindowsServer2003-x64-enu.exe that addresses the vulnerabilities discussed in Microsoft Security Bulletin MS07-016 should be installed. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Operating System Buffer overflow in the Winsock API in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via unknown vectors, aka "Winsock Hostname Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word Unspecified vulnerability in Microsoft Word 2000, 2002, and 2003 and Word Viewer 2003 allows remote attackers to execute code via unspecified vectors related to malformed data structures that trigger memory corruption, a different vulnerability than CVE-2006-5994. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability." Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM Christine Walzer ACCEPTED ACCEPTED Microsoft Internet Explorer Microsoft Internet Explorer 6.0.2800.1106 on Microsoft Windows XP SP2, and other versions including 5.01 and 5.5, allows remote web servers to bypass zone restrictions and execute arbitrary code in the local computer zone by redirecting a function to another function with the same name, as demonstrated by SimilarMethodNameRedir, aka the "Similar Method Name Redirection Cross Domain Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Andrew Simmons INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Gaim Gaim before 1.3.1 allows remote attackers to cause a denial of service (application crash) via a Yahoo! message with non-ASCII characters in a file name. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft FrontPage Server Extensions 2000 Buffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to execute arbitrary code via a crafted chunked encoded request. Tiffany Bergeron Andrew Buttner INTERIM ACCEPTED Christine Walzer Christine Walzer INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 mozilla The browser user interface in Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 does not properly distinguish between user-generated events and untrusted synthetic events, which makes it easier for remote attackers to perform dangerous actions that normally could only be performed manually by the user. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office Unspecified vulnerability in Microsoft Office XP and 2003 allows remote user-assisted attackers to execute arbitrary code via a malformed Smart Tag. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 7 dtspcd Buffer overflow in the client connection routine of libDtSvc.so.1 in CDE Subprocess Control Service (dtspcd) allows remote attackers to execute arbitrary commands. David Proulx Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Internet Explorer Cross-domain vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, aka "Redirect Cross-Domain Information Disclosure Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Kerberos Heap-based buffer overflow in the Key Distribution Center (KDC) in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to cause a denial of service (apllication crash) and possibly execute arbitrary code via a certain valid TCP or UDP request. Robert L. Hollis DRAFT INTERIM ACCEPTED Nabil Ouchn INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Integer overflow in pcre_compile.c in Perl Compatible Regular Expressions (PCRE) before 6.2, as used in multiple products such as Python, Ethereal, and PHP, allows attackers to execute arbitrary code via quantifier values in regular expressions, which leads to a heap-based buffer overflow. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick, a different vulnerability than CVE-2003-1027. Tiffany Bergeron Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Ethereal Multiple integer overflow vulnerabilities in Ethereal 0.9.11 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) Mount and (2) PPP dissectors. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 4 mozilla Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 does not properly verify the associated types of DOM node names within the context of their namespaces, which allows remote attackers to modify certain tag properties, possibly leading to execution of arbitrary script or code, as demonstrated using an XHTML document with IMG tags with custom properties ("XHTML node spoofing"). Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Perl Race condition in the rmtree function in File::Path.pm in Perl before 5.8.4 allows local users to create arbitrary setuid binaries in the tree being deleted, a different vulnerability than CVE-2004-0452. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Operating System The ShellAbout API call in Korean Input Method Editor (IME) in Korean versions of Microsoft Windows XP SP1 and SP2, Windows Server 2003 up to SP1, and Office 2003, allows local users to gain privileges by launching the "shell about dialog box" and clicking the "End-User License Agreement" link, which executes Notepad with the privileges of the program that displays the about box. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Operating System Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via a blind throughput-reduction attack using spoofed Source Quench packets, aka the "ICMP Source Quench attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Sun Solaris 9 Sun Solaris 8 Sun Solaris 7 Operating System Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root. Robert L. Hollis DRAFT INTERIM ACCEPTED Nabil Ouchn INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Operating System Buffer overflow in the DNS Client service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted record response. NOTE: while MS06-041 implies that there is a single issue, there are multiple vectors, and likely multiple vulnerabilities, related to (1) a heap-based buffer overflow in a DNS server response to the client, (2) a DNS server response with malformed ATMA records, and (3) a length miscalculation in TXT, HINFO, X25, and ISDN records. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Microsoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Javascript BODY onload event that calls the window function, aka "Mismatched Document Object Model Objects Memory Corruption Vulnerability." Robert L. Hollis DRAFT Robert L. Hollis INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Web Client Service Buffer overflow in the Web Client service in Microsoft Windows XP and Windows Server 2003 allows remote authenticated users to execute arbitrary code via a crafted WebDAV request containing special parameters. Matthew Burton DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Internet Information Server (IIS) Buffer overflow in the ASP data transfer mechanism in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code, aka "Microsoft-discovered variant of Chunked Encoding buffer overrun." Tiffany Bergeron ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 5.5 and 6 does not properly handle plug-in navigation, which allows remote attackers to alter displayed address bars and thereby spoof web pages, facilitating phishing attacks, aka the "Plug-in Navigation Address Bar Spoofing Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Internet Explorer Microsoft Internet Explorer 5.01 and 6 does not properly handle uninitialized COM objects, which allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code, as demonstrated by the Nth function in the DirectAnimation.DATuple ActiveX control, aka "COM Object Instantiation Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer 7 The patch IE7-KB928090-WindowsServer2003-x64-enu.exe that addresses the vulnerabilities discussed in Microsoft Security Bulletin MS07-016 should be installed. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 gftp Directory traversal vulnerability in gftp before 2.0.18 for GTK+ allows remote malicious FTP servers to read arbitrary files via .. (dot dot) sequences in filenames returned from a LIST command. Jay Beale DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Buffer overflow in the Web Client service (WebClnt.dll) for Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote authenticated users or Guests to execute arbitrary code via crafted RPC requests, a different vulnerability than CVE-2005-1207. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System Heap-based buffer overflow in T2EMBED.DLL in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1, Windows 98, and Windows ME allows remote attackers to execute arbitrary code via an e-mail message or web page with a crafted Embedded Open Type (EOT) web font that triggers the overflow during decompression. Robert L. Hollis DRAFT INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Hyperlink Object Library The Hyperlink Object Library for Windows 98, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a crafted link that triggers an "unchecked buffer" in the library, possibly due to a buffer overflow. Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Windows Animated Cursor The Windows Animated Cursor (ANI) capability in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allow remote attackers to cause a denial of service via (1) the frame number set to zero, which causes an invalid memory address to be used and leads to a kernel crash, or (2) the rate number set to zero, which leads to resource exhaustion and hang. Christine Walzer DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 ImageMagick Heap-based buffer overflow in the ReadPNMImage function in pnm.c for ImageMagick 6.2.1 and earlier allows remote attackers to cause a denial of service (application crash) via a PNM file with a small colors value. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6 does not properly validate buffers when handling certain DHTML methods including the createControlRange Javascript function, which allows remote attackers to execute arbitrary code, aka the "DHTML Method Heap Memory Corruption Vulnerability." Harvey Rubinovitz DRAFT INTERIM Harvey Rubinovitz ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft SQL Server 2000 An SQL query method in Microsoft SQL Server 2000 Gold and 7.0 using Mixed Mode allows local database users to gain privileges by reusing a cached connection of the sa administrator account. Yi-Fang Koh ACCEPTED Jonathan Baker Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.5 and 6 does not properly handle plug-in navigation, which allows remote attackers to alter displayed address bars and thereby spoof web pages, facilitating phishing attacks, aka the "Plug-in Navigation Address Bar Spoofing Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Flash Player Unspecified vulnerability in Adobe (Macromedia) Flash Player 8.0.24.0 allows remote attackers to execute arbitrary commands via a malformed .swf file that results in "multiple improper memory access" errors. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Microsoft Internet Explorer 6.0.2800.1106 on Microsoft Windows XP SP2, and other versions including 5.01 and 5.5, allows remote web servers to bypass zone restrictions and execute arbitrary code in the local computer zone by redirecting a function to another function with the same name, as demonstrated by SimilarMethodNameRedir, aka the "Similar Method Name Redirection Cross Domain Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Windows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to execute arbitrary commands via a shortcut (.lnk) file with long font properties that lead to a buffer overflow in the Client/Server Runtime Server Subsystem (CSRSS), a different vulnerability than CVE-2005-2118. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Windows Internet Naming Service (WINS) The Windows Internet Naming Service (WINS) for Microsoft Windows Server 2003, and possibly Windows NT and Server 2000, does not properly validate the length of certain packets, which allows attackers to cause a denial of service and possibly execute arbitrary code. Andrew Buttner INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Sun Solaris 9 Sun Solaris 10 Operating System Unspecified vulnerability in Sun Solaris 9 and 10 for the x86 platform allows local users to gain privileges or cause a denial of service (panic) via unspecified vectors, possibly involving functions from the mm driver. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Windows Server 2003 Operating System Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allow remote attackers to execute arbitrary code via crafted Windows Metafile (WMF) and Enhanced Metafile (EMF) format images that lead to heap-based buffer overflows, as demonstrated using MRBP16::bCheckRecord. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word Microsoft Word in Office 2000 SP3, XP SP3, Office 2003 SP2, Works Suite 2004 to 2006, and Office 2004 for Mac does not correctly check the properties of certain documents and warn the user of macro content, which allows user-assisted remote attackers to execute arbitrary code. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 dtspcd Buffer overflow in the client connection routine of libDtSvc.so.1 in CDE Subprocess Control Service (dtspcd) allows remote attackers to execute arbitrary commands. David Proulx Todd Dolinsky INTERIM ACCEPTED ACCEPTED Sun Solaris 8 kcms_configure kcms_configure as included with Solaris 7 and 8 allows a local attacker to gain additional privileges via a buffer overflow in a command line argument. David Proulx ACCEPTED Microsoft Windows NT Microsoft FrontPage Server Extensions 2000 Buffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to execute arbitrary code via a crafted chunked encoded request. Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Heap-based buffer overflow in T2EMBED.DLL in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1, Windows 98, and Windows ME allows remote attackers to execute arbitrary code via an e-mail message or web page with a crafted Embedded Open Type (EOT) web font that triggers the overflow during decompression. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Unknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to obtain information and possibly execute code when browsing from a web site to a web folder view using WebDAV, aka "Web Folder Behaviors Cross-Domain Vulnerability". Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel 2002 Microsoft Excel 97, 2000, and 2002 allows remote attackers to execute arbitrary code via a spreadsheet with a malicious XLM (Excel 4) macro that bypasses the macro security model. Andrew Buttner INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Matthew Wojcik INTERIM John Hoyland ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Visual Basic Buffer overflow in Microsoft Visual Basic for Applications (VBA) SDK 6.0 through 6.4, as used by Microsoft Office 2000 SP3, Office XP SP3, Project 2000 SR1, Project 2002 SP1, Access 2000 Runtime SP3, Visio 2002 SP2, and Works Suite 2004 through 2006, allows user-assisted attackers to execute arbitrary code via unspecified document properties that are not verified when VBA is invoked to open documents. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01 through 6.0 allows remote attackers to identify the path to the Temporary Internet Files folder and obtain user information such as cookies via certain uses of the OBJECT tag, which are not subjected to the proper security checks, aka "Temporary Internet Files folders Name Reading." Harvey Rubinovitz ACCEPTED ACCEPTED Red Hat Linux 9 Ethereal Multiple off-by-one vulnerabilities in Ethereal 0.9.11 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) AIM, (2) GIOP Gryphon, (3) OSPF, (4) PPTP, (5) Quake, (6) Quake2, (7) Quake3, (8) Rsync, (9) SMB, (10) SMPP, and (11) TSP dissectors, which do not properly use the tvb_get_nstringz and tvb_get_nstringz0 functions. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability." Andrew Buttner Andrew Buttner INTERIM ACCEPTED ACCEPTED HP-UX 11 Operating System Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via a blind throughput-reduction attack using spoofed Source Quench packets, aka the "ICMP Source Quench attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability." Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 TIP Distributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service exception and exit) via an "unexpected protocol command during the reconnection request," which is not properly handled by the Transaction Internet Protocol (TIP) functionality. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Word for Windows 6.0 Converter Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CVE-2004-0901. Christine Walzer DRAFT INTERIM Jonathan Baker Ingrid Skoog ACCEPTED Robert L. Hollis DEPRECATED DEPRECATED Microsoft Windows XP Microsoft Internet Explorer 7 The patch IE7-KB929969-WindowsXP-x86-enu.exe that addresses the vulnerabilities discussed in Microsoft Security Bulletin MS07-004 should be installed. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Buffer overflow in the Web Client service (WebClnt.dll) for Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote authenticated users or Guests to execute arbitrary code via crafted RPC requests, a different vulnerability than CVE-2005-1207. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows ME Microsoft Windows NT Microsoft Windows XP Microsoft Internet Explorer Microsoft Internet Explorer 6.0.2800.1106 on Microsoft Windows XP SP2, and other versions including 5.01 and 5.5, allows remote web servers to bypass zone restrictions and execute arbitrary code in the local computer zone by redirecting a function to another function with the same name, as demonstrated by SimilarMethodNameRedir, aka the "Similar Method Name Redirection Cross Domain Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Agent Microsoft Agent allows remote attackers to spoof trusted Internet content and execute arbitrary code by disguising security prompts on a malicious Web page. Harvey Rubinovitz DRAFT Harvey Rubinovitz INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows NT NetDDE Agent NetDDE Agent on Windows NT 4.0, 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows local users to execute arbitrary code as LocalSystem via "shatter" style attack by sending a WM_COPYDATA message followed by a WM_TIMER message, as demonstrated by GetAd, aka "Flaw in Windows WM_TIMER Message Handling Could Enable Privilege Elevation." Ingrid Skoog DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Sun Solaris 7 Admintool Buffer overflow in admintool in Solaris 2.5 through 8 allows local users to gain root privileges via long arguments to (1) the -d command line option, or (2) the PRODVERS argument in the .cdtoc file. David Proulx Matthew Wojcik Matthew Wojcik Matthew Wojcik INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer 7 The patch IE7-KB929969-WindowsServer2003-ia64-enu.exe that addresses the vulnerabilities discussed in Microsoft Security Bulletin MS07-004 should be installed. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 NetDDE Network Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an "unchecked buffer," possibly a buffer overflow. Jonathan Baker DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote attackers to cause a denial of service (hang) via an IGMP packet with an invalid IP option, aka the "IGMP v3 DoS Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla The XML parser in Mozilla Firefox before 1.5.0.1 and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly read sensitive data via unknown attack vectors that trigger an out-of-bounds read. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 postgresql PostgreSQL 7.3.x through 8.0.x gives public EXECUTE access to certain character conversion functions, which allows unprivileged users to call those functions with malicious values, with unknown impact, aka the "Character conversion vulnerability." Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel 97 Microsoft Excel 97, 2000, and 2002 allows remote attackers to execute arbitrary code via a spreadsheet with a malicious XLM (Excel 4) macro that bypasses the macro security model. Andrew Buttner INTERIM ACCEPTED Ingrid Skoog INTERIM Matthew Wojcik INTERIM Microsoft Windows 2000 Operating System Unspecified vulnerability in the kernel in Microsoft Windows 2000 SP4, probably a buffer overflow, allows local users to obtain privileges via unspecified vectors involving an "unchecked buffer." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Windows Server 2003 Operating System The GetEnhMetaFilePaletteEntries API in GDI32.DLL in Windows 2000 allows remote attackers to cause a denial of service (application crash) via a crafted Enhanced Metafile (EMF) file that causes invalid (1) end, (2) emreof, or (3) palent offsets to be used, aka "Enhanced Metafile Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla The Javascript interpreter (jsinterp.c) in Mozilla and Firefox before 1.5.1 does not properly dereference objects, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via unknown attack vectors related to garbage collection. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Robert L. Hollis ACCEPTED ACCEPTED Sun Solaris 8 Admintool Buffer overflow in admintool in Solaris 2.5 through 8 allows local users to gain root privileges via long arguments to (1) the -d command line option, or (2) the PRODVERS argument in the .cdtoc file. David Proulx Matthew Wojcik Matthew Wojcik Matthew Wojcik INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Windows Media Player Heap-based buffer overflow in the WMCheckURLScheme function in WMVCORE.DLL in Microsoft Windows Media Player (WMP) 10.00.00.4036 on Windows XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via a long HREF attribute, using an unrecognized protocol, in a REF element in an ASX PlayList file. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word 2002 Microsoft Word 97, 98(J), 2000, and 2002, and Microsoft Works Suites 2001 through 2004, do not properly check the length of the "Macro names" data value, which could allow remote attackers to execute arbitrary code via a buffer overflow attack. Andrew Buttner DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 ypserv ypserv NIS server before 2.7 allows remote attackers to cause a denial of service via a TCP client request that does not respond to the server, which causes ypserv to block. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 xpdf Various PDF viewers including (1) Adobe Acrobat 5.06 and (2) Xpdf 1.01 allow remote attackers to execute arbitrary commands via shell metacharacters in an embedded hyperlink. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Operating System Multiple unspecified vulnerabilities in lpsched in Sun Solaris 8, 9, and 10 allow local users to delete arbitrary files or disable the LP print service via unknown attack vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Integer overflow in the Install Engine (inseng.dll) for Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious website or HTML email with a long .CAB file name, which triggers the integer overflow when calculating a buffer length and leads to a heap-based buffer overflow. Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Information Server (IIS) Cross-site scripting vulnerability (XSS) in the ASP function responsible for redirection in Microsoft Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to embed a URL containing script in a redirection message. David Proulx Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory corruption") via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the "<STYLE>@;/*" string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the "CSS Heap Memory Corruption Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 xinetd Memory leak in xinetd 2.3.10 allows remote attackers to cause a denial of service (memory consumption) via a large number of rejected connections. Jay Beale INTERIM Jay Beale Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft ASN.1 Library Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 BER encodings with (1) very large length fields that cause arbitrary heap data to be overwritten, or (2) modified bit strings. Andrew Buttner INTERIM ACCEPTED ACCEPTED HP-UX 11 Operating System Multiple TCP/IP and ICMP implementations, when using Path MTU (PMTU) discovery (PMTUD), allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via forged ICMP ("Fragmentation Needed and Don't Fragment was Set") packets with a low next-hop MTU value, aka the "Path MTU discovery attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Sun Solaris 7 kcms_configure kcms_configure as included with Solaris 7 and 8 allows a local attacker to gain additional privileges via a buffer overflow in a command line argument. David Proulx ACCEPTED HP-UX 11 ftpd wu-ftpd 2.6.2 and earlier, with the restricted-gid option enabled, allows local users to bypass access restrictions by changing the permissions to prevent access to their home directory, which causes wu-ftpd to use the root directory instead. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 mikmod Buffer overflow in mikmod 3.1.6 and earlier allows remote attackers to execute arbitrary code via an archive file that contains a file with a long filename. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT MDAC 2.8 The License Logging service for Windows NT Server, Windows 2000 Server, and Windows Server 2003 does not properly validate the length of messages, which leads to an "unchecked buffer" and allows remote attackers to cause a denial of service (crash) and possibly execute arbtirary code, aka the "License Logging Service Vulnerability." Ingrid Skoog DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability." Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED HP-UX 11 Samba Integer overflow in the Samba daemon (smbd) in Samba 2.x and 3.0.x through 3.0.9 allows remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via a Samba request with a large number of security descriptors that triggers a heap-based buffer overflow. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Windows 2000 In Microsoft Windows NT and Windows 2000, a trusting domain that receives authorization information from a trusted domain does not verify that the trusted domain is authoritative for all listed SIDs, which allows remote attackers to gain Domain Administrator privileges on the trusting domain by injecting SIDs from untrusted domains into the authorization data that comes from from the trusted domain. Tiffany Bergeron Tiffany Bergeron ACCEPTED INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Compressed Folders Integer overflow in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition allows remote attackers to execute arbitrary code via compressed (zipped) folders that involve an "unchecked buffer" and improper length validation. David Proulx DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office MSO.DLL in Microsoft Office 2000, Office XP (2002), and Office 2003 allows user-assisted attackers to cause a denial of service and execute arbitrary code via multiple attack vectors, as originally demonstrated using a crafted document record with a malformed string, as demonstrated by replacing a certain "01 00 00 00" byte sequence with an "FF FF FF FF" byte sequence, possibly causing an invalid array index, in (1) an Excel .xls document, which triggers an access violation in ole32.dll; (2) an Excel .xlw document, which triggers an access violation in excel.exe; (3) a Word document, which triggers an access violation in mso.dll in winword.exe; and (4) a PowerPoint document, which triggers an access violation in powerpnt.txt. NOTE: after the initial disclosure, this issue was demonstrated by triggering an integer overflow using an inconsistent size for a Unicode "Sheet Name" string. Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Management Console Cross-site scripting (XSS) vulnerability in Internet Explorer 5.01 and 6 in Microsoft Windows 2000 SP4 permits access to local "HTML-embedded resource files" in the Microsoft Management Console (MMC) library, which allows remote authenticated users to execute arbitrary commands, aka "MMC Redirect Cross-Site Scripting Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 mozilla A regression error in Firefox 1.0.3 and Mozilla 1.7.7 allows remote attackers to inject arbitrary Javascript from one page into the frameset of another site, aka the frame injection spoofing vulnerability, a re-introduction of a vulnerability that was originally identified and addressed by CVE-2004-0718. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel 2000 Microsoft Excel 97, 2000, and 2002 allows remote attackers to execute arbitrary code via a spreadsheet with a malicious XLM (Excel 4) macro that bypasses the macro security model. Christine Walzer ACCEPTED Ingrid Skoog INTERIM ACCEPTED Robert L. Hollis INTERIM John Hoyland ACCEPTED ACCEPTED Red Hat Linux 9 vsftpd vsftpd FTP daemon in Red Hat Linux 9 is not compiled against TCP wrappers (tcp_wrappers) but is installed as a standalone service, which inadvertently prevents vsftpd from restricting access as intended. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office Unspecified vulnerability in mso.dll in Microsoft Office 2000, XP, and 2003, and Microsoft PowerPoint 2000, XP, and 2003, allows remote user-assisted attackers to execute arbitrary code via a malformed record in a (1) .DOC, (2) .PPT, or (3) .XLS file that triggers memory corruption, related to an "array boundary condition" (possibly an array index overflow), a different vulnerability than CVE-2006-3434, CVE-2006-3650, and CVE-2006-3868. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Internet Explorer 5.5 and 6 does not properly handle plug-in navigation, which allows remote attackers to alter displayed address bars and thereby spoof web pages, facilitating phishing attacks, aka the "Plug-in Navigation Address Bar Spoofing Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 up2date up2date 3.0.7 and 3.1.23 does not properly verify RPM GPG signatures, which could allow remote attackers to cause unsigned packages to be installed from the Red Hat Network, if that network is compromised. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability." Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Remote Access Service (RAS) Buffer overflow in Remote Access Service (RAS) phonebook for Windows NT 4.0, 2000, XP, and Routing and Remote Access Server (RRAS) allows local users to execute arbitrary code by modifying the rasphone.pbk file to use a long dial-up entry. Tiffany Bergeron ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CVE-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability." Andrew Buttner Andrew Buttner INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Internet Explorer in Windows XP SP2, and other versions including 5.01 and 5.5, allows remote attackers to install arbitrary programs via a web page that uses certain styles and the AnchorClick behavior, popup windows, and drag-and-drop capabilities to drop the program in the local startup folder, as demonstrated by "wottapoop.html". Harvey Rubinovitz DRAFT INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft FrontPage Server Extensions 2002 Unknown vulnerability in the SmartHTML interpreter (shtml.dll) in Microsoft FrontPage Server Extensions 2000 and 2002, and Microsoft SharePoint Team Services 2002, allows remote attackers to cause a denial of service (response failure) via a certain request. Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM Glenn Strickland INTERIM Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Outlook Unspecified vulnerability in Microsoft Outlook 2000 through 2003, Exchange 5.0 Server SP2 and 5.5 SP4, Exchange 2000 SP3, and Office allows remote attackers to execute arbitrary code via an e-mail message with a crafted Transport Neutral Encapsulation Format (TNEF) MIME attachment, related to message length validation. Robert L. Hollis DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 sysreport sysreport 1.3.15 and earlier includes contents of the up2date file in a report, which leaks the password for a proxy server in plaintext and allows local users to gain privileges. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Operating System Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the "blind connection-reset attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Nabil Ouchn INTERIM Matthew Wojcik ACCEPTED Pai Peng INTERIM ACCEPTED ACCEPTED Sun Solaris 7 mibiisa Buffer overflow in the MIB parsing component of mibiisa for Solaris 5.6 through 8 allows remote attackers to gain root privileges. David Proulx ACCEPTED Red Hat Linux 9 unzip Directory traversal vulnerability in UnZip 5.50 allows attackers to overwrite arbitrary files via invalid characters between two . (dot) characters, which are filtered and result in a ".." sequence. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System The Microsoft Windows kernel in Microsoft Windows 2000 Server, Windows XP, and Windows Server 2003 allows remote attackers to cause a denial of service (crash) via crafted Remote Desktop Protocol (RDP) requests. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 swagentd Unspecified vulnerability in swagentd in HP-UX B.11.00, B.11.04, and B.11.11 allows remote attackers to cause a denial of service (application crash) via unspecified vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED HP-UX 11 ftpd The FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 SquirrelMail Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail before 1.2.11 allow remote attackers to inject arbitrary HTML code and steal information from a client's web browser. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows ME Microsoft Internet Explorer Integer overflow in the Install Engine (inseng.dll) for Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious website or HTML email with a long .CAB file name, which triggers the integer overflow when calculating a buffer length and leads to a heap-based buffer overflow. Harvey Rubinovitz DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED HP-UX 10 AutoRAID Manager Possible unknown vulnerability or vulnerabilities in HP DiskArray Utilities with AutoRAID Manager. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Remote Access Service (RAS) Buffer overflow in Remote Access Service (RAS) phonebook for Windows NT 4.0, 2000, XP, and Routing and Remote Access Server (RRAS) allows local users to execute arbitrary code by modifying the rasphone.pbk file to use a long dial-up entry. Tiffany Bergeron ACCEPTED Microsoft Windows Server 2003 Operating System The Microsoft Windows kernel in Microsoft Windows 2000 Server, Windows XP, and Windows Server 2003 allows remote attackers to cause a denial of service (crash) via crafted Remote Desktop Protocol (RDP) requests. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer The legacy <script> data-island capability for XML in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to read arbitrary XML files, and portions of other files, via a URL whose "src" attribute redirects to a local file. Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Operating System Stack-based buffer overflow in the NetpManageIPCConnect function in the Workstation service (wkssvc.dll) in Microsoft Windows 2000 SP4 and XP SP2 allows remote attackers to execute arbitrary code via NetrJoinDomain2 RPC messages with a long hostname. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft FrontPage Server Extensions 2000 Unknown vulnerability in the SmartHTML interpreter (shtml.dll) in Microsoft FrontPage Server Extensions 2000 and 2002, and Microsoft SharePoint Team Services 2002, allows remote attackers to cause a denial of service (response failure) via a certain request. Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Services for UNIX The Telnet client for Microsoft Windows XP, Windows Server 2003, and Windows Services for UNIX allows remote attackers to read sensitive environment variables via the NEW-ENVIRON option with a SEND ENV_USERVAR command. Jonathan Baker DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the Popup.show method and use drag-and-drop actions in a popup window, aka "HijackClick 3" and the "Script in Image Tag File Download Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the Popup.show method and use drag-and-drop actions in a popup window, aka "HijackClick 3" and the "Script in Image Tag File Download Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Sendmail The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Operating Ssytem Heap-based buffer overflow in the Server Service (SRV.SYS driver) in Microsoft Windows 2000 SP4, XP SP1 and SP2, Server 2003 up to SP1, and other products, allows remote attackers to execute arbitrary code via crafted first-class Mailslot messages that triggers memory corruption and bypasses size restrictions on second-class Mailslot messages. Robert L. Hollis INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Admintool Buffer overflow in admintool in Solaris 2.6, 7, and 8 allows local users to gain root privileges via a long media installation path. David Proulx Matthew Wojcik Matthew Wojcik Matthew Wojcik INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 CUPS CUPS before 1.1.19 allows remote attackers to cause a denial of service via a partial printing request to the IPP port (631), which does not time out. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED HP-UX 11 remshd Unspecified vulnerability in xterm for HP-UX 11.00, 11.11, and 11.23 allows local users to gain privileges via unknown vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Sendmail The DNS map code in Sendmail 8.12.8 and earlier, when using the "enhdnsbl" feature, does not properly initialize certain data structures, which allows remote attackers to cause a denial of service (process crash) via an invalid DNS response that causes Sendmail to free incorrect data. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED HP-UX 11 Operating System Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via a blind throughput-reduction attack using spoofed Source Quench packets, aka the "ICMP Source Quench attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Sendmail A "potential buffer overflow in ruleset parsing" for Sendmail 8.12.9, when using the nonstandard rulesets (1) recipient (2), final, or (3) mailer-specific envelope recipients, has unknown consequences. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP MSN Messenger Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking. Christine Walzer DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM Robert L. Hollis ACCEPTED Jonathan Baker INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED HP-UX 11 ftpd The FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Network News Transport Protocol (NNTP) The Network News Transfer Protocol (NNTP) component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an "unchecked buffer," leading to off-by-one and heap-based buffer overflows. Christine Walzer DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Licence Logging Service Unknown vulnerability in the rwho daemon (in.rwhod) for Solaris 7 through 9 allows remote attackers to execute arbitrary code. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft FrontPage Server Extensions 2000 Unknown vulnerability in the SmartHTML interpreter (shtml.dll) in Microsoft FrontPage Server Extensions 2000 and 2002, and Microsoft SharePoint Team Services 2002, allows remote attackers to cause a denial of service (response failure) via a certain request. Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Publisher Stack-based buffer overflow in Microsoft Publisher 2000 through 2003 allows user-assisted remote attackers to execute arbitrary code via a crafted PUB file, which causes an overflow when parsing fonts. Robert L. Hollis DRAFT Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 The application Microsoft Publisher 2002 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Remote Procedure Call (RPC) The RPC component in Windows 2000, Windows NT 4.0, and Windows XP allows remote attackers to cause a denial of service (disabled RPC service) via a malformed packet to the RPC Endpoint Mapper at TCP port 135, which triggers a null pointer dereference. Tiffany Bergeron Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick, a different vulnerability than CVE-2003-1027. Andrew Buttner Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Windows Shell The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document. Harvey Rubinovitz DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word 98 Microsoft Word 97, 98(J), 2000, and 2002, and Microsoft Works Suites 2001 through 2004, do not properly check the length of the "Macro names" data value, which could allow remote attackers to execute arbitrary code via a buffer overflow attack. Andrew Buttner INTERIM ACCEPTED Harvey Rubinovitz INTERIM INTERIM Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word 97 Microsoft Word 97, 98(J), 2000, and 2002, and Microsoft Works Suites 2001 through 2004, do not properly check the length of the "Macro names" data value, which could allow remote attackers to execute arbitrary code via a buffer overflow attack. Andrew Buttner INTERIM ACCEPTED Ingrid Skoog INTERIM Ingrid Skoog INTERIM Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Buffer overflow in the International Domain Name (IDN) support in Mozilla Firefox 1.0.6 and earlier, and Netscape 8.0.3.3 and 7.2, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a hostname with all "soft" hyphens (character 0xAD), which is not properly handled by the NormalizeIDN call in nsStandardURL::BuildNormalizedSpec. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Virtual Machine (VM) Two vulnerabilities in Microsoft Virtual Machine (VM) up to and including build 5.0.3805, as used in Internet Explorer and other applications, allow remote attackers to read files via a Java applet with a spoofed location in the CODEBASE parameter in the APPLET tag, possibly due to a parsing error. Tiffany Bergeron INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System Buffer overflow in Collaboration Data Objects (CDO), as used in Microsoft Windows and Microsoft Exchange Server, allows remote attackers to execute arbitrary code when CDOSYS or CDOEX processes an e-mail message with a large header name, as demonstrated using the "Content-Type" string. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Internet Information Server (IIS) Cross-site scripting vulnerability for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other web users via the error message used in a URL redirect (""302 Object Moved") message. Tiffany Bergeron ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word Unspecified vulnerability in Microsoft Word 2000, 2002, and Office 2003 allows remote user-assisted attackers to execute arbitrary code via unspecified vectors involving a crafted file resulting in a malformed stack, as exploited by malware with names including Trojan.Mdropper.Q, Mofei, and Femo. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Internet Explorer Microsoft Internet Explorer 5.01 and 6 does not properly identify the originating domain zone when handling redirects, which allows remote attackers to read cross-domain web pages and possibly execute code via unspecified vectors involving a crafted web page, aka "Source Element Cross-Domain Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System COM+ in Microsoft Windows does not properly "create and use memory structures," which allows local users or remote attackers to execute arbitrary code. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows Workstation Service Stack-based buffer overflow in a logging function for Windows Workstation Service (WKSSVC.DLL) allows remote attackers to execute arbitrary code via RPC calls that cause long entries to be written to a debug log file ("NetSetup.LOG"), as demonstrated using the NetAddAlternateComputerName API. Tiffany Bergeron ACCEPTED ACCEPTED Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6 does not properly cache SSL content, which allows remote attackers to obtain information or spoof content via a web site with the same host name as the target web site, whose content is cached and reused when the user visits the target web site. Harvey Rubinovitz DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Windows Shell The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document. Harvey Rubinovitz DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Sendmail The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel Unspecified vulnerability in Microsoft Excel 2000, 2002, 2003, 2004 for Mac, v.X for Mac, Excel Viewer 2003, and Microsoft Works Suite 2004 through 2006 allows user-assisted attackers to execute arbitrary code via a crafted DATETIME record in an XLS file, a different vulnerability than CVE-2006-3867 and CVE-2006-3875. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer The showHelp() function in Microsoft Internet Explorer 5.01, 5.5, and 6.0 supports certain types of pluggable protocols that allow remote attackers to bypass the cross-domain security model and execute arbitrary code, aka "Improper Cross Domain Security Validation with ShowHelp functionality." David Proulx Christine Walzer INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 semi MIME library The (1) semi MIME library 1.14.5 and earlier, and (2) wemi 1.14.0 and possibly other versions, allows local users to overwrite arbitrary files via a symlink attack on temporary files. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office Unspecified vulnerability in PowerPoint in Microsoft Office 2000, Office 2002, Office 2003, Office 2004 for Mac, and Office v.X for Mac allows user-assisted attackers to execute arbitrary code via an unspecified "crafted file," a different vulnerability than CVE-2006-3435, CVE-2006-4694, and CVE-2006-3876. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Samba, Samba-TNG Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x versions, and Samba-TNG before 0.3.2, allows remote attackers to execute arbitrary code. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object. Andrew Buttner Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Samba Multiple buffer overflows in Samba before 2.2.8a may allow remote attackers to execute arbitrary code or cause a denial of service, as discovered by the Samba team and a different vulnerability than CVE-2003-0201. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Internet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the Popup.show method and use drag-and-drop actions in a popup window, aka "HijackClick 3" and the "Script in Image Tag File Download Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Windows Server 2003 Operating System The Client-Server Run-time Subsystem in Microsoft Windows XP SP2 and Server 2003 allows local users to gain privileges via a crafted file manifest within an application, aka "File Manifest Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 rpc.yppasswdd Buffer overflow in rpc.yppasswdd (yppasswd server) in Solaris 2.6, 7 and 8 allows remote attackers to gain root access via a long username. David Proulx ACCEPTED Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory corruption") via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the "<STYLE>@;/*" string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the "CSS Heap Memory Corruption Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted SELECTION record that triggers memory corruption, a different vulnerability than CVE-2006-1302. Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object. Andrew Buttner Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Sun Solaris 7 Xsun Buffer overflow in Xsun in Solaris 8 and earlier allows local users to execute arbitrary commands via a long HOME environmental variable. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gzip is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Red Hat Linux 9 Samba The code for writing reg files in Samba before 2.2.8 allows local users to overwrite arbitrary files via a race condition involving chown. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gwenhywfar is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package guile-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package gtkspell-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gucharmap-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package gtkutils-data is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Data Access Compnents 2.6 Buffer overflow in a component of Microsoft Data Access Components (MDAC) 2.5 through 2.8 allows remote attackers to execute arbitrary code via a malformed UDP response to a broadcast request. Christine Walzer INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gtk-sharp-complete is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows ME Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6 does not properly cache SSL content, which allows remote attackers to obtain information or spoof content via a web site with the same host name as the target web site, whose content is cached and reused when the user visits the target web site. Harvey Rubinovitz DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 smbd Buffer overflow in the SMB/CIFS packet fragment re-assembly code for SMB daemon (smbd) in Samba before 2.2.8, and Samba-TNG before 0.3.1, allows remote attackers to execute arbitrary code. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 MSDTC The MIDL_user_allocate function in the Microsoft Distributed Transaction Coordinator (MSDTC) proxy (MSDTCPRX.DLL) allocates a 4K page of memory regardless of the required size, which allows attackers to overwrite arbitrary memory locations using an incorrect size value that is provided to the NdrAllocate function, which writes management data to memory outside of the allocated buffer. Robert L. Hollis DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 SMTP The SMTP (Simple Mail Transfer Protocol) component of Microsoft Windows XP 64-bit Edition, Windows Server 2003, Windows Server 2003 64-bit Edition, and the Exchange Routing Engine component of Exchange Server 2003, allows remote attackers to execute arbitrary code via a malicious DNS response message containing length values that are not properly validated. Christine Walzer DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gwc-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Red Hat Enterprise Linux 4 mozilla Firefox before 1.0.5 and Mozilla before 1.7.9 does not properly clone base objects, which allows remote attackers to execute arbitrary code by navigating the prototype chain to reach a privileged object. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Ethereal Heap-based buffer overflow in the NTLMSSP code for Ethereal 0.9.9 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gtkspell is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtksourceview-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package guile-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object. Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gtksourceview-sharp2 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gtk-sharp2-complete is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object. Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED SUSE Linux 10.1 openSUSE Factory Package gwenhywfar-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gwenview is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtkpbbuttons is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package g-wrap is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package gwenview-lang is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel Buffer overflow in Microsoft Excel 2000 through 2003 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted COLINFO record, which triggers the overflow during a "data filling operation." Robert L. Hollis INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gtksourceview is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gwget-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Red Hat Linux 9 Postfix The address parser code in Postfix 1.1.12 and earlier allows remote attackers to cause a denial of service (lock) via (1) a malformed envelope address to a local host that would generate a bounce and contains the ".!" string in the MAIL FROM or Errors-To headers, which causes nqmgr to lock up, or (2) via a valid MAIL FROM with a RCPT TO containing a ".!" string, which causes an instance of the SMTP listener to lock up. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gtksourceview-sharp is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gzip-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object. Tiffany Bergeron Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gtk2-devel-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtk-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtk-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtk2-engines-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package gvim is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01 through 6.0 does not properly check certain parameters of a PNG file when opening it, which allows remote attackers to cause a denial of service (crash) by triggering a heap-based buffer overflow using invalid length codes during decompression, aka "Malformed PNG Image File Failure." Harvey Rubinovitz ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package gtkglext-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gstreamer-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtk-sharp2-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gtkglext is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gtkhtml2 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtkhtml-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gtkglext-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gstreamer-plugins is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gtksourceview-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package gxdview-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Interactive Training The OLE Dialog component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1 allows user-assisted remote attackers to execute arbitrary code via an RTF file with a malformed OLE object that triggers memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Ethereal Format string vulnerability in packet-socks.c of the SOCKS dissector for Ethereal 0.8.7 through 0.9.9 allows remote attackers to execute arbitrary code via SOCKS packets containing format string specifiers. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtk1-compat-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gtk-sharp-gapi is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gutenprint-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gtk2-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gtkcard is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gwc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Word for Windows 6.0 Converter Microsoft Word for Windows 6.0 Converter (MSWRD632.WPC), as used in WordPad, does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CVE-2004-0571. Christine Walzer DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtk-xfce-engine-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gtkhtml is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gstreamer-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gstreamer010-plugins-good is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows XP Flash Player Microsoft Excel allows user-assisted attackers to execute arbitrary javascript and redirect users to arbitrary sites via an Excel spreadsheet with an embedded Shockwave Flash Player ActiveX Object, which is automatically executed when the user opens the spreadsheet. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtk2-engines-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtktalog-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gurlchecker is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gtkpod is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtk1-compat is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package gup is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtkzip-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel Unspecified vulnerability in Microsoft Excel 2000 through 2004 allows remote user-assisted attackers to execute arbitrary code via unspecified vectors. NOTE: this is a different vulnerability than CVE-2006-3086. Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE Factory Package gtk-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gucharmap-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gstreamer-plugins-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtkhtml-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Windows Media Player Buffer overflow in the Windows Media Format Runtime in Microsoft Windows Media Player (WMP) 6.4 and Windows XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted Advanced Systems Format (ASF) file. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gstreamer010-plugins-good-extra is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gstreamer010-plugins-base-visual is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gstreamer010-plugins-ugly-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtk2-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gstreamer-plugins-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Indexing Service Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Auto Select, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL, which is injected into an error message whose charset is set to UTF-7. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtkam-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gstreamer010 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package gtkglarea is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gwenhywfar-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtetrinet-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CVE-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability." Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED SUSE Linux 10.1 openSUSE Factory Package gstreamer010-plugins-base-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gstreamer010-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtktalog is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gstreamer010-plugins-base-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gsynaptics is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gthumb-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gstreamer-plugins-extra is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Integer overflow in the Install Engine (inseng.dll) for Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious website or HTML email with a long .CAB file name, which triggers the integer overflow when calculating a buffer length and leads to a heap-based buffer overflow. Harvey Rubinovitz DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED SUSE Linux 10.1 openSUSE Factory Package gtkpbbuttons-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtk-xfce-engine is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtkmm24-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtkiterm is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CVE-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability." Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM Christine Walzer ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Integer overflow in the Install Engine (inseng.dll) for Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious website or HTML email with a long .CAB file name, which triggers the integer overflow when calculating a buffer length and leads to a heap-based buffer overflow. Harvey Rubinovitz DRAFT INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtk-qt-engine-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gstreamer010-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gurlchecker-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gstreamer-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CVE-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability." Andrew Buttner Andrew Buttner INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Windows Shell Buffer overflow in Microsoft Internet Explorer and Explorer on Windows XP SP1, WIndows 2000, Windows 98, and Windows Me may allow remote malicious servers to cause a denial of service (application crash) and possibly execute arbitrary code via long share names, as demonstrated using Samba. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gthumb is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gstreamer010-plugins-bad is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gtk-engines is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package gspcav-kmp-debug is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CVE-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability." Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Windows Server 2003 Operating System Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the "blind connection-reset attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gtk-sharp2-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtklp-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gspcav is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gtk-qt-engine is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CVE-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability." Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gsmlib-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package grass is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gstreamer-plugins-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtk-sharp-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package gxdview is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word Unspecified vulnerability in Microsoft Word allows user-assisted remote attackers to execute arbitrary code on Word 2000, and cause a denial of service on Word 2003, via unknown attack vectors that trigger memory corruption, as exploited by Trojan.Mdropper.W and later by Trojan.Mdropper.X, a different issue than CVE-2006-6456, CVE-2006-5994, and CVE-2006-6561. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE Factory Package gtkspell-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Microsoft Windows NT Remote Procedure Call (RPC) The RPC Runtime Library for Microsoft Windows NT 4.0 allows remote attackers to read active memory or cause a denial of service (system crash) via a malicious message, possibly related to improper length values. Matthew Burton DRAFT INTERIM ACCEPTED Matthew Burton INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package grep-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package groff-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gtk2-themes is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gsl-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package graphviz-plugins-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CVE-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability." Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gscpm is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtkmm24-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package goffice is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnutls-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability." Andrew Buttner INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gtkhtml-sharp2 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtk-sharp-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gpsbabel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gstreamer010-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gstreamer010-plugins-base-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE Factory Package GraphicsMagick-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Data Access Compnents 2.5 Buffer overflow in a component of Microsoft Data Access Components (MDAC) 2.5 through 2.8 allows remote attackers to execute arbitrary code via a malformed UDP response to a broadcast request. Christine Walzer INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gstreamer-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtk-qt-engine-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package graphviz-perl is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnupod is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gpg-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnugo-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtk2-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gob2-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package google-perftools is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtkam is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnutls-devel-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gstreamer010-plugins-base-oil is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package goffice-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtetrinet is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnuchess is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package gnome-web-photo-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package groff is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gok-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package GraphicsMagick-c++-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package goobox-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package gtkutils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory Red Hat Linux 9 Postfix Postfix 1.1.11 and earlier allows remote attackers to use Postfix to conduct "bounce scans" or DDos attacks of other hosts via an email address to the local host containing the target IP address and service name followed by a "!" string, which causes Postfix to attempt to use SMTP to communicate with the target on the associated port. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnutls-devel-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gpm-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package graphviz-java is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtkspell-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gpg2-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gromacs is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnucash-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gpsbabel-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE Factory Package gok-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gtk-sharp-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gromacs-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnutls is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gpm-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gstreamer-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package grepmail is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object. Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 EOG Format string vulnerability in Eye Of Gnome (EOG) allows attackers to execute arbitrary code via format string specifiers in a command line argument for the file to display. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-terminal is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package graphviz-php is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-utils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gstreamer010-plugins-base-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gocr-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gos-wallpapers is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package goobox is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Internet Explorer The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute code such as Javascript, as demonstrated using (1) delayed HTTP redirect operations, and an HTTP response with a Location: header containing a "URL:" prepended to a "ms-its" protocol URI, or (2) modifying the location attribute of the window, as exploited by the Download.ject (aka Scob aka Toofer) using the ADODB.Stream object. Tiffany Bergeron DRAFT INTERIM ACCEPTED Christine Walzer INTERIM Christine Walzer ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gstreamer010-plugins-base is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnuboy is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gobby is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gnucash-docs is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnuplot is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package gtkglext-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package GraphicsMagick-c++ is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package gnumeric-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gpgme is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnu-efi is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnugk is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-vfs2-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gromacs-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Microsoft Internet Explorer Double-free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image. Andrew Buttner DRAFT INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gtksourceview-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gstreamer-plugins-excess is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package gstreamer010-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gnucash-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package goom2k4-rc2 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-utils is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package gup-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Outlook Microsoft Outlook 2002 and 2003 allows user-assisted remote attackers to execute arbitrary code via a malformed VEVENT record in an .iCal meeting request or ICS file. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.1 openSUSE Factory Package gnugk-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gphoto-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package graphviz-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package gphotofs-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gsf-sharp is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package gperf is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package gst-plugins-farsight is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-printer-add-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6 does not properly cache SSL content, which allows remote attackers to obtain information or spoof content via a web site with the same host name as the target web site, whose content is cached and reused when the user visits the target web site. Harvey Rubinovitz DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Integer overflow in imgbmp.cxx for Windows 2000 allows remote attackers to execute arbitrary code via a BMP image with a large bfOffBits value. Ingrid Skoog DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gstreamer010-plugins-good-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-vfs2-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gnome-vfs-monikers is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtklp is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package google-perftools-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-print-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 CDE Buffer overflow in CDE libDtHelp library allows local users to execute arbitrary code via (1) a modified DTHELPUSERSEARCHPATH environment variable and the Help feature, (2) DTSEARCHPATH, or (3) LOGNAME. Brian Soby DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gtkdoc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory HP-UX 11 Operating System Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the "blind connection-reset attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED openSUSE Factory Package gnome-python-desktop-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnump3d is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-phone-manager-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package gmime-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gucharmap is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gnomebaker is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package gtkpod-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-filesystem is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gphotofs is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability." Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gmp-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gnome-commander-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-keyring-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-desktop-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gmp-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gqview-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gnome-panel-extras is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnushogi is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package goffice-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability." Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM Christine Walzer ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package glibc-profile-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnet-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-system-monitor-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package graphviz-ruby is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-bluetooth-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-menus-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package glitz is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package gnome-keyring-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability." Andrew Buttner INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package global is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gst-plugins-farsight-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package glibc-profile is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package gnet-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gtk-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package gnuboy-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtkhtml2-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-vfs-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gnome-sharp2 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gtkmm24 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability." Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word Unspecified vulnerability in Microsoft Word 2000, 2002, and Office 2003 allows remote user-assisted attackers to execute arbitrary code via a crafted mail merge file, a different vulnerability than CVE-2006-3647 and CVE-2006-4693. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE Factory Package graphviz-lua is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package gtkutils is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-session-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-pilot-conduits-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gnome-pilot is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gramofile-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package glest is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package glibc-html is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package grip-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gsl-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Double-free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image. Andrew Buttner DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package gxmhtml is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package glib-devel-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gnome-games is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package graphviz-tcl is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gkrellm-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package glabels-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gstreamer010-plugins-bad-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gpm is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object. Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-common is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-doc-utils is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gnome-commander is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows XP NetDDE Network Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an "unchecked buffer," possibly a buffer overflow. Jonathan Baker DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED openSUSE Factory Package gspcav-kmp-default is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Microsoft Windows NT Network News Transport Protocol (NNTP) The Network News Transfer Protocol (NNTP) component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an "unchecked buffer," leading to off-by-one and heap-based buffer overflows. Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Integer overflow in imgbmp.cxx for Windows 2000 allows remote attackers to execute arbitrary code via a BMP image with a large bfOffBits value. Ingrid Skoog DRAFT INTERIM ACCEPTED Christine Walzer INTERIM Christine Walzer ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-menus-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gnome-netstatus is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-menus-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-spell-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gnash-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE Factory Package google-perftools-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package glib2-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnutls-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package glitz-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-keyring-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package gnome-main-menu-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-vfs2-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-session is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package glibc-locale-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtkmm2-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnumeric-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnomemeeting-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-vfs2-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gpm-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gpdf-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnuserv is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package graphviz-sharp is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-applets-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-libs-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package graphviz-plugins is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-desktop-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-panel-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gnu-jaf is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-keyring-manager is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gnu-regexp is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package graphviz-guile is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package graphviz-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gstreamer010-plugins-ugly is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-nettool is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package glest-data is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package gtk-engines-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package GraphicsMagick-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Red Hat Linux 9 pine Integer signedness error in rfc2231_get_param from strings.c in PINE before 4.58 allows remote attackers to execute arbitrary code via an email that causes an out-of-bounds array access using a negative number. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gtk2-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtk2-engines-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnomeicu is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-volume-manager-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnokii-smsd is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-alsamixer is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package glibc-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-mime-data is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Network News Transport Protocol (NNTP) The Network News Transfer Protocol (NNTP) component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an "unchecked buffer," leading to off-by-one and heap-based buffer overflows. Christine Walzer DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED openSUSE Factory Package gnu-inetlib is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Internet Explorer Microsoft Internet Explorer 5.01 SP4 and 6 does not properly handle various HTML layout component combinations, which allows user-assisted remote attackers to execute arbitrary code via a crafted HTML file that leads to memory corruption, aka "HTML Rendering Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package gnome-doc-utils-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package gnome-desktop-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package gpgme-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-applets-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gnome-main-menu-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-menus is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gnu-regexp-javadoc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gqview is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gnomemeeting is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gob2 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE Factory Package glibmm2-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE Factory Package gsynaptics-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package glib2-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package gnome-mount-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package glibc-locale is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gutenprint is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package g-wrap-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gnome-media-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows NT Remote Access Service (RAS) The default permissions for the RAS Administration key in Windows NT 4.0 allows local users to execute arbitrary commands by changing the value to point to a malicious DLL, aka one of the "Registry Permissions" vulnerabilities. Matt Busby INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to read arbitrary files via malformed requests to the GetObject function, which bypass some of GetObject's security checks. David Proulx Robert L. Hollis INTERIM Robert L. Hollis Robert L. Hollis Robert L. Hollis Robert L. Hollis Robert L. Hollis Robert L. Hollis Robert L. Hollis ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Internet Explorer Microsoft Internet Explorer 5 SP4 and 6 do not properly garbage collect when "multiple imports are used on a styleSheets collection" to construct a chain of Cascading Style Sheets (CSS), which allows remote attackers to execute arbitrary code via unspecified vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-cups-manager-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package glitz-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnutls-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package gkermit-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE Factory Package gnu-javamail is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package graphviz-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gnushogi-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package gnome-power-manager-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gocr is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gnome-speech-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Red Hat Linux 9 pine Buffer overflow in PINE before 4.58 allows remote attackers to execute arbitrary code via a malformed message/external-body MIME type. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gpa-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Message Queuing Buffer overflow in the Message Queuing component of Microsoft Windows 2000 and Windows XP SP1 allows remote attackers to execute arbitrary code via a crafted message. Ingrid Skoog DRAFT INTERIM Christine Walzer Andrew Buttner ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 .NET Framework The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a (1) "\" (backslash) or (2) "%5C" (encoded backslash), aka "Path Validation Vulnerability." Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM Matthew Wojcik Daniel Tarnu ACCEPTED Robert L. Hollis INTERIM ACCEPTED Jeff Cheng INTERIM Jeff Cheng ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gonvert is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Race condition in the memory management routines in the DHTML object processor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail, aka "DHTML Object Memory Corruption Vulnerability". Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package glib-sharp2 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-desktop is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package gkermit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gramofile is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-menus-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Microsoft Word 2003 Windows Server 2003 and XP SP2, with Windows Firewall turned off, allows remote attackers to cause a denial of service (CPU consumption) via a TCP packet with the SYN flag set and the same destination and source address and port, aka a reoccurrence of the "Land" vulnerability (CVE-1999-0016). Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gqcam-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-audio is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package gok-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package glibc-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-desktop-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package glibmm24-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gsl is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnokii-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Operating System Stack-based buffer overflow in the Plug and Play (PnP) service for Microsoft Windows 2000 and Windows XP Service Pack 1 allows remote attackers to execute arbitrary code via a crafted packet, and local users to gain privileges via a malicious application, as exploited by the Zotob (aka Mytob) worm. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package gjdoc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gnopernicus-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gpgme-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-pilot-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gtk2-engines is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gpdf is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package glitz-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package glitz-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-cups-manager is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package glib-devel-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Windows Server 2003 Operating System Argument injection vulnerability in the Windows Object Packager (packager.exe) in Microsoft Windows XP SP1 and SP2 and Server 2003 SP1 and earlier allows remote user-assisted attackers to execute arbitrary commands via a crafted file with a "/" (slash) character in the filename of the Command Line property, followed by a valid file extension, which causes the command before the slash to be executed, aka "Object Packager Dialogue Spoofing Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package glibc-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package glade-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnomeicu-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gecko-sharp is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gpg is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package ghostscript-fonts-other is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-pilot-conduits is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gnome-utils-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01 through 6.0 does not properly perform security checks on certain encoded characters within a URL, which allows a remote attacker to steal potentially sensitive information from a user by redirecting the user to another site that has that information, aka "Encoded Characters Information Disclosure." Harvey Rubinovitz ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-media is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6 does not properly validate certain URLs in Channel Definition Format (CDF) files, which allows remote attackers to obtain sensitive information or execute arbitrary code, aka the "Channel Definition Format (CDF) Cross Domain Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE Factory Package g-wrap-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE Factory Package gexif is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gwget is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package giflib-devel-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnats is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gimp-cmyk-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Remote Procedure Call (RPC) The RPC DCOM interface in Windows 2000 SP3 and SP4 allows remote attackers to cause a denial of service (crash), and local attackers to use the DoS to hijack the epmapper pipe to gain privileges, via certain messages to the __RemoteGetClassObject interface that cause a NULL pointer to be passed to the PerformScmStage function. Tiffany Bergeron ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package gdome2-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gqcam is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 9 Kerberos5 Double-free vulnerabilities in the error handling code for ASN.1 decoders in the (1) Key Distribution Center (KDC) library and (2) client library for MIT Kerberos 5 (krb5) 1.3.4 and earlier may allow remote attackers to execute arbitrary code. Brian Soby DRAFT Brian Soby INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package gnome-python-desktop is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome2-SuSE is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gltt-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package glade is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package glade-sharp2 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE Factory Package gspcav-kmp-ppc64 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-phone-manager is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gdbm-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 MSN Messenger GIF file validation error in MSN Messenger 6.2 allows remote attackers in a user's contact list to execute arbitrary code via a GIF image with an improper height and width. Christine Walzer DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM Robert L. Hollis ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-screensaver-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gphoto is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package glibc-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gnome-vfs-monikers-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package geronimo-tomcat-servlet-container is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnopernicus-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Operating System Buffer overflow in the Server Service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers, including anonymous users, to execute arbitrary code via a crafted RPC message, a different vulnerability than CVE-2006-1314. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package grub-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gettext-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gimp-help is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package giflib-progs is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package glib2-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-system-tools is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package gd-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ginac is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability." Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gperf-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gjiten-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gettext-java-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE Factory Package gimp-unstable-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gemdropx-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-keyring-manager-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gl-117-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gnopernicus is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability." Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Microsoft Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model to run malicious script or arbitrary programs via dialog boxes, aka "Improper Cross Domain Security Validation with dialog box." David Proulx Robert L. Hollis INTERIM Robert L. Hollis Robert L. Hollis Robert L. Hollis Robert L. Hollis Robert L. Hollis Robert L. Hollis Robert L. Hollis Robert L. Hollis ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gconfmm is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gconf-sharp is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package glibc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-spell2 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gscmxx is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Windows Server 2003 Windows kernel The kernel for Microsoft Windows Server 2003 does not reset certain values in CPU data structures, which allows local users to cause a denial of service (system crash) via a malicious program. Ingrid Skoog Ingrid Skoog DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-presence-applet-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-print-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package ghostscript-fonts-std is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft SQL Server 2000 Buffer overflow in the SQLXML ISAPI extension of Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code via data queries with a long content-type parameter, aka "Unchecked Buffer in SQLXML ISAPI Extension." Matthew Burton Matthew Burton DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package ghex is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE Factory Package gnome-mag-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gstreamer-plugins-default is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gnome-reset is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-nettool-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-icon-theme is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package glabels is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-pilot-conduits-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package glibc-devel-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package genromfs is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gnome-python-desktop-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package gc-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gftp-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gcc42-obj-c++ is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Race condition in the memory management routines in the DHTML object processor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail, aka "DHTML Object Memory Corruption Vulnerability". Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 openSUSE Factory Package git-core-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package glibc-i18ndata is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gpsdrive is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gmime is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package gnome-themes-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE Factory Package gcc42-gij-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gnome-bluetooth-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED Robert L. Hollis INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Apache Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied. Brian Soby Brian Soby Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gpa is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package glchess-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gnome-speech is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel Unspecified vulnerability in Microsoft Excel 2000, 2002, 2003, 2004 for Mac, v.X for Mac, and Excel Viewer 2003 allows user-assisted attackers to execute arbitrary code via a crafted COLINFO record in an XLS file, a different vulnerability than CVE-2006-2387 and CVE-2006-3867. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Proxy Server 2.0 SP1 Microsoft Proxy Server 2.0 and Microsoft ISA Server 2000 (which is included in Small Business Server 2000 and Small Business Server 2003 Premium Edition) allows remote attackers to spoof trusted Internet content on a specially crafted webpage via spoofed reverse DNS lookup results. Christine Walzer DRAFT INTERIM Christine Walzer Ingrid Skoog ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-presence-applet is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-media-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gcc41-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gconf2-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gkrellm is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gettext is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gconf-editor-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnuplot-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Red Hat Linux 9 php Cross-site scripting (XSS) vulnerability in the transparent SID support capability for PHP before 4.3.2 (session.use_trans_sid) allows remote attackers to insert arbitrary script via the PHPSESSID parameter. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE Factory Package gmp-devel-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Microsoft Windows NT DHCP The DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition does not properly validate the length of certain messages, which allows remote attackers to execute arbitrary code via a malformed DHCP message, aka the "DHCP Request Vulnerability." Ingrid Skoog DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package gecko-sharp2-docs is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gltt is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gnu-getopt is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gcc-objc-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtk2-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gdbm-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft SQL Server 2000 Buffer overflow in the SQLXML ISAPI extension of Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code via data queries with a long content-type parameter, aka "Unchecked Buffer in SQLXML ISAPI Extension." Matthew Burton Matthew Burton Matthew Burton DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package gcc-locale is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gtk-sharp2-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package git-core is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gftp is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package giflib-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 8 Sun Solaris 9 LDAP Unknown vulnerability in LDAP on Sun Solaris 8 and 9, when using Role Based Access Control (RBAC), allows local users to execute certain commands with additional privileges. Brian Soby DRAFT INTERIM ACCEPTED INTERIM DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gimp-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Windows kernel Buffer overflow in Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to cause a denial of service (i.e., system crash) via a malformed request, aka "Object Management Vulnerability". Ingrid Skoog DRAFT INTERIM Christine Walzer Andrew Buttner ACCEPTED ACCEPTED Microsoft Windows NT Windows NT 4.0 The WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 allows remote attackers to write to arbitrary memory locations and possibly execute arbitrary code via a modified memory pointer in a WINS replication packet to TCP port 42, aka the "Association Context Vulnerability." Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gnome-mag is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Information Server (IIS) Buffer overflow in ssinc.dll for Microsoft Internet Information Services (IIS) 5.0 allows local users to execute arbitrary code via a web page with a Server Side Include (SSI) directive with a long filename, aka "Server Side Include Web Pages Buffer Overrun." Tiffany Bergeron ACCEPTED Christine Walzer INTERIM ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-games-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package gscpm-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gdk-pixbuf-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gnuserv-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gconfmm-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gcc42-c++ is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package git-cvs is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gecko-sharp2 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gedit-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gcc-gij is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Windows Server 2003 Operating System Windows Server 2003 and XP SP2, with Windows Firewall turned off, allows remote attackers to cause a denial of service (CPU consumption) via a TCP packet with the SYN flag set and the same destination and source address and port, aka a reoccurrence of the "Land" vulnerability (CVE-1999-0016). Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gnome-pilot-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gdb-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gexif-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gdm is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gnome-web-photo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gtk-sharp2 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-netstatus-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gconf-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel Unspecified vulnerability in Microsoft Excel 2000, 2002, 2003, 2004 for Mac, v.X for Mac, and Excel Viewer 2003 allows user-assisted attackers to execute arbitrary code via a crafted Lotus 1-2-3 file, a different vulnerability than CVE-2006-2387 and CVE-2006-3875. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnucash is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gettext-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gimp-cmyk is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gconfmm-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gentoo-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Microsoft Word 2003 Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the "blind connection-reset attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gmp-devel-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gnome-bluetooth is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gecko-sdk is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package giflib-devel-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 7 Admintool Buffer overflow in admintool in Solaris 2.6, 7, and 8 allows local users to gain root privileges via a long media installation path. David Proulx Matthew Wojcik Matthew Wojcik Matthew Wojcik INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gdk-pixbuf-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gmime-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Microsoft Windows XP Windows kernel Buffer overflow in the font processing component of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application. Ingrid Skoog DRAFT INTERIM Christine Walzer ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gnokii is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package ghostscript-omni is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-terminal-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package gnome-themes-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnet-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Windows 2000 TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP. Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package gcc41-c++ is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability. Tiffany Bergeron Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package gcc41-gij-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gdk-pixbuf-gnome is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package glib-sharp is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows NT MDAC 2.8 The License Logging service for Windows NT Server, Windows 2000 Server, and Windows Server 2003 does not properly validate the length of messages, which leads to an "unchecked buffer" and allows remote attackers to cause a denial of service (crash) and possibly execute arbtirary code, aka the "License Logging Service Vulnerability." Ingrid Skoog DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gltt-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-panel-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gconf2 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gnome-sharp is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gcc41-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnutls-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Internet Security and Acceleration Server 2000 Buffer overflow in the H.323 filter of Microsoft Internet Security and Acceleration Server 2000 allows remote attackers to execute arbitrary code in the Microsoft Firewall Service via certain H.323 traffic, as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol. David Proulx INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jeff Cheng INTERIM Jeff Cheng Jeff Cheng Jeff Cheng ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gd-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gcc41-testresults is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-speech-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gnome-vfs-sharp2 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gcc-fortran-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gdbm-devel-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gcc42-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package gforth-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package glibmm2-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gentoo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server Microsoft Exchange 2003 and Outlook Web Access (OWA), when configured to use NTLM authentication, does not properly reuse HTTP connections, which can cause OWA users to view mailboxes of other users when Kerberos has been disabled as an authentication method for IIS 6.0, e.g. when SharePoint Services 2.0 is installed. Andrew Buttner INTERIM ACCEPTED John Hoyland INTERIM Jeff Cheng Jeff Cheng INTERIM openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtk-qt-engine-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Microsoft Internet Information Server (IIS) The WebDAV Message Handler for Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows remote attackers to cause a denial of service (memory and CPU exhaustion, application crash) via a PROPFIND request with an XML message containing XML elements with a large number of attributes. Jonathan Baker DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package gnome-mount is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gcc41-objc-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package geki2 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package glib2-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows NT VDM The Virtual DOS Machine (VDM) subsystem of Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows local users to access kernel memory and gain privileges via a malicious program that modified some system structures in a way that is not properly validated by privileged operating system functions. Ingrid Skoog DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.1 openSUSE Factory Package gpart-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gsmlib is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft PowerPoint PowerPoint in Microsoft Office 2000, XP, 2003, 2004 for Mac, and v.X for Mac does not properly parse the slide notes field in a document, which allows remote user-assisted attackers to execute arbitrary code via crafted data in this field, which triggers an erroneous object pointer calculation that uses data from within the document. NOTE: this issue is different than other PowerPoint vulnerabilities including CVE-2006-4694. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package ghostscript-x11 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Microsoft Internet Explorer The DHTML Edit Control (dhtmled.ocx) allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as demonstrated by "AbusiveParent" in Internet Explorer 6.0.2900.2180. Jonathan Baker DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE Factory Package gcc42-objc-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Sun Solaris 8 mozilla The (1) Mozilla 1.6, (2) Firebird 0.7, (3) Firefox 0.8, and (4) Netscape 7.1 web browsers do not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-main-menu is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gettext-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ggv-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package gdm-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gcc-mudflap-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ganglia-monitor-core-gmond is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Word for Windows 6.0 Converter Microsoft Word for Windows 6.0 Converter (MSWRD632.WPC), as used in WordPad, does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CVE-2004-0571. Christine Walzer DRAFT INTERIM ACCEPTED Robert L. Hollis DEPRECATED DEPRECATED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-vfs2-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package ghostscript-ijs-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-system-monitor is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 openSUSE Factory Package gcc-fortran-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-print is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 openSUSE Factory Package gcc-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-vfsmm-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 HyperTerminal HyperTerminal application for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value that is saved in a session file, which allows remote attackers to execute arbitrary code via a malicious HyperTerminal session file (.ht), web site, or Telnet URL contained in an e-mail message, triggering a buffer overflow. Harvey Rubinovitz DRAFT INTERIM Harvey Rubinovitz ACCEPTED John Hoyland INTERIM Daniel Tarnu ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-vfs is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Operating System Stack-based buffer overflow in the Plug and Play (PnP) service for Microsoft Windows 2000 and Windows XP Service Pack 1 allows remote attackers to execute arbitrary code via a crafted packet, and local users to gain privileges via a malicious application, as exploited by the Zotob (aka Mytob) worm. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-libs-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gforth is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gcc-java is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gcc41-info is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package genromfs-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package garlic is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gcc42-fortran-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gpg2 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package gcc41-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package glade-sharp is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Sun Solaris 7 Sun RPC Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd. Brian Soby DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Specific applications using this library are not tested for because Suns advisory only provides a sample of known vulnerable applications and states that they are still investigating. SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ghex-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Windows Messenger Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability." Matthew Burton DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package gambas2-gb-qt-kde is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gail-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gcc-c++ is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gaim is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gal2-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method and using CreateLink, as demonstrated using LinkillerSaveRef, LinkillerJPU, and Linkiller, or (2) modifying the createRange method and using the FIND dialog to select text, as demonstrated using Findeath, aka the "Function Pointer Override Cross Domain" vulnerability. Tiffany Bergeron Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package gambas2-gb-sdl-opengl is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome2-user-docs is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package glibmm24 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package gcc-mudflap is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ghostview-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gnomebaker-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE Factory Package gspcav-kmp-bigsmp is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package glibc-info is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package glibc-locale-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Windows Shell The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document. Harvey Rubinovitz DRAFT INTERIM Andrew Buttner ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01 through 6.0 does not properly perform security checks on certain encoded characters within a URL, which allows a remote attacker to steal potentially sensitive information from a user by redirecting the user to another site that has that information, aka "Encoded Characters Information Disclosure." Harvey Rubinovitz ACCEPTED Robert L. Hollis INTERIM Robert L. Hollis Robert L. Hollis Robert L. Hollis Robert L. Hollis Robert L. Hollis Robert L. Hollis Robert L. Hollis ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gmp-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ggv is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gcc41-gij-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Help and Support Center (HSC) Stack-based buffer overflow in the PCHealth system in the Help and Support Center function in Windows XP and Windows Server 2003 allows remote attackers to execute arbitrary code via a long query in an HCP URL. Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtkmm2-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package glibc-profile-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gconf2-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Microsoft Internet Explorer 6.0.2800.1106 on Microsoft Windows XP SP2, and other versions including 5.01 and 5.5, allows remote web servers to bypass zone restrictions and execute arbitrary code in the local computer zone by redirecting a function to another function with the same name, as demonstrated by SimilarMethodNameRedir, aka the "Similar Method Name Redirection Cross Domain Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-libs-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package global-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Red Hat Linux 9 CGI.pm Cross-site scripting (XSS) vulnerability in start_form() of CGI.pm allows remote attackers to insert web script via a URL that is fed into the form's action parameter. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Sun Solaris 8 whodo Buffer overflow in whodo in Solaris SunOS 5.5.1 through 5.8 allows local users to execute arbitrary code via a long (1) SOR or (2) CFIME environment variable. David Proulx Matthew Wojcik INTERIM Matthew Wojcik Matthew Wojcik Matthew Wojcik ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package gcc41-fortran-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gawk is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gal-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtkzip is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package geronimo-jetty-servlet-container is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gnu-regexp-demo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gambas2-gb-form is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package htop-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gcc41-java is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 openSUSE Factory Package gcc-objc-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory Red Hat Linux 9 pam_smb Buffer overflow in PAM SMB module (pam_smb) 1.1.6 and earlier, when authenticating to a remote service, allows remote attackers to execute arbitrary code. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hypermail-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package gawk-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gambas2-gb-opengl is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gcal is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gtkmm2 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package grass-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gcal-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package hylafax-client is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-panel-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gtk-sharp2-gapi is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 ISA Server 2000 Microsoft ISA Server 2000 allows remote attackers to connect to services utilizing the NetBIOS protocol via a NetBIOS connection with an ISA Server that uses the NetBIOS (all) predefined packet filter. Christine Walzer DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gwenview-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gcc42-testresults is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package giflib-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gambas2-gb-qt is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gambas2-gb-xml-xslt is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Microsoft Internet Explorer Buffer overflow in the Content Advisor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a crafted Content Advisor file, aka "Content Advisor Memory Corruption Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM John Hoyland ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-vfsmm-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gambas2-gb-ldap is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Cursor and Icon Formatting Integer overflow in the LoadImage API of the USER32 Lib for Microsoft Windows allows remote attackers to execute arbitrary code via a .bmp, .cur, .ico or .ani file with a large image size field, which leads to a buffer overflow, aka the "Cursor and Icon Format Handling Vulnerability." Christine Walzer DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Apache mod_access in Apache 1.3 before 1.3.30, when running big-endian 64-bit platforms, does not properly parse Allow/Deny rules using IP addresses without a netmask, which could allow remote attackers to bypass intended access restrictions. Brian Soby Brian Soby Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Small Business Server 2000 Buffer overflow in the Server Message Block (SMB) functionality for Microsoft Windows 2000, XP SP1 and SP2, and Server 2003 and SP1 allows remote attackers to execute arbitrary code via unknown vectors, aka the "Server Message Block Vulnerability." Jonathan Baker DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gimp-unstable is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package htmldoc-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package gcc-ada-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package gal2-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-libs is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gcc42-objc-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-printer-add is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-panel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Sun Solaris 9 Kerberos5 Double-free vulnerabilities in error handling code in krb524d for MIT Kerberos 5 (krb5) 1.2.8 and earlier may allow remote attackers to execute arbitrary code. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gfxboot is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Red Hat Linux 9 OpenSSL OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms ("Karatsuba" and normal). Jay Beale INTERIM Jay Beale Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 openSUSE Factory Package gnome-themes-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package gamin-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hwinfo-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gconf is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gambas2-gb-sdl-sound is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gawk-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package hugin is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package html2text-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gnome-backgrounds is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE Factory Package gc-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE Factory Package hpijs-standalone is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package hwinfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtkglarea-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package hotkey-setup-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE Factory Package gcc42-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gambas2-gb-eval is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hplip-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gcalctool is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-themes is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package geronimo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Operating System Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via a blind throughput-reduction attack using spoofed Source Quench packets, aka the "ICMP Source Quench attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Nabil Ouchn INTERIM Matthew Wojcik ACCEPTED Pai Peng INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gcalctool-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package hfsplusutils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package htdig-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package html2ps is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gimp-unstable-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gnome-patch-translation is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-panel-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-volume-manager is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package gcc42-ada is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gimp-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 HTML Help Facility Integer overflow in Microsoft Windows 98, 2000, XP SP2 and earlier, and Server 2003 SP1 and earlier allows remote attackers to execute arbitrary code via a crafted compiled Help (.CHM) file with a large size field that triggers a heap-based buffer overflow, as demonstrated using a "ms-its:" URL in Internet Explorer. Andrew Buttner DRAFT INTERIM ACCEPTED Jeff Ito INTERIM ACCEPTED ACCEPTED Sun Solaris 8 mozilla Integer overflow in the SOAPParameter object constructor in (1) Netscape version 7.0 and 7.1 and (2) Mozilla 1.6, and possibly earlier versions, allows remote attackers to execute arbitrary code. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hfsutils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gambas2-gb-db is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-keyring is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gdk-pixbuf-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-screensaver is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package hbedv-dazuko-kmp-smp is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package hermes is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package galago-sharp is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gnome-media-cd is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Internet Explorer Microsoft Internet Explorer 6.0.2800.1106 and earlier allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded newline ("%0a") before the FTP command, which causes the commands to be inserted into the resulting FTP session, as demonstrated using a PORT command. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package gdome2 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gdbm-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ghostview is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package hdparm is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package graphviz is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-desktop-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gambas2-gb-crypt is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package hbedv-dazuko-kmp-xenpae is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package heroes-tron-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gcc42-fortran-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Red Hat Linux 9 OpenSSL The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the "Klima-Pokorny-Rosa attack." Jay Beale INTERIM Jay Beale Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hydrogen is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package heroes-tron is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gammu-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gfxboot-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package GraphicsMagick is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package gcc42-info is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gail-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package hanout-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package git-svn is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package ghostscript-fonts-rus is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Information Server (IIS) Cross-site scripting vulnerability in Help File search facility for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to embed scripts into another user's session. Tiffany Bergeron ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package grip is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hello is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package HLaTeX is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package gau-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package hercules-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Windows kernel The kernel of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via certain access requests. Ingrid Skoog DRAFT INTERIM Christine Walzer Andrew Buttner ACCEPTED ACCEPTED Microsoft Windows Server 2003 NetDDE Network Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an "unchecked buffer," possibly a buffer overflow. Jonathan Baker DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gimp is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package git-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability. Andrew Buttner Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gaim-galago-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package gal2 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gnash is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gambas2-gb-xml is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Windows Server 2003 Macrovision Buffer overflow in Macrovision SafeDisc secdrv.sys before 4.3.86.0, as shipped in Microsoft Windows XP SP2, XP Professional x64 and x64 SP2, Server 2003 SP1 and SP2, and Server 2003 x64 and x64 SP2 allows local users to overwrite arbitrary memory locations and gain privileges via a crafted argument to a METHOD_NEITHER IOCTL, as originally discovered in the wild. Robert L. Hollis DRAFT INTERIM INTERIM SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ghostscript-library-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Internet Explorer Use-after-free vulnerability in the CRecalcProperty function in mshtml.dll in Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code by calling the setExpression method and then modifying the outerHTML property of an HTML element, one variant of "Uninitialized Memory Corruption Vulnerability." Jeff Ito DRAFT INTERIM INTERIM Microsoft Windows XP Microsoft Windows Server 2003 The URL handling in Shell32.dll in the Windows shell in Microsoft Windows XP and Server 2003, with Internet Explorer 7 installed, allows remote attackers to execute arbitrary programs via invalid "%" sequences in a mailto: or other URI handler, as demonstrated using mIRC, Outlook, Firefox, Adobe Reader, Skype, and other applications. NOTE: this issue might be related to other issues involving URL handlers in Windows systems, such as CVE-2007-3845. There also might be separate but closely related issues in the applications that are invoked by the handlers. Sudhir Gandhe DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gbuffy is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package htdig is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gamix-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gambas2-gb-net-curl is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows NT Microsoft Word for Windows 6.0 Converter Microsoft Word for Windows 6.0 Converter (MSWRD632.WPC), as used in WordPad, does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CVE-2004-0571. Christine Walzer DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gtkhtml2-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Sun Solaris 8 Sun Solaris 9 Sun Cluster OpenSSL 0.9.6 and 0.9.7 does not properly track the number of characters in certain ASN.1 inputs, which allows remote attackers to cause a denial of service (crash) via an SSL client certificate that causes OpenSSL to read past the end of a buffer when the long form is used. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED openSUSE Factory Package helix-banshee is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hanout is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gdchart is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package hpijs-standalone-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Microsoft Windows XP MSMQ Service Unspecified vulnerability in Pragmatic General Multicast (PGM) in Microsoft Windows XP SP2 and earlier allows remote attackers to execute arbitrary code via a crafted multicast message. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE Factory Package helix-banshee-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package helix-dbus-server-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hmconv-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gettext-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package fuse-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gcc41-ada is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gconf2-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package hbedv-dazuko-kmp-xen is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 kernel Unknown vulnerability in Solaris 2.6 through 9 causes a denial of service (system panic) via "a rare race condition" or an attack by local users. Brian Soby DRAFT INTERIM ACCEPTED INTERIM DRAFT INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gconf-editor is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Internet Explorer Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via crafted layout combinations involving DIV tags and HTML CSS float properties that trigger memory corruption, aka "HTML Rendering Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package gambas2-gb-gtk is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package fyre is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hk_classes-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gbdfed is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE Factory Package helix-banshee-engine-gst is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtk-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Internet Explorer Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code via uninitialized or deleted objects used in repeated calls to the (1) cloneNode or (2) nodeValue JavaScript function, a different issue than CVE-2007-3902 and CVE-2007-5344, a variant of "Uninitialized Memory Corruption Vulnerability." Jeff Ito DRAFT INTERIM INTERIM SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hello-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gstreamer010-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package helix-banshee-plugins-extra is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Microsoft Word 2003 Microsoft Windows XP SP2 and earlier, 2000 SP3 and SP4, Server 2003, and older operating systems allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IP packets with malformed options, aka the "IP Validation Vulnerability." Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gmime-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package HLaTeX-fonts is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gambas2-gb-compress is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package frozen-bubble is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gnu-crypto is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package freetype-tools is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package fribidi-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package fs-check is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gtk-sharp2-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hcode is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package HLaTeX-fonts-extra is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package heap-buddy-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gail-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gedit-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package ghostscript-cjk is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Sun Solaris 8 Sun Solaris 9 Sun Solaris 7 Sun Solaris 2.6 The kernel in Solaris 2.6, 7, 8, and 9 allows local users to gain privileges by loading arbitrary loadable kernel modules (LKM), possibly involving the modload function. Nicholas Hansen DRAFT INTERIM INTERIM openSUSE Factory Package hostapd-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-cups-manager-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft PowerPoint Unspecified vulnerability in PowerPoint in Microsoft Office 2000, Office 2002, Office 2003, Office 2004 for Mac, and Office v.X for Mac allows user-assisted attackers to execute arbitrary code via a crafted Data record in a PPT file, a different vulnerability than CVE-2006-3435 and CVE-2006-4694. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hk_classes-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gambas2-gb-qt-ext is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gettext-java is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package fuse-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ginac-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package htdig-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gaim-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package hbedv-dazuko-kmp-bigsmp is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gnomedb-sharp is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows 2000 DirectX Stack-based buffer overflow in the DirectShow Synchronized Accessible Media Interchange (SAMI) parser in quartz.dll for Microsoft DirectX 7.0 through 10.0 allows remote attackers to execute arbitrary code via a crafted SAMI file. Jeff Ito DRAFT INTERIM INTERIM Red Hat Linux 9 OpenSSH Multiple "buffer management errors" in OpenSSH before 3.7.1 may allow attackers to cause a denial of service or execute arbitrary code using (1) buffer_init in buffer.c, (2) buffer_free in buffer.c, or (3) a separate function in channels.c, a different vulnerability than CVE-2003-0693. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE Factory Package fyre-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package fwnn-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnats-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gdk-pixbuf is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package FreeNX is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gnu-crypto-javadoc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package helix-dbus-server is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gambas2-gb-qt-kde-html is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package hwinfo-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package hp2xx-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Utilities Manager/Windows Messaging The control for listing accessibility options in the Accessibility Utility Manager on Windows 2000 (ListView) does not properly handle Windows messages, which allows local users to execute arbitrary code via a "Shatter" style message to the Utility Manager that references a user-controlled callback function. Christine Walzer ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package freeradius-dialupadmin is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows NT HyperTerminal HyperTerminal application for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value that is saved in a session file, which allows remote attackers to execute arbitrary code via a malicious HyperTerminal session file (.ht), web site, or Telnet URL contained in an e-mail message, triggering a buffer overflow. Harvey Rubinovitz DRAFT INTERIM Harvey Rubinovitz ACCEPTED John Hoyland INTERIM Daniel Tarnu ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package glib2-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package helix-banshee-engine-helix is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package help2man-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hk_classes is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-blog is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package fuse is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package fuseiso is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package helix-banshee-plugins-default is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Microsoft Windows XP Windows kernel The Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability." Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Internet Information Server (IIS) Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server (IIS) 4.0 and 5.0 allows attackers to cause a denial of service or execute arbitrary code via HTR requests with long variable names. Tiffany Bergeron ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED Microsoft Windows XP unknown The OLE component in Windows 98, 2000, XP, and Server 2003, and Exchange Server 5.0 through 2003, does not properly validate the lengths of messages for certain OLE data, which allows remote attackers to execute arbitrary code, aka the "Input Validation Vulnerability." Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-power-manager is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package freetype-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package freeradius-client-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fwnncom is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package hugin-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Program Group Converter Buffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Adobe Acrobat Reader Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking. Matthew Wojcik DRAFT INTERIM ACCEPTED ACCEPTED openSUSE Factory Package freeradius-client-libs is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package freesci-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 9 Bind BIND 8.3.x through 8.3.3 allows remote attackers to cause a denial of service (termination due to assertion failure) via a request for a subdomain that does not exist, with an OPT resource record with a large UDP payload size. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED openSUSE Factory Package gedit-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gcc41-fortran-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ganglia-monitor-core-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-vfs2 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gconf2-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package htdig-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE Factory Package graphviz-ocaml is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gail-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fonts-thryomanes is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Internet Explorer Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code via a crafted website using Javascript that creates, modifies, deletes, and accesses document objects using the tags property, which triggers heap corruption, related to uninitialized or deleted objects, a different issue than CVE-2007-3902 and CVE-2007-3903, and a variant of "Uninitialized Memory Corruption Vulnerability." Jeff Ito DRAFT INTERIM INTERIM SUSE Linux 10.1 openSUSE Factory Package hbedv-dazuko-kmp-default is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gok is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE Factory Package htop is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package glibmm24-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hermes-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Operating System Stack-based buffer overflow in the Microsoft Message Queuing (MSMQ) service in Microsoft Windows 2000 Server SP4, Windows 2000 Professional SP4, and Windows XP SP2 allows attackers to execute arbitrary code via a long string in an opnum 0x06 RPC call to port 2103. NOTE: this is remotely exploitable on Windows 2000 Server. Robert L. Hollis DRAFT INTERIM INTERIM openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hanterm-xf is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package frisk-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package hostap-utils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gaim-bs is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Red Hat Linux 9 OpenSSH A "buffer management error" in buffer_append_space of buffer.c for OpenSSH before 3.7 may allow remote attackers to execute arbitrary code by causing an incorrect amount of memory to be freed and corrupting the heap, a different vulnerability than CVE-2003-0695. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package freetype2-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gtkhtml-sharp is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package hbedv-dazuko is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-spell2-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fontconfig-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package help2man is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package foomatic-filters is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package fuse_kio-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package gamin-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package freealut is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Red Hat Linux 9 OpenSSH "Memory bugs" in OpenSSH 3.7.1 and earlier, with unknown impact, a different set of vulnerabilities than CVE-2003-0693 and CVE-2003-0695. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hmconv is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Windows kernel The Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability." Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package html-dtd is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package freeglut-devel-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package gaim-otr-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gambas2-gb-vb is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package gnome-utils-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package fox16-example-apps is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gedit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package gdome2-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Red Hat Linux 9 OpenSSH OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE Factory Package hicolor-icon-theme is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package horde is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gambas2-ide is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package formido-music is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package gtkcard-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gcc41-obj-c++ is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gambas2-gb-xml-rpc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ftwnn is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fontconfig-devel-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package freeglut-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01 through 6.0 allows remote attackers to identify the path to the Temporary Internet Files folder and obtain user information such as cookies via certain uses of the OBJECT tag, which are not subjected to the proper security checks, aka "Temporary Internet Files folders Name Reading." Harvey Rubinovitz ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package freqtweak is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hal-resmgr-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package fortune-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-vfs-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package fvwm-themes is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gambas2-gb-info is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gnu-getopt-javadoc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package freeradius-client-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package gstreamer010-plugins-good-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 7 Solaris Enterprise Authentication Mechanism (SEAM) The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes the KDC to corrupt its heap (aka "buffer underrun"). Brian Soby DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Vulnerability exists in standard Solaris kerberos and SEAM. This definition only covers SEAM Red Hat Linux 9 nfs-utils Off-by-one error in the xlog function of mountd in the Linux NFS utils package (nfs-utils) before 1.0.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain RPC requests to mountd that do not contain newlines. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package gambas2-gb-v4l is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package gcc42-gij is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fribidi-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package glib2 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package framebuffer is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package galago-gtk-sharp is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hp-officeJet-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package freeipmi-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package freefont is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-keyring-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Red Hat Linux 9 MySQL MySQL 3.23.55 and earlier creates world-writeable files and allows mysql users to gain root privileges by using the "SELECT * INFO OUTFILE" operator to overwrite a configuration file and cause mysql to run as root upon restart, as demonstrated by modifying my.cnf. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE Factory Package gimp-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package ftgl-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package frox-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory Sun Solaris 8 Sun Solaris 9 Apache mod_digest for Apache before 1.3.31 does not properly verify the nonce of a client response by using a AuthNonce secret. Brian Soby Brian Soby Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gconf-sharp2 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package free-ttf-fonts is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package HLaTeX-fonts-base is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package FooBillard is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package frink is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package freetype2-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Windows Server 2003 Outlook Express Buffer overflow in INETCOMM.DLL, as used in Microsoft Internet Explorer 6.0 through 6.0 SP2, Windows Explorer, Outlook Express 6, and possibly other programs, allows remote user-assisted attackers to cause a denial of service (application crash) via a long mhtml URI in the URL value in a URL file. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-applets is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package formido-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package ghostscript-library is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package hal is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hal-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gammu-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 8 mozilla Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to install arbitrary extensions by using interactive events to manipulate the XPInstall Security dialog box. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fortune is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package frozen-bubble-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fwnndev is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Color Management Module Buffer overflow in the Microsoft Color Management Module for Windows allows remote attackers to execute arbitrary code via an image with crafted ICC profile format tags. Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Information Server (IIS) IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability. Tiffany Bergeron ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package freetype2-devel-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnome-spell is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows XP Windows kernel Buffer overflow in Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to cause a denial of service (i.e., system crash) via a malformed request, aka "Object Management Vulnerability". Ingrid Skoog DRAFT INTERIM Christine Walzer ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gal-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows Server 2003 Operating System The DNS server in Microsoft Windows 2000 Server SP4, and Server 2003 SP1 and SP2, uses predictable transaction IDs when querying other DNS servers, which allows remote attackers to spoof DNS replies, poison the DNS cache, and facilitate further attack vectors. Robert L. Hollis DRAFT Jeff Cheng Jeff Cheng Jeff Cheng INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package fribidi-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hostap-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Network News Transport Protocol (NNTP) The Network News Transfer Protocol (NNTP) component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an "unchecked buffer," leading to off-by-one and heap-based buffer overflows. Christine Walzer DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package freetype2-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package gobby-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-mag-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gstreamer010-plugins-base-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gimp-unstable-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 A version of Microsoft Windows Server 2003 SP1 (x64) is installed. Sudhir Gandhe DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fly is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Message Queuing Buffer overflow in the Message Queuing component of Microsoft Windows 2000 and Windows XP SP1 allows remote attackers to execute arbitrary code via a crafted message. Ingrid Skoog DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Sun Solaris 7 lpstat Stack-based buffer overflow in the bsd_queue() function for lpq on Solaris 2.6 and 7 allows local users to gain root privilege. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package frink-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package fvwm2 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gcc41-objc-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory HP-UX 11 ftpd The FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ganglia-monitor-core is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package hal-resmgr is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hylafax-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gaim-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gcc-obj-c++ is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Sun Solaris 7 CDE Buffer overflow in TT_SESSION environment variable in ToolTalk shared library allows local users to gain root privileges. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED openSUSE Factory Package graphviz-python is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Microsoft Windows NT Windows Internet Naming Service (WINS) The WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 allows remote attackers to write to arbitrary memory locations and possibly execute arbitrary code via a modified memory pointer in a WINS replication packet to TCP port 42, aka the "Association Context Vulnerability." Matthew Burton DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package FOTAQ is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fnlib-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Internet Explorer Heap-based buffer overflow in DirectAnimation.PathControl COM object (daxctle.ocx) in Microsoft Internet Explorer 6.0 SP1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a Spline function call whose first argument specifies a large number of points. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package freeglut-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Local Security Authority Subsystem Service (LSASS) LSASS (Local Security Authority Subsystem Service) of Windows 2000 Server and Windows Server 2003 does not properly validate connection information, which allows local users to gain privileges via a specially-designed program. Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED openSUSE Factory Package helix-banshee-plugins-DAAP is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-keyring-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package freeglut is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package fusepod-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the Popup.show method and use drag-and-drop actions in a popup window, aka "HijackClick 3" and the "Script in Image Tag File Download Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package hercules is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gcc-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gambas2-gb-qt-opengl is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Red Hat Linux 9 MySQL Double-free vulnerability in mysqld for MySQL before 3.23.55 allows attackers with MySQL access to cause a denial of service (crash) via mysql_change_user. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fxload-2002_04_11 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gst-plugins-farsight-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package grub is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Sun Solaris 10 The get_server_hello function in the SSLv2 client code in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows remote servers to cause a denial of service (client crash) via unknown vectors that trigger a null pointer dereference. Todd Dolinsky DRAFT INTERIM INTERIM openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hatari is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package firmwarekit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package git-email is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gambas2-gb-pcre is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gpsdrive-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gda-sharp is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 IIS Buffer overflow in Microsoft Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows local and possibly remote attackers to execute arbitrary code via crafted Active Server Pages (ASP). Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 The application Microsoft IIS 5.0 is installed. Robert L. Hollis INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fftw-mpi-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ftgl is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package freeradius-client is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package fbi-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Windows Shell Buffer overflow in Microsoft Internet Explorer and Explorer on Windows XP SP1, WIndows 2000, Windows 98, and Windows Me may allow remote malicious servers to cause a denial of service (application crash) and possibly execute arbitrary code via long share names, as demonstrated using Samba. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package FAUmachine-suse-90 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package ghex-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package fltk-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gdb-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package hostapd is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Red Hat Linux 9 Mutt Buffer overflow in Mutt 1.4.0 and possibly earlier versions, 1.5.x up to 1.5.3, and other programs that use Mutt code such as Balsa before 2.0.10, allows a remote malicious IMAP server to cause a denial of service (crash) and possibly execute arbitrary code via a crafted folder. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package frontline is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package file-roller-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package fdecc-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package helix-banshee-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package glchess is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package freeipmi-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package fping is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Internet Explorer Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code via "unexpected method calls to HTML objects," aka "DHTML Object Memory Corruption Vulnerability." Jeff Ito DRAFT INTERIM INTERIM openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package galago-daemon is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package fop is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Internet Explorer Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code by using the document.getElementByID Javascript function to access crafted Cascading Style Sheet (CSS) elements, and possibly other unspecified vectors involving certain layout positioning combinations in an HTML file. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 cachefsd cachefsd in Solaris 2.6, 7, and 8 allows remote attackers to cause a denial of service (crash) via an invalid procedure call in an RPC request. Brian Soby DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Word for Windows 6.0 Converter Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CVE-2004-0901. Christine Walzer DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package filesystem is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package fast-user-switch-applet is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package fetchmailconf is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package fusepod is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gsmlib-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package findutils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fbset-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnumeric is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Flash Player Unspecified vulnerability in Adobe (Macromedia) Flash Player 8.0.24.0 allows remote attackers to cause a denial of service (browser crash) via a malformed, compressed .swf file, a different issue than CVE-2006-3587. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package heap-buddy is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package heartbeat-pils is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package f-spot is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows 2000 VDM The Virtual DOS Machine (VDM) subsystem of Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows local users to access kernel memory and gain privileges via a malicious program that modified some system structures in a way that is not properly validated by privileged operating system functions. Ingrid Skoog DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package freetype-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package festival-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package frox is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE Factory Package fox16-static is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package gsf-sharp-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package flphoto is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel Buffer overflow in certain Asian language versions of Microsoft Excel might allow user-assisted attackers to execute arbitrary code via a crafted STYLE record in a spreadsheet that triggers the overflow when the user attempts to repair the document or selects the "Style" option, as demonstrated by nanika.xls. NOTE: Microsoft has confirmed to CVE via e-mail that this is different than the other Excel vulnerabilities announced before 20060707, including CVE-2006-3059 and CVE-2006-3086. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package glibmm2 is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package heartbeat-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Visual Studio .NET 2002 Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation. Ingrid Skoog DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED John Hoyland INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE Factory Package freealut-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package flac-xmms is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package hal-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gambas2-gb-image is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package genisoimage is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fcwnncom is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package fbiterm is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Red Hat Linux 9 lv lv reads a .lv file from the current working directory, which allows local users to execute arbitrary commands as other lv users by placing malicious .lv files into other directories. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Sun Solaris 7 cachefsd Buffer overflow in the fscache_setup function of cachefsd in Solaris 2.6, 7, and 8 allows local users to gain root privileges via a long mount argument. David Proulx Brian Soby INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnokii-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fluidsynth is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package fox16 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package flim-xemacs is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package filters-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package hp-officeJet is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package file-roller is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gambas2-gb-net-smtp is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fkwnndev is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package hal-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Word 2002 Microsoft Outlook 2000 and 2002, when configured to use Microsoft Word as the email editor, does not block scripts that are used while editing email messages in HTML or Rich Text Format (RTF), which could allow remote attackers to execute arbitrary scripts via an email that the user forwards or replies to. Ingrid Skoog DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hp2xx is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package FAUmachine-debian-30r0 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista DirectX Buffer overflow in Microsoft DirectShow in Microsoft DirectX 7.0 through 10.0 allows remote attackers to execute arbitrary code via a crafted (1) WAV or (2) AVI file. Jeff Ito DRAFT INTERIM INTERIM openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hfsplusutils is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package FA_clalsadrv is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package graphviz-gd is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fping-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows NT DHCP The DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition, with DHCP logging enabled, does not properly validate the length of certain messages, which allows remote attackers to cause a denial of service (application crash) via a malformed DHCP message, aka "Logging Vulnerability." Ingrid Skoog DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package FAUmachine-suse-92 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hostap is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Operating System The server driver (srv.sys) in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (system crash) via an SMB_COM_TRANSACTION SMB message that contains a string without null character termination, which leads to a NULL dereference in the ExecuteTransaction function, possibly related to an "SMB PIPE," aka the "Mailslot DOS" vulnerability. NOTE: the name "Mailslot DOS" was derived from incomplete initial research; the vulnerability is not associated with a mailslot. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package FastCGI-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package git-arch is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package fdupes is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Compressed Folders Integer overflow in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition allows remote attackers to execute arbitrary code via compressed (zipped) folders that involve an "unchecked buffer" and improper length validation. David Proulx DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package fetchmail is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package FreeNX-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gpart is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fast-user-switch-applet-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package finch-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package flood-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 The application Microsoft Publisher 2000 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package heartbeat-stonith is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package glibc-devel-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package exiftool is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package FAUmachine-openbsd-36 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fftw3-threads-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 ISA Server 2000 Microsoft Proxy Server 2.0 and Microsoft ISA Server 2000 (which is included in Small Business Server 2000 and Small Business Server 2003 Premium Edition) allows remote attackers to spoof trusted Internet content on a specially crafted webpage via spoofed reverse DNS lookup results. Christine Walzer DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnugo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package freesci is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fftw3-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package evolution-sharp is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package hal-gnome is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package exo-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gdbm-devel-64bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 10 Buffer overflow in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions has unspecified impact and remote attack vectors involving a long list of ciphers. Todd Dolinsky DRAFT INTERIM INTERIM openSUSE Factory Package evolution-exchange-doc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Sun Solaris 8 Sun Solaris 9 Sun Cluster Integer overflow in OpenSSL 0.9.6 and 0.9.7 allows remote attackers to cause a denial of service (crash) via an SSL client certificate with certain ASN.1 tag values. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED openSUSE Factory Package exo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gcdmaster is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package fwnn-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package esound is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ethereal-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package freeradius-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package freealut-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package heartbeat-cmpi is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package howtoenh is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Program Group Converter Buffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package emil is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package eruby is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package flim is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE Factory Package etherape-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Telnet protocol Buffer overflow in telnet server in Windows 2000 and Interix 2.2 allows remote attackers to execute arbitrary code via malformed protocol options. Christine Walzer Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package eclipse-pde is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package eclipse-gtk2 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package FAUmachine-openbsd-35 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package evolution-webcal is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fonttools is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Samba Buffer overflow in Microsoft Word 2000, Word 2002, and Word 2003 allows remote attackers to execute arbitrary code via a crafted document. Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-vfsmm is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fxload-debuginfo-2002_04_11 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package edict-emacs is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package figlet is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Red Hat Linux 9 LPRng psbanner in the LPRng package allows local users to overwrite arbitrary files via a symbolic link attack on the /tmp/before file. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package FA_clalsadrv-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fly-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package emu-tools is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel 2002 Unknown vulnerability in Microsoft Excel 2000, 2002, 2001 for Mac, and v.X for Mac allows remote attackers to execute arbitrary code via a malicious file containing certain parameters that are not properly validated. Matthew Burton DRAFT John Hoyland DRAFT SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package exim-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Distributed Component Object Model (DCOM) Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed DCERPC DCOM object activation request packet with modified length fields, a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0528. Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package eject is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package evolution-data-server-doc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package flac is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package eblook is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package FileZilla-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package ejb-javadoc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package evolution-data-server-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation. Ingrid Skoog DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package ecj-bootstrap is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package FA_clthreads-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package eclipse-scripts is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package flac-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package flex-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package fvwm2-gtk is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory HP-UX 11 ftpd The FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package freeradius-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows Vista SMBv2 Unspecified vulnerability in Server Message Block Version 2 (SMBv2) signing support in Microsoft Windows Vista allows remote attackers to force signature re-computation and execute arbitrary code via a crafted SMBv2 packet, aka "SMBv2 Signing Vulnerability." Robert L. Hollis DRAFT INTERIM INTERIM openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package f2c is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package galago-daemon-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package enlightenment-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-panel-doc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-system-tools-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fftw3-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package evolution-sharp-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fftw-mpi is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word 2003 Buffer overflow in Microsoft Word 2002 (10.6612.6714) SP3, and possibly other versions, allows remote attackers to cause a denial of service (application exception) and possibly execute arbitrary code in winword.exe via certain unexpected values in a .doc file, including (1) an offset that triggers an out-of-bounds memory access, (2) a certain value that causes a large memory copy as triggered by an integer conversion error, and other values. Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED Chris Wood INTERIM ACCEPTED ACCEPTED Sun Solaris 7 libnsl Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd. David Proulx Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package hfsutils is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package fillup is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package exo-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ebview-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package FAUmachine-base is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package eclipse-subversive is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows XP A version of Microsoft Windows XP Professional x64 Edition Service Pack 2 is installed. Sudhir Gandhe DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package enchant-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ebtables-debuginfo-v2 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 7 Bind Buffer overflow in the DNS resolver code used in libc, glibc, and libbind, as derived from ISC BIND, allows remote malicious DNS servers to cause a denial of service and possibly execute arbitrary code via the stub resolvers. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 .NET Framework Microsoft .NET framework 2.0 (ASP.NET) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1 allows remote attackers to bypass access restrictions via unspecified "URL paths" that can access Application Folder objects "explicitly by name." Robert L. Hollis INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package FastCGI-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package eel-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package freqtweak-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ElectricFence-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package evolution-pilot is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE Factory Package enscript-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gcc41-locale is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fontforge-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package FA_clthreads is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package formido is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package gcc42-java is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE Factory Package ecryptfs-utils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hal-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package freetype-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gnet is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package FAUmachine-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package fileshareset is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ebdev is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package elilo-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package emacs-lisp-intro is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Red Hat Enterprise Linux 4 mozilla Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 allows remote attackers to cause a denial of service (access violation and crash), and possibly execute arbitrary code, by calling InstallVersion.compareTo with an object instead of a string. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory corruption") via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the "<STYLE>@;/*" string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the "CSS Heap Memory Corruption Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ez-ipupdate is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package evolution-data-server-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package e2fsprogs-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gaim-galago is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ethtool-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package finch is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fnfx-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package fusesmb-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ebview is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability. Andrew Buttner Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package flash-player is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package expect-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package enblend-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package eblook-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package fastjar is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gammu is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package evince-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer in Windows XP SP2, and other versions including 5.01 and 5.5, allows remote attackers to install arbitrary programs via a web page that uses certain styles and the AnchorClick behavior, popup windows, and drag-and-drop capabilities to drop the program in the local startup folder, as demonstrated by "wottapoop.html". Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package enigma is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-libs-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gnome-alsamixer-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package evolution-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package eazy is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package FlightGear is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package evolution-galago-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package enchant-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package epiphany is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE Factory Package farsight-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package heartbeat-gui is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package glibc-obsolete is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Outlook Express 6 for Windows 2003 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package fbi is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package fam-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package eIDconfig-belgium is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fftw3-threads is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package exiftran is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package html2text is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package evolution-data-server is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fftw-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package epplet-base-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fltk-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 NetWare Unspecified vulnerability in the driver for the Client Service for NetWare (CSNW) in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 up to SP1 allows remote attackers to cause a denial of service (hang and reboot) via has unknown attack vectors, aka "NetWare Driver Denial of Service Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package ethtool is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package eel-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fftw-threads-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package howto is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package freeipmi-utils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package freeglut-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package eiciel-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package evolution-galago is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package exifprobe is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package eximstats-html is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory HP-UX 11 Operating System Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the "blind connection-reset attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package emacs-url is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package epiphany-extensions is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package fribidi-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fontconfig-devel-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package evms-ha is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Sun Solaris 8 Sun Solaris 9 Apache Apache does not filter terminal escape sequences from its error logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences. Brian Soby Brian Soby Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package fonts-arabic is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package fltk is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package ethereal-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package ethereal is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Red Hat Linux 9 Konqueror KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package flac-xmms-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package evolution-data-server-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package heartbeat is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gail-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package dx is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package evince is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package fuseiso-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package eID-belgium-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package eclipse-platform is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package fastjar-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory HP-UX 11 ftpd The FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Sun Solaris 7 rpc.rwalld Format string vulnerability in RPC wall daemon (rpc.rwalld) for Solaris 2.5.1 through 8 allows remote attackers to execute arbitrary code via format strings in a message that is not properly provided to the syslog function when the wall command cannot be executed. David Proulx Todd Dolinsky INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gamix is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 7 lpstat, libprint Unknown multiple vulnerabilities in (1) lpstat and (2) the libprint library in Solaris 2.6 through 9 may allow attackers to execute arbitrary code or read or write arbitrary files. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.1 openSUSE Factory Package dvgt-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package enigma-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 9 Sun Solaris 10 Unspecified vulnerability in the ioctl interface in the Solaris Volume Manager (SVM) in Sun Solaris 9 and 10 allows local users to cause a denial of service (panic) via unspecified vectors, a different vulnerability than CVE-2004-1346. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package freeciv is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gjiten is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fillets-ng is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package eclipse-cdt is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package eclipse is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability. Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED ACCEPTED openSUSE Factory Package eclipse-cdt-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package flac-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package eximon is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package epydoc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6 does not properly validate certain URLs in Channel Definition Format (CDF) files, which allows remote attackers to obtain sensitive information or execute arbitrary code, aka the "Channel Definition Format (CDF) Cross Domain Vulnerability." Harvey Rubinovitz DRAFT INTERIM Harvey Rubinovitz ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package emacs-nox is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dvgrab is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package hplip-hpijs is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package fam is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fwnn is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model and access information on the local system or in other domains, and possibly execute code, via cached methods and objects, aka "Cross Domain Verification via Cached Methods." Harvey Rubinovitz ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gemdropx is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ganglia-monitor-core-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package epiphany-extensions-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Microsoft Word for Windows 6.0 Converter Microsoft Word for Windows 6.0 Converter (MSWRD632.WPC), as used in WordPad, does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CVE-2004-0571. Christine Walzer DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Robert L. Hollis DEPRECATED DEPRECATED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dog is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ganglia-monitor-core-gmetad is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package ekiga is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dvbd is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package gamin is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ganglia-webfrontend is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Windows Shell The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document. Harvey Rubinovitz DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package eID-belgium is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dvi2tty-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package exifprobe-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package etherape is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ez-ipupdate-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package expat-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package eciadsl-usermode is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ebtables-v2 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package freetype2-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package esound-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 ISA Server 2000 The Winsock Proxy service in Microsoft Proxy Server 2.0 and the Microsoft Firewall service in Internet Security and Acceleration (ISA) Server 2000 allow remote attackers to cause a denial of service (CPU consumption or packet storm) via a spoofed, malformed packet to UDP port 1745. Tiffany Bergeron ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fkwnn is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package drbd-kmp-xen is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package docbook-xsl-stylesheets is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dosemu-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package dosutils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package f2c-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package fribidi is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package frisk is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package freeradius is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package efont-unicode is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory HP-UX 11 Operating System Multiple TCP/IP and ICMP implementations, when using Path MTU (PMTU) discovery (PMTUD), allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via forged ICMP ("Fragmentation Needed and Don't Fragment was Set") packets with a low next-hop MTU value, aka the "Path MTU discovery attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED openSUSE Factory Package dvbstream-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dos2unix-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 7 Sun Solaris 8 Bourne Shell (sh) Bourne Again Shell (bash) TENEX C Shell (tcsh) C Shell (csh) Korn Shell (ksh) Multiple shell programs on various Unix systems, including (1) tcsh, (2) csh, (3) sh, and (4) bash, follow symlinks when processing << redirects (aka here-documents or in-here documents), which allows local users to overwrite files of other users via a symlink attack. Brian Soby DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM Matthew Wojcik ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package docbook2x is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package DirectFB-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package FlightGear-data is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 SMB (Server Message Block) The Server Message Block (SMB) implementation for Windows NT 4.0, 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allows remote attackers to execute arbitrary code via Transaction responses containing (1) Trans or (2) Trans2 commands, aka the "Server Message Block Vulnerability," and as demonstrated using Trans2 FIND_FIRST2 responses with large file name length fields. Christine Walzer DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package docbook_3 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package emacs-vm-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package eperl is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 NetWare Buffer overflow in Client Service for NetWare (CSNW) in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 up to SP1 allows remote attackers to execute arbitrary code via crafted messages, aka "Client Service for NetWare Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package drbd-kmp-iseries64 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package exif is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dovecot-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package FA_clxclient-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package doxygen is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package epic-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package eruby-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Exchange Server Heap-based buffer overflow in the SvrAppendReceivedChunk function in xlsasink.dll in the SMTP service of Exchange Server 2000 and 2003 allows remote attackers to execute arbitrary code via a crafted X-LINK2STATE extended verb request to the SMTP port. Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fillets-ng-data is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 8 Sun Solaris 9 DtMail Format string vulnerability in CDE Mailer (dtmail) on Solaris 8 and 9 allows local users to gain privileges via format strings in the argv[0] value. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 HTML Help Facility The HTML Help facility in Microsoft Windows 98, 98 Second Edition, Millennium Edition, NT 4.0, NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP uses the Local Computer Security Zone when opening .chm files from the Temporary Internet Files folder, which allows remote attackers to execute arbitrary code via HTML mail that references or inserts a malicious .chm file containing shortcuts that can be executed, aka "Code Execution via Compiled HTML Help File." Christine Walzer ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fftw3 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gambas2-gb-sdl is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package ekiga-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hydrogen-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package dosfstools-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fontforge is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package drbd-kmp-smp is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office XP SP3 Buffer overflow in Microsoft Office XP allows remote attackers to execute arbitrary code via a link with a URL file location containing long inputs after (1) "%00 (null byte) in .doc filenames or (2) "%0a" (carriage return) in .rtf filenames. Ingrid Skoog Ingrid Skoog Ingrid Skoog Anna Min DRAFT INTERIM ACCEPTED INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Windows kernel The Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability." Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package evolution-exchange is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows NT Simple Network Management Protocol (SNMP) Buffer overflow in SNMP agent service in Windows 95/98/98SE, Windows NT 4.0, Windows 2000, and Windows XP allows remote attackers to cause a denial of service or execute arbitrary code via a malformed management request. NOTE: this candidate may be split or merged with other candidates. This and other PROTOS-related candidates, especially CVE-2002-0012 and CVE-2002-0013, will be updated when more accurate information is available. Matt Busby Matthew Burton DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dvgrab-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package epos is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package expect is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fam-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package festival-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package hbedv-dazuko-kmp-debug is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package digikamimageplugins-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package e2fsprogs-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package findutils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package diald-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Red Hat Linux 9 Linux kernel The C-Media PCI sound driver in Linux before 2.4.22 does not use the get_user function to access userspace in certain conditions, which crosses security boundaries and may facilitate the exploitation of vulnerabilities, a different vulnerability than CVE-2003-0699. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package FAUmachine-suse-91 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package heartbeat-ldirectord is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package emacs-vm is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package doc++ is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Office XP SP2 Buffer overflow in the converter for Microsoft WordPerfect 5.x on Office 2000, Office XP, Office 2003, and Works Suites 2001 through 2004 allows remote attackers to execute arbitrary code via a malicious document or website. Ingrid Skoog DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED ACCEPTED openSUSE Factory Package firmwarekit-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows XP GDI+ Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation. Ingrid Skoog DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package emacs-calc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package emacs-el is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package finger-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to read arbitrary files via malformed requests to the GetObject function, which bypass some of GetObject's security checks. David Proulx ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word Integer overflow in Microsoft Word 2000, 2002, 2003, 2004 for Mac, and v.X for Mac allows remote user-assisted attackers to execute arbitrary code via a crafted string in a Word document, which overflows a 16-bit integer length value, aka "Memmove Code Execution," a different vulnerability than CVE-2006-3651 and CVE-2006-4693. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fluidsynth-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package dos2unix is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dovecot is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fcwnn is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package fftw is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows XP Windows kernel The kernel of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via certain access requests. Ingrid Skoog DRAFT INTERIM Christine Walzer ACCEPTED ACCEPTED SUSE Linux 10.1 openSUSE Factory Package dx-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package dosbootdisk is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package docbook2x-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package eel-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Operating System mso.dll, as used by Microsoft PowerPoint 2000 through 2003, allows user-assisted attackers to execute arbitrary commands via a malformed shape container in a PPT file that leads to memory corruption, as exploited by Trojan.PPDropper.B, a different issue than CVE-2006-1540 and CVE-2006-3493. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 mozilla Mozilla Firefox 0.9.1 and 0.9.2 allows remote web sites to spoof certificates of trusted web sites via redirects and Javascript that uses the "onunload" method. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gau is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package gitk is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package dhcp-tools is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package eel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hal-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package gaim-otr is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE Factory Package fox16-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package f-spot-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fcwnndev is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package eiciel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package ElectricFence is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package DirectFB-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package fam-server is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package fuse_kio is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package etherboot is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows NT HyperTerminal HyperTerminal application for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value that is saved in a session file, which allows remote attackers to execute arbitrary code via a malicious HyperTerminal session file (.ht), web site, or Telnet URL contained in an e-mail message, triggering a buffer overflow. Harvey Rubinovitz DRAFT INTERIM Harvey Rubinovitz ACCEPTED John Hoyland INTERIM ACCEPTED John Hoyland INTERIM Daniel Tarnu ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package figlet-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fnlib is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dnsmasq is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Kerberos MIT Kerberos 5 (krb5) 1.3 through 1.4.1 Key Distribution Center (KDC) allows remote attackers to cause a denial of service (application crash) via a certain valid TCP connection that causes a free of unallocated memory. Robert L. Hollis DRAFT INTERIM ACCEPTED Nabil Ouchn INTERIM ACCEPTED ACCEPTED openSUSE Factory Package dx-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE Factory Package digikamimageplugins-superimpose is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package enchant is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Distributed Component Object Model (DCOM) Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed RPC request with a long filename parameter, a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0715. Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package giflib-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dvi2tty is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package diffutils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package flamethrower is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package ejb is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 8 Bind Unknown vulnerability in in.named on Solaris 8 allows remote attackers to cause a denial of service (process crash). Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 A version of Microsoft Windows Server 2003 (ia64) Gold is installed. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fluidsynth-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dvd+rw-tools-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows NT Windows Animated Cursor The Windows Animated Cursor (ANI) capability in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allow remote attackers to cause a denial of service via (1) the frame number set to zero, which causes an invalid memory address to be used and leads to a kernel crash, or (2) the rate number set to zero, which leads to resource exhaustion and hang. Christine Walzer DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gdk-pixbuf-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package diald is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package eject-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows NT VDM The Virtual DOS Machine (VDM) subsystem of Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows local users to access kernel memory and gain privileges via a malicious program that modified some system structures in a way that is not properly validated by privileged operating system functions. Ingrid Skoog DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gcc-info is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package finger-server is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package enblend is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.5 and 6 does not properly handle plug-in navigation, which allows remote attackers to alter displayed address bars and thereby spoof web pages, facilitating phishing attacks, aka the "Plug-in Navigation Address Bar Spoofing Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package doc-gnu-ko is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package FAUmachine is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package drbd-kmp-debug is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package engine_pkcs11 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package flood is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dinat is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package deltarpm-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Windows kernel Buffer overflow in the font processing component of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application. Ingrid Skoog DRAFT INTERIM Christine Walzer ACCEPTED ACCEPTED SUSE Linux 10.1 openSUSE Factory Package dvbtune-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Flash Player Buffer overflow in Adobe Flash Player 8.0.24.0 and earlier, Flash Professional 8, Flash MX 2004, and Flex 1.5 allows user-assisted remote attackers to execute arbitrary code via a long, dynamically created string in a SWF movie. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package djvulibre is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package emacs-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package docbook_5 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package devel_rpm_build is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package encfs is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dssi is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package e2fsprogs is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package desktop-data-SuSE-extra is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package dhcp-server is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package device-mapper-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01 through 6.0 does not properly check certain parameters of a PNG file when opening it, which allows remote attackers to cause a denial of service (crash) by triggering a heap-based buffer overflow using invalid length codes during decompression, aka "Malformed PNG Image File Failure." Harvey Rubinovitz ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fontconfig-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fonttools-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gconf2-32bit is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Buffer overflow in the Content Advisor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a crafted Content Advisor file, aka "Content Advisor Memory Corruption Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Jason Spashett INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dietlibc-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package devs is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package dhcp6 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dragonegg-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fdecc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package devilspie is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's "href" to the malicious Javascript, then calling execCommand("Refresh") to refresh the page, aka BodyRefreshLoadsJPU or the "ExecCommand Cross Domain" vulnerability. Tiffany Bergeron Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package elisp-manual is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package farsight-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package efont-serif-ttf is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package dita-ot is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package drbd-kmp-xenpae is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package diffmk is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Compressed Folders Integer overflow in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition allows remote attackers to execute arbitrary code via compressed (zipped) folders that involve an "unchecked buffer" and improper length validation. David Proulx DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows Vista Operating System Unspecified vulnerability in the Windows Advanced Local Procedure Call (ALPC) in the kernel in Microsoft Windows Vista allows local users to gain privileges via unspecified vectors involving "legacy reply paths." Robert L. Hollis DRAFT INTERIM INTERIM openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package flex-old is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6 does not properly validate buffers when handling certain DHTML methods including the createControlRange Javascript function, which allows remote attackers to execute arbitrary code, aka the "DHTML Method Heap Memory Corruption Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package dicts is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE Factory Package digikam-lang is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package e2fsprogs-devel-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package dovecot-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dhcdbd-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package FileZilla is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package expat-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package evms-gui is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package eric is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package djvulibre-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Unknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to execute arbitrary code via a web site or an HTML e-mail containing a crafted JPEG image that causes memory corruption, aka "JPEG Image Rendering Memory Corruption Vulnerability". Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Information Server (IIS) Buffer overflow in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers and cause a denial of service or execute arbitrary code via HTTP header field values. Tiffany Bergeron ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package docbook_4 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package exim is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package device-mapper-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package delayacct-utils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 SUSE Linux 10.0 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package faces is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fftw-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dcraw-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dosemu is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package frontline-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package diffstat-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office Unspecified vulnerability in Microsoft Office 2000, XP, 2003, 2004 for Mac, and v.X for Mac allows remote user-assisted attackers to execute arbitrary code via a crafted string that triggers memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Windows Help and Support Center Stack-based buffer overflow in the PCHealth system in the Help and Support Center function in Windows XP and Windows Server 2003 allows remote attackers to execute arbitrary code via a long query in an HCP URL. Christine Walzer DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package digikam-doc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package eperl-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package devhelp-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ddiwrapper-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gcc42-locale is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package docutils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Word for Windows 6.0 Converter Microsoft Word for Windows 6.0 Converter (MSWRD632.WPC), as used in WordPad, does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CVE-2004-0571. Christine Walzer DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Office XP SP2 Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation. Ingrid Skoog DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package deskbar-applet is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model and access information on the local system or in other domains, and possibly execute code, via cached methods and objects, aka "Cross Domain Verification via Cached Methods." Harvey Rubinovitz ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dejagnu is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fam-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package doxywizard-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ddskk-xemacs is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package farsifonts is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dictd-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package drbd is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6 does not properly cache SSL content, which allows remote attackers to obtain information or spoof content via a web site with the same host name as the target web site, whose content is cached and reused when the user visits the target web site. Harvey Rubinovitz DRAFT INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED openSUSE Factory Package engine_pkcs11-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fluidsynth-dssi is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Red Hat Linux 9 Linux kernel The C-Media PCI sound driver in Linux before 2.4.21 does not use the get_user function to access userspace, which crosses security boundaries and may facilitate the exploitation of vulnerabilities, a different vulnerability than CVE-2003-0700. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE Factory Package evms-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package desktop-file-utils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dvb-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package firmwarekit-r1 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gbuffy-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package dx-data is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package FAUmachine-redhat-9 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package freetype2 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package hcode-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package docbook-simple is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Red Hat Linux 9 Linux kernel Integer signedness error in the decode_fh function of nfs3xdr.c in Linux kernel before 2.4.21 allows remote attackers to cause a denial of service (kernel panic) via a negative size value within XDR data of an NFSv3 procedure call. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package ddclient is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package digikam-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package device-mapper-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dietzlib is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package dhcp-client is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dog-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package eel-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package dds2tar is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer The DHTML Edit Control (dhtmled.ocx) allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as demonstrated by "AbusiveParent" in Internet Explorer 6.0.2900.2180. Jonathan Baker DRAFT INTERIM ACCEPTED Christine Walzer INTERIM Andrew Buttner ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package fusesmb is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Red Hat Linux 9 Linux kernel Linux 2.4.x allows remote attackers to spoof the bridge Forwarding table via forged packets whose source addresses are the same as the target. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED SUSE Linux 10.1 openSUSE Factory Package deb-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package expat-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package doxywizard is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package drac-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package flex-old-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package FastCGI is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package dmapi-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package drbd-kmp-bigsmp is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gambas2-runtime is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package docbook-toys is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Red Hat Linux 9 Linux kernel The STP protocol implementation in Linux 2.4.x does not properly verify certain lengths, which could allow attackers to cause a denial of service. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package DirectFB-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package emacs-x11 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package delayacct-utils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package f2c-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package docudir is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE Factory Package hostap-utils is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package freetype is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package dbxml is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 7 Sun Solaris 8 sendfilev() Buffer overflow in ntpd ntp daemon 4.0.99k and earlier (aka xntpd and xntp3) allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long readvar argument. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package eciadsl-usermode-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package emacs-info is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dvbstream is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dhcpcd-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Windows XP Multiple TCP/IP and ICMP implementations, when using Path MTU (PMTU) discovery (PMTUD), allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via forged ICMP ("Fragmentation Needed and Don't Fragment was Set") packets with a low next-hop MTU value, aka the "Path MTU discovery attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ht2html is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Windows 2000 Microsoft Windows XP SP2 and earlier, 2000 SP3 and SP4, Server 2003, and older operating systems allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IP packets with malformed options, aka the "IP Validation Vulnerability." Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE Factory Package evince-doc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows XP Windows Shell Buffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe. Andrew Buttner DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dictd is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package drgeo-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Red Hat Enterprise Linux 3 gzip Directory traversal vulnerability in gunzip -N in gzip 1.2.4 through 1.3.5 allows remote attackers to write to arbitrary directories via a .. (dot dot) in the original filename within a compressed file. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package FAUmachine-fc-3 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package engdic is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Internet Explorer Buffer overflow in the URL processor of Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL with a long hostname, aka "URL Parsing Memory Corruption Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package drbd-kmp-default is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package emacs-w3-cvs is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package doxygen-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package emu-tools-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package desktop-file-utils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package gbdfed-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Project Professional 2003 Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation. Ingrid Skoog DRAFT Ingrid Skoog INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED Microsoft Windows Server 2003 HTML Help Facility Integer overflow in Microsoft Windows 98, 2000, XP SP2 and earlier, and Server 2003 SP1 and earlier allows remote attackers to execute arbitrary code via a crafted compiled Help (.CHM) file with a large size field that triggers a heap-based buffer overflow, as demonstrated using a "ms-its:" URL in Internet Explorer. Andrew Buttner DRAFT INTERIM ACCEPTED Jeff Ito INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package dbxml-utils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package dmapi-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package device-mapper-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dhcp-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package exif-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package dirmngr is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package ecryptfs-utils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package dragonegg is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dbus-1-qt-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package docbook-tdg is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Red Hat Linux 9 Linux kernel The STP protocol, as enabled in Linux 2.4.x, does not provide sufficient security by design, which allows attackers to modify the bridge topology. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Windows 2000 Windows 2000 allows local users to prevent the application of new group policy settings by opening Group Policy files with exclusive-read access. Tiffany Bergeron Christine Walzer INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Apache Multiple stack-based buffer overflows in (1) mod_alias and (2) mod_rewrite for Apache before 1.3.29 allow attackers to create configuration files to cause a denial of service (crash) or execute arbitrary code via a regular expression with more than 9 captures. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package eog-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package FooBillard-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package doc++-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package elilo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dosbox-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package garlic-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package docbook-xml-slides is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package dviutils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package ddt-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel Buffer overflow in Microsoft Excel 2000 through 2003 allows user-assisted attackers to execute arbitrary code via a .xls file with certain crafted fields in a SELECTION record, which triggers memory corruption, aka "Malformed SELECTION record Vulnerability." Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package freeglut-devel-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package dosfstools is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package dhcpcd is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package gail is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package dbus-1-qt is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package db-java is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package dbus-1-glib is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package drgeo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package flphoto-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package hplip is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package enscript is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package dazuko-kmp-xenpae is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package dmraid is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package dbus-1-qt3 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package dbus-1-python is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package datakiosk-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows ME Microsoft Internet Explorer Internet Explorer in Windows XP SP2, and other versions including 5.01 and 5.5, allows remote attackers to install arbitrary programs via a web page that uses certain styles and the AnchorClick behavior, popup windows, and drag-and-drop capabilities to drop the program in the local startup folder, as demonstrated by "wottapoop.html". Harvey Rubinovitz DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package flex-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package docbook-css-stylesheets is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package detex-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 .NET Framework Cross-site scripting (XSS) vulnerability in Microsoft .NET Framework 2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving "ASP.NET controls that set the AutoPostBack property to true". Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dbh-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows ME Program Group Converter Buffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gambas-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package esound-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package eclipse-archdep is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ddd-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package db-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package fontconfig-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dietlibc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dbview is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Operating System The Microsoft Windows kernel in Microsoft Windows 2000 Server, Windows XP, and Windows Server 2003 allows remote attackers to cause a denial of service (crash) via crafted Remote Desktop Protocol (RDP) requests. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dhcp-tools-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package dbench-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dbus-1-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dviutils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package dbus-1-python-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package db42-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package devhelp is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Race condition in the memory management routines in the DHTML object processor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail, aka "DHTML Object Memory Corruption Vulnerability". Harvey Rubinovitz DRAFT INTERIM ACCEPTED Jason Spashett INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package deskbar-applet-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package db43-java is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Operating System The Remote Installation Service (RIS) in Microsoft Windows 2000 SP4 uses a TFTP server that allows anonymous access, which allows remote attackers to upload and overwrite arbitrary files to gain privileges on systems that use RIS. Robert L. Hollis DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package gambas2-gb-net is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ddskk is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package ctags is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package datakiosk is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package epiphany-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gambas2-gb-debug is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Microsoft Word for Windows 6.0 Converter Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CVE-2004-0901. Christine Walzer DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cyrus-sasl-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package dbus-1-python-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package freeciv-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 HTML Help ActiveX Control Buffer overflow in the HTML Help ActiveX Control (hhctrl.ocx) in Microsoft Windows 98, 98 Second Edition, Millennium Edition, NT 4.0, NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers to execute code via (1) a long parameter to the Alink function, or (2) script containing a long argument to the showHelp function. Christine Walzer Andrew Buttner ACCEPTED Matthew Wojcik INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package deltarpm is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fftw-threads is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cyrus-sasl-gssapi is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package gambas2-gb-db-form is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package dbus-1-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cscope-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dmraid-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package gambas is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package fonts-config is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package derby is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Information Server (IIS) The ASP function Response.AddHeader in Microsoft Internet Information Server (IIS) 4.0 and 5.0 does not limit memory requests when constructing headers, which allow remote attackers to generate a large header to cause a denial of service (memory consumption) with an ASP page. Tiffany Bergeron Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE Factory Package ddrescue-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package dejavu is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cyrus-sasl-devel-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cyrus-sasl-saslauthd-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package g3utils is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package dds2tar-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package csmash-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package dbus-1-qt3-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hypermail is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package cyrus-sasl-sqlauxprop is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick, a different vulnerability than CVE-2003-1027. Andrew Buttner Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cvs2svn is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package flac-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package ddt is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE Factory Package curl-ca-bundle is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package dbxml-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cups-SUSE-ppds-dat is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package curlftpfs-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package drbd-kmp-ppc64 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package cross-spu-binutils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package freetype2-devel-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick, a different vulnerability than CVE-2003-1027. Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package db-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cyrus-sasl-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package dbus-1-java is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package d4x-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package cryptix-javadoc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package drbd-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package dbus-1-mono is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package cross-spu-gcc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package desktop-data-SuSE is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package dante-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick, a different vulnerability than CVE-2003-1027. Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Internet Information Server (IIS) Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "\" characters twice. Tiffany Bergeron ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package db40-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package dbench is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package csound-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package dtc-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package ding is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package dapi is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package flac-bmp is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package htmldoc is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package cross-spu-gcc-static is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE Factory Package cross-spu-newlib-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick, a different vulnerability than CVE-2003-1027. Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package findutils-locate is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package dhcp6-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package dcraw is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package evms is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows XP Help and Support Center (HSC) Stack-based buffer overflow in the PCHealth system in the Help and Support Center function in Windows XP and Windows Server 2003 allows remote attackers to execute arbitrary code via a long query in an HCP URL. Christine Walzer DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package dapi-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cyrus-sasl-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package dhcdbd is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package dapl is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package db43-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick, a different vulnerability than CVE-2003-1027. Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE Factory Package hanterm-xf-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package db41-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Windows Internet Naming Service (WINS) The WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 allows remote attackers to write to arbitrary memory locations and possibly execute arbitrary code via a modified memory pointer in a WINS replication packet to TCP port 42, aka the "Association Context Vulnerability." Matthew Burton DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.1 openSUSE Factory Package encfs-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package desktop-translations is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dirmngr-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package Crystalcursors is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package cross-spu-newlib is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-x86_64-binutils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package hotkey-setup is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft SharePoint Team Services Buffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to execute arbitrary code via a crafted chunked encoded request. Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fetchmail-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package diffstat is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package ft2demos is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dbus-1-qt-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package dazuko-kmp-debug is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fnfx is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package cross-spu-gcc-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package e2fsprogs-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package db1-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package flex is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft FrontPage Server Extensions 2002 Buffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to execute arbitrary code via a crafted chunked encoded request. Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package dbus-1-devel-doc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ec-fonts-mftraced is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Red Hat Enterprise Linux 3 libpng Portable Network Graphics (PNG) library libpng 1.2.5 and earlier does not correctly calculate offsets, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a buffer overflow attack on the row buffers. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cyrus-sasl-plain is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package cryptix-asn1-javadoc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package db40-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package hdparm-debuginfo is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package dbus-1-mono-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package dirdiff is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE Factory Package cryptconfig is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cups-backends is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package des-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package evms-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dcraw-gnome is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package dapi-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package docbook-utils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package docbook-xml-website is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package epplet-base is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package dapi-kde is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package hermes-devel is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft FrontPage Server Extensions 2000 Buffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to execute arbitrary code via a crafted chunked encoded request. Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package docbook-dsssl-stylesheets is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package drac is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 priocntl() Directory traversal vulnerability in priocntl system call in Solaris does allows local users to execute arbitrary code via ".." sequences in the pc_clname field of a pcinfo_t structure, which cause priocntl to load a malicious kernel module. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package eclipse-jdt is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package dapl-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package handedict is installed. Thomas R. Jones DRAFT INTERIM INTERIM cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fhs is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dosbox is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package cryptconfig-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package ddd is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability. Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package db-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package dbus-1-glib-doc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE Factory Package cross-spu-gcc-static-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE Factory Package cross-avr-gcc42 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ctwm is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package eruby-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cyrus-sasl-crammd5 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Windows Media Player Heap-based buffer overflow in Windows Media Format Runtime 7.1, 9, 9.5, 9.5 x64 Edition, 11, and Windows Media Services 9.1 for Microsoft Windows 2000, XP, Server 2003, and Vista allows user-assisted remote attackers to execute arbitrary code via a crafted Advanced Systems Format (ASF) file. Jeff Ito DRAFT INTERIM INTERIM SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fvwm2-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package db43-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability. Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package emacs-auctex is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package dockutils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package eclipse-source is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dbus-1-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dbus-1-glib-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package device-mapper is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cups-drivers is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package db1-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dbh is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-ia64-gcc-icecream-backend is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability. Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE Factory Package epos-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cracklib-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package db-utils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sendmail A "potential buffer overflow in ruleset parsing" for Sendmail 8.12.9, when using the nonstandard rulesets (1) recipient (2), final, or (3) mailer-specific envelope recipients, has unknown consequences. Brian Soby DRAFT DRAFT openSUSE 10.2 openSUSE Factory Package ctapi-cyberjack-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows NT Microsoft Internet Explorer The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP. Christine Walzer DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Sun Solaris 8 mozilla Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote attackers to use certain redirect sequences to spoof the security lock icon that makes a web page appear to be encrypted. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cyrus-sasl-saslauthd is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Sun Solaris 7 Solaris Runtime Linker Stack-based buffer overflow in the runtime linker, ld.so.1, on Solaris 2.6 through 9 allows local users to gain root privileges via a long LD_PRELOAD environment variable. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package dazuko-kmp-default is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 10 Sun Solaris 9 Sun Solaris 8 Access Manager Unspecified vulnerability in Sun Java System Access Manager 7.0 allows local users logged in as "root" to bypass authentication and gain top-level administrator privileges via the amadmin CLI tool. Robert L. Hollis DRAFT INTERIM ACCEPTED Nabil Ouchn INTERIM ACCEPTED ACCEPTED Microsoft Windows NT The operating system installed on the system is Microsoft Windows NT. Andrew Buttner ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package crafty-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package dbus-1-x11 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-arm-binutils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cups-libs is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cyrus-sasl-devel-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package cscope is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package dbus-1-glib-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package db42-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package db-java-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package dbus-1-gtk is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method and using CreateLink, as demonstrated using LinkillerSaveRef, LinkillerJPU, and Linkiller, or (2) modifying the createRange method and using the FIND dialog to select text, as demonstrated using Findeath, aka the "Function Pointer Override Cross Domain" vulnerability. Andrew Buttner Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-ppc-gcc-icecream-backend is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package esound-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-x86_64-binutils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded, which are decoded twice to generate a malicious hostname, aka the "URL Decoding Zone Spoofing Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Windows Explorer The Web View DLL (webvw.dll), as used in Windows Explorer on Windows 2000 systems, does not properly filter an apostrophe ("'") in the author name in a document, which allows attackers to execute arbitrary script via extra attributes when Web View constructs a mailto: link for the preview pane when the user selects the file. Ingrid Skoog DRAFT Andrew Buttner INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-mips-binutils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-alpha-binutils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 MDAC 2.8 The License Logging service for Windows NT Server, Windows 2000 Server, and Windows Server 2003 does not properly validate the length of messages, which leads to an "unchecked buffer" and allows remote attackers to cause a denial of service (crash) and possibly execute arbtirary code, aka the "License Logging Service Vulnerability." Ingrid Skoog DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED ACCEPTED openSUSE Factory Package db-doc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package csmash is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Red Hat Enterprise Linux 3 cpio Race condition in cpio 2.6 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by cpio after the decompression is complete. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package dialog is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package courier-authlib-pipe is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows NT DHCP The DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition does not properly validate the length of certain messages, which allows remote attackers to execute arbitrary code via a malformed DHCP message, aka the "DHCP Request Vulnerability." Ingrid Skoog DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package evolution-data-server-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package cross-sparc-gcc-icecream-backend is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-ppc64-gcc-icecream-backend is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows NT MDAC 2.1 Heap-based buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) 2.1 through 2.6, and Internet Explorer 5.01 through 6.0, allows remote attackers to execute code via a malformed HTTP request to the Data Stub. Ingrid Skoog DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package devel_rpm_build-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ftgl-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package control-center2-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method and using CreateLink, as demonstrated using LinkillerSaveRef, LinkillerJPU, and Linkiller, or (2) modifying the createRange method and using the FIND dialog to select text, as demonstrated using Findeath, aka the "Function Pointer Override Cross Domain" vulnerability. Andrew Buttner Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package cpufrequtils-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 OLE The OLE component in Windows 98, 2000, XP, and Server 2003, and Exchange Server 5.0 through 2003, does not properly validate the lengths of messages for certain OLE data, which allows remote attackers to execute arbitrary code, aka the "Input Validation Vulnerability." Christine Walzer Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 9 Basic Security Module The patches (1) 114332-08 and (2) 114929-06 for Sun Solaris 9 disable the auditing functionality of the Basic Security Module (BSM), which allows attackers to avoid having their activity logged. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package devhelp-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE Factory Package dbus-1-glib-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cracklib-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cups-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package cross-spu-binutils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-hppa-binutils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package cpufrequtils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method and using CreateLink, as demonstrated using LinkillerSaveRef, LinkillerJPU, and Linkiller, or (2) modifying the createRange method and using the FIND dialog to select text, as demonstrated using Findeath, aka the "Function Pointer Override Cross Domain" vulnerability. Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package ctapi-cyberjack is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fam-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package csindex is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Windows Server 2003 MDAC 2.7 The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a (1) "\" (backslash) or (2) "%5C" (encoded backslash), aka "Path Validation Vulnerability." Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED Daniel Tarnu INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED Jeff Cheng INTERIM Jeff Cheng Jeff Cheng ACCEPTED ACCEPTED SUSE Linux 10.1 openSUSE Factory Package compiz-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package dbus-1-x11-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package freeipmi is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package dasher is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package dazuko-kmp-bigsmp is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dialog-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cups-client is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package dante is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-arm-binutils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package f2c-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package coolmail is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Client Server Runtime System (CSRSS) Stack-based buffer overflow in WINSRV.DLL in the Client Server Runtime System (CSRSS) process of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application that provides console window information with a long FaceName value. Ingrid Skoog DRAFT INTERIM Christine Walzer ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package emil-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package cvsup is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package festival is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package evolution-webcal-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory HP-UX 11 AutoRAID Manager Possible unknown vulnerability or vulnerabilities in HP DiskArray Utilities with AutoRAID Manager. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-s390x-binutils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package cron-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package epiphany-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package compface-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package coriander is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package compat-openssl097g-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Operating System The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP. Christine Walzer INTERIM ACCEPTED Robert L. Hollis ACCEPTED INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package freeglut-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package cryptsetup is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cyrus-sasl-digestmd5 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method and using CreateLink, as demonstrated using LinkillerSaveRef, LinkillerJPU, and Linkiller, or (2) modifying the createRange method and using the FIND dialog to select text, as demonstrated using Findeath, aka the "Function Pointer Override Cross Domain" vulnerability. Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 openSUSE Factory Package CommonC++-doc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package filters is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package control-center is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package dhcp-relay is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package crack-attack-sounds is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dssi-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package dev86 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package configure-thinkpad-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package dita is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package compiz-cvs_060503 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method and using CreateLink, as demonstrated using LinkillerSaveRef, LinkillerJPU, and Linkiller, or (2) modifying the createRange method and using the FIND dialog to select text, as demonstrated using Findeath, aka the "Function Pointer Override Cross Domain" vulnerability. Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package cryptix-asn1 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package courier-authlib-userdb is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package ddrescue is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-avr-binutils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-s390-binutils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 HTML Help Facility Internet Explorer 5.x and 6.0 allows remote attackers to execute arbitrary programs via a modified directory traversal attack using a URL containing ".." (dot dot) sequences and a filename that ends in "::" which is treated as a .chm file even if it does not have a .chm extension. NOTE: this bug may overlap CVE-2004-0475. Andrew Buttner INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package courier-authlib-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package db1-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package devilspie-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cook-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method and using CreateLink, as demonstrated using LinkillerSaveRef, LinkillerJPU, and Linkiller, or (2) modifying the createRange method and using the FIND dialog to select text, as demonstrated using Findeath, aka the "Function Pointer Override Cross Domain" vulnerability. Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package elib is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows XP Windows XP TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP. Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package courier-imap-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package compface is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 9 sshd The Secure Shell (SSH) Daemon (SSHD) in Sun Solaris 9 does not properly log IP addresses when SSHD is configured with the ListenAddress as 0.0.0.0, which makes it easier for remote attackers to hide the source of their activities. Brian Soby DRAFT INTERIM ACCEPTED INTERIM DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fillets-ng-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package compat-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package crack-attack-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package ConsoleKit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package fox16-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Red Hat Enterprise Linux 3 php Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 FTP The FTP service in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows attackers who have established an FTP session to cause a denial of service via a specially crafted status request containing glob characters. Tiffany Bergeron Glenn Strickland INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dasher-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package concurrent-javadoc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cvs-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows NT HTML Help ActiveX Control Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to execute arbitrary code by using the "Related Topics" command in the Help ActiveX Control (hhctrl.ocx) to open a Help popup window containing the PCHealth tools.htm file in the local zone and injecting Javascript to be executed, as demonstrated using "writehta.txt" and the ADODB recordset, which saves a .HTA file to the local system, aka the "HTML Help ActiveX control Cross Domain Vulnerability." Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cln is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package curl-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cron is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cmatrix is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cracklib is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package compat-neon024-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's "href" to the malicious Javascript, then calling execCommand("Refresh") to refresh the page, aka BodyRefreshLoadsJPU or the "ExecCommand Cross Domain" vulnerability. Andrew Buttner Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package cloop-kmp-iseries64 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package compat-curl2-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package db1-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package dmapi is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package contact-lookup-applet is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ctags-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP NetBT Name Service The NetBT Name Service (NBNS) for NetBIOS in Windows NT 4.0, 2000, XP, and Server 2003 may include random memory in a response to a NBNS query, which could allow remote attackers to obtain sensitive information. Ingrid Skoog Ingrid Skoog Ingrid Skoog INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jeff Cheng INTERIM Jeff Cheng ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package curl-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-mips-binutils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package fonts-thai is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Operating System Unspecified vulnerability in Microsoft PowerPoint 2000 through 2003, possibly a buffer overflow, allows user-assisted remote attackers to execute arbitrary commands via a malformed record in the BIFF file format used in a PPT file, a different issue than CVE-2006-1540, aka "Microsoft PowerPoint Malformed Record Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cook is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package darts is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package cloop-kmp-bigsmp is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package cm-unicode is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package coriander-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package concurrent is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package fillup-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package epiphany-doc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package compat-g77-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-i386-binutils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Microsoft Internet Explorer 7 The patch IE7-KB928090-WindowsServer2003-x86-enu.exe that addresses the vulnerabilities discussed in Microsoft Security Bulletin MS07-016 should be installed. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fontconfig-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cups-libs-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package compat-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package fontconfig is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Sun Solaris 9 Solaris Volume Manager (SVM) The Sun Solaris Volume Manager (SVM) on Solaris 9 allows local users to cause a denial of service (kernel panic) via a malformed probe request to the SVM. Brian Soby DRAFT INTERIM ACCEPTED INTERIM DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Matthew Wojcik ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer The DHTML Edit Control (dhtmled.ocx) allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as demonstrated by "AbusiveParent" in Internet Explorer 6.0.2900.2180. Jonathan Baker DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package db42-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package control-center2-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package compat-libstdc++-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 SMTP The SMTP (Simple Mail Transfer Protocol) component of Microsoft Windows XP 64-bit Edition, Windows Server 2003, Windows Server 2003 64-bit Edition, and the Exchange Routing Engine component of Exchange Server 2003, allows remote attackers to execute arbitrary code via a malicious DNS response message containing length values that are not properly validated. Christine Walzer DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System The Microsoft Windows kernel in Microsoft Windows 2000 Server, Windows XP, and Windows Server 2003 allows remote attackers to cause a denial of service (crash) via crafted Remote Desktop Protocol (RDP) requests. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE Factory Package dtc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Windows 2000 Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the "blind connection-reset attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package epic is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Windows Shell The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document. Harvey Rubinovitz DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package esound-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package claws-mail-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-x86_64-gcc-icecream-backend is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cmatrix-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package courier-authlib-pgsql is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package courier-imap is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Red Hat Enterprise Linux 3 php Race condition in shtool 2.0.1 and earlier allows local users to create or modify arbitrary files via a symlink attack on the .shtool.$$ temporary file, a different vulnerability than CVE-2005-1759. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-sparc-binutils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package compat-curl2-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package compat-g77 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package compat-openssl097g-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package digikam is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dazuko is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package cryptsetup-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package culmus is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE Factory Package ConsoleKit-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package courier-authlib-ldap is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's "href" to the malicious Javascript, then calling execCommand("Refresh") to refresh the page, aka BodyRefreshLoadsJPU or the "ExecCommand Cross Domain" vulnerability. Andrew Buttner Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE Factory Package deskbar-applet-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package commoncpp2-doc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package clisp-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package chromium is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package dbus-1-qt3-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE Factory Package check-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package flex-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package checkmedia-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cln-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package compiz-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's "href" to the malicious Javascript, then calling execCommand("Refresh") to refresh the page, aka BodyRefreshLoadsJPU or the "ExecCommand Cross Domain" vulnerability. Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package clanbomber-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Task Scheduler Stack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0, allows local or remote attackers to execute arbitrary code via a .job file containing long parameters, as demonstrated using Internet Explorer and accessing a .job file on an anonymous share. Tiffany Bergeron INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cjk-latex-hbf-cns40-b5 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package d4x is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package fluidsynth-dssi-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package claws-mail is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE Factory Package comgt-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package cpufrequtils-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package courier-authlib is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cups-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's "href" to the malicious Javascript, then calling execCommand("Refresh") to refresh the page, aka BodyRefreshLoadsJPU or the "ExecCommand Cross Domain" vulnerability. Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package curl-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dante-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package evolution-exchange-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Word for Windows 6.0 Converter Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CVE-2004-0901. Christine Walzer DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package cryptix is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package compartm-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package claws-mail-extra-plugins is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package conglomerate-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package courier-authlib-mysql is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package clanlib is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's "href" to the malicious Javascript, then calling execCommand("Refresh") to refresh the page, aka BodyRefreshLoadsJPU or the "ExecCommand Cross Domain" vulnerability. Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE Factory Package cpp42 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-avr-gcc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ctwm-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package cyrus-sasl-ldap-auxprop is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package eog is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package control-center2 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package cryptsetup-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package chromium-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package control-center-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Licence Logging Service Buffer overflow in the ping daemon of Sun Solaris 7 through 9 may allow local users to execute arbitrary code. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Windows 2000 Buffer overflow in a function in User32.dll on Windows NT through Server 2003 allows local users to execute arbitrary code via long (1) LB_DIR messages to ListBox or (2) CB_DIR messages to ComboBox controls in a privileged application. Tiffany Bergeron ACCEPTED Christine Walzer INTERIM ACCEPTED INTERIM Christine Walzer INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Sun Solaris 7 whodo Buffer overflow in whodo in Solaris SunOS 5.5.1 through 5.8 allows local users to execute arbitrary code via a long (1) SOR or (2) CFIME environment variable. David Proulx Matthew Wojcik INTERIM Matthew Wojcik Matthew Wojcik Matthew Wojcik ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package checkbot is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package db43-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-s390-binutils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package ddt-client is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package CID-keyed-fonts-Wada is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package cross-sh4-binutils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package dbxml-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package chemtool-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP SMB (Server Message Block) Buffer overflow in the SMB capability for Microsoft Windows XP, 2000, and NT allows remote attackers to cause a denial of service and possibly execute arbitrary code via an SMB packet that specifies a smaller buffer length than is required. Ingrid Skoog INTERIM ACCEPTED ACCEPTED openSUSE Factory Package clucene-core is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Operating System Integer overflow in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a 0x7fffffff argument to the setSlice method on a WebViewFolderIcon ActiveX object, which leads to an invalid memory copy. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package curl-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package chkrootkit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package flac-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Operating System The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP. Christine Walzer DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-alpha-gcc-icecream-backend is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package classpath-javadocs is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package compat-expat1 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package csound is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cyrus-sasl-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cpio is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package chemtool is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-ia64-binutils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package claws-mail-extra-plugins-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Outlook Express Microsoft Outlook Express 5.5 and 6 allows attackers to cause a denial of service (application crash) via a malformed e-mail header. Jonathan Baker DRAFT INTERIM Christine Walzer ACCEPTED Daniel Tarnu INTERIM ACCEPTED Jeff Cheng INTERIM Jeff Cheng ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package cppunit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package conglomerate is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dbus-1-glib-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Microsoft Internet Explorer Internet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory corruption") via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the "<STYLE>@;/*" string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the "CSS Heap Memory Corruption Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cracklib-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package finger is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Internet Explorer Microsoft Internet Explorer 6 and earlier allows remote attackers to read Temporary Internet Files (TIF) and obtain sensitive information via unspecified vectors involving certain drag and drop operations, aka "TIF Folder Information Disclosure Vulnerability," and a different issue than CVE-2006-5577. Robert L. Hollis DRAFT INTERIM Matthew Wojcik ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package classpath-webplugin is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package chess is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cedilla is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package compat-readline4 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package cjk-lyx is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE Factory Package cdrkit-cdrtools-compat is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-avr-binutils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package chasen is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package cloop-kmp-xenpae is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package commoncpp2-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word 2000 Microsoft Word 97, 98(J), 2000, and 2002, and Microsoft Works Suites 2001 through 2004, do not properly check the length of the "Macro names" data value, which could allow remote attackers to execute arbitrary code via a buffer overflow attack. Christine Walzer ACCEPTED Ingrid Skoog INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package classpath-webplugin-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package compat-openssl096g is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-i386-binutils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package ccscript3-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows NT Cursor and Icon Formatting Integer overflow in the LoadImage API of the USER32 Lib for Microsoft Windows allows remote attackers to execute arbitrary code via a .bmp, .cur, .ico or .ani file with a large image size field, which leads to a buffer overflow, aka the "Cursor and Icon Format Handling Vulnerability." Christine Walzer DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package cpp41 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-ia64-binutils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package circuslinux-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cjk-latex-hbf-jisksp40 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package fdupes-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's "href" to the malicious Javascript, then calling execCommand("Refresh") to refresh the page, aka BodyRefreshLoadsJPU or the "ExecCommand Cross Domain" vulnerability. Andrew Buttner Andrew Buttner Andrew Buttner INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package fbset is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cifs-mount is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package farsight is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cppunit-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package compiz-kde is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package compiz-gnome is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cjk-latex-han-tfmvf is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package ccaudio2-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cups-drivers-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ddiwrapper is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Network News Transport Protocol (NNTP) Memory leak in NNTP service in Windows NT 4.0 and Windows 2000 allows remote attackers to cause a denial of service (memory exhaustion) via a large number of malformed posts. Christine Walzer ACCEPTED ACCEPTED SUSE Linux 10.1 openSUSE Factory Package cfengine-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package chmlib-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package convert is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-s390x-gcc-icecream-backend is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package detex is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cvsps-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Office XP SP3 Buffer overflow in the converter for Microsoft WordPerfect 5.x on Office 2000, Office XP, Office 2003, and Works Suites 2001 through 2004 allows remote attackers to execute arbitrary code via a malicious document or website. Christine Walzer DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ccrtp-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package bzip2 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package crm114 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Cross-Frame scripting vulnerability in the WebBrowser control as used in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code, read arbitrary files, or conduct other unauthorized activities via script that accesses the Document property, which bypasses <frame> and <iframe> domain restrictions. Harvey Rubinovitz ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cairo-doc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package cairomm-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package digikamimageplugins is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package classpath is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows XP Local Security Authority Subsystem Service (LSASS) LSASS (Local Security Authority Subsystem Service) of Windows 2000 Server and Windows Server 2003 does not properly validate connection information, which allows local users to gain privileges via a specially-designed program. Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ccrtp is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package cvsps is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Sun Solaris 9 Kerberos5 Double-free vulnerability in the krb5_rd_cred function for MIT Kerberos 5 (krb5) 1.3.1 and earlier may allow local users to execute arbitrary code. Brian Soby DRAFT Brian Soby INTERIM ACCEPTED ACCEPTED SUSE Linux 10.1 openSUSE Factory Package compiz-debuginfo-cvs_060503 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Visio Professional 2003 Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation. Ingrid Skoog DRAFT Ingrid Skoog INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Robert L. Hollis ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word Unspecified vulnerability in Microsoft Word 2000, 2002, and Word Viewer 2003 allows user-assisted remote attackers to execute arbitrary code via a crafted DOC file that triggers memory corruption, as demonstrated via the 12122006-djtest.doc file, a different issue than CVE-2006-5994 and CVE-2006-6456. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package cacti is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6 does not properly validate certain URLs in Channel Definition Format (CDF) files, which allows remote attackers to obtain sensitive information or execute arbitrary code, aka the "Channel Definition Format (CDF) Cross Domain Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bzflag is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cdparanoia-32bit-IIIalpha9 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package clamav is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package CASA_auth_token_server-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package cloop-kmp-debug is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows XP Local Security Authority Subsystem Service (LSASS) LSASS (Local Security Authority Subsystem Service) of Windows 2000 Server and Windows Server 2003 does not properly validate connection information, which allows local users to gain privileges via a specially-designed program. Ingrid Skoog DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Office 2003 Buffer overflow in the converter for Microsoft WordPerfect 5.x on Office 2000, Office XP, Office 2003, and Works Suites 2001 through 2004 allows remote attackers to execute arbitrary code via a malicious document or website. Christine Walzer DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Word for Windows 6.0 Converter Microsoft Word for Windows 6.0 Converter (MSWRD632.WPC), as used in WordPad, does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CVE-2004-0571. Christine Walzer DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Windows Workstation Service Stack-based buffer overflow in a logging function for Windows Workstation Service (WKSSVC.DLL) allows remote attackers to execute arbitrary code via RPC calls that cause long entries to be written to a debug log file ("NetSetup.LOG"), as demonstrated using the NetAddAlternateComputerName API. Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package CASA-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package celestia is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-s390x-binutils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package CID-keyed-fonts-Munhwa is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package colordiff is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE Factory Package claws-mail-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-hppa-binutils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package ccscript-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package dante-server is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package FA_clxclient is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Color Management Module Buffer overflow in the Microsoft Color Management Module for Windows allows remote attackers to execute arbitrary code via an image with crafted ICC profile format tags. Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 7 Xsun Buffer overflow in Xsun on Solaris 2.6 through 8 allows local users to gain root privileges via a long -co (color database) command line argument. David Proulx ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package circuslinux is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package cvs-doc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package bzip2-doc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package courier-authlib-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cdesim is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package crack-attack is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cjk-latex-hbf-jfs56 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package exmh is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cdrdao-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package comgt is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package conglomerate-doc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package ccscript3-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package compat-openssl097g is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cabextract is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dvbd-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package ccgo-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package db41 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package DirectFB-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package crm114-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package compat-gdbm is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory Red Hat Linux 9 Linux kernel The /proc filesystem in Linux allows local users to obtain sensitive information by opening various entries in /proc/self before executing a setuid program, which causes the program to fail to change the ownership and permissions of those entries. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cdparanoia-IIIalpha9 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package ccaudio2-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package evolution-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cjk-latex-wadalab-maru2 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package CommonC++ is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package cadaver is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package castor is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package diffutils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package clucene-core-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Sun Solaris 10 Unspecified vulnerability in the Internet Protocol (IP) functionality in Sun Solaris 10 allows local users to cause a denial of service (panic) via unspecified vectors, probably related to a UDP packet. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Linux kernel The execve system call in Linux 2.4.x records the file descriptor of the executable process in the file table of the calling process, which allows local users to gain read access to restricted file descriptors. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package bytefx-data-mysql is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package chmlib is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package dvd+rw-tools is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package CID-keyed-fonts-MOE is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package bundle-lang-kde is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package celestia-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package chkrootkit-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package enlightenment is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package db42-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cogito is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cyrus-imapd-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package cross-mips-gcc-icecream-backend is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE Factory Package bsd-games-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package bsh-demo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package cdparanoia-debuginfo-IIIalpha9 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package CASA-kwallet-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package ccscript3 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cdda2wav is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package compat-expat1-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 8 mozilla Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to execute arbitrary code. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bpg-fonts is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cups-backends-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package cupsddk-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package colorgcc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package e2fsprogs-devel-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package e2fsprogs-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package clanlib-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP NetDDE Network Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an "unchecked buffer," possibly a buffer overflow. Jonathan Baker DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package dbsplit-tools is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package CASA-cli is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Visual Studio .NET 2005 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED Andrew Buttner DEPRECATED DEPRECATED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cjk-latex-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package camsource-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package bsh2 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package Botan is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cedict is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cairo-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cdk-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package bsh2-demo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package DirectFB is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package bootsplash-theme-SuSE is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows user-assisted remote attackers to execute arbitrary code via an Excel file with an out-of-range Column field in certain BIFF8 record types, which references arbitrary memory. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE Factory Package bundle-lang-kde-en is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-ppc-binutils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package capi4linux-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package contact-lookup-applet-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package ccaudio-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package boost-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package CASA_auth_token_server-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cupsddk is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package compat-curl2-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Cursor and Icon Formatting Integer overflow in the LoadImage API of the USER32 Lib for Microsoft Windows allows remote attackers to execute arbitrary code via a .bmp, .cur, .ico or .ani file with a large image size field, which leads to a buffer overflow, aka the "Cursor and Icon Format Handling Vulnerability." Christine Walzer DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer Integer overflow in imgbmp.cxx for Windows 2000 allows remote attackers to execute arbitrary code via a BMP image with a large bfOffBits value. Ingrid Skoog DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package briquolo-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package callgrind is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package cloop-kmp-xen is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Windows Animated Cursor The Windows Animated Cursor (ANI) capability in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allow remote attackers to cause a denial of service via (1) the frame number set to zero, which causes an invalid memory address to be used and leads to a kernel crash, or (2) the rate number set to zero, which leads to resource exhaustion and hang. Christine Walzer DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package CASA-kwallet is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-i386-gcc-icecream-backend is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bonobo-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cannadic is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cdparanoia-64bit-IIIalpha9 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package cross-avr-gcc42-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows XP Windows Media Player for Windows XP Directory traversal vulnerability in Microsoft Windows Media Player 7.1 and Windows Media Player for Windows XP allows remote attackers to execute arbitrary code via a skins file with a URL containing hex-encoded backslash characters (%5C) that causes an executable to be placed in an arbitrary location. Tiffany Bergeron ACCEPTED ACCEPTED SUSE Linux 10.1 openSUSE Factory Package crash-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package bootsplash is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package canna-yubin is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package bsh2-manual is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bombermaze-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package capi4linux is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Hyperlink Object Library The Hyperlink Object Library for Windows 98, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a crafted link that triggers an "unchecked buffer" in the library, possibly due to a buffer overflow. Christine Walzer DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM Andrew Buttner ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package dx-doc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dvgt is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package CommonC++-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.5 and 6.0 allows remote attackers to bypass restrictions for executing scripts via an object that processes asynchronous events after the initial security checks have been made. David Proulx Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE Factory Package bonnie++-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package convmv is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package boo-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded, which are decoded twice to generate a malicious hostname, aka the "URL Decoding Zone Spoofing Vulnerability." Harvey Rubinovitz DRAFT INTERIM Harvey Rubinovitz ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ccrtp-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package canna is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE Factory Package clucene-core-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package cmake-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package db43-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE Factory Package cg-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows NT Windows NT 4.0 The getCanonicalPath function in Windows NT 4.0 may free memory that it does not own and cause heap corruption, which allows attackers to cause a denial of service (crash) via requests that cause a long file name to be passed to getCanonicalPath, as demonstrated on the IBM JVM using a long string to the java.io.getCanonicalPath Java method. Tiffany Bergeron INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package db40-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package capi4linux-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package curlftpfs is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package bootloader-theme-SUSELinux-Prof is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cairo-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bzip2-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package boost is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package capisuite-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package CASA-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package cloop-kmp-default is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Operating System Microsoft Internet Explorer 6.0 does not properly handle Drag and Drop events, which allows remote user-assisted attackers to execute arbitrary code via a link to an SMB file share with a filename that contains encoded ..\ (%2e%2e%5c) sequences and whose extension contains the CLSID Key identifier for HTML Applications (HTA), aka "Folder GUID Code Execution Vulnerability." NOTE: directory traversal sequences were used in the original exploit, although their role is not clear. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT HTML Help Facility Heap-based buffer overflow in the HtmlHelp program (hh.exe) in HTML Help for Microsoft Windows 98, Me, NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary commands via a .CHM file with a large length field, a different vulnerability than CVE-2003-1041. Andrew Buttner INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Robert L. Hollis INTERIM Robert L. Hollis Jonathan Baker ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package cracklib-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package boost-jam-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cdrdao is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bluez-test is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bzip2-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ccache-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package db1 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bochs-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cjk-latex-hbf-hanja65 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package chasen-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-alpha-binutils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package classpath-examples is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package compat-libstdc++-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bzflag-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cdk is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package dhcp is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Stack-based buffer overflow in the svcauth_gss_validate function in lib/rpc/svc_auth_gss.c in the RPCSEC_GSS RPC library (librpcsecgss) in MIT Kerberos 5 (krb5) 1.4 through 1.6.2, as used by the Kerberos administration daemon (kadmind) and some third-party applications that use krb5, allows remote attackers to cause a denial of service (daemon crash) and probably execute arbitrary code via a long string in an RPC message. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP VDM The Virtual DOS Machine (VDM) subsystem of Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows local users to access kernel memory and gain privileges via a malicious program that modified some system structures in a way that is not properly validated by privileged operating system functions. Ingrid Skoog DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 openSUSE Factory Package bitlbee-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 SQL Server 2000 Buffer overflow in bulk insert procedure of Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, allows attackers with database administration privileges to execute arbitrary code via a long filename in the BULK INSERT query. Yi-Fang Koh Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package canna-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cdrecord is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Internet Explorer Buffer overflow in the Content Advisor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a crafted Content Advisor file, aka "Content Advisor Memory Corruption Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package coreutils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package bluez-cups is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package capi4hylafax is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package boost-devel-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package CID-keyed-fonts-WadaH is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bind-libs-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package bios_update_tools is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cjk-latex-han1-tfmvf is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package bzr is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package bootsplash-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package CASA_auth_token_client-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Windows kernel Buffer overflow in Windows Kernel allows local users to gain privileges by causing certain error messages to be passed to a debugger. Christine Walzer Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE Factory Package cracklib-dict-full is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package cyrus-imapd is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package cmake is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bridge-utils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package castor-demo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package castor-test is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 HyperTerminal HyperTerminal application for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value that is saved in a session file, which allows remote attackers to execute arbitrary code via a malicious HyperTerminal session file (.ht), web site, or Telnet URL contained in an e-mail message, triggering a buffer overflow. Harvey Rubinovitz DRAFT Harvey Rubinovitz Harvey Rubinovitz INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6 does not properly validate buffers when handling certain DHTML methods including the createControlRange Javascript function, which allows remote attackers to execute arbitrary code, aka the "DHTML Method Heap Memory Corruption Vulnerability." Harvey Rubinovitz DRAFT INTERIM Harvey Rubinovitz Harvey Rubinovitz Harvey Rubinovitz ACCEPTED Robert L. Hollis ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package blt-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package cgwd is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Sun Solaris 8 mozilla Mozilla 1.5 through 1.7 allows a CA certificate to be imported even when their DN is the same as that of the built-in CA root certificate, which allows remote attackers to cause a denial of service to SSL pages because the malicious certificate is treated as invalid. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cups-libs-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package Botan-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bootchart is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package commoncpp2 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Internet Explorer Microsoft Internet Explorer 6 and earlier allows remote attackers to obtain sensitive information via unspecified uses of the OBJECT HTML tag, which discloses the absolute path of the corresponding TIF folder, aka "TIF Folder Information Disclosure Vulnerability," and a different issue than CVE-2006-5578. Robert L. Hollis DRAFT INTERIM Matthew Wojcik ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package commoncpp2-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dvbtune is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package bundle-lang-kde-de is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cfengine is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package bsdtar is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package bomberclone is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package CASA_auth_token_client-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cairo-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cecilia is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 NetDDE Network Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an "unchecked buffer," possibly a buffer overflow. Jonathan Baker DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED HP-UX 11 swagentd Unspecified vulnerability in swagentd in HP-UX B.11.00, B.11.04, and B.11.11 allows remote attackers to cause a denial of service (application crash) via unspecified vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package castor-javadoc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package CASA_auth_token_apache2_2_support is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package ccache is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bison-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package compat-gdbm-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ccscript is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package boswars-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cjk-latex-hbf-cns40 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package bundle-lang-kde-es is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE Factory Package cairomm-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Red Hat Linux 9 Linux kernel The RPC code in Linux kernel 2.4 sets the reuse flag when sockets are created, which could allow local users to bind to UDP ports that are used by privileged services such as nfsd. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package createrepo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package caca-utils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package cloop is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package bsh-javadoc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cjk-latex-hbf-kanji48 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bbtools is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package bayonne-UsEng is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package Botan-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package bos is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Microsoft Internet Explorer Race condition in the memory management routines in the DHTML object processor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail, aka "DHTML Object Memory Corruption Vulnerability". Harvey Rubinovitz DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM John Hoyland ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Windows Server 2003 Microsoft .NET Framework 2.0 is installed. Robert L. Hollis INTERIM ACCEPTED Andrew Buttner DEPRECATED ACCEPTED Sun Solaris 8 cachefsd Heap-based buffer overflow in cfsd_calloc function of Solaris cachefsd allows remote attackers to execute arbitrary code via a request with a long directory and cache name. David Proulx Brian Soby INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED openSUSE Factory Package blas-man is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package blas is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows NT Cursor and Icon Formatting Integer overflow in the LoadImage API of the USER32 Lib for Microsoft Windows allows remote attackers to execute arbitrary code via a .bmp, .cur, .ico or .ani file with a large image size field, which leads to a buffer overflow, aka the "Cursor and Icon Format Handling Vulnerability." Christine Walzer DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bmp-plugins-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Explorer.exe Buffer overflow in EXPLORER.EXE on Windows XP allows attackers to execute arbitrary code as the XP user via a desktop.ini file with a long .ShellClassInfo parameter. Ingrid Skoog Ingrid Skoog INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 openSUSE Factory Package bigsister is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dvb is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bash-completion is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package bluez-firmware is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package control-center-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Red Hat Linux 9 Linux kernel A race condition in the way env_start and env_end pointers are initialized in the execve system call and used in fs/proc/base.c on Linux 2.4 allows local users to cause a denial of service (crash). Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package bsh2-javadoc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package avahi-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package audit-visualize is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package blackbox is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package cyrus-sasl-otp is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bc-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package checkmedia is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Visio Professional 2002 Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation. Ingrid Skoog DRAFT Ingrid Skoog INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED openSUSE Factory Package docbook5-xsl-stylesheets is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE Factory Package bomberclone-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft FrontPage Server Extensions 2000 Unknown vulnerability in the SmartHTML interpreter (shtml.dll) in Microsoft FrontPage Server Extensions 2000 and 2002, and Microsoft SharePoint Team Services 2002, allows remote attackers to cause a denial of service (response failure) via a certain request. Tiffany Bergeron Tiffany Bergeron INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Anna Min INTERIM ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package bsf-javadoc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 7 CDE Buffer overflow in the AddSuLog function of the CDE dtaction utility allows local users to gain root privileges via a long user name. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package chrpath is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package avalon-framework-javadoc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package awesfx is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package check-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dnsmasq-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package dazuko-kmp-xen is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows NT Program Group Converter Buffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe. Andrew Buttner DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED SUSE Linux 10.1 openSUSE Factory Package callgrind-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 8 Sun Solaris 9 Perl Cross-site scripting (XSS) vulnerability in start_form() of CGI.pm allows remote attackers to insert web script via a URL that is fed into the form's action parameter. Robert L. Hollis DRAFT INTERIM ACCEPTED Nabil Ouchn INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package autotrace-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package ccgo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package avahi-qt4 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package axis-manual is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package dbus-1-qt3-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package blender-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package barcode-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package baekmuk-ttf is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package atmel-firmware is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded, which are decoded twice to generate a malicious hostname, aka the "URL Decoding Zone Spoofing Vulnerability." Harvey Rubinovitz DRAFT INTERIM Harvey Rubinovitz Harvey Rubinovitz Harvey Rubinovitz ACCEPTED Robert L. Hollis ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Integer overflow in imgbmp.cxx for Windows 2000 allows remote attackers to execute arbitrary code via a BMP image with a large bfOffBits value. Ingrid Skoog DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package blackbox-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bug-buddy-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package bsh-manual is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package antlr-jedit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows XP The Server service (srvsvc.dll) in Windows XP SP1 and SP2 allows remote attackers to obtain sensitive information (users who are accessing resources) via an anonymous logon using a named pipe, which is not properly authenticated, aka the "Named Pipe Vulnerability." Jonathan Baker DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package blam-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cadaver-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package compat-libstdc++ is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package bb is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package canna-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package devel_rpm_build-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package amavisd-new-20030616p9 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package crafty is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package autogen is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dirdiff-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package black-box-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE Factory Package classpath-jta is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package clisp is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package at-spi-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package avahi-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Red Hat Linux 9 /proc/tty/driver/serial in Linux 2.4.x reveals the exact number of characters used in serial links, which could allow local users to obtain potentially sensitive information such as the length of passwords. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package boost-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Project Professional 2002 Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation. Ingrid Skoog DRAFT Ingrid Skoog INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package atk-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package cloop-kmp-smp is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package audiofile-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package autoyast2-utils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cdrecord-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package at-spi-doc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package banshee-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cjk-latex-han1 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 SQL Server 2000 Microsoft SQL Server 7, 2000, and MSDE allows local users to execute arbitrary code via a certain request to the Local Procedure Calls (LPC) port that leads to a buffer overflow. Yi-Fang Koh Jonathan Baker INTERIM ACCEPTED Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog INTERIM ACCEPTED Christine Walzer Christine Walzer Christine Walzer INTERIM ACCEPTED Matthew Wojcik INTERIM Matthew Wojcik Matthew Wojcik Matthew Wojcik ACCEPTED ACCEPTED openSUSE Factory Package bcm43xx-fwcutter-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package beagle-gui is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Multiple unspecified vulnerabilities in the kernel in Sun Solaris 8 through 10 allow local users to cause a denial of service (panic), related to the support for retrieval of kernel statistics, and possibly related to the sfmmu_mlspl_enter or sfmmu_mlist_enter functions. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bluez-utils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package autotrace-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package compat-neon024 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-hppa-gcc-icecream-backend is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package aufs-kmp-bigsmp-cvs20070604_2 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bash-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package dhcp-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package boost-jam is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package check-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package cracklib-dict-small is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package banshee-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE Factory Package audacious-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package compartm is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package beagle-firefox is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package beagle-evolution is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE Factory Package db-utils-doc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package boost-doc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as demonstrated by Exploit-MSExcel.h in targeted zero-day attacks. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cpufrequtils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package audit-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package BitTorrent-curses is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED Robert L. Hollis INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 openSUSE Factory Package bootsplash-theme-OpenXchange is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package blender is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package authldap is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 SUSE Linux 10.0 openSUSE Factory Package avm_fcdsl is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package bluez-utils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package bug-buddy is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows 2000 SMTP SMTP service in Microsoft Windows 2000, Windows XP Professional, and Exchange 2000 allows remote attackers to cause a denial of service via a command with a malformed data transfer (BDAT) request. Tiffany Bergeron Andrew Buttner ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Operating System The Server Service (SRV.SYS driver) in Microsoft Windows 2000 SP4, XP SP1 and SP2, Server 2003 up to SP1, and other products, allows remote attackers to obtain sensitive information via crafted requests that leak information in SMB buffers, which are not properly initialized, aka "SMB Information Disclosure Vulnerability." Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-tn is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package aufs-kmp-default-cvs20070604_2 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE Factory Package binutils-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package aumix-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-te is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package autoyast2-installation is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bwidget is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package beagle-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bacula-server is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package audacious-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows 2000 SQL Server 2000 Microsoft SQL Server 7, 2000, and MSDE allows local or remote authenticated users to cause a denial of service (crash or hang) via a long request to a named pipe. Yi-Fang Koh Jonathan Baker INTERIM ACCEPTED Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog INTERIM ACCEPTED Christine Walzer Christine Walzer Christine Walzer INTERIM ACCEPTED Matthew Wojcik INTERIM Matthew Wojcik Matthew Wojcik Matthew Wojcik ACCEPTED ACCEPTED openSUSE Factory Package avahi-glib-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package CASA_auth_token_server is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package bundle-lang-kde-pt is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package audiofile is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package bind-utils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-ny is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package at76_usb-kmp-ppc64 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package audacity is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package bayonne2-UsEng is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package check-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Simple Network Management Protocol (SNMP) Vulnerabilities in the SNMPv1 request handling of a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via (1) GetRequest, (2) GetNextRequest, and (3) SetRequest messages, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor. This and other SNMP-related candidates will be updated when more accurate information is available. Harvey Rubinovitz Harvey Rubinovitz INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package bsh2-classgen is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package at-poke-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package aufs-debuginfo-cvs20070604 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package bayonne2-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 7 Sendmail The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package cairomm is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package bigsister-server is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory Sun Solaris 8 Sun Solaris 9 TCP/IP Unknown vulnerability in the TCP/IP stack for Sun Solaris 8 and 9 allows local users to cause a denial of service (system panic) via unknown vectors. Brian Soby DRAFT INTERIM ACCEPTED INTERIM DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package asterisk-odbc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package CASA is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Sun Solaris 10 patchadd The patchadd facility for Solaris 10 fails to install T-patches. Sun sometimes releases a T-patch as a temporary version of a patch prior to the final release of that patch. While this flaw does not directly represent a vulnerability, it does prevent the timely application of some (possibly critical) updates. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package b2bua is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Distributed Component Object Model (DCOM) Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed RPC request with a long filename parameter, a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0715. Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ccaudio is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cdk-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package avahi-compat-howl-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package batik is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package CASA_auth_token_pam_support is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package bitlbee is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory Red Hat Enterprise Linux 3 Linux kernel Multiple unknown vulnerabilities in Linux kernel 2.4 and 2.6 allow local users to gain privileges or access kernel memory, as found by the Sparse source code checking tool. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package buffer-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Remote Procedure Call (RPC) Buffer overflow in a certain DCOM interface for RPC in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a malformed message, as exploited by the Blaster/MSblast/LovSAN and Nachi/Welchia worms. Tiffany Bergeron ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package astools-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package db40-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package bonnie-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows XP Cursor and Icon Formatting Integer overflow in the LoadImage API of the USER32 Lib for Microsoft Windows allows remote attackers to execute arbitrary code via a .bmp, .cur, .ico or .ani file with a large image size field, which leads to a buffer overflow, aka the "Cursor and Icon Format Handling Vulnerability." Christine Walzer DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package avahi-mono is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package astools is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability." Harvey Rubinovitz DRAFT INTERIM Harvey Rubinovitz ACCEPTED Robert L. Hollis ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package autoconf is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package compat-openssl097g-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package bind-devel-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Red Hat Linux 9 Linux kernel The TCP/IP fragment reassembly handling in the Linux kernel 2.4 allows remote attackers to cause a denial of service (CPU consumption) via certain packets that cause a large number of hash table collisions. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package audit-libs-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package delta-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bogofilter is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package axp is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package apache2-jakarta-tomcat-connectors is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package bin86-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package asusfan-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package cgwd-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bootp-DD2 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE Factory Package avmfritzcapi is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:factory Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 MDAC 2.6 Heap-based buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) 2.1 through 2.6, and Internet Explorer 5.01 through 6.0, allows remote attackers to execute code via a malformed HTTP request to the Data Stub. Ingrid Skoog DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED openSUSE Factory Package avahi-compat-mDNSResponder-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package asusfan is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package blam is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE Factory Package asterisk-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-tr is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package AtaAuto is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package ctapi-cyberjack-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package audiofile-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package audiofile-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package apache-ant is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package binutils-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package camlp4 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package atftp-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package avahi-compat-howl is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package bsh2-bsf is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package apache-doc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package barcode-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bayonne is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package clanlib-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package blueprint-cursor-theme is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Red Hat Linux 9 Linux kernel The mxcsr code in Linux kernel 2.4 allows attackers to modify CPU state registers via a malformed address. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Adobe Acrobat Reader Format string vulnerability in Adobe Acrobat Reader 6.0.0 through 6.0.2 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an .ETD document containing format string specifiers in (1) title or (2) baseurl fields. Matthew Wojcik DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED iDEFENSE reports that deleting eBook.api from the plug_ins directory is a workaround. See http://www.idefense.com/application/poi/display?id=163&type=vulnerabilities openSUSE 10.2 openSUSE Factory Package CASA_auth_token_svc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Windows Media Player 9 The OLE component in Windows 98, 2000, XP, and Server 2003, and Exchange Server 5.0 through 2003, does not properly validate the lengths of messages for certain OLE data, which allows remote attackers to execute arbitrary code, aka the "Input Validation Vulnerability." Christine Walzer DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-tet is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Red Hat Enterprise Linux 3 Linux kernel Linux kernel 2.4.x and 2.6.x for x86 allows local users to cause a denial of service (system crash), possibly via an infinite loop that triggers a signal handler with a certain sequence of fsave and frstor instructions, as originally demonstrated using a "crash.c" program. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bombermaze is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package attr-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-sk is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package delta is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bind-lwresd is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 SQL Server 2000 Buffer overflow in the password encryption function of Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, allows remote attackers to gain control of the database and execute arbitrary code via SQL Server Authentication, aka "Unchecked Buffer in Password Encryption Procedure." Yi-Fang Koh Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package BASS is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package at-spi-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package castor-doc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory corruption") via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the "<STYLE>@;/*" string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the "CSS Heap Memory Corruption Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cdrecord-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package blocxx-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package bitchx-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package csindex-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE Factory Package alice-compat is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package buffer is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Information Server (IIS) Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request sessions, aka "Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise." Tiffany Bergeron ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED openSUSE Factory Package dbview-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-pa is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-sw is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package adminfs is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bison-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Operating System The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP. Christine Walzer INTERIM ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package banshee-plugins-default is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows XP COM Internet Services Windows 2000, XP, and Server 2003 does not properly "validate the use of memory regions" for COM structured storage files, which allows attackers to execute arbitrary code, aka the "COM Structured Storage Vulnerability." Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cdesim-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package blocxx-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Microsoft Internet Explorer 7 The patch IE7-KB929969-WindowsServer2003-x86-enu.exe that addresses the vulnerabilities discussed in Microsoft Security Bulletin MS07-004 should be installed. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package binutils-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-ru is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package darts-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cabextract-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package asterisk-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Distributed Component Object Model (DCOM) Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed RPC request with a long filename parameter, a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0715. Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cjk-latex-wadalab-gothic is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-wa is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-avr-gcc-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package at76_usb-kmp-bigsmp is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Visual Studio Cross-zone scripting vulnerability in the WMI Object Broker (WMIScriptUtils.WMIObjectBroker2) ActiveX control (WmiScriptUtils.dll) in Microsoft Visual Studio 2005 allows remote attackers to bypass Internet zone restrictions and execute arbitrary code by instantiating dangerous objects, aka "WMI Object Broker Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package CASA-gui is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package bigsister-agent is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package autofs-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package beagle-index is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package autoyast2 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package atk-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package at-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package bcel-javadoc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package cdda2wav-cdrkit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package aspell-pt_PT is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows XP Windows Media Player for Windows XP Buffer overflow in Microsoft Windows Media Player 6.4 allows remote attackers to execute arbitrary code via a malformed Advanced Streaming Format (ASF) file. Tiffany Bergeron ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package compiz is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package basket is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-zu is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package asterisk-spandsp is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package apache-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package dbus-1-qt-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bacula-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cjk-latex-wadalab-mincho2 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package CheckHardware is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package at-poke is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Internet Explorer 7 The patch IE7-KB929969-WindowsServer2003-x64-enu.exe that addresses the vulnerabilities discussed in Microsoft Security Bulletin MS07-004 should be installed. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP A version of Microsoft Windows XP Professional x64 Edition Service Pack 1 is installed. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bibview is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package compat-readline4-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package audacious is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package asterisk-capi-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package avahi-qt3 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package avrdude is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-s390-gcc-icecream-backend is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package clanbomber is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package CASA-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 SUSE Linux Enterprise Server 10 openSUSE Factory Package avmailgate is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft XML Core Services Buffer overflow in the Extensible Stylesheet Language Transformations (XSLT) processing in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 allows remote attackers to execute arbitrary code via a crafted Web page. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE Factory Package audacity-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE Factory Package aspell-nds is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows 2000 POSIX The POSIX component of Microsoft Windows NT and Windows 2000 allows local users to execute arbitrary code via certain parameters, possibly by modifying message length values and causing a buffer overflow. Ingrid Skoog INTERIM ACCEPTED John Hoyland Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 The operating system installed on the system is Microsoft Windows 2000. Andrew Buttner ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package blocxx is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package barcode is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package audit-libs-python-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE Factory Package axis is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package avahi-glib is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bdfresize-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package banshee is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Red Hat Linux 9 Linux kernel Unknown vulnerability in the TTY layer of the Linux kernel 2.4 allows attackers to cause a denial of service ("kernel oops"). Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-ms is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package autofs4 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ckermit-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package at-spi is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package atk is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cairo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package avahi is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE Factory Package aspell-hy is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package bootsplash-theme-SuSE-Home is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Windows 2000 Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to execute arbitrary code by using the "Related Topics" command in the Help ActiveX Control (hhctrl.ocx) to open a Help popup window containing the PCHealth tools.htm file in the local zone and injecting Javascript to be executed, as demonstrated using "writehta.txt" and the ADODB recordset, which saves a .HTA file to the local system, aka the "HTML Help ActiveX control Cross Domain Vulnerability." Matthew Burton DRAFT Matthew Burton Matthew Burton INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer 7 The patch IE7-KB928090-WindowsXP-x86-enu.exe that addresses the vulnerabilities discussed in Microsoft Security Bulletin MS07-016 should be installed. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP A version of Microsoft Windows XP (x86) Service Pack 2 is installed. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED openSUSE Factory Package aufs-kmp-ppc64-cvs20070604_2 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-yi is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-arm-gcc-icecream-backend is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package asterisk-pgsql is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-mi is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package atftp is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package blasman is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-hu is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package apache-jakarta-tomcat-connectors is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-ku is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Microsoft Internet Explorer 7 The patch IE7-KB928090-WindowsServer2003-ia64-enu.exe that addresses the vulnerabilities discussed in Microsoft Security Bulletin MS07-016 should be installed. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Linux kernel The do_fork function in Linux 2.4.x before 2.4.26, and 2.6.x before 2.6.6, does not properly decrement the mm_count counter when an error occurs after the mm_struct for a child process has been activated, which triggers a memory leak that allows local users to cause a denial of service (memory exhaustion) via the clone (CLONE_VM) system call. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package dbus-1-qt3-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6 does not properly validate certain URLs in Channel Definition Format (CDF) files, which allows remote attackers to obtain sensitive information or execute arbitrary code, aka the "Channel Definition Format (CDF) Cross Domain Vulnerability." Harvey Rubinovitz DRAFT INTERIM Harvey Rubinovitz Harvey Rubinovitz Harvey Rubinovitz ACCEPTED Robert L. Hollis ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Sun Solaris 9 fs.auto, xfs Buffer overflow in Dispatch() routine for XFS font server (fs.auto) on Solaris 2.5.1 through 9 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a certain XFS query. Brian Soby DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package avalon-framework-manual is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package chrpath-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package avrdude-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package clamav-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-lt is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package bonobo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows XP Windows Media Player for Windows XP Microsoft Windows Media Player versions 6.4 and 7.1 and Media Player for Windows XP allow remote attackers to bypass Internet Explorer's (IE) security mechanisms and run code via an executable .wma media file with a license installation requirement stored in the IE cache, aka the "Cache Path Disclosure via Windows Media Player". Tiffany Bergeron ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package automake is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package bsh is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package atitvout-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bluefish is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bacula is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dbus-1-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package db-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cyrus-sasl is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package camsource is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package basket-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Red Hat Linux 9 skk skk (Simple Kana to Kanji conversion program) 12.1 and earlier, and the ddskk package which is based on skk, creates temporary files insecurely, which allows local users to overwrite arbitrary files. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bb-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package dar-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package capisuite is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package audit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bitchx is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-uk is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package crash-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package audit-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package atk-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-cs is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office Unspecified vulnerability in Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and other products, allows user-assisted attackers to execute arbitrary code via an Office file with a malformed property that triggers memory corruption related to record lengths, aka "Microsoft Office Property Vulnerability," a different vulnerability than CVE-2006-1316. Robert L. Hollis Matthew Wojcik INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-cy is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package canna-libs is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE Factory Package boswars is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Buffer overflow in the Content Advisor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a crafted Content Advisor file, aka "Content Advisor Memory Corruption Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-hi is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-af is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bbtools-gui-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package db41-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package blocxx-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-mg is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Red Hat Linux 9 Linux kernel The ioperm system call in Linux kernel 2.4.20 and earlier does not properly restrict privileges, which allows local users to gain read or write access to certain I/O ports. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bzip2-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package dar is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-bg is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package avahi-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package castor-xml is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package BitTorrent is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package awstats is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cpio-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bochs is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 9 CDE CDE ToolTalk database server (ttdbserver) allows local users to overwrite arbitrary files via a symlink attack on the transaction log file used by the _TT_TRANSACTION RPC procedure. Brian Soby DRAFT INTERIM ACCEPTED Brian Soby Brian Soby INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 SMB Signing (Server Message Block) The SMB signing capability in the Server Message Block (SMB) protocol in Microsoft Windows 2000 and Windows XP allows attackers to disable the digital signing settings in an SMB session to force the data to be sent unsigned, then inject data into the session without detection, e.g. by modifying group policy information sent from a domain controller. Christine Walzer ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bmp-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-hr is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-hsb is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-de is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package banshee-engine-gst is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package avr-libc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-gd is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package cyrus-imapd-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package beagle-thunderbird is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package bundle-lang-kde-fr is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package autofs is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package awesfx-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bison-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package autolog is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-sl is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cups-drivers-stp is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Program Group Converter Buffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-pl is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package aufs-cvs20070604 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-fi is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package arts-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package aspell-pt_BR is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-sparc-binutils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package arpwatch-ethercodes-build is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package cdp is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-am is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package avahi-glib-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package arts-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package boost-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package banshee-plugins-DAAP is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Visio Professional 2002 Buffer overflow in Microsoft Office XP allows remote attackers to execute arbitrary code via a link with a URL file location containing long inputs after (1) "%00 (null byte) in .doc filenames or (2) "%0a" (carriage return) in .rtf filenames. Ingrid Skoog DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package arpwatch-ethercodes is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-rw is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package ash is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows NT Windows Internet Naming Service (WINS) The WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 allows remote attackers to write to arbitrary memory locations and possibly execute arbitrary code via a modified memory pointer in a WINS replication packet to TCP port 42, aka the "Association Context Vulnerability." Matthew Burton DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package asterisk-zaptel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-qu is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Windows kernel Buffer overflow in the font processing component of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application. Ingrid Skoog DRAFT INTERIM Christine Walzer ACCEPTED ACCEPTED Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 MDAC 2.5 Heap-based buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) 2.1 through 2.6, and Internet Explorer 5.01 through 6.0, allows remote attackers to execute code via a malformed HTTP request to the Data Stub. Ingrid Skoog DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-et is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package bcm43xx-fwcutter is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package blocxx-devel-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package asciidoc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package aaa_base_novell is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package blt is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package bluez-libs is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE Factory Package at76_usb is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package aqbanking-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Cross-Frame scripting vulnerability in the WebBrowser control as used in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code, read arbitrary files, or conduct other unauthorized activities via script that accesses the Document property, which bypasses <frame> and <iframe> domain restrictions. Harvey Rubinovitz ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Sun Solaris 9 OpenSSH A "buffer management error" in buffer_append_space of buffer.c for OpenSSH before 3.7 may allow remote attackers to execute arbitrary code by causing an incorrect amount of memory to be freed and corrupting the heap, a different vulnerability than CVE-2003-0695. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package arpwatch-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package bison is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package art-sharp is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package briquolo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package banshee-engine-helix is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE Factory Package cross-sh4-binutils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cloop-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-mr is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package aqbanking-geldkarte is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft SQL Server 2000 Buffer overflow in SQL Server 7.0 and 2000 allows remote attackers to execute arbitrary code via a long OLE DB provider name to (1) OpenDataSource or (2) OpenRowset in an ad hoc connection. Yi-Fang Koh Ingrid Skoog Ingrid Skoog INTERIM ACCEPTED Christine Walzer Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package CASA_auth_token_client is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cairo-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package checkinstall is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Office 2003 Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation. Ingrid Skoog Ingrid Skoog DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Robert L. Hollis ACCEPTED Robert L. Hollis INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Windows Server 2003 DirectX IDirectPlay4 Application Programming Interface (API) of Microsoft DirectPlay 7.0a thru 9.0b, as used in Windows Server 2003 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed packet. Tiffany Bergeron Tiffany Bergeron Tiffany Bergeron INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-id is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package bayonne-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package apcupsd-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package cloop-kmp-ppc64 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-he is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Windows Server 2003 Operating System TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that cause the application for the spoofed file type to pass the file back to the operating system for handling rather than raise an error message, aka the first variant of the "Content Disposition" vulnerability. Tiffany Bergeron Christine Walzer INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Robert L. Hollis INTERIM Robert L. Hollis Robert L. Hollis Robert L. Hollis Robert L. Hollis Robert L. Hollis Robert L. Hollis Robert L. Hollis ACCEPTED ACCEPTED openSUSE Factory Package apache-mod_php4 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-it is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package aqbanking is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-or is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package arts-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package appleir is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package bootcycle is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6 does not properly validate buffers when handling certain DHTML methods including the createControlRange Javascript function, which allows remote attackers to execute arbitrary code, aka the "DHTML Method Heap Memory Corruption Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package autogen-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-el is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft PowerPoint Unspecified vulnerability in PowerPoint in Microsoft Office 2000, Office XP and Office 2003 allows user-assisted attackers to execute arbitrary code via a crafted record in a PPT file, as exploited by malware such as Exploit:Win32/Controlppt.W, Exploit:Win32/Controlppt.X, and Exploit-PPT.d/Trojan.PPDropper.F. NOTE: it has been reported that the attack vector involves SlideShowWindows.View.GotoNamedShow. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Word 2003 TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP. Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE Factory Package avahi-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package aumix is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package apmd is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word 2000 Buffer overflow in Microsoft Word 2000, Word 2002, and Word 2003 allows remote attackers to execute arbitrary code via a crafted document. Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package binutils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package apache2-example-pages is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package bash is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package axis-javadoc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package asl-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Windows XP The Messenger Service for Windows NT through Server 2003 does not properly verify the length of the message, which allows remote attackers to execute arbitrary code via a buffer overflow attack. Tiffany Bergeron Andrew Buttner ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package asterisk-alsa is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-ro is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package anthy-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package camsource-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package apache2-mod_auth_mysql-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package aqbanking-yellownet-qt3 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel 2000 Unknown vulnerability in Microsoft Excel 2000, 2002, 2001 for Mac, and v.X for Mac allows remote attackers to execute arbitrary code via a malicious file containing certain parameters that are not properly validated. Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 openSUSE Factory Package ccaudio-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Certificate Validation The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS. Christine Walzer Christine Walzer Christine Walzer Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Office 2000 SP3 Buffer overflow in the converter for Microsoft WordPerfect 5.x on Office 2000, Office XP, Office 2003, and Works Suites 2001 through 2004 allows remote attackers to execute arbitrary code via a malicious document or website. Christine Walzer DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Stack-based buffer overflow in the Plug and Play (PnP) service for Microsoft Windows 2000 and Windows XP Service Pack 1 allows remote attackers to execute arbitrary code via a crafted packet, and local users to gain privileges via a malicious application, as exploited by the Zotob (aka Mytob) worm. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 openSUSE Factory Package bayonne-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package argus-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package apache2-mod_fastcgi-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package ant-jdepend is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 7 Sun Am7990 Ethernet Driver Multiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain information from previous packets or kernel memory by using malformed packets, as demonstrated by Etherleak. Brian Soby DRAFT Matthew Wojcik DRAFT openSUSE 10.2 openSUSE Factory Package apache2-mod_jk is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package apache2-mod_tidy is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package apt-server is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-ta is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package apache2-mod-apparmor is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows XP Client Server Runtime System (CSRSS) Stack-based buffer overflow in WINSRV.DLL in the Client Server Runtime System (CSRSS) process of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application that provides console window information with a long FaceName value. Ingrid Skoog DRAFT INTERIM Christine Walzer ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package appdefko is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package apache2-prefork is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Microsoft Outlook Express Microsoft Outlook Express 5.5 and 6 allows attackers to cause a denial of service (application crash) via a malformed e-mail header. Jonathan Baker DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Daniel Tarnu INTERIM ACCEPTED Jeff Cheng INTERIM Jeff Cheng ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package atk-doc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package bitstream-vera is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-be is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package CheckHardware-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package aspell-sr is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package asclock is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package arnold is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-hil is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-sv is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package aspell-dictionaries is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package cpuspeed is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cross-ppc-binutils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package audit-libs-python is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package art-sharp2 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package autoconf-el is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package classpath-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package ant-nodeps is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Windows 2000 Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed DCERPC DCOM object activation request packet with modified length fields, a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0528. Tiffany Bergeron ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package arptables-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 98 Windows Shell Buffer overflow in Microsoft Internet Explorer and Explorer on Windows XP SP1, WIndows 2000, Windows 98, and Windows Me may allow remote malicious servers to cause a denial of service (application crash) and possibly execute arbitrary code via long share names, as demonstrated using Samba. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package bridge-utils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package antlr-javadoc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package ant-manual is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package at76_usb-kmp-debug is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package apache2-mod_auth_ntlm_winbind is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-da is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package arcad_eval is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package crash is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Red Hat Enterprise Linux 3 Gaim Gaim before 1.3.1 allows remote attackers to cause a denial of service (crash) via a malformed MSN message that leads to a memory allocation of a large size, possibly due to an integer signedness error. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED openSUSE Factory Package apache2-mod_apparmor-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package aqbanking-gtk2 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package aspell-gu is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-en is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package apache2-mod_jk-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package apache2-mod_fastcgi is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package asm-javadoc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package apt-libs is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 8 Sun Crypto Accelerator 4000 The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package aranym is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Windows kernel Buffer overflow in Windows Kernel allows local users to gain privileges by causing certain error messages to be passed to a debugger. Christine Walzer DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package CASA_auth_token_jaas_support is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package avahi-compat-mDNSResponder-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package apache2-mod_python is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package aqbanking-yellownet is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package cpuspeed-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package aspell-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package apache2-mod_fcgid is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package binutils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the Popup.show method and use drag-and-drop actions in a popup window, aka "HijackClick 3" and the "Script in Image Tag File Download Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package ant-commons-logging is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Red Hat Linux 9 Netfilter The route cache implementation in Linux 2.4, and the Netfilter IP conntrack module, allows remote attackers to cause a denial of service (CPU consumption) via packets with forged source addresses that cause a large number of hash table collisions. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package ant-apache-regexp is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package apache2-mod_murka is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package ant-jmf is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package ant-apache-bcel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package cppunit-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package cdp-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package alsa-plugins-samplerate is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-vi is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package amrnb-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package asm is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Red Hat Linux 9 Netfilter The connection tracking core of Netfilter for Linux 2.4.20, with CONFIG_IP_NF_CONNTRACK enabled or the ip_conntrack module loaded, allows remote attackers to cause a denial of service (resource consumption) due to an inconsistency with Linux 2.4.20's support of linked lists, which causes Netfilter to fail to identify connections with an UNCONFIRMED status and use large timeouts. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Network Connection Manager (NCM) A handler routine for the Network Connection Manager (NCM) in Windows 2000 allows local users to gain privileges via a complex attack that causes the handler to run in the LocalSystem context with user-specified code. Christine Walzer Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE Factory Package appleir-kmp-default is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package avalon-logkit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package baekmuk is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package apache2-mod_apparmor is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package ant-apache-log4j is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package appleir-kmp-debug is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package cjk-latex is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Sun Solaris 7 kcms_server Directory traversal vulnerability in Sun Kodak Color Management System (KCMS) library service daemon (kcms_server) allows remote attackers to read arbitrary files via the KCS_OPEN_PROFILE procedure. Brian Soby DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package apparmor-parser is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Sun Solaris 8 Sun Solaris 9 Sun Cluster Double-free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an SSL client certificate with a certain invalid ASN.1 encoding. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 SMB (Server Message Block) Buffer overflow in the Server Message Block (SMB) functionality for Microsoft Windows 2000, XP SP1 and SP2, and Server 2003 and SP1 allows remote attackers to execute arbitrary code via unknown vectors, aka the "Server Message Block Vulnerability." Jonathan Baker DRAFT INTERIM ACCEPTED ACCEPTED openSUSE Factory Package amarok-lang is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package balsa-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package bluez-gnome is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package coreutils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package asclock-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package alsa-plugins-jack is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-ca is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package avalon-framework is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package books is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Windows Animated Cursor The Windows Animated Cursor (ANI) capability in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allow remote attackers to cause a denial of service via (1) the frame number set to zero, which causes an invalid memory address to be used and leads to a kernel crash, or (2) the rate number set to zero, which leads to resource exhaustion and hang. Christine Walzer DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Buffer overflow in the PNG image rendering component of Microsoft Internet Explorer allows remote attackers to execute arbitrary code via a crafted PNG file. Harvey Rubinovitz DRAFT Harvey Rubinovitz INTERIM ACCEPTED Anna Min INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package amarok-xine is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE Factory Package apache2-mod_mono-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package alsa-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package aseqview-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package alsa-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-la is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package ant-jai is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 7 libpng The png_handle_iCCP function in libpng 1.2.5 and earlier allows remote attackers to cause a denial of service (application crash) via a certain PNG image that triggers a null dereference. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 openSUSE Factory Package configure-thinkpad is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory Microsoft Windows XP Hyperlink Object Library The Hyperlink Object Library for Windows 98, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a crafted link that triggers an "unchecked buffer" in the library, possibly due to a buffer overflow. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Internet Explorer Microsoft Internet Explorer 5.01, 6, and 7 uses certain COM objects from (1) Msb1fren.dll, (2) Htmlmm.ocx, and (3) Blnmgrps.dll as ActiveX controls, which allows remote attackers to execute arbitrary code via unspecified vectors, a different issue than CVE-2006-4697. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package avahi-compat-mDNSResponder-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 MDAC 2.8 The License Logging service for Windows NT Server, Windows 2000 Server, and Windows Server 2003 does not properly validate the length of messages, which leads to an "unchecked buffer" and allows remote attackers to cause a denial of service (crash) and possibly execute arbtirary code, aka the "License Logging Service Vulnerability." Ingrid Skoog DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 openSUSE Factory Package CommonC++-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package amrnb is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package classpath-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package ant-javamail is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package acpiw-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Windows kernel Buffer overflow in the font processing component of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application. Ingrid Skoog DRAFT INTERIM Christine Walzer Andrew Buttner ACCEPTED ACCEPTED SUSE Linux 10.1 openSUSE Factory Package alltray is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package CASA-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Operating System Buffer overflow in the Print Spooler service (Spoolsv.exe) for Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code via a malicious message. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Buffer overflow in the URL processor of Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL with a long hostname, aka "URL Parsing Memory Corruption Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM John Hoyland ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package bmp is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package ant-junit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package asl is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package ant-apache-resolver is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package apache2-mod_macro is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package aqbanking-ofx-qt3 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-fr is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package apache2-mod_python-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package amanda-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 9 Operating System Solaris 9, when configured as a Kerberos client with patch 112908-12 or 115168-03 and using pam_krb5 as an "auth" module with the debug feature enabled, records passwords in plaintext, which could allow local users to gain other user's passwords by reading log files. Robert L. Hollis DRAFT INTERIM ACCEPTED Nabil Ouchn INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bind-libs-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package arts-gmcop is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-csb is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package antiword is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows XP HyperTerminal HyperTerminal application for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value that is saved in a session file, which allows remote attackers to execute arbitrary code via a malicious HyperTerminal session file (.ht), web site, or Telnet URL contained in an e-mail message, triggering a buffer overflow. Harvey Rubinovitz DRAFT INTERIM Harvey Rubinovitz ACCEPTED Christine Walzer David Proulx INTERIM ACCEPTED Daniel Tarnu INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package alsa-tools is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-br is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package abiword is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Windows 2000 The WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 allows remote attackers to write to arbitrary memory locations and possibly execute arbitrary code via a modified memory pointer in a WINS replication packet to TCP port 42, aka the "Association Context Vulnerability." Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package alsa is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Red Hat Linux 9 Linux kernel The kernel module loader in Linux kernel 2.2.x before 2.2.25, and 2.4.x before 2.4.21, allows local users to gain root privileges by using ptrace to attach to a child process that is spawned by the kernel. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Sun Solaris 7 Bind Buffer overflow in named in BIND 4 versions 4.9.10 and earlier, and 8 versions 8.3.3 and earlier, allows remote attackers to execute arbitrary code via a certain DNS server response containing SIG resource records (RR). Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package apache2-mod_perl-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.5 and 6 does not properly handle plug-in navigation, which allows remote attackers to alter displayed address bars and thereby spoof web pages, facilitating phishing attacks, aka the "Plug-in Navigation Address Bar Spoofing Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Kerberos5 The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes the KDC to corrupt its heap (aka "buffer underrun"). Brian Soby DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Vulnerability exists in standard Solaris kerberos and SEAM. This definition only covers Solaris kerberos openSUSE Factory Package alsa-plugins-maemo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package apache2-mod_php4 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package acerhk-kmp-xenpae is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bmp-plugins is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-ga is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bdfresize is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Windows 2000 Format string vulnerability in the C runtime functions in SQL Server 7.0 and 2000 allows attackers to cause a denial of service. Yi-Fang Koh ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package acroread is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package ant is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package armagetron-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package aelfred is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package asterisk-capi is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package apache2-mod_scgi is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package apparmor-profile-editor is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package abuse is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package apache2-worker is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package agfa-fonts is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package BitTorrent-gtk is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package aircrack-ng-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-es is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 DirectX IDirectPlay4 Application Programming Interface (API) of Microsoft DirectPlay 7.0a thru 9.0b, as used in Windows Server 2003 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed packet. Tiffany Bergeron Tiffany Bergeron Tiffany Bergeron INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package bonnie++ is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE Factory Package cg-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package archzoom is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package alien is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package acerhk-kmp-default is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-bn is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bibview-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package antivir is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package acx-kmp-ppc64 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package ant-apache-oro is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows NT Remote Procedure Call (RPC) The RPC Runtime Library for Microsoft Windows NT 4.0 allows remote attackers to read active memory or cause a denial of service (system crash) via a malicious message, possibly related to improper length values. Matthew Burton DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED openSUSE Factory Package chmlib-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package apache2-mod_perl is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package amtu is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package amarok-helix is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package clucene-core-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Red Hat Linux 9 krb5 Certain weaknesses in the implementation of version 4 of the Kerberos protocol (krb4) in the krb5 distribution, when triple-DES keys are used to key krb4 services, allow an attacker to create krb4 tickets for unauthorized principals using a cut-and-paste attack and "ticket splicing." Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Information Server (IIS) Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code. Tiffany Bergeron ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package asc-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package abiword-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-ia is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package clamav-db is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Utility Manager Utility Manager in Windows 2000 launches winhlp32.exe while Utility Manager is running with raised privileges, which allows local users to gain system privileges via a "Shatter" style attack that sends a Windows message to cause Utility Manager to launch winhlp32 by directly accessing the context sensitive help and bypassing the GUI, then sending another message to winhlp32 in order to open a user-selected file, a different vulnerability than CVE-2003-0908. Jonathan Baker INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package acerhk is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package aspell-fy is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package autotrace is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package amarok is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE Factory Package apache2-mod_auth_ntlm_winbind-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bluez-libs-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package capi4linux-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 5.5 and 6 does not properly handle plug-in navigation, which allows remote attackers to alter displayed address bars and thereby spoof web pages, facilitating phishing attacks, aka the "Plug-in Navigation Address Bar Spoofing Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package aide is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package albumshaper-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package ant-antlr is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package amarok-gstreamer is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package apache2-mod_tidy-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package apache2 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package apparmor-dbus is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Red Hat Linux 9 krb5 Version 4 of the Kerberos protocol (krb4), as used in Heimdal and other packages, allows an attacker to impersonate any principal in a realm via a chosen-plaintext attack. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-gv is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package aqbanking-kde3 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package armagetron is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package avahi-compat-mDNSResponder is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package apel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package ckermit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package apache2-mod_php5 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package audit-libs is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package checkinstall-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package bzflag-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package ant-scripts is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package akpi-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package amarok-helix-backend is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package agrep is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package atk-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package biabam is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package calamaris is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package alsa-tools-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE Factory Package adaptec-firmware is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux Enterprise Server 10 openSUSE Factory Package apparmor-provider-control is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Network News Transport Protocol (NNTP) The Network News Transfer Protocol (NNTP) component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an "unchecked buffer," leading to off-by-one and heap-based buffer overflows. Christine Walzer DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM Jeff Cheng ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package asc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package alsa-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package audiofile-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-is is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package alsa-oss-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package acpid is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package bootp-DD2-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package asterisk is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package argus-client-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package apparmor-admin_en is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package abuse-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Microsoft Internet Explorer Internet Explorer 6 on Double Byte Character Set (DBCS) systems allows remote attackers to alter displayed address bars and spoof web pages via a URL containing special characters, facilitating phishing attacks, aka the "Address Bar Spoofing on Double Byte Character Set Systems Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Indexing Service The Indexing Service for Microsoft Windows XP and Server 2003 does not properly validate the length of a message, which allows remote attackers to execute arbitrary code via a buffer overflow attack. Harvey Rubinovitz DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package blender-doc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package amarok-yauap is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-mt is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package amarok-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package blocxx-doc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package check is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package acl-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Red Hat Linux 9 krb5 The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes the KDC to corrupt its heap (aka "buffer underrun"). Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE Factory Package ant-phone is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package amanda is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package alsa-utils-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package apache2-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package acx-kmp-debug is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package akpi is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package chasen-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package acerhk-kmp-bigsmp is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel Unspecified vulnerability in Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted FNGROUPCOUNT value. Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Windows Server 2003 Enhanced Metafile (EMF) Unknown vulnerability in the Graphics Rendering Engine processes of Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code via (1) Windows Metafile (WMF) or (2) Enhanced Metafile (EMF) image formats that involve "an unchecked buffer." Ingrid Skoog Ingrid Skoog DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package alsa-tools-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Basic Security Module Unknown vulnerability in the Basic Security Module (BSM), when configured to audit either the Administrative (ad) or the System-Wide Administration (as) audit class in Solaris 7, 8, and 9, allows local users to cause a denial of service (kernel panic). Brian Soby DRAFT Sudhir Gandhe DRAFT openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package amarok-xmms is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 7 NIS The getdbm procedure in ypxfrd allows local users to read arbitrary files, and remote attackers to read databases outside /var/yp, via a directory traversal and symlink attack on the domain and map arguments. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.1 openSUSE Factory Package alltray-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package aufs-kmp-debug-cvs20070604_2 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package bayonne2-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package attr is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Sun Solaris 8 mozilla Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the "chrome" flag and XML User Interface Language (XUL) files. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-mk is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package AdobeICCProfiles is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word 2002 Buffer overflow in Microsoft Word 2000, Word 2002, and Word 2003 allows remote attackers to execute arbitrary code via a crafted document. Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package alevt is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP DirectX IDirectPlay4 Application Programming Interface (API) of Microsoft DirectPlay 7.0a thru 9.0b, as used in Windows Server 2003 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed packet. Tiffany Bergeron Tiffany Bergeron Tiffany Bergeron INTERIM ACCEPTED Christine Walzer Christine Walzer Christine Walzer INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package apache2-mod_macro-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package aqbanking-geldkarte-qt3 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package albumshaper is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute code such as Javascript, as demonstrated using (1) delayed HTTP redirect operations, and an HTTP response with a Location: header containing a "URL:" prepended to a "ms-its" protocol URI, or (2) modifying the location attribute of the window, as exploited by the Download.ject (aka Scob aka Toofer) using the ADODB.Stream object. Tiffany Bergeron DRAFT INTERIM ACCEPTED ACCEPTED openSUSE Factory Package adm8211 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package ccscript-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ami-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package a2ps-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package aspell-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package acx-kmp-bigsmp is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package aegis-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package cgwd-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE Factory Package at76_usb-kmp-default is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package acpid-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows NT FTP The FTP service in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows attackers who have established an FTP session to cause a denial of service via a specially crafted status request containing glob characters. Tiffany Bergeron Glenn Strickland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-eo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package alsamixergui-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package amavisd-new is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package acct-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows NT NetDDE Network Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an "unchecked buffer," possibly a buffer overflow. Jonathan Baker DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED openSUSE Factory Package alsa-oss-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-lv is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package arts-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 The application Microsoft Publisher 2003 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package apt-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package beagle-quickfinder is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6 does not properly validate certain URLs in Channel Definition Format (CDF) files, which allows remote attackers to obtain sensitive information or execute arbitrary code, aka the "Channel Definition Format (CDF) Cross Domain Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package archway is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package acerhk-kmp-debug is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Operating System The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP. Christine Walzer INTERIM ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED SUSE Linux 10.1 openSUSE Factory Package aaa_base-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word Unspecified vulnerability in Microsoft Word 2000 and 2002, Office Word and Word Viewer 2003, Word 2004 and 2004 v. X for Mac, and Works 2004, 2005, and 2006 allows remote attackers to execute arbitrary code via a Word document with a malformed string that triggers memory corruption, a different vulnerability than CVE-2006-6456. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Windows Media Player 9 Windows Media Player 9 allows remote attackers to execute arbitrary code via a PNG file containing large (1) width or (2) height values, aka the "PNG Processing Vulnerability." Christine Walzer DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Sun Solaris 7 libpng Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package apel-xemacs is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package bin86 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package apparmor-docs is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package abcde-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package appleir-kmp-bigsmp is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package ccaudio2 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 openSUSE Factory Package apache2-mod_murka-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Windows 2000 Buffer overflow in Troubleshooter ActiveX Control (Tshoot.ocx) in Microsoft Windows 2000 SP4 and earlier allows remote attackers to execute arbitrary code via an HTML document with a long argument to the RunQuery2 method. Tiffany Bergeron Andrew Buttner ACCEPTED ACCEPTED openSUSE Factory Package acx is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package amrnb-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package bluez-hcidump is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package acerhk-kmp-kdump is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package adaptx-javadoc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package abcde is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package apache2-mod_fcgid-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package alsamixergui is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package a2ps-perl-ja is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-uz is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Double-free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image. Andrew Buttner DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package bing is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bootsplash-theme-SuSE-classic is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package afs-krb5-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package apparmor-profile-editor-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE Factory Package adm8211-kmp-bigsmp is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package argus-server is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows XP COM Internet Services Windows 2000, XP, and Server 2003 does not properly "validate the use of memory regions" for COM structured storage files, which allows attackers to execute arbitrary code, aka the "COM Structured Storage Vulnerability." Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package bonobo-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 SQL Server 2000 Microsoft SQL Server 7, 2000, and MSDE allows local users to gain privileges by hijacking a named pipe during the authentication of another user, aka the "Named Pipe Hijacking" vulnerability. Yi-Fang Koh Jonathan Baker INTERIM ACCEPTED INTERIM Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog INTERIM ACCEPTED Christine Walzer Christine Walzer Christine Walzer Christine Walzer Christine Walzer Christine Walzer Christine Walzer INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Project Professional 2002 Buffer overflow in Microsoft Office XP allows remote attackers to execute arbitrary code via a link with a URL file location containing long inputs after (1) "%00 (null byte) in .doc filenames or (2) "%0a" (carriage return) in .rtf filenames. Ingrid Skoog DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE Factory Package apache-example-pages is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package aalib-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE Factory Package adm8211-kmp-default is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows XP Distributed Component Object Model (DCOM) Buffer overflow in a certain DCOM interface for RPC in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a malformed message, as exploited by the Blaster/MSblast/LovSAN and Nachi/Welchia worms. Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED This bulletin has been superceded by MS03-039. Definition reflects updated information. SUSE Linux Enterprise Desktop 10 openSUSE Factory Package acroread_ja is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package alacarte is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel Microsoft Office Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via malformed cell comments, which lead to modification of "critical data offsets" during the rebuilding process. Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package aelfred-javadoc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package avalon-logkit-javadoc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package argus-client is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package adm8211-kmp-ppc64 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package busybox is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package ant-swing is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bluez-hcidump-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package ant-javadoc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Internet Explorer Microsoft Internet Explorer 7 on Windows XP SP2 allows remote attackers to prevent users from leaving a site, spoof the address bar, and conduct phishing and other attacks via repeated document.open function calls after a user requests a new page, but before the onBeforeUnload function is called. Robert L. Hollis DRAFT Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng Todd Dolinsky INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package aaa_skel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package autolog-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 DHCP Client Buffer overflow in the DHCP Client service for Microsoft Windows 2000 SP4, Windows XP SP1 and SP2, and Server 2003 up to SP1 allows remote attackers to execute arbitrary code via a crafted DHCP response. Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE Factory Package apache2-mod_perl-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package anjuta-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package aqbanking-qt3 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Operating System rpcrt4.dll (aka the RPC runtime library) in Microsoft Windows XP SP2, XP Professional x64 Edition, Server 2003 SP1 and SP2, Server 2003 x64 Edition and x64 Edition SP2, and Vista and Vista x64 Edition allows remote attackers to cause a denial of service (RPCSS service stop and system restart) via an RPC request that uses NTLMSSP PACKET authentication with a zero-valued verification trailer signature, which triggers an invalid dereference. NOTE: this also affects Windows 2000 SP4, although the impact is an information leak. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft SQL Server The xp_displayparamstmt function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability. Tiffany Bergeron Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog INTERIM Ingrid Skoog ACCEPTED Christine Walzer Christine Walzer Christine Walzer Christine Walzer Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package arpwatch is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package apparmor-profiles is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bbtools-gui is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package aegis is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package bayonne2 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 SMTP The SMTP (Simple Mail Transfer Protocol) component of Microsoft Windows XP 64-bit Edition, Windows Server 2003, Windows Server 2003 64-bit Edition, and the Exchange Routing Engine component of Exchange Server 2003, allows remote attackers to execute arbitrary code via a malicious DNS response message containing length values that are not properly validated. Christine Walzer DRAFT Christine Walzer INTERIM ACCEPTED Jeff Cheng INTERIM Jeff Cheng ACCEPTED ACCEPTED Red Hat Linux 9 krb5 Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, glibc, and dietlibc, allows remote attackers to execute arbitrary code via certain integer values in length fields, a different vulnerability than CVE-2002-0391. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.5 and 6.0 allows remote attackers to bypass restrictions for executing scripts via an object that processes asynchronous events after the initial security checks have been made. David Proulx ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package apache2-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package afio-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package adns-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package amavisd-new-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP The Server service (srvsvc.dll) in Windows XP SP1 and SP2 allows remote attackers to obtain sensitive information (users who are accessing resources) via an anonymous logon using a named pipe, which is not properly authenticated, aka the "Named Pipe Vulnerability." Jonathan Baker DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bsd-games is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package acl is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 SharePoint Multiple cross-site scripting (XSS) vulnerabilities in Microsoft Windows SharePoint Services 3.0 for Windows Server 2003 and Office SharePoint Server 2007 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO (query string) in "every main page," as demonstrated by default.aspx. Robert L. Hollis DRAFT Chris Wood INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Office SharePoint Server 2007 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Internet Explorer Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code via unspecified vectors involving memory corruption from an unhandled error. Robert L. Hollis DRAFT Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng INTERIM ACCEPTED ACCEPTED openSUSE Factory Package akonadi is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package ant-apache-bsf is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows NT DHCP The DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition, with DHCP logging enabled, does not properly validate the length of certain messages, which allows remote attackers to cause a denial of service (application crash) via a malformed DHCP message, aka "Logging Vulnerability." Ingrid Skoog DRAFT Ingrid Skoog Ingrid Skoog INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE Factory Package bakefile is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package aircrack-ng is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package antivir-avguard is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package ant-trax is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 MDAC 2.8 Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking. Christine Walzer DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED Jason Spashett INTERIM John Hoyland ACCEPTED Dragos Prisaca INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 The application Microsoft IIS 6.0 is installed. Robert L. Hollis INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED The operating system installed on the system is Red Hat Enterprise Linux 4. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package apache2-doc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package blackbox-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-gl is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows NT Windows kernel Buffer overflow in Windows Kernel allows local users to gain privileges by causing certain error messages to be passed to a debugger. Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE Factory Package avahi-python is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package aqbanking-ofx is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package anjuta is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package abook is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bogofilter-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Buffer overflow in the URL processor of Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL with a long hostname, aka "URL Parsing Memory Corruption Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE Factory Package apparmor-dbus-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package alsa-tools-gui is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Cross-site scripting vulnerability (XSS) in Internet Explorer 5.01 through 6.0 allows remote attackers to read and execute files on the local system via web pages using the <frame> or <iframe> element and javascript, aka "Frames Cross Site Scripting," as demonstrated using the PrivacyPolicy.dlg resource. Harvey Rubinovitz ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista MSN Messenger MSN Messenger 8.1 is installed Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 7 libc The Sun RPC functionality in multiple libc implementations does not provide a time-out mechanism when reading data from TCP connections, which allows remote attackers to cause a denial of service (hang). Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bbtools-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Operating System The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP. Christine Walzer INTERIM ACCEPTED INTERIM ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Internet Explorer Microsoft Internet Explorer 5.01 through 7 allows remote attackers to spoof the URL address bar and other "trust UI" components via unspecified vectors, a different issue than CVE-2007-1091 and CVE-2007-3826. Robert L. Hollis DRAFT Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package aaa_base is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Windows Server 2003 Operating System The hardware detection functionality in the Windows Shell in Microsoft Windows XP SP2 and Professional, and Server 2003 SP1 allows local users to gain privileges via an unvalidated parameter to a function related to the "detection and registration of new hardware." Sudhir Gandhe DRAFT Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package black-box is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-tl is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package apt4rpm is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 openSUSE Factory Package acerhk-kmp-xen is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory The operating system installed on the system is Sun Solaris 10. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Internet Explorer Unspecified vulnerability in the pdwizard.ocx ActiveX object for Internet Explorer 5.01, 6 SP1, and 7 allows remote attackers to execute arbitrary code via unknown vectors related to Microsoft Visual Basic 6 objects and memory corruption, aka "ActiveX Object Memory Corruption Vulnerability." Robert L. Hollis DRAFT Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package beagle is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Sun Solaris 10 ISC BIND 9 through 9.5.0a5 uses a weak random number generator during generation of DNS query ids when answering resolver questions or sending NOTIFY messages to slave name servers, which makes it easier for remote attackers to guess the next query id and perform DNS cache poisoning. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Server is a Server 2003 Domain Controller Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 10 Unspecified vulnerability in the kernel debugger (kmdb) in Sun Solaris 10, when running on x86, allows local users to cause a denial of service (system hang) via unspecified vectors. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sendmail Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-nn is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office Microsoft Office 2000, XP, 2003, 2004 for Mac, and v.X for Mac do not properly parse the length of a chart record, which allows remote user-assisted attackers to execute arbitrary code via a Word document with an embedded malformed chart record that triggers an overwrite of pointer values with values from the document, a different vulnerability than CVE-2006-3434, CVE-2006-3864, and CVE-2006-3868. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6 does not properly cache SSL content, which allows remote attackers to obtain information or spoof content via a web site with the same host name as the target web site, whose content is cached and reused when the user visits the target web site. Harvey Rubinovitz DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word 2000 Buffer overflow in Microsoft Word 2002 (10.6612.6714) SP3, and possibly other versions, allows remote attackers to cause a denial of service (application exception) and possibly execute arbitrary code in winword.exe via certain unexpected values in a .doc file, including (1) an offset that triggers an out-of-bounds memory access, (2) a certain value that causes a large memory copy as triggered by an integer conversion error, and other values. Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package adaptx is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Race condition in the kernel in Sun Solaris 8 through 10 allows local users to cause a denial of service (panic) via unspecified vectors related to "the handling of thread contexts." Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 for x64. Mark Villanova DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Unspecified vulnerability in libnsl in Sun Solaris 8 and 9 allows remote attackers to cause a denial of service (crash) via malformed RPC requests that trigger a crash in rpcbind. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft XML Core Services The XMLHTTP ActiveX control in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 does not properly handle HTTP server-side redirects, which allows remote user-assisted attackers to access content from other domains. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft XML Core Services 5 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft XML Core Services 3 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Windows Media Player Microsoft Windows Media Player 7.1, 9, 10, and 11 allows remote attackers to execute arbitrary code via a skin file (WMZ or WMD) with crafted header information that causes a size mismatch between compressed and decompressed data and triggers a heap-based buffer overflow, aka "Windows Media Player Code Execution Vulnerability Parsing Skins." Robert L. Hollis DRAFT Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 The Xsession script, as used by X Display Manager (xdm) in NetBSD before 20060212, X.Org before 20060317, and Solaris 8 through 10 before 20061006, allows local users to overwrite arbitrary files, or read another user's Xsession errors file, via a symlink attack on a /tmp/xses-$USER file. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Internet Information Server (IIS) Buffer overflow in Microsoft Internet Information Server (IIS) 4.0 allows local users to execute arbitrary code via the redirect function. David Proulx INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Jonathan Baker INTERIM Glenn Strickland ACCEPTED ACCEPTED Sun Solaris 10 Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client "-f" sequences as valid requests for the login program to skip authentication, which allows remote attackers to log into certain accounts, as demonstrated by the bin account. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft PowerPoint Unspecified vulnerability in PowerPoint in Microsoft Office 2000, Office 2002, Office 2003, Office 2004 for Mac, and Office v.X for Mac allows user-assisted attackers to execute arbitrary code via an unspecified "crafted file," a different vulnerability than CVE-2006-3435, CVE-2006-4694, and CVE-2006-3876. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 The application Microsoft PowerPoint 2000 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 The application Microsoft PowerPoint 2003 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 The application Microsoft PowerPoint 2002 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Information Server (IIS) Buffer overflow in the ASP data transfer mechanism in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code, aka "Microsoft-discovered variant of Chunked Encoding buffer overrun." Andrew Buttner ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED Sun Solaris 10 The tcp_fuse_rcv_drain function in the Sun Solaris 10 kernel before 20061017, when TCP Fusion is enabled, allows local users to cause a denial of service (system crash) via a TCP loopback connection with both endpoints on the same system. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package alevtd is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package aeolus is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP DirectX IDirectPlay4 Application Programming Interface (API) of Microsoft DirectPlay 7.0a thru 9.0b, as used in Windows Server 2003 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed packet. Tiffany Bergeron Tiffany Bergeron Tiffany Bergeron Tiffany Bergeron INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Sun Solaris 10 Operating System Unspecified vulnerability in the kernel processing in Solaris 10 64 bit platform, when running in 64-bit mode, allows local users to cause a denial of service (system panic) via unknown attack vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Nabil Ouchn INTERIM ACCEPTED ACCEPTED The operating system installed on the system is Sun Solaris 8. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Windows 2000 Multiple TCP/IP and ICMP implementations, when using Path MTU (PMTU) discovery (PMTUD), allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via forged ICMP ("Fragmentation Needed and Don't Fragment was Set") packets with a low next-hop MTU value, aka the "Path MTU discovery attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package argus is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory openSUSE Factory Package bluez-gnome-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows XP Windows Shell The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document. Harvey Rubinovitz DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 9 Sendmail Buffer overflow in Sendmail before 8.12.5, when configured to use a custom DNS map to query TXT records, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malicious DNS server. Brian Soby DRAFT Brian Soby INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Media Player Windows Media Player v8.0 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT DirectX Multiple integer overflows in a Microsoft Windows DirectX MIDI library (QUARTZ.DLL) allow remote attackers to execute arbitrary code via a MIDI (.mid) file with (1) large length for a Text or Copyright string, or (2) a large number of tracks, which leads to a heap-based buffer overflow. Christine Walzer DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package apache2-mod_mono is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package apache2-mod_auth_mysql is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory The operating system installed on the system is Sun Solaris 9. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Unspecified vulnerability in the strfreectty function in the Special File System (SPECFS) in Sun Solaris 8 through 10 allows local users to cause a denial of service (system panic), related to passing a NULL pointer to the pgsignal function. Todd Dolinsky DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package apcupsd is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Integer signedness error in FIFO filesystems (named pipes) on Sun Solaris 8 through 10 allows local users to read the contents of unspecified memory locations via a negative value to the I_PEEK ioctl. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Help and Support Center (HSC) Stack-based buffer overflow in the PCHealth system in the Help and Support Center function in Windows XP and Windows Server 2003 allows remote attackers to execute arbitrary code via a long query in an HCP URL. Christine Walzer ACCEPTED Christine Walzer INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package aalib is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows NT POSIX The POSIX component of Microsoft Windows NT and Windows 2000 allows local users to execute arbitrary code via certain parameters, possibly by modifying message length values and causing a buffer overflow. Ingrid Skoog Ingrid Skoog INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Buffer overflow in the format command in Solaris 8, 9, and 10 allows local users with access to format (such as the "File System Management" RBAC profile) to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2006-4307. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 9 Samba Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x versions, and Samba-TNG before 0.3.2, allows remote attackers to execute arbitrary code. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Internet Explorer Microsoft Internet Explorer 7 allows remote attackers to prevent users from leaving a site, spoof the address bar, and conduct phishing and other attacks via onUnload Javascript handlers. Robert L. Hollis DRAFT Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package bing-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Internet Explorer Integer overflow in imgbmp.cxx for Windows 2000 allows remote attackers to execute arbitrary code via a BMP image with a large bfOffBits value. Ingrid Skoog DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package abook-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package bind-doc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 HTML Help Facility Heap-based buffer overflow in the HtmlHelp program (hh.exe) in HTML Help for Microsoft Windows 98, Me, NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary commands via a .CHM file with a large length field, a different vulnerability than CVE-2003-1041. Andrew Buttner INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 The (1) NSID_SHUFFLE_ONLY and (2) NSID_USE_POOL PRNG algorithms in ISC BIND 8 before 8.4.7-P1 generate predictable DNS query identifiers when sending outgoing queries such as NOTIFY messages when answering questions as a resolver, which allows remote attackers to poison DNS caches via unknown vectors. NOTE: this issue is different from CVE-2007-2926. Todd Dolinsky DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Vista Andrew Buttner DRAFT DRAFT openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package arptables is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package bind-chrootenv is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Red Hat Linux 9 KDM KDM in KDE 3.1.3 and earlier uses a weak session cookie generation algorithm that does not provide 128 bits of entropy, which allows attackers to guess session cookies via brute force methods and gain access to the user session. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Excel Microsoft Excel in Office 2000 SP3, Office XP SP3, Office 2003 SP2, and Office 2004 for Mac allows remote attackers to execute arbitrary code via a Workspace with a certain index value that triggers memory corruption. Sudhir Gandhe DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 The libsldap library in Sun Solaris 8, 9, and 10 allows local users to cause a denial of service (Name Service Caching Daemon (nscd) crash) via unspecified vectors. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-pt is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 The Execute method in the ADODB.Connection 2.7 and 2.8 ActiveX control objects (ADODB.Connection.2.7 and ADODB.Connection.2.8) in the Microsoft Data Access Components (MDAC) 2.5 SP3, 2.7 SP1, 2.8, and 2.8 SP1 does not properly track freed memory when the second argument is a BSTR, which allows remote attackers to cause a denial of service (Internet Explorer crash) and possibly execute arbitrary code via certain strings in the second and third arguments. Sudhir Gandhe DRAFT Robert L. Hollis INTERIM ACCEPTED ACCEPTED Sun Solaris 9 Kerberos5 The asn1buf_skiptail function in the ASN.1 decoder library for MIT Kerberos 5 (krb5) 1.2.2 through 1.3.4 allows remote attackers to cause a denial of service (infinite loop) via a certain BER encoding. Brian Soby DRAFT Brian Soby INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package a2ps is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Outlook Express Microsoft Outlook Express 5.5 and 6 allows attackers to cause a denial of service (application crash) via a malformed e-mail header. Jonathan Baker DRAFT INTERIM ACCEPTED Daniel Tarnu INTERIM ACCEPTED Jeff Cheng INTERIM Jeff Cheng ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ash-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-sc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Messenger Service The Messenger Service for Windows NT through Server 2003 does not properly verify the length of the message, which allows remote attackers to execute arbitrary code via a buffer overflow attack. Christine Walzer ACCEPTED Andrew Buttner ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package balsa is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Indexing Service The Indexing Service for Microsoft Windows XP and Server 2003 does not properly validate the length of a message, which allows remote attackers to execute arbitrary code via a buffer overflow attack. Harvey Rubinovitz DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Excel Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2003 Viewer, and Office Excel 2007 does not properly validate version information, which allows user-assisted remote attackers to execute arbitrary code via a crafted Excel file, aka "Calculation Error Vulnerability". Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Directory traversal vulnerability in ld.so.1 in Sun Solaris 8, 9, and 10 allows local users to execute arbitrary code via a .. (dot dot) sequence in the LANG environment variable that points to a locale file containing attacker-controlled format string specifiers. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 10 Race condition in the TCP subsystem for Solaris 10 allows remote attackers to cause a denial of service (system panic) via unknown vectors. Gyesi Amaniampong DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Double-free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image. Andrew Buttner DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE Factory Package adm8211-kmp-debug is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Stack-based buffer overflow in agentdpv.dll 2.0.0.3425 in Microsoft Agent on Windows 2000 SP4 allows remote attackers to execute arbitrary code via a crafted URL to the Agent (Agent.Control) ActiveX control, which triggers an overflow within the Agent Service (agentsrv.exe) process, a different issue than CVE-2007-1205. Sudhir Gandhe DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:microsoft:windows-nt:2000:sp4 Microsoft Windows Vista Andrew Buttner DRAFT DRAFT Microsoft Windows 2000 Enhanced Metafile (EMF) Unknown vulnerability in the Graphics Rendering Engine processes of Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code via (1) Windows Metafile (WMF) or (2) Enhanced Metafile (EMF) image formats that involve "an unchecked buffer." Ingrid Skoog DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package banshee-plugins-extra is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory HP-UX 11 Operating System Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the "blind connection-reset attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Internet Explorer The tblinf32.dll (aka vstlbinf.dll) ActiveX control for Internet Explorer 5.01, 6 SP1, and 7 uses an incorrect IObjectsafety implementation, which allows remote attackers to execute arbitrary code by requesting the HelpString property, involving a crafted DLL file argument to the TypeLibInfoFromFile function, which overwrites the HelpStringDll property to call the DLLGetDocumentation function in another DLL file, aka "ActiveX Object Vulnerability." Robert L. Hollis DRAFT Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Certificate Validation Microsoft Windows 98 and Windows NT 4.0 do not properly verify the Basic Constraints of digital certificates, allowing remote attackers to execute code, aka "New Variant of Certificate Validation Flaw Could Enable Identity Spoofing" (CAN-2002-0862). Christine Walzer Christine Walzer Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word 2002 Buffer overflow in Microsoft Word 2002 (10.6612.6714) SP3, and possibly other versions, allows remote attackers to cause a denial of service (application exception) and possibly execute arbitrary code in winword.exe via certain unexpected values in a .doc file, including (1) an offset that triggers an out-of-bounds memory access, (2) a certain value that causes a large memory copy as triggered by an integer conversion error, and other values. Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package alsa-plugins-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package adns is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer Double-free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Information Server (IIS) Cross-site scripting vulnerability for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other web users via the error message used in a URL redirect (""302 Object Moved") message. Harvey Rubinovitz ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office Buffer overflow in GIFIMP32.FLT, as used in Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and other products, allows user-assisted attackers to execute arbitrary code via a crafted GIF image that triggers memory corruption when it is parsed. Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 The application Microsoft Project 2000 SR1 is installed. Robert L. Hollis INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Unspecified vulnerability in Sun Solaris 8, 9 and 10 allows remote attackers to cause a denial of service (panic) via crafted IPv6 packets, a different vulnerability than CVE-2006-5013. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 10 Unspecified vulnerability in "Solaris Auditing" in the Basic Security Module (BSM) in Sun Solaris 10, when configured for auditing of networking (nt) events, allows local users to cause a denial of service (panic) via unspecified vectors. Todd Dolinsky DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package audit-libs-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Sun Solaris 7 Bind BIND 8.x through 8.3.3 allows remote attackers to cause a denial of service (crash) via SIG RR elements with invalid expiry times, which are removed from the internal BIND database and later cause a null dereference. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 .NET Framework The PE Loader service in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to execute arbitrary code via unspecified vectors involving an "unchecked buffer" and unvalidated message lengths, probably a buffer overflow. Sudhir Gandhe DRAFT Sudhir Gandhe Robert L. Hollis Robert L. Hollis INTERIM ACCEPTED Dragos Prisaca INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 bytefx-data-mysql ibm-data-db2 mono-basic mono-core mono-core-32bit mono-data mono-data-firebird mono-data-oracle mono-data-postgresql mono-data-sqlite mono-data-sybase mono-devel mono-extras mono-jscript mono-locale-extras mono-nunit mono-web mono-winforms The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read source code by appending a space (%20) to a URI, and (2) read credentials via a request for Web.Config%20. Thomas R. Jones DRAFT INTERIM ACCEPTED Nicholas Hansen INTERIM Nicholas Hansen Nicholas Hansen Jeff Cheng Jeff Cheng Jeff Cheng ACCEPTED ACCEPTED cpe://novell:opensuse:10.2 cpe://novell:suse_linux:10.1 cpe://novell:suse_linux_enterprise:10:desktop cpe://novell:suse_linux_enterprise:10:server cpe:///novell:bytefx-data-mysql cpe:///novell:ibm-data-db2 cpe:///novell:mono-basic cpe:///novell:mono-core cpe:///novell:mono-core-32bit cpe:///novell:mono-data cpe:///novell:mono-data-firebird cpe:///novell:mono-data-oracle cpe:///novell:mono-data-postgresql cpe:///novell:mono-data-sqlite cpe:///novell:mono-data-sybase cpe:///novell:mono-devel cpe:///novell:mono-extras cpe:///novell:mono-jscript cpe:///novell:mono-locale-extras cpe:///novell:mono-nunit cpe:///novell:mono-web cpe:///novell:mono-winforms openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package mono-basic is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package ibm-data-db2 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package bytefx-data-mysql is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 Package mono-data-postgresql is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop cpe:/o:novell:suse_linux_enterprise:10::server openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 Package mono-data-oracle is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop cpe:/o:novell:suse_linux_enterprise:10::server openSUSE 10.2 SUSE Linux 10.1 Package mono-jscript is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 Package mono-data-firebird is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop cpe:/o:novell:suse_linux_enterprise:10::server openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package mono-extras is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop SUSE Linux 10.1 is installed. Thomas R. Jones DRAFT Jonathan Baker INTERIM ACCEPTED Nicholas Hansen INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 Package mono-data-sqlite is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop cpe:/o:novell:suse_linux_enterprise:10::server openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package mono-winforms is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 Package mono-nunit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop cpe:/o:novell:suse_linux_enterprise:10::server SUSE Linux Enterprise Desktop 10 is installed. Thomas R. Jones DRAFT Jonathan Baker INTERIM ACCEPTED Nicholas Hansen INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-az is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 is installed. Thomas R. Jones DRAFT Jonathan Baker Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Simple Network Management Protocol (SNMP) Buffer overflow in SNMP agent service in Windows 95/98/98SE, Windows NT 4.0, Windows 2000, and Windows XP allows remote attackers to cause a denial of service or execute arbitrary code via a malformed management request. NOTE: this candidate may be split or merged with other candidates. This and other PROTOS-related candidates, especially CVE-2002-0012 and CVE-2002-0013, will be updated when more accurate information is available. Tiffany Bergeron ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Operating System Integer overflow in the AttemptWrite function in Graphics Rendering Engine (GDI) on Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted metafile (image) with a large record length value, which triggers a heap-based buffer overflow. Robert L. Hollis DRAFT Jeff Cheng Jeff Cheng Jeff Cheng INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package a2ac is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Outlook Express The MHTML protocol handler in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle Content-Disposition "notifications," which allows remote attackers to obtain sensitive information from other Internet Explorer domains, aka "Content Disposition Parsing Cross Domain Information Disclosure Vulnerability." Sudhir Gandhe DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package apcupsd-gui is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory openSUSE Factory Package alsa-oss is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Sun Solaris 10 Unspecified vulnerability in Sun Solaris 10 allows context-dependent attackers to cause a denial of service (panic) via unspecified vectors involving the event port API. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Buffer overflow in the Content Advisor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a crafted Content Advisor file, aka "Content Advisor Memory Corruption Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package atitvout is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.1 openSUSE Factory Package aide-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista The application Microsoft Word 2007 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer in Windows XP SP2, and other versions including 5.01 and 5.5, allows remote attackers to install arbitrary programs via a web page that uses certain styles and the AnchorClick behavior, popup windows, and drag-and-drop capabilities to drop the program in the local startup folder, as demonstrated by "wottapoop.html". Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package alsa-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows Vista Andrew Buttner DRAFT DRAFT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 .NET Framework Interpretation conflict in ASP.NET in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to access configuration files and obtain sensitive information, and possibly bypass security mechanisms that try to constrain the final substring of a string, via %00 characters, related to use of %00 as a string terminator within POSIX functions but a data character within .NET strings, aka "Null Byte Termination Vulnerability." Sudhir Gandhe DRAFT Robert L. Hollis Robert L. Hollis Robert L. Hollis Jonathan Baker INTERIM ACCEPTED Dragos Prisaca INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista .NET Framework Microsoft .NET Framework 1.0 (Service Pack 3 or later) is Installed Sudhir Gandhe DRAFT INTERIM ACCEPTED ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute code such as Javascript, as demonstrated using (1) delayed HTTP redirect operations, and an HTTP response with a Location: header containing a "URL:" prepended to a "ms-its" protocol URI, or (2) modifying the location attribute of the window, as exploited by the Download.ject (aka Scob aka Toofer) using the ADODB.Stream object. Tiffany Bergeron DRAFT INTERIM ACCEPTED Harvey Rubinovitz INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft XML Core Services Microsoft XML Core Services (MSXML) 3.0 through 6.0 allows remote attackers to execute arbitrary code via the substringData method on a (1) TextNode or (2) XMLDOM object, which causes an integer overflow that leads to a buffer overflow. Robert L. Hollis DRAFT Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack. Robert L. Hollis DRAFT John Hoyland INTERIM ACCEPTED ACCEPTED SUSE Linux 10.1 openSUSE Factory Package a2ac-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 Package mono-locale-extras is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop cpe:/o:novell:suse_linux_enterprise:10::server Sun Solaris 9 pam_krb5 Solaris 9, when configured as a Kerberos client with patch 112908-12 or 115168-03 and using pam_krb5 as an "auth" module with the debug feature enabled, records passwords in plaintext, which could allow local users to gain other user's passwords by reading log files. Brian Soby DRAFT Brian Soby INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2003 Viewer, and 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via a crafted AutoFilter filter record in an Excel BIFF8 format XLS file, which triggers memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista MSN Messenger Heap-based buffer overflow in Microsoft MSN Messenger 6.2, 7.0, and 7.5, and Live Messenger 8.0 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors involving video conversation handling in Web Cam and video chat sessions. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista MSN Messenger MSN Messenger 8.0 is installed Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista MSN Messenger MSN Messenger 6.2 is installed Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista MSN Messenger MSN Messenger 7.5 is installed Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Local Security Authority Subsystem Service (LSASS) LSASS (Local Security Authority Subsystem Service) of Windows 2000 Server and Windows Server 2003 does not properly validate connection information, which allows local users to gain privileges via a specially-designed program. Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Buffer overflow in the Routing and Remote Access service (RRAS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," aka the "RRAS Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to cause a denial of service (hang) via by calling the MrxSmbCscIoctlCloseForCopyChunk with the file handle of the shadow device, which results in a deadlock, aka the "SMB Invalid Handle Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Double-free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image. Andrew Buttner DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Operating System The Graphics Rendering Engine in Microsoft Windows 2000 through 2000 SP4 and Windows XP through SP2 maps GDI Kernel structures on a global shared memory section that is mapped with read-only permissions, but can be remapped by other processes as read-write, which allows local users to cause a denial of service (memory corruption and crash) and gain privileges by modifying the kernel structures. Sudhir Gandhe DRAFT INTERIM Robert L. Hollis ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Visual Studio Stack-based buffer overflow in Visual Studio Crystal Reports for Microsoft Visual Studio .NET 2002 and 2002 SP1, .NET 2003 and 2003 SP1, and 2005 and 2005 SP1 (formerly Business Objects Crystal Reports XI Professional) allows user-assisted remote attackers to execute arbitrary code via a crafted RPT file. Robert L. Hollis DRAFT Jeff Cheng Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Visual Studio 2005 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Exchange Server Integer overflow in the IMAP (IMAP4) support in Microsoft Exchange Server 2000 SP3 allows remote attackers to cause a denial of service (service hang) via crafted literals in an IMAP command, aka the "IMAP Literal Processing Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Office Unspecified vulnerability in MSO.dll in Microsoft Office 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and 2007 allows user-assisted remote attackers to execute arbitrary code via a malformed drawing object, which triggers memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Word 2000 Microsoft Outlook 2000 and 2002, when configured to use Microsoft Word as the email editor, does not block scripts that are used while editing email messages in HTML or Rich Text Format (RTF), which could allow remote attackers to execute arbitrary scripts via an email that the user forwards or replies to. Ingrid Skoog DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Stack-based buffer overflow in the Universal Plug and Play (UPnP) service in Microsoft Windows XP SP2 allows remote attackers on the same subnet to execute arbitrary code via crafted HTTP headers in request or notification messages, which trigger memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Internet Explorer Use-after-free vulnerability in Microsoft Internet Explorer 7 on Windows XP SP2, Windows Server 2003 SP1 or SP2, or Windows Vista allows remote attackers to execute arbitrary code via crafted HTML objects, resulting in accessing deallocated memory of CMarkup objects, aka the second of two "HTML Objects Memory Corruption Vulnerabilities" and a different issue than CVE-2007-0946. Sudhir Gandhe DRAFT INTERIM Robert L. Hollis Jeff Ito ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista MSN Messenger MSN Messenger 7.0 is installed Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Windows 2000 Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability." Matthew Burton DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Outlook Express A component in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle certain HTTP headers when processing MHTML protocol URLs, which allows remote attackers to obtain sensitive information from other Internet Explorer domains, aka "URL Parsing Cross Domain Information Disclosure Vulnerability." Sudhir Gandhe DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Professional 9.3 is installed. Thomas R. Jones DRAFT Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Windows kernel Buffer overflow in Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to cause a denial of service (i.e., system crash) via a malformed request, aka "Object Management Vulnerability". Ingrid Skoog DRAFT INTERIM Christine Walzer ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package mono-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop Microsoft Windows 2000 Windows 2000 Internet Explorer allows remote attackers to bypass zone restrictions to inject and execute arbitrary programs by creating a popup window and inserting ActiveX object code with a "data" tag pointing to the malicious code, which Internet Explorer treats as HTML or Javascript, but later executes as an HTA application, a different vulnerability than CVE-2003-0532, and as exploited using the QHosts Trojan horse (aka Trojan.Qhosts, QHosts-1, VBS.QHOSTS, or aolfix.exe). Tiffany Bergeron Andrew Buttner ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Multiple unspecified vulnerabilities in tip in Sun Solaris 8, 9, and 10 allow local users to gain uucp account privileges via unspecified vectors. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 GNOME XScreenSaver in Sun Solaris 8 and 9 before 20070417, when root is logged into the console, does not automatically lock the screen after a session has been inactive, which might allow physically proximate attackers to access the console. Yuzheng Zhou DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Exchange Server Unspecified vulnerability in Microsoft Exchange allows remote attackers to execute arbitrary code via e-mail messages with crafted (1) vCal or (2) iCal Calendar properties. Robert L. Hollis DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Operating System Unspecified vulnerability in Microsoft Agent (msagent\agentsvr.exe) in Windows 2000 SP4, XP SP2, and Server 2003, 2003 SP1, and 2003 SP2 allows remote attackers to execute arbitrary code via crafted URLs, which result in memory corruption. Sudhir Gandhe DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Unspecified vulnerability in Sun Solaris X Inter Client Exchange library (libICE) on Solaris 8 and 9 allows context-dependent attackers to cause a denial of service (application crash) to applications that use the library. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 10 Unspecified vulnerability in inetd in Sun Solaris 10 before 20070529 allows local users to cause a denial of service (daemon termination) via unspecified manipulations of the /var/run/.inetd.uds Unix domain socket file. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Internet Explorer Multiple buffer overflows in the (1) ActiveListen (Xlisten.dll) and (2) ActiveVoice (Xvoice.dll) speech controls, as used by Microsoft Internet Explorer 5.01, 6, and 7, allow remote attackers to execute arbitrary code via a crafted ActiveX object that triggers memory corruption, as demonstrated via the ModeName parameter to the FindEngine function in ACTIVEVOICEPROJECTLib.DirectSS. Sudhir Gandhe DRAFT Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to cause a denial of service (hang) via by calling the MrxSmbCscIoctlCloseForCopyChunk with the file handle of the shadow device, which results in a deadlock, aka the "SMB Invalid Handle Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Cross-site scripting vulnerability (XSS) in Internet Explorer 5.01 through 6.0 allows remote attackers to read and execute files on the local system via web pages using the <frame> or <iframe> element and javascript, aka "Frames Cross Site Scripting," as demonstrated using the PrivacyPolicy.dlg resource. Harvey Rubinovitz ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Excel Unspecified vulnerability in Microsoft Excel 2002 SP3 and 2003 SP2 allows user-assisted remote attackers to execute arbitrary code via a malformed Excel file containing multiple active worksheets, which results in memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package antlr-manual is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory SUSE Linux 10.0 is installed. Thomas R. Jones DRAFT Jonathan Baker INTERIM ACCEPTED ACCEPTED Sun Solaris 7 login Buffer overflow in login in various System V based operating systems allows remote attackers to execute arbitrary commands via a large number of arguments through services such as telnet and rlogin. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla The WYSIWYG rendering engine ("rich mail" editor) in Mozilla Thunderbird 1.0.7 and earlier allows user-assisted attackers to bypass javascript security settings and obtain sensitive information or cause a crash via an e-mail containing a javascript URI in the SRC attribute of an IFRAME tag, which is executed when the user edits the e-mail. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML. NOTE: due to the lack of sufficient public details from the vendor as of 20060413, it is unclear how CVE-2006-1529, CVE-2006-1530, CVE-2006-1531, and CVE-2006-1723 are different. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Windows kernel Buffer overflow in Windows Kernel allows local users to gain privileges by causing certain error messages to be passed to a debugger. Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Unspecified vulnerability in the HID (Human Interface Device) class driver in Sun Solaris 8, 9, and 10 before 20070925 allows local users to cause a denial of service (panic) via unspecified vectors. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 does not properly protect the compilation scope of privileged built-in XBL bindings, which allows remote attackers to execute arbitrary code via the (1) valueOf.call or (2) valueOf.apply methods of an XBL binding, or (3) "by inserting an XBL method into the DOM's document.body prototype chain." Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Word 2000 Microsoft Word and Excel allow remote attackers to steal sensitive information via certain field codes that insert the information when the document is returned to the attacker, as demonstrated in Word using (1) INCLUDETEXT or (2) INCLUDEPICTURE, aka "Flaw in Word Fields and Excel External Updates Could Lead to Information Disclosure." Ingrid Skoog DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System Buffer overflow in the TCP/IP Protocol driver in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote attackers to execute arbitrary code via unknown vectors related to IP source routing. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Internet Explorer Multiple unspecified vulnerabilities in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allow remote attackers to execute arbitrary code by instantiating certain COM objects from Wmm2fxa.dll as ActiveX controls including (1) DXImageTransform.Microsoft.MMSpecialEffect1Input, (2) DXImageTransform.Microsoft.MMSpecialEffect1Input.1, (3) DXImageTransform.Microsoft.MMSpecialEffect2Inputs, (4) DXImageTransform.Microsoft.MMSpecialEffect2Inputs.1, (5) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input, and (6) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input.1, which causes memory corruption during garbage collection. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Outlook Web Access Cross-site scripting (XSS) vulnerability in Outlook Web Access for Exchange Server 5.5 Service Pack 4 allows remote attackers to insert arbitrary script and spoof content in HTML email or web caches via an HTML redirect query. Christine Walzer DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Jeff Cheng INTERIM Jeff Cheng ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Buffer overflow in the dtsession Common Desktop Environment (CDE) Session Manager in Sun Solaris 8, 9, and 10 allows local users to execute arbitrary code via unspecified vectors. Yuzheng Zhou DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Excel Unspecified vulnerability in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2003 Viewer, 2004 for Mac, and 2007 allows user-assisted remote attackers to execute arbitrary code via a crafted set font value in an Excel file, which results in memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Operating System The Client Server Run-Time Subsystem (CSRSS) in Microsoft Windows allows local users to cause a denial of service (crash) or read arbitrary memory from csrss.exe via crafted arguments to the NtRaiseHardError function with status 0x50000018, a different vulnerability than CVE-2006-6696. Sudhir Gandhe DRAFT INTERIM Robert L. Hollis Sudhir Gandhe ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows Server 2003 The LDAP service in Windows Active Directory in Microsoft Windows 2000 Server SP4, Server 2003 SP1 and SP2, Server 2003 x64 Edition and SP2, and Server 2003 for Itanium-based Systems SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted LDAP request with an unspecified number of "convertible attributes." Sudhir Gandhe DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 7 Bind ISC BIND 8.3.x before 8.3.7, and 8.4.x before 8.4.3, allows remote attackers to poison the cache via a malicious name server that returns negative responses with a large TTL (time-to-live) value. Brian Soby DRAFT INTERIM ACCEPTED Brian Soby Brian Soby INTERIM ACCEPTED ACCEPTED Sun Solaris 10 pkgadd in Sun Solaris 10 before 20060825 installs files with insecure file and directory permissions (755 or 777) if the pkgmap file contains a "?" (question mark) in the mode field, which allows local users to modify arbitrary files or directories, a different vulnerability than CVE-2002-1871. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Windows XP Buffer overflow in a function in User32.dll on Windows NT through Server 2003 allows local users to execute arbitrary code via long (1) LB_DIR messages to ListBox or (2) CB_DIR messages to ComboBox controls in a privileged application. Tiffany Bergeron Andrew Buttner ACCEPTED Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Internet Explorer Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via "unexpected data" related to "parameter validation" in the DXImageTransform.Microsoft.Light ActiveX control, which causes Internet Explorer to crash in a way that enables the code execution. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Windows kernel The Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability." Christine Walzer DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to execute arbitrary code by calling the MrxSmbCscIoctlOpenForCopyChunk function with the METHOD_NEITHER method flag and an arbitrary address, possibly for kernel memory, aka the "SMB Driver Elevation of Privilege Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package aspell-no is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Red Hat Enterprise Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 for x64. Mark Villanova DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Microsoft JScript 5.1, 5.5, and 5.6 on Windows 2000 SP4, and 5.6 on Windows XP, Server 2003, Windows 98 and Windows Me, will "release objects early" in certain cases, which results in memory corruption and allows remote attackers to execute arbitrary code. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 7 Solaris Enterprise Authentication Mechanism (SEAM) Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root. Brian Soby DRAFT Brian Soby INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows XP Microsoft Windows 2000 Content Management Server Microsoft Content Management Server (MCMS) 2001 SP1 and 2002 SP2 does not properly handle certain characters in a crafted HTTP GET request, which allows remote attackers to execute arbitrary code, aka the "CMS Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 9 SUSE Linux Enterprise Server 9 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:9:server Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Windows Script Engine for JScript v5.6 Integer overflow in JsArrayFunctionHeapSort function used by Windows Script Engine for JScript (JScript.dll) on various Windows operating system allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail that uses a large array index value that enables a heap-based buffer overflow attack. Tiffany Bergeron David Proulx David Proulx ACCEPTED Christine Walzer Christine Walzer INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Distributed Component Object Model (DCOM) Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed DCERPC DCOM object activation request packet with modified length fields, a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0528. Christine Walzer DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis DEPRECATED DEPRECATED Red Hat Linux 9 Mutt Buffer overflow in Mutt 1.4.0 and possibly earlier versions, 1.5.x up to 1.5.3, and other programs that use Mutt code such as Balsa before 2.0.10, allows a remote malicious IMAP server to cause a denial of service (crash) and possibly execute arbitrary code via a crafted folder. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package aseqview is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Negotiate SSP interface The Negotiate Security Software Provider (SSP) interface in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service (crash from null dereference) or execute arbitrary code via a crafted SPNEGO NegTokenInit request during authentication protocol selection. Ingrid Skoog Ingrid Skoog Ingrid Skoog ACCEPTED Christine Walzer INTERIM ACCEPTED Anna Min INTERIM ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Exchange Server Unspecified vulnerability in Microsoft Exchange allows remote attackers to execute arbitrary code via e-mail messages with crafted (1) vCal or (2) iCal Calendar properties. Robert L. Hollis DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package adaptx-doc is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package afio is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Operating System Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0, 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to cause a denial of service (crash) via a BuildContextW request with a large (1) UuidString or (2) GuidIn of a certain length, which causes an out-of-range memory access, aka the MSDTC Denial of Service Vulnerability. NOTE: this is a variant of CVE-2005-2119. Robert L. Hollis DRAFT INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Remote Data Protocol (RDP) Remote Data Protocol (RDP) version 5.0 in Microsoft Windows 2000 and RDP 5.1 in Windows XP does not encrypt the checksums of plaintext session data, which could allow a remote attacker to determine the contents of encrypted sessions via sniffing, aka "Weak Encryption in RDP Protocol." Tiffany Bergeron Christine Walzer INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Unspecified vulnerability in the vuidmice STREAMS modules in Sun Solaris 8, 9, and 10 allows local users with console (/dev/console) access to cause a denial of service ("unusable" system console) via unspecified vectors. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 for x86. Mark Villanova DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Flash Player Macromedia Flash 6 and 7 (Flash.ocx) allows remote attackers to execute arbitrary code via a SWF file with a modified frame type identifier that is used as an out-of-bounds array index to a function pointer. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Internet Explorer Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and obtain sensitive information by using the @import directive to download files from other domains that are not valid Cascading Style Sheets (CSS) files, as demonstrated using Google Desktop, aka "CSSXSS" and "CSS Cross-Domain Information Disclosure Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft PowerPoint Unspecified vulnerability in Microsoft PowerPoint in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP1 and SP2, Office 2004 for Mac, and v. X for Mac allows user-assisted attackers to execute arbitrary code via a PowerPoint document with a malformed record, which triggers memory corruption. Robert L. Hollis DRAFT John Hoyland INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System Buffer overflow in the Remote Access Connection Manager service (RASMAN) service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," that lead to registry corruption and stack corruption, aka the "RASMAN Registry Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Apache Apache 1.4.x before 1.3.30, and 2.0.x before 2.0.49, when using multiple listening sockets on certain platforms, allows remote attackers to cause a denial of service (blocked new connections) via a "short-lived connection on a rarely-accessed listening socket." Brian Soby Brian Soby Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package afs-krb5 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Integer overflow in ALLOCATE_LOCAL in the ProcXCMiscGetXIDList function in the XC-MISC extension in the X.Org X11 server (xserver) 7.1-1.1.0, and other versions before 20070403, allows remote authenticated users to execute arbitrary code via a large expression, which results in memory corruption. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Windows 2000 The Authenticode capability in Microsoft Windows NT through Server 2003 does not prompt the user to download and install ActiveX controls when the system is low on memory, which could allow remote attackers execute arbitrary code without user approval. Tiffany Bergeron Tiffany Bergeron ACCEPTED ACCEPTED Microsoft Windows XP Operating System The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to cause a denial of service (hang) via by calling the MrxSmbCscIoctlCloseForCopyChunk with the file handle of the shadow device, which results in a deadlock, aka the "SMB Invalid Handle Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Internet Explorer Microsoft Internet Explorer 5.01, 6, and 7 allows remote attackers to execute arbitrary code by causing Internet Explorer to access an uninitialized or deleted object, related to prototype variables and table cells, aka "Uninitialized Memory Corruption Vulnerability." Sudhir Gandhe DRAFT Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Internet Explorer Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and obtain sensitive information by using the @import directive to download files from other domains that are not valid Cascading Style Sheets (CSS) files, as demonstrated using Google Desktop, aka "CSSXSS" and "CSS Cross-Domain Information Disclosure Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Word for Windows 6.0 Converter Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CVE-2004-0901. Christine Walzer DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla The HTML rendering engine in Mozilla Thunderbird 1.5, when "Block loading of remote images in mail messages" is enabled, does not properly block external images from inline HTML attachments, which could allow remote attackers to obtain sensitive information, such as application version or IP address, when the user reads the email and the external image is accessed. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Media Player Stack-based buffer overflow in Microsoft Windows Media Player 9 and 10 allows remote attackers to execute arbitrary code via a PNG image with a large chunk size. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Internet Explorer Multiple unspecified vulnerabilities in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allow remote attackers to execute arbitrary code by instantiating certain COM objects from Wmm2fxa.dll as ActiveX controls including (1) DXImageTransform.Microsoft.MMSpecialEffect1Input, (2) DXImageTransform.Microsoft.MMSpecialEffect1Input.1, (3) DXImageTransform.Microsoft.MMSpecialEffect2Inputs, (4) DXImageTransform.Microsoft.MMSpecialEffect2Inputs.1, (5) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input, and (6) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input.1, which causes memory corruption during garbage collection. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-fo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel Stack-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, and 2003 Viewer allows user-assisted remote attackers to execute arbitrary code via a .XLS BIFF file with a malformed Named Graph record, which results in memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 9 Solaris Management Console (SMC) Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO. Brian Soby DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Information Server (IIS) Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to Internet Data Administration (.ida) and Internet Data Query (.idq) files such as default.ida, as commonly exploited by Code Red. Tiffany Bergeron Tiffany Bergeron ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Unspecified vulnerability in Firefox and Thunderbird 1.5 before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to bypass the js_ValueToFunctionObject check and execute arbitrary code via unknown vectors involving setTimeout and Firefox' ForEach method. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Sun Solaris 9 The libike library in Sun Solaris 9 before 20070529 contains a logic error related to a certain pointer, which allows remote attackers to cause a denial of service (in.iked daemon crash) by sending certain UDP packets with a source port different from 500. NOTE: this issue might overlap CVE-2006-2298. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package apparmor-utils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows XP Task Scheduler Stack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0, allows local or remote attackers to execute arbitrary code via a .job file containing long parameters, as demonstrated using Internet Explorer and accessing a .job file on an anonymous share. Tiffany Bergeron Tiffany Bergeron INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Windows XP Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to execute arbitrary code by using the "Related Topics" command in the Help ActiveX Control (hhctrl.ocx) to open a Help popup window containing the PCHealth tools.htm file in the local zone and injecting Javascript to be executed, as demonstrated using "writehta.txt" and the ADODB recordset, which saves a .HTA file to the local system, aka the "HTML Help ActiveX control Cross Domain Vulnerability." Matthew Burton DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Negotiate Security Software Provider The Negotiate Security Software Provider (SSP) interface in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service (crash from null dereference) or execute arbitrary code via a crafted SPNEGO NegTokenInit request during authentication protocol selection. Ingrid Skoog INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Internet Explorer Unspecified vulnerability in Internet Explorer 6.0 on Microsoft Windows XP SP2 allows remote attackers to execute arbitrary code via "exceptional conditions" that trigger memory corruption, as demonstrated using an exception handler and nested object tags, a variant of CVE-2006-1992. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package antlr-bootstrap is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory HP-UX 11 Operating System Multiple TCP/IP and ICMP implementations, when using Path MTU (PMTU) discovery (PMTUD), allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via forged ICMP ("Fragmentation Needed and Don't Fragment was Set") packets with a low next-hop MTU value, aka the "Path MTU discovery attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Word for Windows 6.0 Converter Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CVE-2004-0901. Christine Walzer DRAFT INTERIM Christine Walzer ACCEPTED Ingrid Skoog INTERIM ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Unspecified vulnerability in the NFS client module in Sun Solaris 8 through 10 before 20070524, when operating as an NFS server, allows remote attackers to cause a denial of service (crash) via certain Access Control List (acl) packets. John Wregglesworth DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 returns the Object class prototype instead of the global window object when (1) .valueOf.call or (2) .valueOf.apply are called without any arguments, which allows remote attackers to conduct cross-site scripting (XSS) attacks. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package aqbanking-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Outlook Express Microsoft Outlook Express 5.5 and 6 allows attackers to cause a denial of service (application crash) via a malformed e-mail header. Jonathan Baker DRAFT INTERIM ACCEPTED Daniel Tarnu INTERIM ACCEPTED Jeff Cheng INTERIM Jeff Cheng ACCEPTED ACCEPTED Sun Solaris 8 kcms_server Directory traversal vulnerability in Sun Kodak Color Management System (KCMS) library service daemon (kcms_server) allows remote attackers to read arbitrary files via the KCS_OPEN_PROFILE procedure. David Proulx Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Internet Explorer Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via "unexpected data" related to "parameter validation" in the DXImageTransform.Microsoft.Light ActiveX control, which causes Internet Explorer to crash in a way that enables the code execution. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package apt-file is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML. NOTE: due to the lack of sufficient public details from the vendor as of 20060413, it is unclear how CVE-2006-1529, CVE-2006-1530, CVE-2006-1531, and CVE-2006-1723 are different. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows Vista The patch Windows6.0-KB925902-x64.msu that addresses the vulnerabilities discussed in Microsoft Security Bulletin MS07-017 should be installed. Jonathan Baker DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Internet Explorer Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via "unexpected data" related to "parameter validation" in the DXImageTransform.Microsoft.Light ActiveX control, which causes Internet Explorer to crash in a way that enables the code execution. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 HTML Help Facility Internet Explorer 5.x and 6.0 allows remote attackers to execute arbitrary programs via a modified directory traversal attack using a URL containing ".." (dot dot) sequences and a filename that ends in "::" which is treated as a .chm file even if it does not have a .chm extension. NOTE: this bug may overlap CVE-2004-0475. Andrew Buttner INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to execute arbitrary code by calling the MrxSmbCscIoctlOpenForCopyChunk function with the METHOD_NEITHER method flag and an arbitrary address, possibly for kernel memory, aka the "SMB Driver Elevation of Privilege Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Multiple unspecified vulnerabilities in the Role Based Access Control (RBAC) functionality in Sun Solaris 8 allow remote attackers who know the password for a role to gain privileges via that role. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED openSUSE Factory Package acx-kmp-default is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows NT Remote Procedure Call (RPC) Buffer overflow in a certain DCOM interface for RPC in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a malformed message, as exploited by the Blaster/MSblast/LovSAN and Nachi/Welchia worms. Christine Walzer DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Internet Explorer Microsoft Internet Explorer 5.01 SP4 on Windows 2000 SP4; 6 SP1 on Windows 2000 SP4; 6 and 7 on Windows XP SP2, or Windows Server 2003 SP1 or SP2; and possibly 7 on Windows Vista does not properly "instantiate certain COM objects as ActiveX controls," which allows remote attackers to execute arbitrary code via a crafted COM object from chtskdic.dll. Sudhir Gandhe DRAFT INTERIM Robert L. Hollis Jeff Ito ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System Buffer overflow in the Routing and Remote Access service (RRAS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," aka the "RRAS Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 10 Unspecified vulnerability in the Virtual File System (VFS) in Sun Solaris 10 allows local users to cause a denial of service (kernel memory consumption) via unspecified vectors. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Internet Explorer Heap-based buffer overflow in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via crafted UTF-8 encoded HTML that results in size discrepancies during conversion to Unicode, aka "HTML Decoding Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 openSUSE Factory Package aelfred-demo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Red Hat Linux 9 KDM KDM in KDE 3.1.3 and earlier does not verify whether the pam_setcred function call succeeds, which may allow attackers to gain root privileges by triggering error conditions within PAM modules, as demonstrated in certain configurations of the MIT pam_krb5 module. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Mozilla Firefox 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to read arbitrary files by (1) inserting the target filename into a text box, then turning that box into a file upload control, or (2) changing the type of the input control that is associated with an event handler. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows XP Internet Explorer Multiple unspecified vulnerabilities in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allow remote attackers to execute arbitrary code by instantiating certain COM objects from Wmm2fxa.dll as ActiveX controls including (1) DXImageTransform.Microsoft.MMSpecialEffect1Input, (2) DXImageTransform.Microsoft.MMSpecialEffect1Input.1, (3) DXImageTransform.Microsoft.MMSpecialEffect2Inputs, (4) DXImageTransform.Microsoft.MMSpecialEffect2Inputs.1, (5) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input, and (6) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input.1, which causes memory corruption during garbage collection. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Operating System Buffer overflow in the Graphics Device Interface (GDI) in Microsoft Windows 2000 SP4; XP SP2; Server 2003 Gold, SP1, and SP2; and Vista allows local users to gain privileges via certain "color-related parameters" in crafted images. Sudhir Gandhe DRAFT INTERIM Robert L. Hollis ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Visio 2002 Microsoft Office 2003 Unspecified vulnerability in Microsoft Visio 2002 allows remote user-assisted attackers to execute arbitrary code via a Visio (.VSD, VSS, .VST) file with a crafted version number that triggers memory corruption. Sudhir Gandhe DRAFT Robert L. Hollis Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Internet Explorer Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via "unexpected data" related to "parameter validation" in the DXImageTransform.Microsoft.Light ActiveX control, which causes Internet Explorer to crash in a way that enables the code execution. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Operating System Buffer overflow in the Graphics Device Interface (GDI) in Microsoft Windows 2000 SP4; XP SP2; Server 2003 Gold, SP1, and SP2; and Vista allows local users to gain privileges via a crafted Enhanced Metafile (EMF) image format file. Sudhir Gandhe DRAFT INTERIM Robert L. Hollis ACCEPTED ACCEPTED Microsoft Windows XP Flash Player Multiple unspecified vulnerabilities in Adobe Flash Player 8.0.22.0 and earlier allow remote attackers to execute arbitrary code via a crafted SWF file. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Unspecified vulnerability in NIS server on Sun Solaris 8, 9, and 10 allows local and remote attackers to cause a denial of service (ypserv hang) via unknown vectors. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 srsexec in Sun Remote Services (SRS) Net Connect Software Proxy Core package in Sun Solaris 10 does not enforce file permissions when opening files, which allows local users to read the first line of arbitrary files via the -d and -v options. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 CDE Buffer overflow in Common Desktop Environment (CDE) ToolTalk RPC database server (rpc.ttdbserverd) allows remote attackers to execute arbitrary code via an argument to the _TT_CREATE_FILE procedure. David Proulx Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Internet Explorer Internet Explorer 6 for Windows XP SP2 and earlier allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicious Shockwave Flash application, then changing the window location back to a trusted URL while the Flash application is still loading. NOTE: this is a different vulnerability than CVE-2006-1192. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Internet Explorer Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows user-assisted remote attackers to execute arbitrary code via a crafted web page that triggers memory corruption when it is saved as a multipart HTML (.mht) file. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package alsa-docs is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Internet Explorer Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and obtain sensitive information by using the @import directive to download files from other domains that are not valid Cascading Style Sheets (CSS) files, as demonstrated using Google Desktop, aka "CSSXSS" and "CSS Cross-Domain Information Disclosure Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Open Enterprise Server 9 Open Enterprise Server 9 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0, 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to cause a denial of service (crash) via a BuildContextW request with a large (1) UuidString or (2) GuidIn of a certain length, which causes an out-of-range memory access, aka the MSDTC Denial of Service Vulnerability. NOTE: this is a variant of CVE-2005-2119. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Internet Explorer Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows user-assisted remote attackers to execute arbitrary code via a crafted web page that triggers memory corruption when it is saved as a multipart HTML (.mht) file. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Windows XP Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the "blind connection-reset attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Information Server (IIS) IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with operating system commands, aka the "Web Server File Request Parsing" vulnerability. Tiffany Bergeron ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Stack-based buffer overflow in ld.so.1 in Sun Solaris 8, 9, and 10 allows local users to execute arbitrary code via large precision padding values in a format string specifier in the format parameter of the doprf function. NOTE: this issue normally does not cross privilege boundaries, except in cases of external introduction of malicious message files, or if it is leveraged with other vulnerabilities such as CVE-2006-6494. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Heap-based buffer overflow in the CRpcIoManagerServer::BuildContext function in msdtcprx.dll for Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0 and Windows 2000 SP2 and SP3 allows remote attackers to execute arbitrary code via a long fifth argument to the BuildContextW or BuildContext opcode, which triggers a bug in the NdrAllocate function, aka the MSDTC Invalid Memory Access Vulnerability. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Buffer overflow in the Remote Access Connection Manager service (RASMAN) service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," that lead to registry corruption and stack corruption, aka the "RASMAN Registry Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Internet Explorer Heap-based buffer overflow in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via crafted UTF-8 encoded HTML that results in size discrepancies during conversion to Unicode, aka "HTML Decoding Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 CDE Heap-based buffer overflow in dtsession for Solaris 2.5.1 through Solaris 9 allows local users to gain root privileges via a long HOME environment variable. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to execute arbitrary code by calling the MrxSmbCscIoctlOpenForCopyChunk function with the METHOD_NEITHER method flag and an arbitrary address, possibly for kernel memory, aka the "SMB Driver Elevation of Privilege Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML. NOTE: due to the lack of sufficient public details from the vendor as of 20060413, it is unclear how CVE-2006-1529, CVE-2006-1530, CVE-2006-1531, and CVE-2006-1723 are different. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Internet Explorer Race condition in Microsoft Internet Explorer 5.01, 6, and 7 allows remote attackers to execute arbitrary code by causing Internet Explorer to install multiple language packs in a way that triggers memory corruption, aka "Language Pack Installation Vulnerability." Sudhir Gandhe DRAFT Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attack vectors related to DHTML. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word Word (or Word Viewer) in Microsoft Office 2000 SP3, XP SP3, 2003 SP2, 2004 for Mac, and Works Suite 2004, 2005, and 2006 does not properly parse certain rich text "property strings of certain control words," which allows user-assisted remote attackers to trigger heap corruption and execute arbitrary code, aka the "Word RTF Parsing Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Certificate Enrollment Control Unknown vulnerability in the Certificate Enrollment ActiveX Control in Microsoft Windows 98, Windows 98 Second Edition, Windows Millennium, Windows NT 4.0, Windows 2000, and Windows XP allow remote attackers to delete digital certificates on a user's system via HTML. Christine Walzer ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Cross-site scripting vulnerability in Internet Explorer 6.0 allows remote attackers to execute scripts in the Local Computer zone via a URL that exploits a local HTML resource file, aka the "Cross-Site Scripting in Local HTML Resource" vulnerability. Andrew Buttner Christine Walzer INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows 95 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Symantec Enterprize Security Manager 6 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package a2ps-h is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Unspecified vulnerability in the Windows Schannel Security Package for Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 and SP2, allows remote servers to execute arbitrary code or cause a denial of service via crafted digital signatures that are processed during an SSL handshake. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Flash Player Multiple unspecified vulnerabilities in Adobe Flash Player 8.0.22.0 and earlier allow remote attackers to execute arbitrary code via a crafted SWF file. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 10 Sun Solaris 10 before patch 118855-16 (20060925), when run on x64 systems using IPv6, allows remote attackers to cause a denial of service (kernel panic) via crafted IPv6 packets. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 10 Multiple unspecified vulnerabilities in labeld in Trusted Extensions in Sun Solaris 10 allow local users to cause a denial of service (multiple application hang) via unspecified vectors. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Internet Explorer Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via "unexpected data" related to "parameter validation" in the DXImageTransform.Microsoft.Light ActiveX control, which causes Internet Explorer to crash in a way that enables the code execution. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Exchange Server Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 does not properly decode certain MIME encoded e-mails, which allows remote attackers to execute arbitrary code via a crafted base64-encoded MIME e-mail message. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 SMB (Server Message Block) Buffer overflow in SMB (Server Message Block) protocol in Microsoft Windows NT, Windows 2000, and Windows XP allows attackers to cause a denial of service (crash) via a SMB_COM_TRANSACTION packet with a request for the (1) NetShareEnum, (2) NetServerEnum2, or (3) NetServerEnum3, aka "Unchecked Buffer in Network Share Provider Can Lead to Denial of Service". Christine Walzer Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows XP SMB (Server Message Block) The Server Message Block (SMB) implementation for Windows NT 4.0, 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allows remote attackers to execute arbitrary code via Transaction responses containing (1) Trans or (2) Trans2 commands, aka the "Server Message Block Vulnerability," and as demonstrated using Trans2 FIND_FIRST2 responses with large file name length fields. Christine Walzer DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Local Security Authority Subsystem Service (LSASS) LSASS (Local Security Authority Subsystem Service) of Windows 2000 Server and Windows Server 2003 does not properly validate connection information, which allows local users to gain privileges via a specially-designed program. Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to bypass same-origin protections and conduct cross-site scripting (XSS) attacks via unspecified vectors involving the window.controllers array. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows XP Windows kernel The Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability." Christine Walzer DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Internet Explorer Unspecified vulnerability in the mdsauth.dll COM object in Microsoft Windows Media Server in the Microsoft Internet Explorer 5.01 SP4 on Windows 2000 SP4; 6 SP1 on Windows 2000 SP4; 6 and 7 on Windows XP SP2, or Windows Server 2003 SP1 or SP2; or 7 on Windows Vista allows remote attackers to overwrite arbitrary files via unspecified vectors, aka the "Arbitrary File Rewrite Vulnerability." Sudhir Gandhe DRAFT INTERIM Robert L. Hollis Jeff Ito ACCEPTED ACCEPTED Microsoft Windows Vista The Teredo interface in Microsoft Windows Vista and Vista x64 Edition does not properly handle certain network traffic, which allows remote attackers to bypass firewall blocking rules and obtain sensitive information via crafted IPv6 traffic, aka "Windows Vista Firewall Blocking Rule Information Disclosure Vulnerability." Sudhir Gandhe DRAFT Sudhir Gandhe INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package acpiw is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Internet Explorer Internet Explorer 6 for Windows XP SP2 and earlier allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicious Shockwave Flash application, then changing the window location back to a trusted URL while the Flash application is still loading. NOTE: this is a different vulnerability than CVE-2006-1192. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Sun Solaris 7 dtspcd The CDE dtspcd daemon allows local users to execute arbitrary commands via a symlink attack. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Word 2000 Microsoft Word 2002, 2000, 97, and 98(J) does not properly check certain properties of a document, which allows attackers to bypass the macro security model and automatically execute arbitrary macros via a malicious document. Christine Walzer Christine Walzer DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Word 2000 Microsoft Word 2002 Unspecified vulnerability in Microsoft Word 2000 SP3, Word 2002 SP3, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via a malformed string in a Word file, aka "Word Memory Corruption Vulnerability." Sudhir Gandhe DRAFT Bryan Worrell INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package alsa-plugins is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista .NET Framework The Just In Time (JIT) Compiler service in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows user-assisted remote attackers to execute arbitrary code via unspecified vectors involving an "unchecked buffer," probably a buffer overflow, aka ".NET JIT Compiler Vulnerability". Sudhir Gandhe DRAFT Sudhir Gandhe Robert L. Hollis Robert L. Hollis Robert L. Hollis INTERIM ACCEPTED Dragos Prisaca INTERIM ACCEPTED Dragos Prisaca INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista .NET Framework Microsoft .NET Framework 2.0 (Original RTM or later) is installed Sudhir Gandhe DRAFT INTERIM ACCEPTED ACCEPTED ACCEPTED Microsoft Windows XP Enhanced Metafile (EMF) Unknown vulnerability in the Graphics Rendering Engine processes of Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code via (1) Windows Metafile (WMF) or (2) Enhanced Metafile (EMF) image formats that involve "an unchecked buffer." Ingrid Skoog DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Vista Microsoft Publisher PUBCONV.DLL in Microsoft Office Publisher 2007 does not properly clear memory when transferring data from disk to memory, which allows user-assisted remote attackers to execute arbitrary code via a malformed .pub page via a certain negative value, which bypasses a sanitization procedure that initializes critical pointers to NULL, aka the "Publisher Invalid Memory Reference Vulnerability". Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 2000 Microsoft Windows Server 2003 The application Microsoft Publisher 2007 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word Microsoft Word in Office 2000 SP3, XP SP3, Office 2003 SP2, Works Suite 2004 to 2006, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via a Word file with a malformed drawing object, which leads to memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE Factory Package akonadi-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Operating System Buffer overflow in the ART Image Rendering component (jgdw400.dll) in Microsoft Windows XP SP1 and Sp2, Server 2003 SP1 and earlier, and Windows 98 and Me allows remote attackers to execute arbitrary code via a crafted ART image that causes heap corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package amarok-arts is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Internet Explorer Heap-based buffer overflow in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via crafted UTF-8 encoded HTML that results in size discrepancies during conversion to Unicode, aka "HTML Decoding Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Vista Windows Mail Windows Mail in Microsoft Windows Vista might allow user-assisted remote attackers to execute certain programs via a link to a (1) local file or (2) UNC share pathname in which there is a directory with the same base name as an executable program at the same level, as demonstrated using C:/windows/system32/winrm (winrm.cmd) and migwiz (migwiz.exe). Sudhir Gandhe DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word Unspecified vulnerability in Microsoft Word 2000 allows remote attackers to cause a denial of service (crash) via unknown vectors, a different vulnerability than CVE-2006-5994, CVE-2006-6456, CVE-2006-6561, and CVE-2007-0515, a variant of Exploit-MS06-027. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP The Window Image Acquisition (WIA) Service in Microsoft Windows XP SP2 allows local users to gain privileges via unspecified vectors involving an "unchecked buffer," probably a buffer overflow. Sudhir Gandhe DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-nb is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Operating System Buffer overflow in the Remote Access Connection Manager service (RASMAN) service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," that lead to registry corruption and stack corruption, aka the "RASMAN Registry Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 The LDAP service in Windows Active Directory in Microsoft Windows 2000 Server SP4 does not properly check "the number of convertible attributes", which allows remote attackers to cause a denial of service (service unavailability) via a crafted LDAP request, related to "client sent LDAP request logic," aka "Windows Active Directory Denial of Service Vulnerability". NOTE: this is probably a different issue than CVE-2007-0040. Sudhir Gandhe DRAFT Sudhir Gandhe INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to inject arbitrary Javascript into other sites by (1) "using a modal alert to suspend an event handler while a new page is being loaded", (2) using eval(), and using certain variants involving (3) "new Script;" and (4) using window.__proto__ to extend eval, aka "cross-site JavaScript injection". Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Operating System Stack-based buffer overflow in the animated cursor code in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a large length value in the second (or later) anih block of a RIFF .ANI, cur, or .ico file, which results in memory corruption when processing cursors, animated cursors, and icons, a variant of CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7. NOTE: this might be a duplicate of CVE-2007-1765; if so, then CVE-2007-0038 should be preferred. Sudhir Gandhe DRAFT INTERIM Robert L. Hollis ACCEPTED ACCEPTED Microsoft Windows NT NetDDE Network Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an "unchecked buffer," possibly a buffer overflow. Jonathan Baker DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System Buffer overflow in the Remote Access Connection Manager service (RASMAN) service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," that lead to registry corruption and stack corruption, aka the "RASMAN Registry Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to cause a denial of service (hang) via by calling the MrxSmbCscIoctlCloseForCopyChunk with the file handle of the shadow device, which results in a deadlock, aka the "SMB Invalid Handle Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Authenticode The Authenticode capability in Microsoft Windows NT through Server 2003 does not prompt the user to download and install ActiveX controls when the system is low on memory, which could allow remote attackers execute arbitrary code without user approval. Tiffany Bergeron Andrew Buttner Andrew Buttner ACCEPTED Christine Walzer Christine Walzer INTERIM ACCEPTED ACCEPTED openSUSE Factory Package aeolus-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla nsHTMLContentSink.cpp in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors involving a "particular sequence of HTML tags" that leads to memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows Server 2003 SMB (Server Message Block) The Server Message Block (SMB) implementation for Windows NT 4.0, 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allows remote attackers to execute arbitrary code via Transaction responses containing (1) Trans or (2) Trans2 commands, aka the "Server Message Block Vulnerability," and as demonstrated using Trans2 FIND_FIRST2 responses with large file name length fields. Christine Walzer DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Buffer overflow in the Remote Access Connection Manager service (RASMAN) service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," that lead to registry corruption and stack corruption, aka the "RASMAN Registry Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Internet Explorer Unspecified vulnerability in Internet Explorer 6.0 on Microsoft Windows XP SP2 allows remote attackers to execute arbitrary code via "exceptional conditions" that trigger memory corruption, as demonstrated using an exception handler and nested object tags, a variant of CVE-2006-1992. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Sun Solaris 7 NIS Buffer overflow in ypbind daemon in Solaris 5.4 through 8 allows remote attackers to execute arbitrary code. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Program Group Converter Buffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Internet Explorer Internet Explorer 6 for Windows XP SP2 and earlier allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicious Shockwave Flash application, then changing the window location back to a trusted URL while the Flash application is still loading. NOTE: this is a different vulnerability than CVE-2006-1192. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to cause a denial of service (hang) via by calling the MrxSmbCscIoctlCloseForCopyChunk with the file handle of the shadow device, which results in a deadlock, aka the "SMB Invalid Handle Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 LDAP Unspecified vulnerability in Solaris 8 and 9 allows local users to obtain the LDAP Directory Server root Distinguished Name (rootDN) password when a privileged user (1) runs idsconfig; or "insecurely" runs LDAP2 commands with the -w option, including (2) ldapadd, (3) ldapdelete, (4) ldapmodify, (5) ldapmodrdn, and (6) ldapsearch. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Operating System Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via a blind throughput-reduction attack using spoofed Source Quench packets, aka the "ICMP Source Quench attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-mn is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows XP Internet Explorer Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and obtain sensitive information by using the @import directive to download files from other domains that are not valid Cascading Style Sheets (CSS) files, as demonstrated using Google Desktop, aka "CSSXSS" and "CSS Cross-Domain Information Disclosure Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Program Group Converter Buffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft PowerPoint Unspecified vulnerability in Microsoft PowerPoint in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP1 and SP2, Office 2004 for Mac, and v. X for Mac allows user-assisted attackers to execute arbitrary code via a PowerPoint document with a malformed record, which triggers memory corruption. Robert L. Hollis DRAFT Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package aspell-fa is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista .NET Framework Microsoft .NET Framework 1.1 Service Pack 1 is Installed Sudhir Gandhe DRAFT INTERIM ACCEPTED ACCEPTED ACCEPTED SUSE Linux 10.0 openSUSE Factory Package apache2-mod_ruby-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory Sun Solaris 10 xscreensaver in Sun Solaris 10 before 20070604, when a GNOME session with Assistive Technology support is running, allows attackers with physical access to take control of the session after entering an Alt-Tab sequence. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Internet Explorer Multiple unspecified vulnerabilities in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allow remote attackers to execute arbitrary code by instantiating certain COM objects from Wmm2fxa.dll as ActiveX controls including (1) DXImageTransform.Microsoft.MMSpecialEffect1Input, (2) DXImageTransform.Microsoft.MMSpecialEffect1Input.1, (3) DXImageTransform.Microsoft.MMSpecialEffect2Inputs, (4) DXImageTransform.Microsoft.MMSpecialEffect2Inputs.1, (5) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input, and (6) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input.1, which causes memory corruption during garbage collection. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Apache Apache 2 before 2.0.47, when running on an IPv6 host, allows attackers to cause a denial of service (CPU consumption by infinite loop) when the FTP proxy server fails to create an IPv6 socket. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary bytecode via JavaScript with a large regular expression. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Sun Solaris 7 Sun Solaris 8 Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to cause a denial of service (hang) via by calling the MrxSmbCscIoctlCloseForCopyChunk with the file handle of the shadow device, which results in a deadlock, aka the "SMB Invalid Handle Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Buffer overflow in the Routing and Remote Access service (RRAS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," aka the "RRAS Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Client Server Runtime System (CSRSS) Stack-based buffer overflow in WINSRV.DLL in the Client Server Runtime System (CSRSS) process of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application that provides console window information with a long FaceName value. Ingrid Skoog DRAFT INTERIM Christine Walzer ACCEPTED ACCEPTED Microsoft Windows Server 2003 Internet Explorer Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via "unexpected data" related to "parameter validation" in the DXImageTransform.Microsoft.Light ActiveX control, which causes Internet Explorer to crash in a way that enables the code execution. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Media Player Stack-based buffer overflow in Microsoft Windows Media Player 9 and 10 allows remote attackers to execute arbitrary code via a PNG image with a large chunk size. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Internet Information Server (IIS) Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request sessions, aka "Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise." Tiffany Bergeron ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED Sun Solaris 10 The Netscape Portable Runtime (NSPR) API 4.6.1 and 4.6.2, as used in Sun Solaris 10, trusts user-specified environment variables for specifying log files even when running from setuid programs, which allows local users to create or overwrite arbitrary files. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Exchange Server Unspecified vulnerability in Microsoft Exchange allows remote attackers to execute arbitrary code via e-mail messages with crafted (1) vCal or (2) iCal Calendar properties. Robert L. Hollis DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Operating System Double-free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to gain privileges by calling the MessageBox function with a MB_SERVICE_NOTIFICATION message with crafted data, which sends a HardError message to Client/Server Runtime Server Subsystem (CSRSS) process, which is not properly handled when invoking the UserHardError and GetHardErrorText functions in WINSRV.DLL. Sudhir Gandhe DRAFT INTERIM Robert L. Hollis Sudhir Gandhe ACCEPTED ACCEPTED Microsoft Windows Server 2003 The operating system installed on the system is Microsoft Windows Server 2003 (64-bit). Sudhir Gandhe INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 The operating system installed on the system is Microsoft Windows Server 2003 Service Pack 2 (64-bit). Sudhir Gandhe INTERIM ACCEPTED ACCEPTED Microsoft Windows Vista The patch Windows6.0-KB930178-x64.msu that addresses the vulnerabilities discussed in Microsoft Security Bulletin MS07-021 should be installed. Jonathan Baker DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package aspell-ar is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows XP Distributed Component Object Model (DCOM) Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed DCERPC DCOM object activation request packet with modified length fields, a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0528. Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 Package mono-data-sybase is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop cpe:/o:novell:suse_linux_enterprise:10::server Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to spoof secure site indicators such as the locked icon by opening the trusted site in a popup window, then changing the location to a malicious site. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Integer overflow in the bdfReadCharacters function in bdfread.c in (1) X.Org libXfont before 20070403 and (2) freetype 2.3.2 and earlier allows remote authenticated users to execute arbitrary code via crafted BDF fonts, which result in a heap overflow. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Operating System Multiple TCP/IP and ICMP implementations, when using Path MTU (PMTU) discovery (PMTUD), allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via forged ICMP ("Fragmentation Needed and Don't Fragment was Set") packets with a low next-hop MTU value, aka the "Path MTU discovery attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package amidic is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Negotiate SSP interface The Negotiate Security Software Provider (SSP) interface in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service (crash from null dereference) or execute arbitrary code via a crafted SPNEGO NegTokenInit request during authentication protocol selection. Ingrid Skoog INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Media Player Stack-based buffer overflow in Microsoft Windows Media Player 9 and 10 allows remote attackers to execute arbitrary code via a PNG image with a large chunk size. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Internet Explorer Internet Explorer 6 for Windows XP SP2 and earlier allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicious Shockwave Flash application, then changing the window location back to a trusted URL while the Flash application is still loading. NOTE: this is a different vulnerability than CVE-2006-1192. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Windows Server 2003 Media Player Stack-based buffer overflow in Microsoft Windows Media Player 9 and 10 allows remote attackers to execute arbitrary code via a PNG image with a large chunk size. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows Vista The patch Windows6.0-KB925902-x86.msu that addresses the vulnerabilities discussed in Microsoft Security Bulletin MS07-017 should be installed. Jonathan Baker DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Internet Explorer Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and obtain sensitive information by using the @import directive to download files from other domains that are not valid Cascading Style Sheets (CSS) files, as demonstrated using Google Desktop, aka "CSSXSS" and "CSS Cross-Domain Information Disclosure Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System The Microsoft Windows kernel in Microsoft Windows 2000 Server, Windows XP, and Windows Server 2003 allows remote attackers to cause a denial of service (crash) via crafted Remote Desktop Protocol (RDP) requests. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Windows Shell Buffer overflow in Windows Shell (used as the Windows Desktop) allows local and possibly remote attackers to execute arbitrary code via a custom URL handler that has not been removed for an application that has been improperly uninstalled. Matthew Burton Matthew Burton DRAFT INTERIM Matthew Burton ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Buffer overflow in the Strcmp function in the XKEYBOARD extension in X Window System X11R6.4 and earlier, as used in SCO UnixWare 7.1.3 and Sun Solaris 8 through 10, allows local users to gain privileges via a long _XKB_CHARSET environment variable value. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System The TrueType Fonts rasterizer in Microsoft Windows 2000 SP4 allows local users to gain privileges via crafted TrueType fonts, which result in an uninitialized function pointer. Sudhir Gandhe DRAFT INTERIM Robert L. Hollis ACCEPTED ACCEPTED Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Samba Buffer overflow in Microsoft Word 2002 (10.6612.6714) SP3, and possibly other versions, allows remote attackers to cause a denial of service (application exception) and possibly execute arbitrary code in winword.exe via certain unexpected values in a .doc file, including (1) an offset that triggers an out-of-bounds memory access, (2) a certain value that causes a large memory copy as triggered by an integer conversion error, and other values. Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package aspell-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Internet Explorer Double-free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image. Andrew Buttner DRAFT INTERIM ACCEPTED Christine Walzer INTERIM Christine Walzer ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to execute arbitrary code by calling the MrxSmbCscIoctlOpenForCopyChunk function with the METHOD_NEITHER method flag and an arbitrary address, possibly for kernel memory, aka the "SMB Driver Elevation of Privilege Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Outlook Express Buffer overflow in Microsoft Outlook Express 5.5 and 6 allows remote attackers to execute arbitrary code via a crafted Windows Address Book (WAB) file containing "certain Unicode strings" and modified length values. Robert L. Hollis DRAFT INTERIM ACCEPTED John Hoyland Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Mozilla Firefox 1.5.0.2, when designMode is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain Javascript that is not properly handled by the contentWindow.focus method in an iframe, which causes a reference to a deleted controller context object. NOTE: this was originally claimed to be a buffer overflow in (1) js320.dll and (2) xpcom_core.dll, but the vendor disputes this claim. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Sun Solaris 7 lbxproxy Buffer overflow in Low BandWidth X proxy (lbxproxy) in Solaris 8 allows local users to execute arbitrary code via a long display command line option. David Proulx ACCEPTED Microsoft Windows Server 2003 Internet Explorer Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to conduct spoofing and phishing attacks by using a modal browser window in a way that preserves the original address bar and trusted UI of a trusted site, even after the browser has been navigated to a malicious site, aka the "Address Bar Spoofing Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System Buffer overflow in the TCP/IP Protocol driver in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote attackers to execute arbitrary code via unknown vectors related to IP source routing. Robert L. Hollis DRAFT INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Operating System Stack-based buffer overflow in xpm_extract_color (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier, and gdk-pixbuf before 0.22, may allow remote attackers to execute arbitrary code via a certain color string. NOTE: this identifier is ONLY for gtk+. It was incorrectly referenced in an advisory for a different issue (CVE-2004-0688). Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System Microsoft JScript 5.1, 5.5, and 5.6 on Windows 2000 SP4, and 5.6 on Windows XP, Server 2003, Windows 98 and Windows Me, will "release objects early" in certain cases, which results in memory corruption and allows remote attackers to execute arbitrary code. Robert L. Hollis DRAFT INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Internet Explorer Integer underflow in the CDownloadSink class code in the Vector Markup Language (VML) component (VGX.DLL), as used in Internet Explorer 5.01, 6, and 7 allows remote attackers to execute arbitrary code via compressed content with an invalid buffer size, which triggers a heap-based buffer overflow. Robert L. Hollis DRAFT Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Microsoft Internet Explorer 5.01 through 6 does not always return the correct IOleClientSite information when dynamically creating an embedded object, which could cause Internet Explorer to run the object in the wrong security context or zone, and allow remote attackers to execute arbitrary code. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Task Scheduler Stack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0, allows local or remote attackers to execute arbitrary code via a .job file containing long parameters, as demonstrated using Internet Explorer and accessing a .job file on an anonymous share. Tiffany Bergeron INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Jeff Ito INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Outlook Express Buffer overflow in Microsoft Outlook Express 5.5 and 6 allows remote attackers to execute arbitrary code via a crafted Windows Address Book (WAB) file containing "certain Unicode strings" and modified length values. Robert L. Hollis DRAFT INTERIM ACCEPTED John Hoyland Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Microsoft Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model to run malicious script or arbitrary programs via dialog boxes, aka "Improper Cross Domain Security Validation with dialog box." Andrew Buttner ACCEPTED Microsoft Windows Server 2003 Operating System Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0, 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to cause a denial of service (crash) via a BuildContextW request with a large (1) UuidString or (2) GuidIn of a certain length, which causes an out-of-range memory access, aka the MSDTC Denial of Service Vulnerability. NOTE: this is a variant of CVE-2005-2119. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 MDAC Unspecified vulnerability in the RDS.Dataspace ActiveX control, which is contained in ActiveX Data Objects (ADO) and distributed in Microsoft Data Access Components (MDAC) 2.7 and 2.8, allows remote attackers to execute arbitrary code via unknown attack vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package alsa-firmware is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Operating System Buffer overflow in the TCP/IP Protocol driver in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote attackers to execute arbitrary code via unknown vectors related to IP source routing. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Internet Explorer Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to conduct spoofing and phishing attacks by using a modal browser window in a way that preserves the original address bar and trusted UI of a trusted site, even after the browser has been navigated to a malicious site, aka the "Address Bar Spoofing Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Unspecified vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to execute HTA files via unknown vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via HTML elements with a certain crafted tag, which leads to memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 rcp on Sun Solaris 8, 9, and 10 before 20070710 does not properly call certain helper applications, which allows local users to gain privileges by creating files with certain names, possibly containing shell metacharacters or spaces, a similar issue to CVE-2006-0225. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Outlook Express Buffer overflow in Microsoft Outlook Express 5.5 and 6 allows remote attackers to execute arbitrary code via a crafted Windows Address Book (WAB) file containing "certain Unicode strings" and modified length values. Robert L. Hollis DRAFT INTERIM ACCEPTED John Hoyland Anna Min INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Sun Solaris 7 CDE Buffer overflow in Common Desktop Environment (CDE) ToolTalk RPC database server (rpc.ttdbserverd) allows remote attackers to execute arbitrary code via an argument to the _TT_CREATE_FILE procedure. David Proulx Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Outlook Express Buffer overflow in Microsoft Outlook Express 5.5 and 6 allows remote attackers to execute arbitrary code via a crafted Windows Address Book (WAB) file containing "certain Unicode strings" and modified length values. Robert L. Hollis DRAFT INTERIM ACCEPTED John Hoyland Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Internet Explorer Unspecified vulnerability in Internet Explorer 6.0 on Microsoft Windows XP SP2 allows remote attackers to execute arbitrary code via "exceptional conditions" that trigger memory corruption, as demonstrated using an exception handler and nested object tags, a variant of CVE-2006-1992. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Internet Explorer Multiple unspecified vulnerabilities in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allow remote attackers to execute arbitrary code by instantiating certain COM objects from Wmm2fxa.dll as ActiveX controls including (1) DXImageTransform.Microsoft.MMSpecialEffect1Input, (2) DXImageTransform.Microsoft.MMSpecialEffect1Input.1, (3) DXImageTransform.Microsoft.MMSpecialEffect2Inputs, (4) DXImageTransform.Microsoft.MMSpecialEffect2Inputs.1, (5) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input, and (6) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input.1, which causes memory corruption during garbage collection. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Buffer overflow in mshtml.dll in Microsoft Internet Explorer 6.0.2900.2180, and probably other versions, allows remote attackers to execute arbitrary code via an HTML tag with a large number of script action handlers such as onload and onmouseover, as demonstrated using onclick, aka the "Multiple Event Handler Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Internet Explorer Unspecified vulnerability in Internet Explorer 6.0 on Microsoft Windows XP SP2 allows remote attackers to execute arbitrary code via "exceptional conditions" that trigger memory corruption, as demonstrated using an exception handler and nested object tags, a variant of CVE-2006-1992. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System Unspecified vulnerability in Windows Explorer in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via attack vectors involving COM objects and "crafted files and directories," aka the "Windows Shell Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System Microsoft Windows 2000 SP4 does not properly validate an RPC server during mutual authentication over SSL, which allows remote attackers to spoof an RPC server, aka the "RPC Mutual Authentication Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED HP-UX 11 ftpd The wu_fnmatch function in wu_fnmatch.c in wu-ftpd 2.6.1 and 2.6.2 allows remote attackers to cause a denial of service (CPU exhaustion by recursion) via a glob pattern with a large number of * (wildcard) characters, as demonstrated using the dir command. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Windows kernel The kernel of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via certain access requests. Ingrid Skoog DRAFT INTERIM Christine Walzer ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Race condition in the Xsession script, as used by X Display Manager (xdm) in NetBSD before 20060212, X.Org before 20060225, and Solaris 8 through 10 before 20061006, causes a user's Xsession errors file to have weak permissions before a chmod is performed, which allows local users to read Xsession errors files of other users. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Operating System Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the "blind connection-reset attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package aranym-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Operating System Buffer overflow in the ART Image Rendering component (jgdw400.dll) in Microsoft Windows XP SP1 and Sp2, Server 2003 SP1 and earlier, and Windows 98 and Me allows remote attackers to execute arbitrary code via a crafted ART image that causes heap corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED HP-UX 11 LDAP Unspecified vulnerability in su in HP HP-UX B.11.11, when using the LDAP netgroup feature, allows local users to gain unspecified access. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Internet Explorer Heap-based buffer overflow in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via crafted UTF-8 encoded HTML that results in size discrepancies during conversion to Unicode, aka "HTML Decoding Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Windows Server 2003 VDM The Virtual DOS Machine (VDM) subsystem of Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows local users to access kernel memory and gain privileges via a malicious program that modified some system structures in a way that is not properly validated by privileged operating system functions. Ingrid Skoog Ingrid Skoog DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office Stack-based buffer overflow in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed record with a modified length value, which leads to memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik Matthew Wojcik INTERIM ACCEPTED ACCEPTED Sun Solaris 8 CDE CDE ToolTalk database server (ttdbserver) allows local users to overwrite arbitrary files via a symlink attack on the transaction log file used by the _TT_TRANSACTION RPC procedure. David Proulx Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Windows Shell Buffer overflow in Microsoft Internet Explorer and Explorer on Windows XP SP1, WIndows 2000, Windows 98, and Windows Me may allow remote malicious servers to cause a denial of service (application crash) and possibly execute arbitrary code via long share names, as demonstrated using Samba. Andrew Buttner DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP FrontPage Server Extensions Cross-site scripting (XSS) vulnerability in _vti_bin/_vti_adm/fpadmdll.dll in Microsoft FrontPage Server Extensions 2002 and SharePoint Team Services allows remote attackers to inject arbitrary web script or HTML, then leverage the attack to execute arbitrary programs or create new accounts, via the (1) operation, (2) command, and (3) name parameters. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Off-by-one error in the mod_ssl Certificate Revocation List (CRL) verification callback in Apache, when configured to use a CRL, allows remote attackers to cause a denial of service (child process crash) via a CRL that causes a buffer overflow of one null byte. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 The application Microsoft Visual Basic 6.0 is installed. Sudhir Gandhe DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows 2000 The application Microsoft Excel 2007 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Windows XP Microsoft Windows XP SP2 and earlier, 2000 SP3 and SP4, Server 2003, and older operating systems allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IP packets with malformed options, aka the "IP Validation Vulnerability." Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Unspecified vulnerability in Windows Explorer in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via attack vectors involving COM objects and "crafted files and directories," aka the "Windows Shell Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Windows Server 2003 MDAC Unspecified vulnerability in the RDS.Dataspace ActiveX control, which is contained in ActiveX Data Objects (ADO) and distributed in Microsoft Data Access Components (MDAC) 2.7 and 2.8, allows remote attackers to execute arbitrary code via unknown attack vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System Buffer overflow in the Routing and Remote Access service (RRAS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," aka the "RRAS Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Microsoft Internet Explorer 5.01 through 6 allows remote attackers to conduct phishing attacks by spoofing the address bar and other parts of the trust UI via unknown methods that allow "window content to persist" after the user has navigated to another site, aka the "Address Bar Spoofing Vulnerability." NOTE: this is a different vulnerability than CVE-2006-1626. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED HP-UX 11 AutoRAID Manager Possible unknown vulnerability or vulnerabilities in HP DiskArray Utilities with AutoRAID Manager. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack. Robert L. Hollis DRAFT John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word Word (or Word Viewer) in Microsoft Office 2000 SP3, XP SP3, 2003 SP2, 2004 for Mac, and Works Suite 2004, 2005, and 2006 does not properly handle data in a certain array, which allows user-assisted remote attackers to execute arbitrary code, aka the "Word Array Overflow Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 The application Microsoft Word 2002 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 The application Microsoft Word Viewer is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 The application Microsoft Word 2000 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded, which are decoded twice to generate a malicious hostname, aka the "URL Decoding Zone Spoofing Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Microsoft Internet Explorer 5.01 through 6 does not always return the correct IOleClientSite information when dynamically creating an embedded object, which could cause Internet Explorer to run the object in the wrong security context or zone, and allow remote attackers to execute arbitrary code. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 for x86. Mark Villanova DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Unknown vulnerability in conv_fix in Sun Solaris 7 through 9, when invoked by conv_lpd, allows local users to overwrite arbitrary files. Brian Soby DRAFT INTERIM ACCEPTED INTERIM DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 openSUSE Factory Package amarok-libvisual is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:opensuse:factory Microsoft Windows XP Operating System The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to execute arbitrary code by calling the MrxSmbCscIoctlOpenForCopyChunk function with the METHOD_NEITHER method flag and an arbitrary address, possibly for kernel memory, aka the "SMB Driver Elevation of Privilege Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Apache The prefork MPM in Apache 2 before 2.0.47 does not properly handle certain errors from accept, which could lead to a denial of service. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Media Player Stack-based buffer overflow in Microsoft Windows Media Player 9 and 10 allows remote attackers to execute arbitrary code via a PNG image with a large chunk size. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Internet Explorer Unspecified vulnerability in Internet Explorer 6.0 on Microsoft Windows XP SP2 allows remote attackers to execute arbitrary code via "exceptional conditions" that trigger memory corruption, as demonstrated using an exception handler and nested object tags, a variant of CVE-2006-1992. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Range field. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Sun Solaris 9 Sun Solaris 10 Stack-based buffer overflow in the rename_principal_2_svc function in kadmind for MIT Kerberos 1.5.3, 1.6.1, and other versions allows remote authenticated users to execute arbitrary code via a crafted request to rename a principal. Nicholas Hansen DRAFT INTERIM ACCEPTED Nicholas Hansen INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Microsoft Internet Explorer 5.01 through 6 allows remote attackers to conduct phishing attacks by spoofing the address bar and other parts of the trust UI via unknown methods that allow "window content to persist" after the user has navigated to another site, aka the "Address Bar Spoofing Vulnerability." NOTE: this is a different vulnerability than CVE-2006-1626. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Unspecified vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to execute HTA files via unknown vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package apt-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Internet Explorer Unspecified vulnerability in the CTableCol::OnPropertyChange method in Microsoft Internet Explorer 5.01 SP4 on Windows 2000 SP4; 6 SP1 on Windows 2000 SP4; and 6 on Windows XP SP2, or Windows Server 2003 SP1 or SP2 allows remote attackers to execute arbitrary code by calling deleteCell on a named table row in a named table column, then accessing the column, which causes Internet Explorer to access previously deleted objects, aka the "Uninitialized Memory Corruption Vulnerability." Sudhir Gandhe DRAFT INTERIM Robert L. Hollis Jeff Ito ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Visual Studio .NET 2003 Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation. Ingrid Skoog DRAFT Ingrid Skoog INTERIM ACCEPTED Robert L. Hollis ACCEPTED John Hoyland INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System Buffer overflow in the Routing and Remote Access service (RRAS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," aka the "RRAS Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED openSUSE Factory Package apparmor-parser-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows NT VDM The component for the Virtual DOS Machine (VDM) subsystem in Windows NT 4.0 and Windows 2000 does not properly validate system structures, which allows local users to access protected kernel memory and execute arbitrary code. Ingrid Skoog ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 Package mono-data is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop cpe:/o:novell:suse_linux_enterprise:10::server Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Internet Explorer Microsoft Internet Explorer 7.0 on Windows XP and Vista allows remote attackers to conduct phishing attacks and possibly execute arbitrary code via a res: URI to navcancl.htm with an arbitrary URL as an argument, which displays the URL in the location bar of the "Navigation Canceled" page and injects the script into the "Refresh the page" link, aka Navigation Cancel Page Spoofing Vulnerability." Sudhir Gandhe DRAFT Robert L. Hollis Robert L. Hollis INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Off-by-one error in the mod_ssl Certificate Revocation List (CRL) verification callback in Apache, when configured to use a CRL, allows remote attackers to cause a denial of service (child process crash) via a CRL that causes a buffer overflow of one null byte. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Buffer overflow in the TCP/IP Protocol driver in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote attackers to execute arbitrary code via unknown vectors related to IP source routing. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via certain invalid HTML that causes memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Microsoft Internet Explorer 5.01 through 6 does not always correctly identify the domain that is associated with a browser window, which allows remote attackers to obtain sensitive cross-domain information and spoof sites by running script after the user has navigated to another site. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Internet Explorer Microsoft Internet Explorer 5.01 and 6 allows certain script to persist across navigations between pages, which allows remote attackers to obtain the window location of visited web pages in other domains or zones, aka "Window Location Information Disclosure Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Excel Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, and 2003 Viewer allows user-assisted remote attackers to execute arbitrary code via a malformed Excel file involving the "denoting [of] the start of a Workspace designation", which results in memory corruption, aka the "Workbook Memory Corruption Vulnerability". Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista The application Microsoft Office Compatibility Pack is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Enterprise Storage Manager (ESM) Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Outlook Express Heap-based buffer overflow in Microsoft Outlook Express 6 and earlier, and Windows Mail for Vista, allows remote Network News Transfer Protocol (NNTP) servers to execute arbitrary code via long NNTP responses that trigger memory corruption. Sudhir Gandhe DRAFT Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows Vista Windows Mail Microsoft Windows Mail is installed Sudhir Gandhe DRAFT Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows Vista The operating system installed on the system is Microsoft Windows Vista x64 Edition Jonathan Baker DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 openSUSE Factory Package apache2-mod_ruby is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Microsoft Internet Explorer Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via by instantiating the (1) Mdt2gddr.dll, (2) Mdt2dd.dll, and (3) Mdt2gddo.dll COM objects as ActiveX controls, which leads to memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP IIS The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to ".dll" followed by arguments such as "~0" through "~9", which causes ntdll.dll to produce a return value that is not correctly handled by IIS, as demonstrated using "/_vti_bin/.dll/*/~0". NOTE: the consequence was originally believed to be only a denial of service (application crash and reboot). Sudhir Gandhe DRAFT Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 The application Microsoft IIS 5.1 is installed. Robert L. Hollis INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain createTextRange call on a checkbox object, which results in a dereference of an invalid table pointer. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer The DHTML Edit Control (dhtmled.ocx) allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as demonstrated by "AbusiveParent" in Internet Explorer 6.0.2900.2180. Jonathan Baker DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 gzip Directory traversal vulnerability in gunzip -N in gzip 1.2.4 through 1.3.5 allows remote attackers to write to arbitrary directories via a .. (dot dot) in the original filename within a compressed file. Robert L. Hollis DRAFT INTERIM ACCEPTED Nabil Ouchn INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to read arbitrary files via malformed requests to the GetObject function, which bypass some of GetObject's security checks. David Proulx Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via unknown vectors related to the crypto.generateCRMFRequest method. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Sun Solaris 10 Operating System X.Org server (xorg-server) 1.0.0 and later, X11R6.9.0, and X11R7.0 inadvertently treats the address of the geteuid function as if it is the return value of a call to geteuid, which allows local users to bypass intended restrictions and (1) execute arbitrary code via the -modulepath command line option or (2) overwrite arbitrary files via -logfile. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Microsoft Windows XP SP1 and SP2 before August 2004, and possibly other operating systems and versions, uses insecure default ACLs that allow the Authenticated Users group to gain privileges by modifying critical configuration information for the (1) Simple Service Discovery Protocol (SSDP), (2) Universal Plug and Play Device Host (UPnP), (3) NetBT, (4) SCardSvr, (5) DHCP, and (6) DnsCache services, aka "Permissive Windows Services DACLs." NOTE: the NetBT, SCardSvr, DHCP, DnsCache already require privileged access to exploit. Robert L. Hollis DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Race condition in the memory management routines in the DHTML object processor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail, aka "DHTML Object Memory Corruption Vulnerability". Harvey Rubinovitz DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Multiple integer overflows in (1) the XGetPixel function in ImUtil.c in X.Org libx11 before 1.0.3, and (2) XInitImage function in xwd.c for ImageMagick, allow user-assisted remote attackers to cause a denial of service (crash) or obtain sensitive information via crafted images with large or negative values that trigger a buffer overflow. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package anthy-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package anthy is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory HP-UX 11 Operating System /sbin/passwd in HP-UX B.11.00, B.11.11, and B.11.23 before 20060326 "does not recover gracefully from some error conditions," which allows local users to cause a denial of service. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Apache Apache 2 before 2.0.47, and certain versions of mod_ssl for Apache 1.3, do not properly handle "certain sequences of per-directory renegotiations and the SSLCipherSuite directive being used to upgrade from a weak ciphersuite to a strong one," which could cause Apache to use the weak ciphersuite. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Red Hat Enterprise Linux 3 Red Hat Enterprise Linux 4 Sendmail Signal handler race condition in Sendmail 8.13.x before 8.13.6 allows remote attackers to execute arbitrary code by triggering timeouts in a way that causes the setjmp and longjmp function calls to be interrupted and modify unexpected memory locations. Robert L. Hollis DRAFT INTERIM ACCEPTED Vladimir Giszpenc INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System The ShellAbout API call in Korean Input Method Editor (IME) in Korean versions of Microsoft Windows XP SP1 and SP2, Windows Server 2003 up to SP1, and Office 2003, allows local users to gain privileges by launching the "shell about dialog box" and clicking the "End-User License Agreement" link, which executes Notepad with the privileges of the program that displays the about box. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) by changing the (1) -moz-grid and (2) -moz-grid-group display styles. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows XP Internet Explorer Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to conduct spoofing and phishing attacks by using a modal browser window in a way that preserves the original address bar and trusted UI of a trusted site, even after the browser has been navigated to a malicious site, aka the "Address Bar Spoofing Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Windows XP Windows Server 2003 and XP SP2, with Windows Firewall turned off, allows remote attackers to cause a denial of service (CPU consumption) via a TCP packet with the SYN flag set and the same destination and source address and port, aka a reoccurrence of the "Land" vulnerability (CVE-1999-0016). Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 sendfilev() Unknown vulnerability in the sendfilev function in Sun Solaris 8 and 9 allows local users to cause a denial of service (system panic) via unknown vectors. Brian Soby DRAFT INTERIM ACCEPTED INTERIM DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Outlook Express Buffer overflow in Microsoft Outlook Express 5.5 and 6 allows remote attackers to execute arbitrary code via a crafted Windows Address Book (WAB) file containing "certain Unicode strings" and modified length values. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM Anna Min ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package aalib-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Unspecified vulnerability in the logging mechanism in Solaris Management Console (SMC) on Sun Solaris 8 through 10 before 20070605 allows remote attackers to execute arbitrary code via unspecified vectors, related to the WBEM server. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Unspecified vulnerability in Windows Explorer in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via attack vectors involving COM objects and "crafted files and directories," aka the "Windows Shell Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain createTextRange call on a checkbox object, which results in a dereference of an invalid table pointer. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via certain invalid HTML that causes memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Unspecified vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to execute HTA files via unknown vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package alevt-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP Operating System Buffer overflow in the Remote Access Connection Manager service (RASMAN) service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," that lead to registry corruption and stack corruption, aka the "RASMAN Registry Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Internet Explorer Unspecified vulnerability in Internet Explorer 5.01 and 6 SP1 allows remote attackers to execute arbitrary code via crafted Cascading Style Sheets (CSS) strings that trigger memory corruption during parsing, related to use of out-of-bounds pointers. Robert L. Hollis DRAFT Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System Microsoft Windows XP SP1 and SP2 before August 2004, and possibly other operating systems and versions, uses insecure default ACLs that allow the Authenticated Users group to gain privileges by modifying critical configuration information for the (1) Simple Service Discovery Protocol (SSDP), (2) Universal Plug and Play Device Host (UPnP), (3) NetBT, (4) SCardSvr, (5) DHCP, and (6) DnsCache services, aka "Permissive Windows Services DACLs." NOTE: the NetBT, SCardSvr, DHCP, DnsCache already require privileged access to exploit. Robert L. Hollis DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft BizTalk Server 2004 Platform SDK Redistributable: CAPICOM CAPICOM Unspecified vulnerability in the Cryptographic API Component Object Model Certificates ActiveX control (CAPICOM.dll) in Microsoft CAPICOM and BizTalk Server 2004 SP1 and SP2 allows remote attackers to execute arbitrary code via unspecified vectors, aka the "CAPICOM.Certificates Vulnerability." Sudhir Gandhe DRAFT Jonathan Baker Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Outlook Express Stack-based buffer overflow in the news reader for Microsoft Outlook Express (MSOE.DLL) 5.5 SP2, 6, and 6 SP1 allows remote malicious NNTP servers to execute arbitrary code via a LIST response with a long second field. Ingrid Skoog DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 10 Integer signedness error in the acl (facl) system call in Solaris 10 before 20070507 allows local users to cause a denial of service (kernel panic) and possibly gain privileges via a certain argument, related to ACE_SETACL. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Buffer overflow in the ART Image Rendering component (jgdw400.dll) in Microsoft Windows XP SP1 and Sp2, Server 2003 SP1 and earlier, and Windows 98 and Me allows remote attackers to execute arbitrary code via a crafted ART image that causes heap corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla The CSS border-rendering code in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain Cascading Style Sheets (CSS) that causes an out-of-bounds array write and buffer overflow. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed graphic, which leads to memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Internet Explorer Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows user-assisted remote attackers to execute arbitrary code via a crafted web page that triggers memory corruption when it is saved as a multipart HTML (.mht) file. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System The ShellAbout API call in Korean Input Method Editor (IME) in Korean versions of Microsoft Windows XP SP1 and SP2, Windows Server 2003 up to SP1, and Office 2003, allows local users to gain privileges by launching the "shell about dialog box" and clicking the "End-User License Agreement" link, which executes Notepad with the privileges of the program that displays the about box. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 95 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Symantec Small Office or Home Office Virus Scan is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote attackers to cause a denial of service (hang) via an IGMP packet with an invalid IP option, aka the "IGMP v3 DoS Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Windows Media Player Heap-based buffer overflow in the bitmap processing routine in Microsoft Windows Media Player 7.1 on Windows 2000 SP4, Media Player 9 on Windows 2000 SP4 and XP SP1, and Media Player 10 on XP SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted bitmap (.BMP) file that specifies a size of 0 but contains additional data. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED HP-UX 11 Operating System /sbin/passwd in HP-UX B.11.00, B.11.11, and B.11.23 before 20060326 "does not recover gracefully from some error conditions," which allows local users to cause a denial of service. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Integer overflow in pcre_compile.c in Perl Compatible Regular Expressions (PCRE) before 6.2, as used in multiple products such as Python, Ethereal, and PHP, allows attackers to execute arbitrary code via quantifier values in regular expressions, which leads to a heap-based buffer overflow. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE Factory Package alsa-plugins-pulse is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Microsoft Internet Explorer Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain createTextRange call on a checkbox object, which results in a dereference of an invalid table pointer. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Windows kernel The kernel of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via certain access requests. Ingrid Skoog DRAFT INTERIM Christine Walzer ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Word for Windows 6.0 Converter Microsoft Word for Windows 6.0 Converter (MSWRD632.WPC), as used in WordPad, does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CVE-2004-0571. Christine Walzer DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED Sun Solaris 8 Licence Logging Service gzip before 1.3 in Solaris 8, when called with the -f or -force flags, will change the permissions of files that are hard linked to the target files, which allows local users to view or modify these files. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office Buffer overflow in Microsoft Office 2000 SP3, XP SP3, and other versions and packages, allows user-assisted attackers to execute arbitrary code via a routing slip that is longer than specified by the provided length field, as exploited by malware such as TROJ_MDROPPER.BH and Trojan.PPDropper.E in attacks against PowerPoint. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via by instantiating the (1) Mdt2gddr.dll, (2) Mdt2dd.dll, and (3) Mdt2gddo.dll COM objects as ActiveX controls, which leads to memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System The ShellAbout API call in Korean Input Method Editor (IME) in Korean versions of Microsoft Windows XP SP1 and SP2, Windows Server 2003 up to SP1, and Office 2003, allows local users to gain privileges by launching the "shell about dialog box" and clicking the "End-User License Agreement" link, which executes Notepad with the privileges of the program that displays the about box. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to gain chrome privileges via multiple attack vectors related to the use of XBL scripts with "Print Preview". Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Sun Solaris 9 Sun Solaris 10 The libike library, as used by in.iked, elfsign, and kcfd in Sun Solaris 9 and 10, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents libike from correctly verifying X.509 and other certificates that use PKCS #1, a similar issue to CVE-2006-4339. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote attackers to cause a denial of service (hang) via an IGMP packet with an invalid IP option, aka the "IGMP v3 DoS Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Internet Explorer Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to conduct spoofing and phishing attacks by using a modal browser window in a way that preserves the original address bar and trusted UI of a trusted site, even after the browser has been navigated to a malicious site, aka the "Address Bar Spoofing Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Microsoft Internet Explorer 5.01 through 6 allows remote attackers to conduct phishing attacks by spoofing the address bar and other parts of the trust UI via unknown methods that allow "window content to persist" after the user has navigated to another site, aka the "Address Bar Spoofing Vulnerability." NOTE: this is a different vulnerability than CVE-2006-1626. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System Microsoft JScript 5.1, 5.5, and 5.6 on Windows 2000 SP4, and 5.6 on Windows XP, Server 2003, Windows 98 and Windows Me, will "release objects early" in certain cases, which results in memory corruption and allows remote attackers to execute arbitrary code. Robert L. Hollis DRAFT INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Unspecified vulnerability in the Win32 API on Microsoft Windows 2000, XP SP2, and Server 2003 SP1 and SP2 allows remote attackers to execute arbitrary code via certain parameters to an unspecified function. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Unspecified vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to execute HTA files via unknown vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Buffer overflow in the ART Image Rendering component (jgdw400.dll) in Microsoft Windows XP SP1 and Sp2, Server 2003 SP1 and earlier, and Windows 98 and Me allows remote attackers to execute arbitrary code via a crafted ART image that causes heap corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 OpenSSL The der_chop script in the openssl package in Trustix Secure Linux 1.5 through 2.1 and other operating systems allows local users to overwrite files via a symlink attack on temporary files. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Operating System The Virtual DOS Machine (VDM) in the Windows Kernel in Microsoft Windows NT 4.0; 2000 SP4; XP SP2; Server 2003, 2003 SP1, and 2003 SP2; and Windows Vista before June 2006; uses insecure permissions (PAGE_READWRITE) for a physical memory view, which allows local users to gain privileges by modifying the "zero page" during a race condition before the view is unmapped. Sudhir Gandhe DRAFT INTERIM Robert L. Hollis Robert L. Hollis ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer An unspecified Microsoft WMF parsing application, as used in Internet Explorer 5.01 SP4 on Windows 2000 SP4, and 5.5 SP2 on Windows Millennium, and possibly other versions, allows attackers to cause a denial of service (crash) and possibly execute code via a crafted WMF file with a manipulated WMF header size, possibly involving an integer overflow, a different vulnerability than CVE-2005-4560, and aka "WMF Image Parsing Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED HP-UX 11 ftpd wu-ftpd 2.6.2 and earlier, with the restricted-gid option enabled, allows local users to bypass access restrictions by changing the permissions to prevent access to their home directory, which causes wu-ftpd to use the root directory instead. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 ftpd wu-ftpd 2.6.2 and earlier, with the restricted-gid option enabled, allows local users to bypass access restrictions by changing the permissions to prevent access to their home directory, which causes wu-ftpd to use the root directory instead. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via a BIFF parsing format file containing malformed BOOLERR records that lead to memory corruption, probably involving invalid pointers. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Office Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed description, which leads to memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM John Hoyland ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Buffer overflow in mshtml.dll in Microsoft Internet Explorer 6.0.2900.2180, and probably other versions, allows remote attackers to execute arbitrary code via an HTML tag with a large number of script action handlers such as onload and onmouseover, as demonstrated using onclick, aka the "Multiple Event Handler Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed graphic, which leads to memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office Unspecified vulnerability in Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and other products, allows user-assisted attackers to execute arbitrary code via a crafted PNG image that triggers memory corruption when it is parsed. Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 The application Microsoft Project 2002 SP1 is installed. Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 The application Microsoft Office 2002 is installed. Robert L. Hollis INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 The application Microsoft Word 2003 is installed. Robert L. Hollis INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling." Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Operating System Unspecified vulnerability in the hsfs filesystem in Solaris 8, 9, and 10 allows unspecified attackers to cause a denial of service (panic) or execute arbitrary code. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Race condition in the kernel in Sun Solaris 8 through 10 allows local users to cause a denial of service (panic) via unspecified vectors, possibly related to the exitlwps function and SIGKILL and /proc PCAGENT signals. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla The E4X implementation in Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 exposes the internal "AnyName" object to external interfaces, which allows multiple cooperating domains to exchange information in violation of the same origin restrictions. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package ampache is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 openSUSE Factory Package aalib-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:desktop cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Internet Explorer Heap-based buffer overflow in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via crafted UTF-8 encoded HTML that results in size discrepancies during conversion to Unicode, aka "HTML Decoding Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE Factory Package alsa-utils is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Interactive Training Buffer overflow in the Step-by-Step Interactive Training in Microsoft Windows 2000 SP4, XP SP2 and Professional, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a long Syllabus string in crafted bookmark link files (cbo, cbl, or .cbm), a different issue than CVE-2005-1212. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Mozilla Firefox 1.5, Netscape 8.0.4 and 7.2, and K-Meleon before 0.9.12 allows remote attackers to cause a denial of service (CPU consumption and delayed application startup) via a web site with a large title, which is recorded in history.dat but not processed efficiently during startup. NOTE: despite initial reports, the Mozilla vendor does not believe that this issue can be used to trigger a crash or buffer overflow in Firefox. Also, it has been independently reported that Netscape 8.1 does not have this issue. Robert L. Hollis DRAFT Matthew Wojcik Matthew Wojcik Robert L. Hollis INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Robert L. Hollis ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Operating System Unspecified vulnerability in the pagedata subsystem of the process file system (/proc) in Solaris 8 through 10 allows local users to cause a denial of service (system hang or panic) via unknown attack vectors that cause cause the kmem_oversize arena to allocate a large amount of system memory that does not get freed. Robert L. Hollis DRAFT INTERIM ACCEPTED Nabil Ouchn INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Operating System Integer overflow in pixbuf_create_from_xpm (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier, and gdk-pixbuf before 0.22, allows remote attackers to execute arbitrary code via certain n_col and cpp values that enable a heap-based buffer overflow. NOTE: this identifier is ONLY for gtk+. It was incorrectly referenced in an advisory for a different issue (CVE-2004-0687). Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 Package mono-core is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop cpe:/o:novell:suse_linux_enterprise:10::server Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via a large number in the CSS letter-spacing property that leads to a heap-based buffer overflow. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED openSUSE Factory Package alsa-oss-debuginfo is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 Operating System The Windows Graphical Device Interface library (GDI32.DLL) in Microsoft Windows allows remote attackers to execute arbitrary code via a Windows Metafile (WMF) format image with a crafted SETABORTPROC GDI Escape function call, related to the Windows Picture and Fax Viewer (SHIMGVW.DLL), a different vulnerability than CVE-2005-2123 and CVE-2005-2124, and as originally discovered in the wild on unionseek.com. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Outlook Express Buffer overflow in Microsoft Outlook Express 5.5 and 6 allows remote attackers to execute arbitrary code via a crafted Windows Address Book (WAB) file containing "certain Unicode strings" and modified length values. Robert L. Hollis DRAFT INTERIM ACCEPTED John Hoyland Anna Min INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Simple Network Management Protocol (SNMP) Vulnerabilities in a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via SNMPv1 trap handling, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor. This and other SNMP-related candidates will be updated when more accurate information is available. Harvey Rubinovitz ACCEPTED Microsoft Windows XP Internet Explorer Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows user-assisted remote attackers to execute arbitrary code via a crafted web page that triggers memory corruption when it is saved as a multipart HTML (.mht) file. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 10 Operating System Unspecified vulnerability in Sun Solaris 10 allows local users to cause a denial of service (null dereference) via unspecified vectors involving the use of the find command on the "/proc" filesystem. NOTE: due to the vagueness of the vendor advisory, it is not clear whether this is related to CVE-2005-3250. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Operating System Unknown vulnerability in HP-UX B.11.00, B.11.04, B.11.11, B.11.22, and B.11.23, when running TCP/IP on IPv4, allows remote attackers to cause a denial of service via certain packets, related to the PMTU, a different vulnerability than CVE-2004-1060. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows XP SMB (Server Message Block) The Server Message Block (SMB) implementation for Windows NT 4.0, 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allows remote attackers to execute arbitrary code via Transaction responses containing (1) Trans or (2) Trans2 commands, aka the "Server Message Block Vulnerability," and as demonstrated using Trans2 FIND_FIRST2 responses with large file name length fields. Christine Walzer DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Outlook Express A component in Microsoft Outlook Express 6 allows remote attackers to bypass domain restrictions and obtain sensitive information via redirections with the mhtml: URI handler, as originally reported for Internet Explorer 6 and 7, aka "URL Redirect Cross Domain Information Disclosure Vulnerability." Sudhir Gandhe DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Outlook Express 6 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Andrew Buttner DEPRECATED DEPRECATED Microsoft Windows XP Internet Explorer Internet Explorer 6 for Windows XP SP2 and earlier allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicious Shockwave Flash application, then changing the window location back to a trusted URL while the Flash application is still loading. NOTE: this is a different vulnerability than CVE-2006-1192. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP HyperTerminal HyperTerminal application for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value that is saved in a session file, which allows remote attackers to execute arbitrary code via a malicious HyperTerminal session file (.ht), web site, or Telnet URL contained in an e-mail message, triggering a buffer overflow. Harvey Rubinovitz DRAFT Harvey Rubinovitz Harvey Rubinovitz INTERIM Christine Walzer David Proulx ACCEPTED Daniel Tarnu INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Buffer overflow in the Web Client service (WebClnt.dll) for Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote authenticated users or Guests to execute arbitrary code via crafted RPC requests, a different vulnerability than CVE-2005-1207. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows ME Windows Shell Buffer overflow in Microsoft Internet Explorer and Explorer on Windows XP SP1, WIndows 2000, Windows 98, and Windows Me may allow remote malicious servers to cause a denial of service (application crash) and possibly execute arbitrary code via long share names, as demonstrated using Samba. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Internet Explorer Internet Explorer 6 for Windows XP SP2 and earlier allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicious Shockwave Flash application, then changing the window location back to a trusted URL while the Flash application is still loading. NOTE: this is a different vulnerability than CVE-2006-1192. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System Stack-based buffer overflow in the Plug and Play (PnP) service for Microsoft Windows 2000 and Windows XP Service Pack 1 allows remote attackers to execute arbitrary code via a crafted packet, and local users to gain privileges via a malicious application, as exploited by the Zotob (aka Mytob) worm. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Internet Information Server (IIS) Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code. Tiffany Bergeron ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Buffer overflow in mshtml.dll in Microsoft Internet Explorer 6.0.2900.2180, and probably other versions, allows remote attackers to execute arbitrary code via an HTML tag with a large number of script action handlers such as onload and onmouseover, as demonstrated using onclick, aka the "Multiple Event Handler Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Windows Media Player Heap-based buffer overflow in the bitmap processing routine in Microsoft Windows Media Player 7.1 on Windows 2000 SP4, Media Player 9 on Windows 2000 SP4 and XP SP1, and Media Player 10 on XP SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted bitmap (.BMP) file that specifies a size of 0 but contains additional data. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM Robert L. Hollis ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, aka a variant of the "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2127. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System The ShellAbout API call in Korean Input Method Editor (IME) in Korean versions of Microsoft Windows XP SP1 and SP2, Windows Server 2003 up to SP1, and Office 2003, allows local users to gain privileges by launching the "shell about dialog box" and clicking the "End-User License Agreement" link, which executes Notepad with the privileges of the program that displays the about box. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Exchange Server The Exchange Collaboration Data Objects (EXCDO) functionality in Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 allows remote attackers to cause a denial of service (crash) via an Internet Calendar (iCal) file containing multiple X-MICROSOFT-CDO-MODPROPS (MODPROPS) properties in which the second MODPROPS is longer than the first, which triggers a NULL pointer dereference and an unhandled exception. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Novell Linux Desktop 9 openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Server 10 openSUSE Factory Package acct is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:linux_desktop:9 cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10:server cpe:/o:novell:opensuse:factory Microsoft Windows XP Microsoft Internet Explorer Unspecified vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to execute HTA files via unknown vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Operating System Buffer overflow in the ART Image Rendering component (jgdw400.dll) in Microsoft Windows XP SP1 and Sp2, Server 2003 SP1 and earlier, and Windows 98 and Me allows remote attackers to execute arbitrary code via a crafted ART image that causes heap corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Windows NT 4.0 In Microsoft Windows NT and Windows 2000, a trusting domain that receives authorization information from a trusted domain does not verify that the trusted domain is authoritative for all listed SIDs, which allows remote attackers to gain Domain Administrator privileges on the trusting domain by injecting SIDs from untrusted domains into the authorization data that comes from from the trusted domain. Tiffany Bergeron ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via by instantiating the (1) Mdt2gddr.dll, (2) Mdt2dd.dll, and (3) Mdt2gddo.dll COM objects as ActiveX controls, which leads to memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Buffer overflow in the Routing and Remote Access service (RRAS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," aka the "RRAS Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Operating System Unspecified vulnerability in HP HP-UX B.11.00, B.11.04, and B.11.11 allows local users to gain privileges via unknown attack vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Buffer overflow in the TCP/IP Protocol driver in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote attackers to execute arbitrary code via unknown vectors related to IP source routing. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System The thread termination routine in the kernel for Windows NT 4.0 and 2000 (NTOSKRNL.EXE) allows local users to modify kernel memory and execution flow via steps in which a terminating thread causes Asynchronous Procedure Call (APC) entries to free the wrong data, aka the "Windows Kernel Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED HP-UX 11 Operating System Unknown vulnerability in the login page for HP Systems Insight Manager (SIM) 4.0 and 4.1, when accessed by Microsoft Internet Explorer with the MS04-025 patch, leads to a denial of service (browser hang). NOTE: although the advisory is vague, this issue does not appear to involve an attacker at all. If not, then this issue is not a vulnerability. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Windows kernel The Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability." Christine Walzer DRAFT INTERIM ACCEPTED Robert L. Hollis DEPRECATED DEPRECATED Sun Solaris 10 X Unspecified vulnerability in in.rexecd in Solaris 10 allows local users to gain privileges on Kerberos systems via unknown attack vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Windows NT 4.0 smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges by duplicating a handle to a privileged process, as demonstrated by DebPloit. Tiffany Bergeron ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed description, which leads to memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Windows Media Player Heap-based buffer overflow in the bitmap processing routine in Microsoft Windows Media Player 7.1 on Windows 2000 SP4, Media Player 9 on Windows 2000 SP4 and XP SP1, and Media Player 10 on XP SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted bitmap (.BMP) file that specifies a size of 0 but contains additional data. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED HP-UX 11 Operating System Unspecified vulnerability in HP HP-UX B.11.00, B.11.04, and B.11.11 allows local users to gain privileges via unknown attack vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED HP-UX 11 remshd Unknown vulnerability in remshd daemon in HP-UX B.11.00, B.11.11, and B.11.23 while running in "Trusted Mode" allows remote attackers to gain unauthorized system access via unknown attack vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows XP Microsoft Windows 2000 Content Management Server Cross-site scripting (XSS) vulnerability in Microsoft Content Management Server (MCMS) 2001 SP1 and 2002 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving HTML redirection queries, aka "Cross-site Scripting and Spoofing Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows XP Microsoft Windows 2000 Microsoft Content Management Server 2002 Service Pack 2 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows XP Microsoft Windows 2000 Microsoft Content Management Server 2001 Service Pack 1 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML. NOTE: due to the lack of sufficient public details from the vendor as of 20060413, it is unclear how CVE-2006-1529, CVE-2006-1530, CVE-2006-1531, and CVE-2006-1723 are different. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Unspecified vulnerability in the format command in Sun Solaris 8 and 9 before 20060821 allows local users to modify arbitrary files via unspecified vectors involving profiles that permit running format with elevated privileges, a different issue than CVE-2006-4306 and CVE-2006-4319. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 envd envd daemon in HP-UX B.11.00 through B.11.11 allows local users to obtain privileges via unknown attack vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Operating System Unspecified kernel GDI functions in Microsoft Windows 2000 SP4; XP SP2; and Server 2003 Gold, SP1, and SP2 allows user-assisted remote attackers to cause a denial of service (possibly persistent restart) via a crafted Windows Metafile (WMF) image that causes an invalid dereference of an offset in a kernel structure, a related issue to CVE-2005-4560. Sudhir Gandhe DRAFT INTERIM Robert L. Hollis ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed description, which leads to memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Operating System The MFC component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1 and Visual Studio .NET 2000, 2002 SP1, 2003, and 2003 SP1 allows user-assisted remote attackers to execute arbitrary code via an RTF file with a malformed OLE object that triggers memory corruption. NOTE: this might be due to a stack-based buffer overflow in the the AfxOleSetEditMenu function in MFC42u.dll. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Visual Studio .NET 2002 SP1 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Visual Studio .NET 2003 SP1 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Visual Studio .NET 2003 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Buffer overflow in mshtml.dll in Microsoft Internet Explorer 6.0.2900.2180, and probably other versions, allows remote attackers to execute arbitrary code via an HTML tag with a large number of script action handlers such as onload and onmouseover, as demonstrated using onclick, aka the "Multiple Event Handler Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Windows Media Player 9 Windows Media Player 9 allows remote attackers to execute arbitrary code via a PNG file containing large (1) width or (2) height values, aka the "PNG Processing Vulnerability." Christine Walzer DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Internet Explorer Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to conduct spoofing and phishing attacks by using a modal browser window in a way that preserves the original address bar and trusted UI of a trusted site, even after the browser has been navigated to a malicious site, aka the "Address Bar Spoofing Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED HP-UX 11 SecureShell sshd in OpenSSH before 4.2, when GSSAPIDelegateCredentials is enabled, allows GSSAPI credentials to be delegated to clients who log in using non-GSSAPI methods, which could cause those credentials to be exposed to untrusted users or hosts. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System The Windows Graphical Device Interface library (GDI32.DLL) in Microsoft Windows allows remote attackers to execute arbitrary code via a Windows Metafile (WMF) format image with a crafted SETABORTPROC GDI Escape function call, related to the Windows Picture and Fax Viewer (SHIMGVW.DLL), a different vulnerability than CVE-2005-2123 and CVE-2005-2124, and as originally discovered in the wild on unionseek.com. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Internet Explorer in Windows XP SP2, and other versions including 5.01 and 5.5, allows remote attackers to install arbitrary programs via a web page that uses certain styles and the AnchorClick behavior, popup windows, and drag-and-drop capabilities to drop the program in the local startup folder, as demonstrated by "wottapoop.html". Harvey Rubinovitz DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Mozilla Firefox 1.5, Thunderbird 1.5 if Javascript is enabled in mail, and SeaMonkey before 1.0 might allow remote attackers to execute arbitrary code via the QueryInterface method of the built-in Location and Navigator objects, which leads to memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Windows kernel The Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability." Christine Walzer DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Apache A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Windows Media Player Buffer overflow in the plug-in for Microsoft Windows Media Player (WMP) 9 and 10, when used in browsers other than Internet Explorer and set as the default application to handle media files, allows remote attackers to execute arbitrary code via HTML with an EMBED element containing a long src attribute. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, aka a variant of the "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2127. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Flash Player Macromedia Flash 6 and 7 (Flash.ocx) allows remote attackers to execute arbitrary code via a SWF file with a modified frame type identifier that is used as an out-of-bounds array index to a function pointer. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Internet Explorer Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and obtain sensitive information by using the @import directive to download files from other domains that are not valid Cascading Style Sheets (CSS) files, as demonstrated using Google Desktop, aka "CSSXSS" and "CSS Cross-Domain Information Disclosure Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 PowerPoint Microsoft PowerPoint 2000 in Office 2000 SP3 has an interaction with Internet Explorer that allows remote attackers to obtain sensitive information via a PowerPoint presentation that attempts to access objects in the Temporary Internet Files Folder (TIFF). Robert L. Hollis DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 Package mono-web is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop cpe:/o:novell:suse_linux_enterprise:10::server Microsoft Windows 2000 Microsoft Office Buffer overflow in Microsoft Office 2000 SP3, XP SP3, and other versions and packages, allows user-assisted attackers to execute arbitrary code via a routing slip that is longer than specified by the provided length field, as exploited by malware such as TROJ_MDROPPER.BH and Trojan.PPDropper.E in attacks against PowerPoint. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 The application Microsoft Office 2000 is installed. Robert L. Hollis INTERIM Glenn Strickland ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED HP-UX 11 Operating System Unknown vulnerability in HP-UX B.11.00, B.11.04, B.11.11, B.11.22, and B.11.23, when running TCP/IP on IPv4, allows remote attackers to cause a denial of service via certain packets, related to the PMTU, a different vulnerability than CVE-2004-1060. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System Windows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to execute arbitrary commands via a shortcut (.lnk) file with long font properties that lead to a buffer overflow in the Client/Server Runtime Server Subsystem (CSRSS), a different vulnerability than CVE-2005-2118. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 TIP Distributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service exception and exit) via an "unexpected protocol command during the reconnection request," which is not properly handled by the Transaction Internet Protocol (TIP) functionality. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Operating System Untrusted search path vulnerability in Winlogon in Microsoft Windows 2000 SP4, when SafeDllSearchMode is disabled, allows local users to gain privileges via a malicious DLL in the UserProfile directory, aka "User Profile Elevation of Privilege Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Windows Internet Naming Service (WINS) The WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 allows remote attackers to write to arbitrary memory locations and possibly execute arbitrary code via a modified memory pointer in a WINS replication packet to TCP port 42, aka the "Association Context Vulnerability." Matthew Burton DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to trick users into downloading and saving an executable file via an image that is overlaid by a transparent image link that points to the executable, which causes the executable to be saved when the user clicks the "Save image as..." option. NOTE: this attack is made easier due to a GUI truncation issue that prevents the user from seeing the malicious extension when there is extra whitespace in the filename. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System Buffer overflow in the Web Client service (WebClnt.dll) for Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote authenticated users or Guests to execute arbitrary code via crafted RPC requests, a different vulnerability than CVE-2005-1207. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allow remote attackers to execute arbitrary code via crafted Windows Metafile (WMF) and Enhanced Metafile (EMF) format images that lead to heap-based buffer overflows, as demonstrated using MRBP16::bCheckRecord. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package aalib-devel-64bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows Server 2003 NetWare The Client Service for NetWare (CSNW) on Microsoft Windows 2000 SP4, XP SP1 and Sp2, and Server 2003 SP1 and earlier, allows remote attackers to execute arbitrary code due to an "unchecked buffer" when processing certain crafted network messages. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, aka a variant of the "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2127. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED HP-UX 11 SecureShell zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Microsoft Internet Explorer 5.01 through 6 does not always return the correct IOleClientSite information when dynamically creating an embedded object, which could cause Internet Explorer to run the object in the wrong security context or zone, and allow remote attackers to execute arbitrary code. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Internet Explorer Integer overflow in the ReadWideString function in agentdpv.dll in Microsoft Agent on Microsoft Windows 2000 SP4, XP SP2, and Server 2003 up to SP1 allows remote attackers to execute arbitrary code via a large length value in an .ACF file, which results in a heap-based buffer overflow. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, as originally demonstrated using the (1) DDS Library Shape Control (Msdds.dll) COM object, and other objects including (2) Blnmgrps.dll, (3) Ciodm.dll, (4) Comsvcs.dll, (5) Danim.dll, (6) Htmlmarq.ocx, (7) Mdt2dd.dll (as demonstrated using a heap corruption attack with uninitialized memory), (8) Mdt2qd.dll, (9) Mpg4ds32.ax, (10) Msadds32.ax, (11) Msb1esen.dll, (12) Msb1fren.dll, (13) Msb1geen.dll, (14) Msdtctm.dll, (15) Mshtml.dll, (16) Msoeacct.dll, (17) Msosvfbr.dll, (18) Mswcrun.dll, (19) Netshell.dll, (20) Ole2disp.dll, (21) Outllib.dll, (22) Psisdecd.dll, (23) Qdvd.dll, (24) Repodbc.dll, (25) Shdocvw.dll, (26) Shell32.dll, (27) Soa.dll, (28) Srchui.dll, (29) Stobject.dll, (30) Vdt70.dll, (31) Vmhelper.dll, and (32) Wbemads.dll, aka a variant of the "COM Object Instantiation Memory Corruption vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System Windows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to execute arbitrary commands via a shortcut (.lnk) file with long font properties that lead to a buffer overflow in the Client/Server Runtime Server Subsystem (CSRSS), a different vulnerability than CVE-2005-2118. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 NetWare The Client Service for NetWare (CSNW) on Microsoft Windows 2000 SP4, XP SP1 and Sp2, and Server 2003 SP1 and earlier, allows remote attackers to execute arbitrary code due to an "unchecked buffer" when processing certain crafted network messages. Robert L. Hollis DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, as originally demonstrated using the (1) DDS Library Shape Control (Msdds.dll) COM object, and other objects including (2) Blnmgrps.dll, (3) Ciodm.dll, (4) Comsvcs.dll, (5) Danim.dll, (6) Htmlmarq.ocx, (7) Mdt2dd.dll (as demonstrated using a heap corruption attack with uninitialized memory), (8) Mdt2qd.dll, (9) Mpg4ds32.ax, (10) Msadds32.ax, (11) Msb1esen.dll, (12) Msb1fren.dll, (13) Msb1geen.dll, (14) Msdtctm.dll, (15) Mshtml.dll, (16) Msoeacct.dll, (17) Msosvfbr.dll, (18) Mswcrun.dll, (19) Netshell.dll, (20) Ole2disp.dll, (21) Outllib.dll, (22) Psisdecd.dll, (23) Qdvd.dll, (24) Repodbc.dll, (25) Shdocvw.dll, (26) Shell32.dll, (27) Soa.dll, (28) Srchui.dll, (29) Stobject.dll, (30) Vdt70.dll, (31) Vmhelper.dll, and (32) Wbemads.dll, aka a variant of the "COM Object Instantiation Memory Corruption vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Operating System Unspecified vulnerability in uucp in Sun Solaris 8 and 9 has unknown impact and attack vectors. NOTE: due to the vagueness of the vendor advisory, it is not clear whether this is related to CVE-2004-0780. Robert L. Hollis DRAFT Matthew Wojcik INTERIM ACCEPTED ACCEPTED HP-UX 11 Operating System Unknown vulnerability in HP-UX B.11.00, B.11.04, B.11.11, B.11.22, and B.11.23, when running TCP/IP on IPv4, allows remote attackers to cause a denial of service via certain packets, related to the PMTU, a different vulnerability than CVE-2004-1060. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System netman.dll in Microsoft Windows Connections Manager Library allows local users to cause a denial of service (Network Connections Service crash) via a large integer argument to a particular function, aka "Network Connection Manager Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package aalib-devel-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows XP HTML Help Facility Heap-based buffer overflow in the HtmlHelp program (hh.exe) in HTML Help for Microsoft Windows 98, Me, NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary commands via a .CHM file with a large length field, a different vulnerability than CVE-2003-1041. Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Outlook Buffer overflow in the Advanced Search (Finder.exe) feature of Microsoft Outlook 2000, 2002, and 2003 allows user-assisted remote attackers to execute arbitrary code via a crafted Outlook Saved Searches (OSS) file that triggers memory corruption, aka "Microsoft Outlook Advanced Find Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Vista Microsoft Windows Vista uses insecure default permissions for unspecified "local user information data stores" in the registry and the file system, which allows local users to obtain sensitive information such as administrative passwords, aka "Permissive User Information Store ACLs Information Disclosure Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 TENEX C Shell (tcsh) Unknown vulnerability in the ls-F builtin function in tcsh on Solaris 8 allows local users to create or delete files as other users, and gain privileges. Brian Soby DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Unspecified vulnerability in Sun Solaris 8 and 9 before 20060821 allows local users to execute arbitrary commands via unspecified vectors, involving the default Role-Based Access Control (RBAC) settings in the "File System Management" profile. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling." Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office Stack-based buffer overflow in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed record with a modified length value, which leads to memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Vista Operating System Use-after-free vulnerability in the Client/Server Run-time Subsystem (CSRSS) in Microsoft Windows Vista does not properly handle connection resources when starting and stopping processes, which allows local users to gain privileges by opening and closing multiple ApiPort connections, which leaves a "dangling pointer" to a process data structure. Sudhir Gandhe DRAFT Robert L. Hollis INTERIM Sudhir Gandhe ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Operating System 'As Service Packs released by Microsft mature, earlier versions and releases become unspported. This equates to a cessation in software and security patches for that baseline. Using an unsupported version of Windows represents a severe security risk.' Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Anna Min INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed description, which leads to memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Microsoft Internet Explorer 5.01, 5.5, and 6, when using an HTTPS proxy server that requires Basic Authentication, sends URLs in cleartext, which allows remote attackers to obtain sensitive information, aka "HTTPS Proxy Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, aka a variant of the "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2127. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Sun Solaris 7 fs.auto, xfs Buffer overflow in Dispatch() routine for XFS font server (fs.auto) on Solaris 2.5.1 through 9 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a certain XFS query. David Proulx Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Stack-based buffer overflow in the Plug and Play (PnP) service (UMPNPMGR.DLL) in Microsoft Windows 2000 SP4, and XP SP1 and SP2, allows remote or local authenticated attackers to execute arbitrary code via a large number of "\" (backslash) characters in a registry key name, which triggers the overflow in a wsprintfW function call. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Internet Explorer 5.01 SP4 up to 6 on various Windows operating systems, including IE 6.0.2900.2180 on Windows XP, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, as demonstrated using the JVIEW Profiler (Javaprxy.dll). NOTE: the researcher says that the vendor could not reproduce this problem. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Windows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to execute arbitrary commands via a shortcut (.lnk) file with long font properties that lead to a buffer overflow in the Client/Server Runtime Server Subsystem (CSRSS), a different vulnerability than CVE-2005-2118. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Buffer overflow in Collaboration Data Objects (CDO), as used in Microsoft Windows and Microsoft Exchange Server, allows remote attackers to execute arbitrary code when CDOSYS or CDOEX processes an e-mail message with a large header name, as demonstrated using the "Content-Type" string. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 allow remote attackers to execute arbitrary code by changing an element's style from position:relative to position:static, which causes Gecko to operate on freed memory. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows XP TIP Distributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service exception and exit) via an "unexpected protocol command during the reconnection request," which is not properly handled by the Transaction Internet Protocol (TIP) functionality. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 VDM The component for the Virtual DOS Machine (VDM) subsystem in Windows NT 4.0 and Windows 2000 does not properly validate system structures, which allows local users to access protected kernel memory and execute arbitrary code. Ingrid Skoog Ingrid Skoog ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP MDAC Unspecified vulnerability in the RDS.Dataspace ActiveX control, which is contained in ActiveX Data Objects (ADO) and distributed in Microsoft Data Access Components (MDAC) 2.7 and 2.8, allows remote attackers to execute arbitrary code via unknown attack vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed graphic, which leads to memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik Matthew Wojcik INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Apache Apache 1.3 before 1.3.25 and Apache 2.0 before version 2.0.46 does not filter terminal escape sequences from its access logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences, a different vulnerability than CVE-2003-0020. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via a BIFF parsing format file containing malformed BOOLERR records that lead to memory corruption, probably involving invalid pointers. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Microsoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Javascript BODY onload event that calls the window function, aka "Mismatched Document Object Model Objects Memory Corruption Vulnerability." Robert L. Hollis DRAFT Robert L. Hollis INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Jeff Cheng INTERIM Jeff Cheng ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Multiple design errors in Microsoft Internet Explorer 5.01, 5.5, and 6 allow user-assisted attackers to execute arbitrary code by (1) overlaying a malicious new window above a file download box, then (2) using a keyboard shortcut and delaying the display of the file download box until the user hits a shortcut that activates the "Run" button, aka "File Download Dialog Box Manipulation Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 5.01 SP4 up to 6 on various Windows operating systems, including IE 6.0.2900.2180 on Windows XP, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, as demonstrated using the JVIEW Profiler (Javaprxy.dll). NOTE: the researcher says that the vendor could not reproduce this problem. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Multiple design errors in Microsoft Internet Explorer 5.01, 5.5, and 6 allow user-assisted attackers to execute arbitrary code by (1) overlaying a malicious new window above a file download box, then (2) using a keyboard shortcut and delaying the display of the file download box until the user hits a shortcut that activates the "Run" button, aka "File Download Dialog Box Manipulation Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office Buffer overflow in Microsoft Office 2000 SP3, XP SP3, and other versions and packages, allows user-assisted attackers to execute arbitrary code via a routing slip that is longer than specified by the provided length field, as exploited by malware such as TROJ_MDROPPER.BH and Trojan.PPDropper.E in attacks against PowerPoint. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 HTML Help Facility Heap-based buffer overflow in the HtmlHelp program (hh.exe) in HTML Help for Microsoft Windows 98, Me, NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary commands via a .CHM file with a large length field, a different vulnerability than CVE-2003-1041. Andrew Buttner INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Apache Apache does not filter terminal escape sequences from its error logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Sun Solaris 8 CDE CDE ToolTalk database server (ttdbserver) allows remote attackers to overwrite arbitrary memory locations with a zero, and possibly gain privileges, via a file descriptor argument in an AUTH_UNIX procedure call, which is used as a table index by the _TT_ISCLOSE procedure. David Proulx Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System COM+ in Microsoft Windows does not properly "create and use memory structures," which allows local users or remote attackers to execute arbitrary code. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Microsoft Internet Explorer 5.01 through 6 allows remote attackers to conduct phishing attacks by spoofing the address bar and other parts of the trust UI via unknown methods that allow "window content to persist" after the user has navigated to another site, aka the "Address Bar Spoofing Vulnerability." NOTE: this is a different vulnerability than CVE-2006-1626. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla 'mozilla.org has launched and delivered SeaMonkey, a community effort to deliver production-quality releases of code derived from the \"Mozilla Application Suite\". This equates to a cessation in software and security patches for that baseline. Using an unsupported software represents a high security risk because no fixes or patches will be made available in response to new vulnerabilities.' Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED Jonathan Baker INTERIM Robert L. Hollis DEPRECATED DEPRECATED HP-UX 11 Apache Integer overflow in pcre_compile.c in Perl Compatible Regular Expressions (PCRE) before 6.2, as used in multiple products such as Python, Ethereal, and PHP, allows attackers to execute arbitrary code via quantifier values in regular expressions, which leads to a heap-based buffer overflow. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Unspecified vulnerability in kcms_calibrate in Sun Solaris 8 and 9 before 20071122 allows local users to execute arbitrary commands via unknown vectors. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla The function allocation code (js_NewFunction in jsfun.c) in Firefox 1.5 allows attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via user-defined methods that trigger garbage collection in a way that operates on freed objects. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla The XULDocument.persist function in Mozilla, Firefox before 1.5.0.1, and SeaMonkey before 1.0 does not validate the attribute name, which allows remote attackers to execute arbitrary Javascript by injecting RDF data into the user's localstore.rdf file. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Robert L. Hollis ACCEPTED ACCEPTED Microsoft Windows XP Operating System The Windows Graphical Device Interface library (GDI32.DLL) in Microsoft Windows allows remote attackers to execute arbitrary code via a Windows Metafile (WMF) format image with a crafted SETABORTPROC GDI Escape function call, related to the Windows Picture and Fax Viewer (SHIMGVW.DLL), a different vulnerability than CVE-2005-2123 and CVE-2005-2124, and as originally discovered in the wild on unionseek.com. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Heap-based buffer overflow in T2EMBED.DLL in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1, Windows 98, and Windows ME allows remote attackers to execute arbitrary code via an e-mail message or web page with a crafted Embedded Open Type (EOT) web font that triggers the overflow during decompression. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Multiple design errors in Microsoft Internet Explorer 5.01, 5.5, and 6 allow user-assisted attackers to execute arbitrary code by (1) overlaying a malicious new window above a file download box, then (2) using a keyboard shortcut and delaying the display of the file download box until the user hits a shortcut that activates the "Run" button, aka "File Download Dialog Box Manipulation Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Sun Solaris 8 fs.auto, xfs Buffer overflow in Dispatch() routine for XFS font server (fs.auto) on Solaris 2.5.1 through 9 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a certain XFS query. David Proulx Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Microsoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Javascript BODY onload event that calls the window function, aka "Mismatched Document Object Model Objects Memory Corruption Vulnerability." Robert L. Hollis DRAFT Robert L. Hollis INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System Windows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to execute arbitrary commands via a shortcut (.lnk) file with long font properties that lead to a buffer overflow in the Client/Server Runtime Server Subsystem (CSRSS), a different vulnerability than CVE-2005-2118. Robert L. Hollis DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 openSUSE Factory Package aalib-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:opensuse:factory Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Outlook Unspecified vulnerability in Microsoft Outlook 2000 through 2003, Exchange 5.0 Server SP2 and 5.5 SP4, Exchange 2000 SP3, and Office allows remote attackers to execute arbitrary code via an e-mail message with a crafted Transport Neutral Encapsulation Format (TNEF) MIME attachment, related to message length validation. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Buffer overflow in URLMON.DLL in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via a crafted URL with an International Domain Name (IDN) using double-byte character sets (DBCS), aka the "Double Byte Character Parsing Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Buffer overflow in the TCP/IP Protocol driver in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote attackers to execute arbitrary code via unknown vectors related to IP source routing. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Solaris Management Console (SMC) The Solaris Management Console (SMC) in Sun Solaris 8 and 9 generates different 404 error messages when a file does not exist versus when a file exists but is otherwise inacessible, which could allow remote attackers to obtain sensitive information in conjunction with a directory traversal (..) attack. Brian Soby DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Kodak Image Viewer Kodak Image Viewer in Microsoft Windows 2000 SP4, and in some cases XP SP2 and Server 2003 SP1 and SP2, allows remote attackers to execute arbitrary code via crafted image files that trigger memory corruption, as demonstrated by a certain .tif (TIFF) file. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Heap-based buffer overflow in Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to execute arbitrary code via an XBM image file that ends in a large number of spaces instead of the expected end tag. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Red Hat Linux 9 GtkHTML gtkhtml before 1.1.10, as used in Evolution, allows remote attackers to cause a denial of service (crash) via a malformed message that causes a null pointer dereference. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Sun Solaris 7 libpng Multiple integer overflows in the (1) png_read_png in pngread.c or (2) png_handle_sPLT functions in pngrutil.c or (3) progressive display image reading capability in libpng 1.2.5 and earlier allow remote attackers to cause a denial of service (application crash) via a malformed PNG image. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Internet Explorer Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to conduct spoofing and phishing attacks by using a modal browser window in a way that preserves the original address bar and trusted UI of a trusted site, even after the browser has been navigated to a malicious site, aka the "Address Bar Spoofing Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System Heap-based buffer overflow in the CRpcIoManagerServer::BuildContext function in msdtcprx.dll for Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0 and Windows 2000 SP2 and SP3 allows remote attackers to execute arbitrary code via a long fifth argument to the BuildContextW or BuildContext opcode, which triggers a bug in the NdrAllocate function, aka the MSDTC Invalid Memory Access Vulnerability. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, aka a variant of the "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2127. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED HP-UX 10 ftpd The FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Mozilla Firefox 1.5 before 1.5.0.2 and SeaMonkey before 1.0.1 causes certain windows to become translucent due to an interaction between XUL content windows and the history mechanism, which might allow user-assisted remote attackers to trick users into executing arbitrary code. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 /usr/ucb/ps in Sun Microsystems Solaris 8 and 9, and certain earlier releases, allows local users to view the environment variables and values of arbitrary processes via the -e option. Robert L. Hollis DRAFT INTERIM ACCEPTED Nabil Ouchn INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Windows Shell Buffer overflow in Windows Shell (used as the Windows Desktop) allows local and possibly remote attackers to execute arbitrary code via a custom URL handler that has not been removed for an application that has been improperly uninstalled. Christine Walzer Christine Walzer INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows Vista The patch Windows6.0-KB930178-x86.msu that addresses the vulnerabilities discussed in Microsoft Security Bulletin MS07-021 should be installed. Jonathan Baker DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, as originally demonstrated using the (1) DDS Library Shape Control (Msdds.dll) COM object, and other objects including (2) Blnmgrps.dll, (3) Ciodm.dll, (4) Comsvcs.dll, (5) Danim.dll, (6) Htmlmarq.ocx, (7) Mdt2dd.dll (as demonstrated using a heap corruption attack with uninitialized memory), (8) Mdt2qd.dll, (9) Mpg4ds32.ax, (10) Msadds32.ax, (11) Msb1esen.dll, (12) Msb1fren.dll, (13) Msb1geen.dll, (14) Msdtctm.dll, (15) Mshtml.dll, (16) Msoeacct.dll, (17) Msosvfbr.dll, (18) Mswcrun.dll, (19) Netshell.dll, (20) Ole2disp.dll, (21) Outllib.dll, (22) Psisdecd.dll, (23) Qdvd.dll, (24) Repodbc.dll, (25) Shdocvw.dll, (26) Shell32.dll, (27) Soa.dll, (28) Srchui.dll, (29) Stobject.dll, (30) Vdt70.dll, (31) Vmhelper.dll, and (32) Wbemads.dll, aka a variant of the "COM Object Instantiation Memory Corruption vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 9 Samba Buffer overflow in samba 2.2.2 through 2.2.6 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an encrypted password that causes the overflow during decryption in which a DOS codepage string is converted to a little-endian UCS2 unicode string. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System COM+ in Microsoft Windows does not properly "create and use memory structures," which allows local users or remote attackers to execute arbitrary code. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, as originally demonstrated using the (1) DDS Library Shape Control (Msdds.dll) COM object, and other objects including (2) Blnmgrps.dll, (3) Ciodm.dll, (4) Comsvcs.dll, (5) Danim.dll, (6) Htmlmarq.ocx, (7) Mdt2dd.dll (as demonstrated using a heap corruption attack with uninitialized memory), (8) Mdt2qd.dll, (9) Mpg4ds32.ax, (10) Msadds32.ax, (11) Msb1esen.dll, (12) Msb1fren.dll, (13) Msb1geen.dll, (14) Msdtctm.dll, (15) Mshtml.dll, (16) Msoeacct.dll, (17) Msosvfbr.dll, (18) Mswcrun.dll, (19) Netshell.dll, (20) Ole2disp.dll, (21) Outllib.dll, (22) Psisdecd.dll, (23) Qdvd.dll, (24) Repodbc.dll, (25) Shdocvw.dll, (26) Shell32.dll, (27) Soa.dll, (28) Srchui.dll, (29) Stobject.dll, (30) Vdt70.dll, (31) Vmhelper.dll, and (32) Wbemads.dll, aka a variant of the "COM Object Instantiation Memory Corruption vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Internet Explorer Microsoft Internet Explorer 6 SP1 on Windows 2000 SP4; 6 and 7 on Windows XP SP2, or Windows Server 2003 SP1 or SP2; and 7 on Windows Vista allows remote attackers to execute arbitrary code via certain property methods that may trigger memory corruption, aka "Property Memory Corruption Vulnerability." Sudhir Gandhe DRAFT INTERIM Robert L. Hollis Jeff Ito ACCEPTED ACCEPTED Microsoft Windows XP Operating System Heap-based buffer overflow in T2EMBED.DLL in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1, Windows 98, and Windows ME allows remote attackers to execute arbitrary code via an e-mail message or web page with a crafted Embedded Open Type (EOT) web font that triggers the overflow during decompression. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Operating System Unspecified vulnerability in xterm for HP-UX 11.00, 11.11, and 11.23 allows local users to gain privileges via unknown vectors. Robert L. Hollis DRAFT Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System The Windows Graphical Device Interface library (GDI32.DLL) in Microsoft Windows allows remote attackers to execute arbitrary code via a Windows Metafile (WMF) format image with a crafted SETABORTPROC GDI Escape function call, related to the Windows Picture and Fax Viewer (SHIMGVW.DLL), a different vulnerability than CVE-2005-2123 and CVE-2005-2124, and as originally discovered in the wild on unionseek.com. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT SMB (Server Message Block) Buffer overflow in the SMB capability for Microsoft Windows XP, 2000, and NT allows remote attackers to cause a denial of service and possibly execute arbitrary code via an SMB packet that specifies a smaller buffer length than is required. Christine Walzer DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED HP-UX 11 Samba Integer overflow in the Samba daemon (smbd) in Samba 2.x and 3.0.x through 3.0.9 allows remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via a Samba request with a large number of security descriptors that triggers a heap-based buffer overflow. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Multiple design errors in Microsoft Internet Explorer 5.01, 5.5, and 6 allow user-assisted attackers to execute arbitrary code by (1) overlaying a malicious new window above a file download box, then (2) using a keyboard shortcut and delaying the display of the file download box until the user hits a shortcut that activates the "Run" button, aka "File Download Dialog Box Manipulation Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Outlook Unspecified vulnerability in Microsoft Outlook 2000 through 2003, Exchange 5.0 Server SP2 and 5.5 SP4, Exchange 2000 SP3, and Office allows remote attackers to execute arbitrary code via an e-mail message with a crafted Transport Neutral Encapsulation Format (TNEF) MIME attachment, related to message length validation. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Certificate Validation Microsoft Windows 98 and Windows NT 4.0 do not properly verify the Basic Constraints of digital certificates, allowing remote attackers to execute code, aka "New Variant of Certificate Validation Flaw Could Enable Identity Spoofing" (CAN-2002-0862). Christine Walzer Christine Walzer Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, as originally demonstrated using the (1) DDS Library Shape Control (Msdds.dll) COM object, and other objects including (2) Blnmgrps.dll, (3) Ciodm.dll, (4) Comsvcs.dll, (5) Danim.dll, (6) Htmlmarq.ocx, (7) Mdt2dd.dll (as demonstrated using a heap corruption attack with uninitialized memory), (8) Mdt2qd.dll, (9) Mpg4ds32.ax, (10) Msadds32.ax, (11) Msb1esen.dll, (12) Msb1fren.dll, (13) Msb1geen.dll, (14) Msdtctm.dll, (15) Mshtml.dll, (16) Msoeacct.dll, (17) Msosvfbr.dll, (18) Mswcrun.dll, (19) Netshell.dll, (20) Ole2disp.dll, (21) Outllib.dll, (22) Psisdecd.dll, (23) Qdvd.dll, (24) Repodbc.dll, (25) Shdocvw.dll, (26) Shell32.dll, (27) Soa.dll, (28) Srchui.dll, (29) Stobject.dll, (30) Vdt70.dll, (31) Vmhelper.dll, and (32) Wbemads.dll, aka a variant of the "COM Object Instantiation Memory Corruption vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED HP-UX 11 Operating System Unspecified vulnerability in HP HP-UX B.11.00, B.11.04, and B.11.11 allows local users to gain privileges via unknown attack vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 MSDTC The MIDL_user_allocate function in the Microsoft Distributed Transaction Coordinator (MSDTC) proxy (MSDTCPRX.DLL) allocates a 4K page of memory regardless of the required size, which allows attackers to overwrite arbitrary memory locations using an incorrect size value that is provided to the NdrAllocate function, which writes management data to memory outside of the allocated buffer. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Buffer overflow in mshtml.dll in Microsoft Internet Explorer 6.0.2900.2180, and probably other versions, allows remote attackers to execute arbitrary code via an HTML tag with a large number of script action handlers such as onload and onmouseover, as demonstrated using onclick, aka the "Multiple Event Handler Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 The application Microsoft Visio 2003 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Multiple UNC Provider (MUP) Buffer overflow in Multiple UNC Provider (MUP) in Microsoft Windows operating systems allows local users to cause a denial of service or possibly gain SYSTEM privileges via a long UNC request. Tiffany Bergeron ACCEPTED Microsoft Windows XP Operating System Unspecified vulnerability in Windows Explorer in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via attack vectors involving COM objects and "crafted files and directories," aka the "Windows Shell Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via by instantiating the (1) Mdt2gddr.dll, (2) Mdt2dd.dll, and (3) Mdt2gddo.dll COM objects as ActiveX controls, which leads to memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Solaris Management Console The default configuration of the web server for the Solaris Management Console (SMC) in Solaris 8, 9, and 10 enables the HTTP TRACE method, which could allow remote attackers to obtain sensitive information such as cookies and authentication data from HTTP headers. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 10 Unspecified vulnerability in Sun Solaris 10 before 20070614, when IPv6 interfaces are present but not configured for IPsec, allows remote attackers to cause a denial of service (system crash) via certain network traffic. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox before 1.0.7 and Mozilla before Suite 1.7.12 allows remote attackers to execute Javascript with chrome privileges via an about: page such as about:mozilla. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Internet Explorer Unspecified vulnerability in Microsoft Internet Explorer 7 on Windows XP SP2, Windows Server 2003 SP1 or SP2, or Windows Vista allows remote attackers to execute arbitrary code via crafted HTML objects, which results in memory corruption, aka the first of two "HTML Objects Memory Corruption Vulnerabilities" and a different issue than CVE-2007-0947. Sudhir Gandhe DRAFT INTERIM Robert L. Hollis Jeff Ito ACCEPTED ACCEPTED Microsoft Windows 2000 Simple Network Management Protocol (SNMP) Vulnerabilities in a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via SNMPv1 trap handling, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor. This and other SNMP-related candidates will be updated when more accurate information is available. Harvey Rubinovitz Anna Min INTERIM ACCEPTED ACCEPTED HP-UX 11 ftpd The FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Sun Solaris 7 CDE Double-free vulnerability in dtlogin in CDE on Solaris, HP-UX, and other operating systems allows remote attackers to execute arbitrary code via a crafted XDMCP packet. Brian Soby Brian Soby DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Microsoft Internet Explorer 5.01, 5.5, and 6, when using an HTTPS proxy server that requires Basic Authentication, sends URLs in cleartext, which allows remote attackers to obtain sensitive information, aka "HTTPS Proxy Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows XP DirectX QUARTZ.DLL in Microsoft Windows Media Player 9 allows remote attackers to write a null byte to arbitrary memory via an AVI file with a crafted strn element with a modified length value. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System The Windows Graphical Device Interface library (GDI32.DLL) in Microsoft Windows allows remote attackers to execute arbitrary code via a Windows Metafile (WMF) format image with a crafted SETABORTPROC GDI Escape function call, related to the Windows Picture and Fax Viewer (SHIMGVW.DLL), a different vulnerability than CVE-2005-2123 and CVE-2005-2124, and as originally discovered in the wild on unionseek.com. Robert L. Hollis DRAFT Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System The Windows Graphical Device Interface library (GDI32.DLL) in Microsoft Windows allows remote attackers to execute arbitrary code via a Windows Metafile (WMF) format image with a crafted SETABORTPROC GDI Escape function call, related to the Windows Picture and Fax Viewer (SHIMGVW.DLL), a different vulnerability than CVE-2005-2123 and CVE-2005-2124, and as originally discovered in the wild on unionseek.com. Robert L. Hollis DRAFT INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01 through 6.0 does not properly perform security checks on certain encoded characters within a URL, which allows a remote attacker to steal potentially sensitive information from a user by redirecting the user to another site that has that information, aka "Encoded Characters Information Disclosure." Harvey Rubinovitz Christine Walzer INTERIM ACCEPTED ACCEPTED HP-UX 11 envd envd daemon in HP-UX B.11.00 through B.11.11 allows local users to obtain privileges via unknown attack vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Information Server (IIS) The WebDAV Message Handler for Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows remote attackers to cause a denial of service (memory and CPU exhaustion, application crash) via a PROPFIND request with an XML message containing XML elements with a large number of attributes. Jonathan Baker DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, aka a variant of the "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2127. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote attackers to cause a denial of service (hang) via an IGMP packet with an invalid IP option, aka the "IGMP v3 DoS Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 DirectX QUARTZ.DLL in Microsoft Windows Media Player 9 allows remote attackers to write a null byte to arbitrary memory via an AVI file with a crafted strn element with a modified length value. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Internet Explorer Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows user-assisted remote attackers to execute arbitrary code via a crafted web page that triggers memory corruption when it is saved as a multipart HTML (.mht) file. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System Buffer overflow in Collaboration Data Objects (CDO), as used in Microsoft Windows and Microsoft Exchange Server, allows remote attackers to execute arbitrary code when CDOSYS or CDOEX processes an e-mail message with a large header name, as demonstrated using the "Content-Type" string. Robert L. Hollis DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Windows kernel Buffer overflow in Windows Kernel allows local users to gain privileges by causing certain error messages to be passed to a debugger. Christine Walzer DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis DEPRECATED DEPRECATED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack. Robert L. Hollis DRAFT John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Word for Windows 6.0 Converter Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CVE-2004-0901. Christine Walzer DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED Microsoft Windows XP Operating System The FTP client in Windows XP SP1 and Server 2003, and Internet Explorer 6 SP1 on Windows 2000 SP4, when "Enable Folder View for FTP Sites" is enabled and the user manually initiates a file transfer, allows user-assisted, remote FTP servers to overwrite files in arbitrary locations via crafted filenames. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 4 mozilla Firefox before 1.0.5 and Mozilla before 1.7.9 allows a child frame to call top.focus and other methods in a parent frame, even when the parent is in a different domain, which violates the same origin policy and allows remote attackers to steal sensitive information such as cookies and passwords from web sites whose child frames do not verify that they are in the same domain as their parents. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Internet Explorer Heap-based buffer overflow in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via crafted UTF-8 encoded HTML that results in size discrepancies during conversion to Unicode, aka "HTML Decoding Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 TIP Distributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service hang) via a crafted Transaction Internet Protocol (TIP) message that causes DTC to repeatedly connect to a target IP and port number after an error occurs, aka the "Distributed TIP Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED HP-UX 11 Operating System /sbin/passwd in HP-UX B.11.00, B.11.11, and B.11.23 before 20060326 "does not recover gracefully from some error conditions," which allows local users to cause a denial of service. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Office Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via a BIFF parsing format file containing malformed BOOLERR records that lead to memory corruption, probably involving invalid pointers. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer HTML e-mail feature in Internet Explorer 5.5 and earlier allows attackers to execute attachments by setting an unusual MIME type for the attachment, which Internet Explorer does not process correctly. Tiffany Bergeron Andrew Buttner ACCEPTED Robert L. Hollis INTERIM Robert L. Hollis Robert L. Hollis Robert L. Hollis Robert L. Hollis Robert L. Hollis ACCEPTED ACCEPTED Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Solaris Management Console The (1) slsmgr and (2) slsadmin programs in Sun Solaris PC NetLink 2.0 create temporary files insecurely, which allows local users to gain privileges. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Operating System Unknown vulnerability in HP-UX B.11.00, B.11.04, B.11.11, B.11.22, and B.11.23, when running TCP/IP on IPv4, allows remote attackers to cause a denial of service via certain packets, related to the PMTU, a different vulnerability than CVE-2004-1060. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Buffer overflow in Collaboration Data Objects (CDO), as used in Microsoft Windows and Microsoft Exchange Server, allows remote attackers to execute arbitrary code when CDOSYS or CDOEX processes an e-mail message with a large header name, as demonstrated using the "Content-Type" string. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Print Spooler Service Buffer overflow in the Print Spooler service (Spoolsv.exe) for Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code via a malicious message. Matthew Burton DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Winamp Buffer overflow in Nullsoft Winamp 5.12 allows remote attackers to execute arbitrary code via a playlist (pls) file with a long file name (File1 field). Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Office Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed graphic, which leads to memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM John Hoyland ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Transaction Server (MTS) The default permissions for the MTS Package Administration registry key in Windows NT 4.0 allows local users to install or modify arbitrary Microsoft Transaction Server (MTS) packages and gain privileges, aka one of the "Registry Permissions" vulnerabilities. Matt Busby INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Xsun Buffer overflow in Xsun on Solaris 2.6 through 8 allows local users to gain root privileges via a long -co (color database) command line argument. David Proulx ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Internet Explorer Unspecified vulnerability in Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code via a crafted Cascading Style Sheets (CSS) tag that triggers memory corruption. Sudhir Gandhe DRAFT Robert L. Hollis Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Simple Network Management Protocol (SNMP) The default permissions for the SNMP Parameters registry key in Windows NT 4.0 allows remote attackers to read and possibly modify the SNMP community strings to obtain sensitive information or modify network configuration, aka one of the "Registry Permissions" vulnerabilities. Matt Busby INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Operating System The Graphics Rendering Engine in Microsoft Windows 2000 SP4 and XP SP2 allows local users to gain privileges via "invalid application window sizes" in layered application windows, aka the "GDI Invalid Window Size Elevation of Privilege Vulnerability." Sudhir Gandhe DRAFT INTERIM Robert L. Hollis ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 7 Sun Solaris 2.6 Directory traversal vulnerability in the vfs_getvfssw function in Solaris 2.6, 7, 8, and 9 allows local users to load arbitrary kernel modules via crafted (1) mount or (2) sysfs system calls. NOTE: this might be the same issue as CVE-2004-1767, but there are insufficient details to be sure. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 7 The operating system installed on the system is Sun Solaris 7 for SPARC. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 7 The operating system installed on the system is Sun Solaris 7 for x86. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 2.6 The operating system installed on the system is Sun Solaris 2.6 for x86. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 GtkHTML GtkHTML, as included in Evolution before 1.2.4, allows remote attackers to cause a denial of service (crash) via certain malformed messages. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 The TCP implementation in Sun Solaris 8, 9, and 10 before 20060726 allows remote attackers to cause a denial of service (resource exhaustion) via a TCP packet with an incorrect sequence number, which triggers an ACK storm. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED The operating system installed on the system is Red Hat Enterprise Linux 5. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 10 The Loopback Filesystem (LOFS) in Sun Solaris 10 allows local users in a non-global zone to move and rename files in a read-only filesystem, which could lead to a denial of service. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Exchange Server Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remote attackers to execute arbitrary scripts, spoof content, or obtain sensitive information via certain UTF-encoded, script-based e-mail attachments, involving an "incorrectly handled UTF character set label". Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Exchange Server 2003 SP2 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Exchange Server 2000SP3 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Exchange Server 2003 SP1 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows Vista Exchange Server 2007 (no Service Pack) is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Internet Information Server (IIS) Buffer overflow in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers and cause a denial of service or execute arbitrary code via HTTP header field values. Tiffany Bergeron ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Visio 2002 Microsoft Office 2003 Multiple unspecified vulnerabilities in Microsoft Visio 2002 allow remote user-assisted attackers to execute arbitrary code via a Visio (.VSD, VSS, .VST) file with a crafted packed object that triggers memory corruption, aka "Visio Document Packaging Vulnerability." Sudhir Gandhe DRAFT Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 The application Microsoft Visio 2002 SP2 is installed. Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 The application Microsoft Office 2003 is installed. Robert L. Hollis INTERIM ACCEPTED Jonathan Baker INTERIM Ken Lassesen ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Server 10 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED Nicholas Hansen INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10:server Microsoft Windows Server 2003 Server is a Server 2003 Member Server Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows Server 2003 Server is a Domain Controller Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 A version of Microsoft Windows Server 2003 (32-bit) is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Desktop 1.0 is installed. Thomas R. Jones DRAFT Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Office SharePoint Services 2003 are installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 2.6 The operating system installed on the system is Sun Solaris 2.6 for SPARC. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Virtual Machine (VM) The ByteCode Verifier component of Microsoft Virtual Machine (VM) build 5.0.3809 and earlier, as used in Windows and Internet Explorer, allows remote attackers to bypass security checks and execute arbitrary code via a malicious Java applet, aka "Flaw in Microsoft VM Could Enable System Compromise." Tiffany Bergeron INTERIM ACCEPTED ACCEPTED Microsoft Windows XP The operating system installed on the system is Microsoft Windows XP (32-bit). Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Windows Media Player Unspecified vulnerability in Microsoft Windows Media Player 7.1, 9, 10, and 11 allows remote attackers to execute arbitrary code via a skin file (WMZ or WMD) with crafted header information that is not properly handled during decompression, aka "Windows Media Player Code Execution Vulnerability Decompressing Skins." Robert L. Hollis DRAFT Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows Vista The operating system installed on the system is Microsoft Windows Vista Dragos Prisaca DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Windows Server 2003 Media Player Windows Media Player v10.0 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Media Player Windows Media Player v9.0 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Media Player Windows Media Player v11.0 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Media Player Windows Media Player v7.1 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 GnuPG The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 HTML Help ActiveX Control Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to execute arbitrary code by using the "Related Topics" command in the Help ActiveX Control (hhctrl.ocx) to open a Help popup window containing the PCHealth tools.htm file in the local zone and injecting Javascript to be executed, as demonstrated using "writehta.txt" and the ADODB recordset, which saves a .HTA file to the local system, aka the "HTML Help ActiveX control Cross Domain Vulnerability." Matthew Burton DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 mozilla Firefox before 1.0.5, Thunderbird before 1.0.5, Mozilla before 1.7.9, Netscape 8.0.2, and K-Meleon 0.9 runs XBL scripts even when Javascript has been disabled, which makes it easier for remote attackers to bypass such protection. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 FreeRADIUS FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (server crash) by sending an Ascend-Send-Secret attribute without the required leading packet. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache Off-by-one error in the mod_ssl Certificate Revocation List (CRL) verification callback in Apache, when configured to use a CRL, allows remote attackers to cause a denial of service (child process crash) via a CRL that causes a buffer overflow of one null byte. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 SecureShell sshd in OpenSSH before 4.2, when GSSAPIDelegateCredentials is enabled, allows GSSAPI credentials to be delegated to clients who log in using non-GSSAPI methods, which could cause those credentials to be exposed to untrusted users or hosts. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Internet Explorer Stack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0, allows local or remote attackers to execute arbitrary code via a .job file containing long parameters, as demonstrated using Internet Explorer and accessing a .job file on an anonymous share. Tiffany Bergeron INTERIM ACCEPTED Andrew Buttner Christine Walzer INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Unspecified vulnerability in the authentication mechanism in Solaris Management Console (SMC) on Sun Solaris 8 through 10 before 20070605 allows remote authenticated users to execute arbitrary code via unspecified vectors, related to the WBEM server. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Multiple design errors in Microsoft Internet Explorer 5.01, 5.5, and 6 allow user-assisted attackers to execute arbitrary code by (1) overlaying a malicious new window above a file download box, then (2) using a keyboard shortcut and delaying the display of the file download box until the user hits a shortcut that activates the "Run" button, aka "File Download Dialog Box Manipulation Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Windows Script Engine for Jscript Integer overflow in JsArrayFunctionHeapSort function used by Windows Script Engine for JScript (JScript.dll) on various Windows operating system allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail that uses a large array index value that enables a heap-based buffer overflow attack. DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Matthew Wojcik INTERIM Anna Min ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Multiple integer overflows in Mozilla Firefox 1.5, Thunderbird 1.5 if Javascript is enabled in mail, and SeaMonkey before 1.0 might allow remote attackers to execute arbitrary code via the (1) EscapeAttributeValue in jsxml.c for E4X, (2) nsSVGCairoSurface::Init in SVG, and (3) nsCanvasRenderingContext2D.cpp in Canvas. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 TIP Distributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service exception and exit) via an "unexpected protocol command during the reconnection request," which is not properly handled by the Transaction Internet Protocol (TIP) functionality. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, including (1) devenum.dll, (2) diactfrm.dll, (3) wmm2filt.dll, (4) fsusd.dll, (5) dmdskmgr.dll, (6) browsewm.dll, (7) browseui.dll, (8) shell32.dll, (9) mshtml.dll, (10) inetcfg.dll, (11) infosoft.dll, (12) query.dll, (13) syncui.dll, (14) clbcatex.dll, (15) clbcatq.dll, (16) comsvcs.dll, and (17) msconf.dll, which causes memory corruption, aka "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2087. Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Microsoft Internet Explorer 5.01 through 6 allows remote attackers to conduct phishing attacks by spoofing the address bar and other parts of the trust UI via unknown methods that allow "window content to persist" after the user has navigated to another site, aka the "Address Bar Spoofing Vulnerability." NOTE: this is a different vulnerability than CVE-2006-1626. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Unknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to execute arbitrary code via a web site or an HTML e-mail containing a crafted JPEG image that causes memory corruption, aka "JPEG Image Rendering Memory Corruption Vulnerability". Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability." Harvey Rubinovitz DRAFT INTERIM Harvey Rubinovitz Harvey Rubinovitz Harvey Rubinovitz ACCEPTED Robert L. Hollis ACCEPTED Robert L. Hollis INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED HP-UX 11 ftpd The wu_fnmatch function in wu_fnmatch.c in wu-ftpd 2.6.1 and 2.6.2 allows remote attackers to cause a denial of service (CPU exhaustion by recursion) via a glob pattern with a large number of * (wildcard) characters, as demonstrated using the dir command. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Certificate Validation The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS. Christine Walzer Christine Walzer Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Office 2000 SP3 Stack-based buffer overflow in Microsoft Word 2000 and Word 2002, and Microsoft Works Suites 2000 through 2004, might allow remote attackers to execute arbitrary code via a .doc file with long font information. Christine Walzer DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Information Server (IIS) The WebDAV Message Handler for Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows remote attackers to cause a denial of service (memory and CPU exhaustion, application crash) via a PROPFIND request with an XML message containing XML elements with a large number of attributes. Jonathan Baker DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 GNU Ghostscript Unknown vulnerability in GNU Ghostscript before 7.07 allows attackers to execute arbitrary commands, even when -dSAFER is enabled, via a PostScript file that causes the commands to be executed from a malicious print job. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Windows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to execute arbitrary commands via a shortcut (.lnk) file with long font properties that lead to a buffer overflow in the Client/Server Runtime Server Subsystem (CSRSS), a different vulnerability than CVE-2005-2118. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Stack-based buffer overflow in the Plug and Play (PnP) service (UMPNPMGR.DLL) in Microsoft Windows 2000 SP4, and XP SP1 and SP2, allows remote or local authenticated attackers to execute arbitrary code via a large number of "\" (backslash) characters in a registry key name, which triggers the overflow in a wsprintfW function call. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Office Stack-based buffer overflow in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed record with a modified length value, which leads to memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM John Hoyland ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Internet Explorer Internet Explorer 5.01 SP4 up to 6 on various Windows operating systems, including IE 6.0.2900.2180 on Windows XP, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, as demonstrated using the JVIEW Profiler (Javaprxy.dll). NOTE: the researcher says that the vendor could not reproduce this problem. Harvey Rubinovitz DRAFT Jonathan Baker INTERIM ACCEPTED Robert L. Hollis ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP TIP Distributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service hang) via a crafted Transaction Internet Protocol (TIP) message that causes DTC to repeatedly connect to a target IP and port number after an error occurs, aka the "Distributed TIP Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Integer overflow in the FontFileInitTable function in X.Org libXfont before 20070403 allows remote authenticated users to execute arbitrary code via a long first line in the fonts.dir file, which results in a heap overflow. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 The operating system installed on the system is Sun Solaris 8 for x86. Jonathan Baker DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 The operating system installed on the system is Sun Solaris 8 for SPARC. Jonathan Baker DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 MDAC Unspecified vulnerability in the RDS.Dataspace ActiveX control, which is contained in ActiveX Data Objects (ADO) and distributed in Microsoft Data Access Components (MDAC) 2.7 and 2.8, allows remote attackers to execute arbitrary code via unknown attack vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Windows kernel The Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability." Christine Walzer DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Internet Information Server (IIS) Buffer overflow in ASP Server-Side Include Function in IIS 4.0, 5.0 and 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via long file names. Tiffany Bergeron ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Unknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to obtain information and possibly execute code when browsing from a web site to a web folder view using WebDAV, aka "Web Folder Behaviors Cross-Domain Vulnerability". Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Internet Explorer Microsoft Internet Explorer 5.01, 5.5, and 6, when using an HTTPS proxy server that requires Basic Authentication, sends URLs in cleartext, which allows remote attackers to obtain sensitive information, aka "HTTPS Proxy Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Outlook Unspecified vulnerability in Microsoft Outlook 2000 through 2003, Exchange 5.0 Server SP2 and 5.5 SP4, Exchange 2000 SP3, and Office allows remote attackers to execute arbitrary code via an e-mail message with a crafted Transport Neutral Encapsulation Format (TNEF) MIME attachment, related to message length validation. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Exchange Server Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2000 SP1 through SP3, when running Outlook Web Access (OWA), allows user-assisted remote attackers to inject arbitrary HTML or web script via unknown vectors related to "HTML parsing." Robert L. Hollis DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 4 mozilla Firefox before 1.0.5 and Mozilla before 1.7.9 does not clearly associate a Javascript dialog box with the web page that generated it, which allows remote attackers to spoof a dialog box from a trusted site and facilitates phishing attacks, aka the "Dialog Origin Spoofing Vulnerability." Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 4 The InstallTrigger.install method in Firefox before 1.0.5 and Mozilla before 1.7.9 allows remote attackers to execute a callback function in the context of another domain by forcing a page navigation after the install method has been called, which causes the callback to be run in the context of the new page and results in a same origin violation. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote attackers to cause a denial of service (hang) via an IGMP packet with an invalid IP option, aka the "IGMP v3 DoS Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Sun Solaris 7 xlock Heap overflow in xlock in Solaris 2.6 through 8 allows local users to gain root privileges via a long (1) XFILESEARCHPATH or (2) XUSERFILESEARCHPATH environmental variable. David Proulx ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded, which are decoded twice to generate a malicious hostname, aka the "URL Decoding Zone Spoofing Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Integer overflow in the JavaScript engine in Firefox before 1.0.7 and Mozilla Suite before 1.7.12 might allow remote attackers to execute arbitrary code. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows XP Windows Media Player 9 Windows Media Player 9 allows remote attackers to execute arbitrary code via a PNG file containing large (1) width or (2) height values, aka the "PNG Processing Vulnerability." Christine Walzer DRAFT Christine Walzer INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Windows Animated Cursor The Windows Animated Cursor (ANI) capability in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allow remote attackers to cause a denial of service via (1) the frame number set to zero, which causes an invalid memory address to be used and leads to a kernel crash, or (2) the rate number set to zero, which leads to resource exhaustion and hang. Christine Walzer DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Microsoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Javascript BODY onload event that calls the window function, aka "Mismatched Document Object Model Objects Memory Corruption Vulnerability." Robert L. Hollis DRAFT Robert L. Hollis INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Information Server (IIS) Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server (IIS) 4.0 and 5.0 allows attackers to cause a denial of service or execute arbitrary code via HTR requests with long variable names. Tiffany Bergeron ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Operating System Heap-based buffer overflow in HTML Help ActiveX control (hhctrl.ocx) in Microsoft Internet Explorer 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code by repeatedly setting the Image field of an Internet.HHCtrl.1 object to certain values, possibly related to improper escaping and long strings. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Microsoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Javascript BODY onload event that calls the window function, aka "Mismatched Document Object Model Objects Memory Corruption Vulnerability." Robert L. Hollis DRAFT Robert L. Hollis INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Telephony Service Buffer overflow in the Telephony Application Programming Interface (TAPI) for Microsoft Windows 98, Windows 98 SE, Windows ME, Windows 2000, Windows XP, and Windows Server 2003 allows attackers elevate privileges or execute arbitrary code via a crafted message. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via HTML elements with a certain crafted tag, which leads to memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0, 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to cause a denial of service (crash) via a BuildContextW request with a large (1) UuidString or (2) GuidIn of a certain length, which causes an out-of-range memory access, aka the MSDTC Denial of Service Vulnerability. NOTE: this is a variant of CVE-2005-2119. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Heap-based buffer overflow in Internet Explorer 6 allows remote attackers to execute arbitrary code via long (1) SRC or (2) NAME attributes in IFRAME, FRAME, and EMBED elements, as originally discovered using the mangleme utility, aka "the IFRAME vulnerability" or the "HTML Elements Vulnerability." Ingrid Skoog DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Robert L. Hollis INTERIM Robert L. Hollis ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System Web View in Windows Explorer on Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 does not properly handle certain HTML characters in preview fields, which allows remote user-assisted attackers to execute arbitrary code. Robert L. Hollis DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via HTML elements with a certain crafted tag, which leads to memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 GDM The X Display Manager Control Protocol (XDMCP) support for GDM before 2.4.1.6 allows attackers to cause a denial of service (daemon crash) via a short authorization key name. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System netman.dll in Microsoft Windows Connections Manager Library allows local users to cause a denial of service (Network Connections Service crash) via a large integer argument to a particular function, aka "Network Connection Manager Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Windows 2000 Windows Server 2003 and XP SP2, with Windows Firewall turned off, allows remote attackers to cause a denial of service (CPU consumption) via a TCP packet with the SYN flag set and the same destination and source address and port, aka a reoccurrence of the "Land" vulnerability (CVE-1999-0016). Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED HP-UX 11 mozilla Buffer overflow in the International Domain Name (IDN) support in Mozilla Firefox 1.0.6 and earlier, and Netscape 8.0.3.3 and 7.2, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a hostname with all "soft" hyphens (character 0xAD), which is not properly handled by the NormalizeIDN call in nsStandardURL::BuildNormalizedSpec. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System The FTP client in Windows XP SP1 and Server 2003, and Internet Explorer 6 SP1 on Windows 2000 SP4, when "Enable Folder View for FTP Sites" is enabled and the user manually initiates a file transfer, allows user-assisted, remote FTP servers to overwrite files in arbitrary locations via crafted filenames. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP TIP Distributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service exception and exit) via an "unexpected protocol command during the reconnection request," which is not properly handled by the Transaction Internet Protocol (TIP) functionality. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 mozilla The InstallTrigger.install method in Firefox before 1.0.5 and Mozilla before 1.7.9 allows remote attackers to execute a callback function in the context of another domain by forcing a page navigation after the install method has been called, which causes the callback to be run in the context of the new page and results in a same origin violation. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Color Management Module Buffer overflow in the Microsoft Color Management Module for Windows allows remote attackers to execute arbitrary code via an image with crafted ICC profile format tags. Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 Program Group Converter Buffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 ftpd The FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Unspecified vulnerability in the (1) Windows Services for UNIX 3.0 and 3.5, and (2) Subsystem for UNIX-based Applications in Microsoft Windows 2000, XP, Server 2003, and Vista allows local users to gain privileges via unspecified vectors related to "certain setuid binary files." Sudhir Gandhe Sudhir Gandhe DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Vista The operating system installed on the system is Microsoft Windows Vista (32-bit) Jonathan Baker DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sadmin The default installation of sadmind on Solaris uses weak authentication (AUTH_SYS), which allows local and remote attackers to spoof Solstice AdminSuite clients and gain root privileges via a certain sequence of RPC packets. Brian Soby Brian Soby DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Todd Dolinsky INTERIM Todd Dolinsky ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to spoof DOM objects via an XBL control that implements an internal XPCOM interface. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows Server 2003 Windows kernel Buffer overflow in Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to cause a denial of service (i.e., system crash) via a malformed request, aka "Object Management Vulnerability". Ingrid Skoog DRAFT INTERIM Christine Walzer ACCEPTED ACCEPTED Microsoft Windows 2000 Remote Procedure Call (RPC) Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed RPC request with a long filename parameter, a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0715. Tiffany Bergeron ACCEPTED ACCEPTED Microsoft Windows XP Operating System COM+ in Microsoft Windows does not properly "create and use memory structures," which allows local users or remote attackers to execute arbitrary code. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 mozilla Firefox before 1.0.5 and Mozilla before 1.7.9 does not clearly associate a Javascript dialog box with the web page that generated it, which allows remote attackers to spoof a dialog box from a trusted site and facilitates phishing attacks, aka the "Dialog Origin Spoofing Vulnerability." Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 DirectX QUARTZ.DLL in Microsoft Windows Media Player 9 allows remote attackers to write a null byte to arbitrary memory via an AVI file with a crafted strn element with a modified length value. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla A regression fix in Mozilla Firefox 1.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the InstallTrigger.install method, which leads to memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED HP-UX 11 ftpd The wu_fnmatch function in wu_fnmatch.c in wu-ftpd 2.6.1 and 2.6.2 allows remote attackers to cause a denial of service (CPU exhaustion by recursion) via a glob pattern with a large number of * (wildcard) characters, as demonstrated using the dir command. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Windows kernel Buffer overflow in Windows Kernel allows local users to gain privileges by causing certain error messages to be passed to a debugger. Christine Walzer DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Windows Server 2003 Operating System Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allow remote attackers to execute arbitrary code via crafted Windows Metafile (WMF) and Enhanced Metafile (EMF) format images that lead to heap-based buffer overflows, as demonstrated using MRBP16::bCheckRecord. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED HP-UX 11 SecureShell zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System COM+ in Microsoft Windows does not properly "create and use memory structures," which allows local users or remote attackers to execute arbitrary code. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 libgd Integer overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary code via PNG image files with large image rows values that lead to a heap-based buffer overflow in the gdImageCreateFromPngCtx function, a different set of vulnerabilities than CVE-2004-0941. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Microsoft Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model to run malicious script or arbitrary programs via dialog boxes, aka "Improper Cross Domain Security Validation with dialog box." Andrew Buttner Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Virtual Server 2005 Microsoft Virtual PC 2004 Heap-based buffer overflow in Microsoft Virtual PC 2004 and PC for Mac 7.1 and 7, and Virtual Server 2005 and 2005 R2, allows local guest OS administrators to execute arbitrary code on the host OS via unspecified vectors related to "interaction and initialization of components." Sudhir Gandhe DRAFT Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 The application Microsoft Virtual Server 2005 R2 Enterprise is installed. Sudhir Gandhe DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 The application Microsoft Virtual Server 2005 Enterprise is installed. Sudhir Gandhe DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 The application Microsoft Virtual Server 2005 R2 Standard is installed. Sudhir Gandhe DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 The application Microsoft Virtual PC 2004 Service Pack 1 is installed. Sudhir Gandhe DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 The application Microsoft Virtual Server 2005 Standard is installed. Sudhir Gandhe DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 The application Microsoft Virtual PC 2004 is installed. Sudhir Gandhe DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 mozilla Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 does not properly verify the associated types of DOM node names within the context of their namespaces, which allows remote attackers to modify certain tag properties, possibly leading to execution of arbitrary script or code, as demonstrated using an XHTML document with IMG tags with custom properties ("XHTML node spoofing"). Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Windows Media Player Heap-based buffer overflow in the bitmap processing routine in Microsoft Windows Media Player 7.1 on Windows 2000 SP4, Media Player 9 on Windows 2000 SP4 and XP SP1, and Media Player 10 on XP SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted bitmap (.BMP) file that specifies a size of 0 but contains additional data. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Web Client Service Buffer overflow in the Web Client service in Microsoft Windows XP and Windows Server 2003 allows remote authenticated users to execute arbitrary code via a crafted WebDAV request containing special parameters. Matthew Burton DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System netman.dll in Microsoft Windows Connections Manager Library allows local users to cause a denial of service (Network Connections Service crash) via a large integer argument to a particular function, aka "Network Connection Manager Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 TIP Distributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service hang) via a crafted Transaction Internet Protocol (TIP) message that causes DTC to repeatedly connect to a target IP and port number after an error occurs, aka the "Distributed TIP Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 10 Format string vulnerability in libwebconsole_services.so in Sun Java Web Console 2.2.2 through 2.2.5 allows remote attackers to cause a denial of service (application crash), obtain sensitive information, and possibly execute arbitrary code via unspecified vectors during a failed login attempt, related to syslog. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Microsoft Internet Explorer 5.01 through 6 does not always correctly identify the domain that is associated with a browser window, which allows remote attackers to obtain sensitive cross-domain information and spoof sites by running script after the user has navigated to another site. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System netman.dll in Microsoft Windows Connections Manager Library allows local users to cause a denial of service (Network Connections Service crash) via a large integer argument to a particular function, aka "Network Connection Manager Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 The HTML Help ActiveX control (Hhctrl.ocx) in Microsoft Windows 2000 SP3, XP SP2 and Professional, 2003 SP1 allows remote attackers to execute arbitrary code via unspecified functions, related to uninitialized parameters. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 10 Unspecified vulnerability in Sun Solaris 10 before 20070130 allows remote attackers to cause a denial of service (system crash) via certain ICMP packets. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Visual Basic 6.0 Object linking and embedding (OLE) Automation, as used in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Office 2004 for Mac, and Visual Basic 6.0 allows remote attackers to execute arbitrary code via the substringData method on a TextNode object, which causes an integer overflow that leads to a buffer overflow. Sudhir Gandhe DRAFT Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 A version of Microsoft Windows Server 2003 SP2 (x64) is installed. Sudhir Gandhe DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 A version of Microsoft Windows Server 2003 (ia64) Service Pack 2 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to execute arbitrary code by using the Object.watch method to access the "clone parent" internal function. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED HP-UX 11 Apache The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Range field. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 gedit Format string vulnerability in gedit 2.10.2 may allow attackers to cause a denial of service (application crash) via a bin file with format string specifiers in the filename. NOTE: while this issue is triggered on the command line by the gedit user, it has been reported that web browsers and email clients could be configured to provide a file name as an argument to gedit, so there is a valid attack that crosses security boundaries. Jay Beale DRAFT INTERIM ACCEPTED Bob Towbes INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System Stack-based buffer overflow in the Plug and Play (PnP) service (UMPNPMGR.DLL) in Microsoft Windows 2000 SP4, and XP SP1 and SP2, allows remote or local authenticated attackers to execute arbitrary code via a large number of "\" (backslash) characters in a registry key name, which triggers the overflow in a wsprintfW function call. Robert L. Hollis DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 sudo Race condition in sudo 1.3.1 up to 1.6.8p8, when the ALL pseudo-command is used after a user entry in the sudoers file, allows local users to gain privileges via a symlink attack. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED It appears that we can't parse the vulnerable configuration condition (an ALL in the second field of a line after a line that has no ALL in the second field) with our existing regexp. Microsoft Windows 2000 Microsoft Word for Windows 6.0 Converter Microsoft Word for Windows 6.0 Converter (MSWRD632.WPC), as used in WordPad, does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CVE-2004-0571. Christine Walzer DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System The GetEnhMetaFilePaletteEntries API in GDI32.DLL in Windows 2000 allows remote attackers to cause a denial of service (application crash) via a crafted Enhanced Metafile (EMF) file that causes invalid (1) end, (2) emreof, or (3) palent offsets to be used, aka "Enhanced Metafile Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Sun Solaris 7 cachefsd Heap-based buffer overflow in cfsd_calloc function of Solaris cachefsd allows remote attackers to execute arbitrary code via a request with a long directory and cache name. David Proulx Brian Soby INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Buffer overflow in the PNG image rendering component of Microsoft Internet Explorer allows remote attackers to execute arbitrary code via a crafted PNG file. Harvey Rubinovitz DRAFT INTERIM ACCEPTED Anna Min INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED HP-UX 11 Apache The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling." Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows 95 Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Word 2003 Buffer overflow in Microsoft Word 2000, Word 2002, and Word 2003 allows remote attackers to execute arbitrary code via a crafted document. Matthew Burton DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED Chris Wood INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, including (1) devenum.dll, (2) diactfrm.dll, (3) wmm2filt.dll, (4) fsusd.dll, (5) dmdskmgr.dll, (6) browsewm.dll, (7) browseui.dll, (8) shell32.dll, (9) mshtml.dll, (10) inetcfg.dll, (11) infosoft.dll, (12) query.dll, (13) syncui.dll, (14) clbcatex.dll, (15) clbcatq.dll, (16) comsvcs.dll, and (17) msconf.dll, which causes memory corruption, aka "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2087. Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 Package mono-core-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 Microsoft Windows XP DirectX QUARTZ.DLL in Microsoft Windows Media Player 9 allows remote attackers to write a null byte to arbitrary memory via an AVI file with a crafted strn element with a modified length value. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Media Player Stack-based buffer overflow in Microsoft Windows Media Player 9 and 10 allows remote attackers to execute arbitrary code via a PNG image with a large chunk size. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Windows 2000 Internet Explorer 5.01 through 6.0 does not properly handle object tags returned from a Web server during XML data binding, which allows remote attackers to execute arbitrary code via an HTML e-mail message or web page. Tiffany Bergeron Tiffany Bergeron ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows Server 2003 Operating System Stack-based buffer overflow in the RPC interface in the Domain Name System (DNS) Server Service in Microsoft Windows 2000 Server SP 4, Server 2003 SP 1, and Server 2003 SP 2 allows remote attackers to execute arbitrary code via a long zone name containing character constants represented by escape sequences. Sudhir Gandhe DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 The operating system installed on the system is Microsoft Windows Server 2003. Andrew Buttner ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Sun Solaris 8 mozilla Mozilla allows remote attackers to cause Mozilla to open a URI as a different MIME type than expected via a null character (%00) in an FTP URI. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 4 mozilla The browser user interface in Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 does not properly distinguish between user-generated events and untrusted synthetic events, which makes it easier for remote attackers to perform dangerous actions that normally could only be performed manually by the user. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Linux kernel The shmctl function in Linux 2.6.9 and earlier allows local users to unlock the memory of other processes, which could cause sensitive memory to be swapped to disk, which could allow it to be read by other users once it has been released. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Interactive Training Buffer overflow in Microsoft Step-by-Step Interactive Training (orun32.exe) allows remote attackers to execute arbitrary code via a bookmark link file (.cbo, cbl, or .cbm extension) with a long User field. Ingrid Skoog DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System Heap-based buffer overflow in the CRpcIoManagerServer::BuildContext function in msdtcprx.dll for Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0 and Windows 2000 SP2 and SP3 allows remote attackers to execute arbitrary code via a long fifth argument to the BuildContextW or BuildContext opcode, which triggers a bug in the NdrAllocate function, aka the MSDTC Invalid Memory Access Vulnerability. Robert L. Hollis DRAFT INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, including (1) devenum.dll, (2) diactfrm.dll, (3) wmm2filt.dll, (4) fsusd.dll, (5) dmdskmgr.dll, (6) browsewm.dll, (7) browseui.dll, (8) shell32.dll, (9) mshtml.dll, (10) inetcfg.dll, (11) infosoft.dll, (12) query.dll, (13) syncui.dll, (14) clbcatex.dll, (15) clbcatq.dll, (16) comsvcs.dll, and (17) msconf.dll, which causes memory corruption, aka "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2087. Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System Buffer overflow in the Web Client service (WebClnt.dll) for Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote authenticated users or Guests to execute arbitrary code via crafted RPC requests, a different vulnerability than CVE-2005-1207. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Outlook Microsoft Outlook 2000, 2002, and 2003 allows user-assisted remote attackers to cause a denial of service (memory exhaustion and interrupted mail recovery) via malformed e-mail header information, possibly related to (1) long subject lines or (2) large numbers of recipients in To or CC headers. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Unknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to execute arbitrary code via a web site or an HTML e-mail containing a crafted JPEG image that causes memory corruption, aka "JPEG Image Rendering Memory Corruption Vulnerability". Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Windows Server 2003 Operating System The GetEnhMetaFilePaletteEntries API in GDI32.DLL in Windows 2000 allows remote attackers to cause a denial of service (application crash) via a crafted Enhanced Metafile (EMF) file that causes invalid (1) end, (2) emreof, or (3) palent offsets to be used, aka "Enhanced Metafile Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Telephony Service Buffer overflow in the Telephony Application Programming Interface (TAPI) for Microsoft Windows 98, Windows 98 SE, Windows ME, Windows 2000, Windows XP, and Windows Server 2003 allows attackers elevate privileges or execute arbitrary code via a crafted message. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 ftpd The FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Office 2007 The application Microsoft Office 2007 is installed. Jonathan Baker DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows XP NetWare The Client Service for NetWare (CSNW) on Microsoft Windows 2000 SP4, XP SP1 and Sp2, and Server 2003 SP1 and earlier, allows remote attackers to execute arbitrary code due to an "unchecked buffer" when processing certain crafted network messages. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 SQL Server 2000 Buffer overflows in extended stored procedures for Microsoft SQL Server 7.0 and 2000 allow remote attackers to cause a denial of service or execute arbitrary code via a database query with certain long arguments. Yi-Fang Koh Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Multiple design errors in Microsoft Internet Explorer 5.01, 5.5, and 6 allow user-assisted attackers to execute arbitrary code by (1) overlaying a malicious new window above a file download box, then (2) using a keyboard shortcut and delaying the display of the file download box until the user hits a shortcut that activates the "Run" button, aka "File Download Dialog Box Manipulation Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer The legacy <script> data-island capability for XML in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to read arbitrary XML files, and portions of other files, via a URL whose "src" attribute redirects to a local file. Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 A version of Microsoft Windows Server 2003 (ia64) Service Pack 1 is installed. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP MDAC Unspecified vulnerability in the RDS.Dataspace ActiveX control, which is contained in ActiveX Data Objects (ADO) and distributed in Microsoft Data Access Components (MDAC) 2.7 and 2.8, allows remote attackers to execute arbitrary code via unknown attack vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP TIP Distributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service hang) via a crafted Transaction Internet Protocol (TIP) message that causes DTC to repeatedly connect to a target IP and port number after an error occurs, aka the "Distributed TIP Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Distributed Component Object Model (DCOM) Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed DCERPC DCOM object activation request packet with modified length fields, a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0528. Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System Buffer overflow in Collaboration Data Objects (CDO), as used in Microsoft Windows and Microsoft Exchange Server, allows remote attackers to execute arbitrary code when CDOSYS or CDOEX processes an e-mail message with a large header name, as demonstrated using the "Content-Type" string. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 7 kcms_server Directory traversal vulnerability in Sun Kodak Color Management System (KCMS) library service daemon (kcms_server) allows remote attackers to read arbitrary files via the KCS_OPEN_PROFILE procedure. David Proulx Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.5 and 6.0 allows remote attackers to bypass restrictions for executing scripts via an object that processes asynchronous events after the initial security checks have been made. David Proulx ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to spawn windows without user interface components such as the address and status bar, which could be used to conduct spoofing or phishing attacks. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer Buffer overflow in the URL processor of Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL with a long hostname, aka "URL Parsing Memory Corruption Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 libgd Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and earlier may allow remote attackers to execute arbitrary code via malformed image files that trigger the overflows due to improper calls to the gdMalloc function, a different set of vulnerabilities than CVE-2004-0990. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Agent Microsoft Agent allows remote attackers to spoof trusted Internet content and execute arbitrary code by disguising security prompts on a malicious Web page. Harvey Rubinovitz DRAFT Harvey Rubinovitz INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Sun Solaris 9 Sun Solaris 10 sshd in OpenSSH before 4.4, when using the version 1 SSH protocol, allows remote attackers to cause a denial of service (CPU consumption) via an SSH packet that contains duplicate blocks, which is not properly handled by the CRC compensation attack detector. Yuzheng Zhou DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System Windows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote user-assisted attackers to execute arbitrary commands via a crafted shortcut (.lnk) file with long font properties that lead to a buffer overflow when the user views the file's properties using Windows Explorer, a different vulnerability than CVE-2005-2122. Robert L. Hollis DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System Unspecified vulnerability in Windows Explorer in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via attack vectors involving COM objects and "crafted files and directories," aka the "Windows Shell Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Office XPSP3 Stack-based buffer overflow in Microsoft Word 2000 and Word 2002, and Microsoft Works Suites 2000 through 2004, might allow remote attackers to execute arbitrary code via a .doc file with long font information. Christine Walzer DRAFT INTERIM Jonathan Baker ACCEPTED Robert L. Hollis INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows remote attackers to execute arbitrary code via malformed IMDATA records that trigger memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via "an invalid and non-sensical ordering of table-related tags" that results in a negative array index. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows XP HTML Help Facility Internet Explorer 5.x and 6.0 allows remote attackers to execute arbitrary programs via a modified directory traversal attack using a URL containing ".." (dot dot) sequences and a filename that ends in "::" which is treated as a .chm file even if it does not have a .chm extension. NOTE: this bug may overlap CVE-2004-0475. Andrew Buttner Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System Heap-based buffer overflow in T2EMBED.DLL in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1, Windows 98, and Windows ME allows remote attackers to execute arbitrary code via an e-mail message or web page with a crafted Embedded Open Type (EOT) web font that triggers the overflow during decompression. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP TIP Distributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service hang) via a crafted Transaction Internet Protocol (TIP) message that causes DTC to repeatedly connect to a target IP and port number after an error occurs, aka the "Distributed TIP Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Windows Media Player 9 The OLE component in Windows 98, 2000, XP, and Server 2003, and Exchange Server 5.0 through 2003, does not properly validate the lengths of messages for certain OLE data, which allows remote attackers to execute arbitrary code, aka the "Input Validation Vulnerability." Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 SMB (Server Message Block) Buffer overflow in the SMB capability for Microsoft Windows XP, 2000, and NT allows remote attackers to cause a denial of service and possibly execute arbitrary code via an SMB packet that specifies a smaller buffer length than is required. Tiffany Bergeron ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain createTextRange call on a checkbox object, which results in a dereference of an invalid table pointer. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED HP-UX 11 Operating System Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the "blind connection-reset attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Nabil Ouchn INTERIM Matthew Wojcik ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allow remote attackers to execute arbitrary code via crafted Windows Metafile (WMF) and Enhanced Metafile (EMF) format images that lead to heap-based buffer overflows, as demonstrated using MRBP16::bCheckRecord. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 libxml2 Multiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2), and possibly other versions, may allow remote attackers to execute arbitrary code via (1) a long FTP URL that is not properly handled by the xmlNanoFTPScanURL function, (2) a long proxy URL containing FTP data that is not properly handled by the xmlNanoFTPScanProxy function, and other overflows related to manipulation of DNS length values, including (3) xmlNanoFTPConnect, (4) xmlNanoHTTPConnectHost, and (5) xmlNanoHTTPConnectHost. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 mozilla Firefox before 1.0.5 allows remote attackers to steal information and possibly execute arbitrary code by using standalone applications such as Flash and QuickTime to open a javascript: URL, which is run in the context of the previous page, and may lead to code execution if the standalone application loads a privileged chrome: URL. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED openSUSE 10.2 openSUSE 10.2 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED Nicholas Hansen INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 Microsoft Windows 2000 ISA Server 2000 Cross-site scripting (XSS) vulnerability in Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to inject arbitrary web script via a URL containing the script in the domain name portion, which is not properly cleansed in the default error pages (1) 500.htm for "500 Internal Server error" or (2) 404.htm for "404 Not Found." Tiffany Bergeron ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 gzip Race condition in gzip 1.2.4, 1.3.3, and earlier, when decompressing a gzipped file, allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by gzip after the decompression is complete. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Word for Windows 6.0 Converter Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CVE-2004-0901. Christine Walzer DRAFT INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED Robert L. Hollis DEPRECATED DEPRECATED Microsoft Windows Server 2003 Internet Explorer Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows user-assisted remote attackers to execute arbitrary code via a crafted web page that triggers memory corruption when it is saved as a multipart HTML (.mht) file. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Outlook Unspecified vulnerability in Microsoft Outlook 2000 through 2003, Exchange 5.0 Server SP2 and 5.5 SP4, Exchange 2000 SP3, and Office allows remote attackers to execute arbitrary code via an e-mail message with a crafted Transport Neutral Encapsulation Format (TNEF) MIME attachment, related to message length validation. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Sun Solaris 10 Operating System Unspecified vulnerability in the kernel processing in Solaris 10 64 bit platform, when running in 64-bit mode, allows local users to cause a denial of service (system panic) via unknown attack vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik DEPRECATED DEPRECATED Microsoft Windows Server 2003 Microsoft Internet Explorer 7 The patch IE7-KB929969-WindowsServer2003-x64-enu.exe that addresses the vulnerabilities discussed in Microsoft Security Bulletin MS07-004 should be installed. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 A version of Microsoft Windows Server 2003 (x64) is installed. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Exchange Server Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2000 SP1 through SP3, when running Outlook Web Access (OWA), allows user-assisted remote attackers to inject arbitrary HTML or web script via unknown vectors related to "HTML parsing." Robert L. Hollis DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Perl Safe.pm 2.0.7 and earlier, when used in Perl 5.8.0 and earlier, may allow attackers to break out of safe compartments in (1) Safe::reval or (2) Safe::rdo using a redefined @_ variable, which is not reset between successive calls. Robert L. Hollis DRAFT INTERIM ACCEPTED Nabil Ouchn INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Internet Explorer Unspecified vulnerability in Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code via certain DHTML script functions, such as normalize, and "incorrectly created elements" that trigger memory corruption, aka "DHTML Script Function Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM Matthew Wojcik ACCEPTED ACCEPTED Microsoft Windows 2000 COM Internet Services Windows 2000, XP, and Server 2003 does not properly "validate the use of memory regions" for COM structured storage files, which allows attackers to execute arbitrary code, aka the "COM Structured Storage Vulnerability." Christine Walzer DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Office Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via a BIFF parsing format file containing malformed BOOLERR records that lead to memory corruption, probably involving invalid pointers. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM John Hoyland ACCEPTED ACCEPTED Microsoft Windows 2000 Crystal Enterprise Crystal Reports Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers to read and delete arbitrary files via ".." sequences in the dynamicimag argument to crystalimagehandler.aspx. Andrew Buttner Jonathan Baker DRAFT Microsoft Windows XP Microsoft Internet Explorer Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, as originally demonstrated using the (1) DDS Library Shape Control (Msdds.dll) COM object, and other objects including (2) Blnmgrps.dll, (3) Ciodm.dll, (4) Comsvcs.dll, (5) Danim.dll, (6) Htmlmarq.ocx, (7) Mdt2dd.dll (as demonstrated using a heap corruption attack with uninitialized memory), (8) Mdt2qd.dll, (9) Mpg4ds32.ax, (10) Msadds32.ax, (11) Msb1esen.dll, (12) Msb1fren.dll, (13) Msb1geen.dll, (14) Msdtctm.dll, (15) Mshtml.dll, (16) Msoeacct.dll, (17) Msosvfbr.dll, (18) Mswcrun.dll, (19) Netshell.dll, (20) Ole2disp.dll, (21) Outllib.dll, (22) Psisdecd.dll, (23) Qdvd.dll, (24) Repodbc.dll, (25) Shdocvw.dll, (26) Shell32.dll, (27) Soa.dll, (28) Srchui.dll, (29) Stobject.dll, (30) Vdt70.dll, (31) Vmhelper.dll, and (32) Wbemads.dll, aka a variant of the "COM Object Instantiation Memory Corruption vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 bzip2 Race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by bzip2 after the decompression is complete. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System The GetEnhMetaFilePaletteEntries API in GDI32.DLL in Windows 2000 allows remote attackers to cause a denial of service (application crash) via a crafted Enhanced Metafile (EMF) file that causes invalid (1) end, (2) emreof, or (3) palent offsets to be used, aka "Enhanced Metafile Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 remshd Unknown vulnerability in remshd daemon in HP-UX B.11.00, B.11.11, and B.11.23 while running in "Trusted Mode" allows remote attackers to gain unauthorized system access via unknown attack vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via Unicode sequences with "zero-width non-joiner" characters. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Operating System Unspecified vulnerability in Microsoft Hyperlink Object Library (hlink.dll), possibly a buffer overflow, allows user-assisted attackers to execute arbitrary code via crafted hyperlinks that are not properly handled when hlink.dll "uses a file containing a malformed function," aka "Hyperlink Object Function Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 DirectX QUARTZ.DLL in Microsoft Windows Media Player 9 allows remote attackers to write a null byte to arbitrary memory via an AVI file with a crafted strn element with a modified length value. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer The legacy <script> data-island capability for XML in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to read arbitrary XML files, and portions of other files, via a URL whose "src" attribute redirects to a local file. Harvey Rubinovitz DRAFT INTERIM ACCEPTED ACCEPTED HP-UX 11 ftpd wu-ftpd 2.6.2 and earlier, with the restricted-gid option enabled, allows local users to bypass access restrictions by changing the permissions to prevent access to their home directory, which causes wu-ftpd to use the root directory instead. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System The FTP client in Windows XP SP1 and Server 2003, and Internet Explorer 6 SP1 on Windows 2000 SP4, when "Enable Folder View for FTP Sites" is enabled and the user manually initiates a file transfer, allows user-assisted, remote FTP servers to overwrite files in arbitrary locations via crafted filenames. Robert L. Hollis DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 ISA Server 2000 Microsoft ISA Server 2000 allows remote attackers to poison the ISA cache or bypass content restriction policies via a malformed HTTP request packet containing multiple Content-Length headers. Christine Walzer DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via HTML elements with a certain crafted tag, which leads to memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Microsoft Internet Explorer 5.01, 5.5, and 6, when using an HTTPS proxy server that requires Basic Authentication, sends URLs in cleartext, which allows remote attackers to obtain sensitive information, aka "HTTPS Proxy Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows XP SMB (Server Message Block) Buffer overflow in the Server Message Block (SMB) functionality for Microsoft Windows 2000, XP SP1 and SP2, and Server 2003 and SP1 allows remote attackers to execute arbitrary code via unknown vectors, aka the "Server Message Block Vulnerability." Jonathan Baker DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Internet Explorer The wininet.dll FTP client code in Microsoft Internet Explorer 5.01 and 6 might allow remote attackers to execute arbitrary code via an FTP server response of a specific length that causes a terminating null byte to be written outside of a buffer, which causes heap corruption. Robert L. Hollis DRAFT Dragos Prisaca INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Unknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to execute arbitrary code via a web site or an HTML e-mail containing a crafted JPEG image that causes memory corruption, aka "JPEG Image Rendering Memory Corruption Vulnerability". Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Sun Solaris 7 snmpdx Format string vulnerability in the logging component of snmpdx for Solaris 5.6 through 8 allows remote attackers to gain root privileges. David Proulx ACCEPTED Red Hat Enterprise Linux 3 telnet Certain BSD-based Telnet clients, including those used on Solaris and SuSE Linux, allow remote malicious Telnet servers to read sensitive environment variables via the NEW-ENVIRON option with a SEND ENV_USERVAR command. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 9 Sun Solaris 10 scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice. Yuzheng Zhou DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 9 The operating system installed on the system is Sun Solaris 9 for x86. Jonathan Baker DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 9 The operating system installed on the system is Sun Solaris 9 for SPARC. Jonathan Baker DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to execute arbitrary code by calling the MrxSmbCscIoctlOpenForCopyChunk function with the METHOD_NEITHER method flag and an arbitrary address, possibly for kernel memory, aka the "SMB Driver Elevation of Privilege Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 TIP Distributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service hang) via a crafted Transaction Internet Protocol (TIP) message that causes DTC to repeatedly connect to a target IP and port number after an error occurs, aka the "Distributed TIP Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Internet Explorer Multiple unspecified vulnerabilities in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allow remote attackers to execute arbitrary code by instantiating certain COM objects from Wmm2fxa.dll as ActiveX controls including (1) DXImageTransform.Microsoft.MMSpecialEffect1Input, (2) DXImageTransform.Microsoft.MMSpecialEffect1Input.1, (3) DXImageTransform.Microsoft.MMSpecialEffect2Inputs, (4) DXImageTransform.Microsoft.MMSpecialEffect2Inputs.1, (5) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input, and (6) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input.1, which causes memory corruption during garbage collection. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP TIP Distributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service exception and exit) via an "unexpected protocol command during the reconnection request," which is not properly handled by the Transaction Internet Protocol (TIP) functionality. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute code such as Javascript, as demonstrated using (1) delayed HTTP redirect operations, and an HTTP response with a Location: header containing a "URL:" prepended to a "ms-its" protocol URI, or (2) modifying the location attribute of the window, as exploited by the Download.ject (aka Scob aka Toofer) using the ADODB.Stream object. Tiffany Bergeron DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Services for UNIX The Telnet client for Microsoft Windows XP, Windows Server 2003, and Windows Services for UNIX allows remote attackers to read sensitive environment variables via the NEW-ENVIRON option with a SEND ENV_USERVAR command. Jonathan Baker DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Visual Studio .NET 2002 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System Buffer overflow in Collaboration Data Objects (CDO), as used in Microsoft Windows and Microsoft Exchange Server, allows remote attackers to execute arbitrary code when CDOSYS or CDOEX processes an e-mail message with a large header name, as demonstrated using the "Content-Type" string. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 GDM The X Display Manager Control Protocol (XDMCP) support for GDM before 2.4.1.6 allows attackers to cause a denial of service (daemon crash) when a chosen host expires, a different issue than CVE-2003-0549. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 uucp Multiple buffer overflows in uucp for Sun Solaris 2.6, 7, 8, and 9 allow local users to execute arbitrary code as the uucp user. Brian Soby DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System Heap-based buffer overflow in T2EMBED.DLL in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1, Windows 98, and Windows ME allows remote attackers to execute arbitrary code via an e-mail message or web page with a crafted Embedded Open Type (EOT) web font that triggers the overflow during decompression. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Color Management Module Buffer overflow in the Microsoft Color Management Module for Windows allows remote attackers to execute arbitrary code via an image with crafted ICC profile format tags. Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 4 fetchmail Buffer overflow in the POP3 client in Fetchmail before 6.2.5.2 allows remote POP3 servers to cause a denial of service and possibly execute arbitrary code via long UIDL responses. NOTE: a typo in an advisory accidentally used the wrong CVE identifier for the Fetchmail issue. This is the correct identifier. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Linux kernel The elf_core_dump function in binfmt_elf.c for Linux kernel 2.x.x to 2.2.27-rc2, 2.4.x to 2.4.31-pre1, and 2.6.x to 2.6.12-rc4 allows local users to execute arbitrary code via an ELF binary that, in certain conditions involving the create_elf_tables function, causes a negative length argument to pass a signed integer comparison, leading to a buffer overflow. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System The GetEnhMetaFilePaletteEntries API in GDI32.DLL in Windows 2000 allows remote attackers to cause a denial of service (application crash) via a crafted Enhanced Metafile (EMF) file that causes invalid (1) end, (2) emreof, or (3) palent offsets to be used, aka "Enhanced Metafile Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Internet Explorer Microsoft Internet Explorer 5.01, 6, and 7 uses certain COM objects from Imjpcksid.dll as ActiveX controls, which allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: this issue might be related to CVE-2006-4193. Robert L. Hollis DRAFT Daniel Tarnu INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 GDM GDM before 2.4.1.6, when using the "examine session errors" feature, allows local users to read arbitrary files via a symlink attack on the ~/.xsession-errors file. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Remote Procedure Call (RPC) The RPC DCOM interface in Windows 2000 SP3 and SP4 allows remote attackers to cause a denial of service (crash), and local attackers to use the DoS to hijack the epmapper pipe to gain privileges, via certain messages to the __RemoteGetClassObject interface that cause a NULL pointer to be passed to the PerformScmStage function. Christine Walzer DRAFT INTERIM ACCEPTED Andrew Buttner INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Linux kernel The linux-2.4.21-mlock.patch in Red Hat Enterprise Linux 3 does not properly maintain the mlock page count when one process unlocks pages that belong to another process, which allows local users to mlock more memory than specified by the rlimit. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Windows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote user-assisted attackers to execute arbitrary commands via a crafted shortcut (.lnk) file with long font properties that lead to a buffer overflow when the user views the file's properties using Windows Explorer, a different vulnerability than CVE-2005-2122. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Buffer overflow in the PNG image rendering component of Microsoft Internet Explorer allows remote attackers to execute arbitrary code via a crafted PNG file. Harvey Rubinovitz DRAFT Harvey Rubinovitz INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer The DHTML Edit Control (dhtmled.ocx) allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as demonstrated by "AbusiveParent" in Internet Explorer 6.0.2900.2180. Jonathan Baker DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED HP-UX 11 Operating System Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via a blind throughput-reduction attack using spoofed Source Quench packets, aka the "ICMP Source Quench attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Robert L. Hollis DRAFT INTERIM ACCEPTED Nabil Ouchn INTERIM Matthew Wojcik ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Solaris Enterprise Authentication Mechanism (SEAM) MIT Kerberos V5 Key Distribution Center (KDC) before 1.2.5 allows remote authenticated attackers to cause a denial of service (crash) on KDCs within the same realm via a certain protocol request that causes a null dereference. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Ximian Evolution The handle_image function in mail-format.c for Ximian Evolution Mail User Agent 1.2.2 and earlier does not properly escape HTML characters, which allows remote attackers inject arbitrary data and HTML via a MIME Content-ID header in a MIME-encoded image. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 gzip zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP NetWare The Client Service for NetWare (CSNW) on Microsoft Windows 2000 SP4, XP SP1 and Sp2, and Server 2003 SP1 and earlier, allows remote attackers to execute arbitrary code due to an "unchecked buffer" when processing certain crafted network messages. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Windows Server 2003 GDI+ Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation. Ingrid Skoog DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 DirectX Multiple integer overflows in a Microsoft Windows DirectX MIDI library (QUARTZ.DLL) allow remote attackers to execute arbitrary code via a MIDI (.mid) file with (1) large length for a Text or Copyright string, or (2) a large number of tracks, which leads to a heap-based buffer overflow. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jeff Ito INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Internet Explorer Heap-based buffer overflow in the DirectAnimation Path Control (DirectAnimation.PathControl) COM object (daxctle.ocx) for Internet Explorer 6.0 SP1, on Chinese and possibly other Windows distributions, allows remote attackers to execute arbitrary code via unknown manipulations in arguments to the KeyFrame method, possibly related to an integer overflow, as demonstrated by daxctle2, and a different vulnerability than CVE-2006-4446. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Excel Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows user-assisted remote attackers to execute arbitrary code via a malformed string, aka "Excel Malformed String Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista The application Microsoft Excel 2003 is installed. Robert L. Hollis INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 The application Microsoft Excel 2000 is installed. Robert L. Hollis DRAFT John Hoyland INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 The application Microsoft Excel 2002 is installed. Robert L. Hollis DRAFT John Hoyland INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 The application Microsoft Excel Viewer is installed. Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Microsoft Internet Explorer 5.01, 5.5, and 6, when using an HTTPS proxy server that requires Basic Authentication, sends URLs in cleartext, which allows remote attackers to obtain sensitive information, aka "HTTPS Proxy Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Sun Solaris 8 snmpdx Format string vulnerability in the logging component of snmpdx for Solaris 5.6 through 8 allows remote attackers to gain root privileges. David Proulx ACCEPTED Sun Solaris 9 CDE CDE ToolTalk database server (ttdbserver) allows remote attackers to overwrite arbitrary memory locations with a zero, and possibly gain privileges, via a file descriptor argument in an AUTH_UNIX procedure call, which is used as a table index by the _TT_ISCLOSE procedure. Brian Soby DRAFT INTERIM ACCEPTED Brian Soby Brian Soby INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED HP-UX 11 Unspecified vulnerability in usermod in HP-UX B.11.00, B.11.11, and B.11.23, when run with certain options that involve a new home directory, might cause usermod to change the ownership of all directories and files under the new directory, which might result in less secure permissions than intended. Robert L. Hollis DRAFT INTERIM ACCEPTED Nabil Ouchn INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Microsoft Internet Explorer 5.01, 5.5, and 6, when using an HTTPS proxy server that requires Basic Authentication, sends URLs in cleartext, which allows remote attackers to obtain sensitive information, aka "HTTPS Proxy Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Internet Explorer Internet Explorer 5.5 and earlier allows remote attackers to display a URL in the address bar that is different than the URL that is actually being displayed, which could be used in web site spoofing attacks, aka the "Web page spoofing vulnerability." Tiffany Bergeron INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 DirectX Multiple integer overflows in a Microsoft Windows DirectX MIDI library (QUARTZ.DLL) allow remote attackers to execute arbitrary code via a MIDI (.mid) file with (1) large length for a Text or Copyright string, or (2) a large number of tracks, which leads to a heap-based buffer overflow. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED Jeff Ito INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Internet Explorer Heap-based buffer overflow in plugin.ocx for Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to execute arbitrary code via the Load() method, a different vulnerability than CVE-2003-0115. Tiffany Bergeron INTERIM ACCEPTED INTERIM Harvey Rubinovitz ACCEPTED ACCEPTED Microsoft Windows Server 2003 Private Communications Transport (PCT) Buffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library, as used in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via PCT 1.0 handshake packets. Andrew Buttner INTERIM ACCEPTED Glenn Strickland INTERIM ACCEPTED ACCEPTED Sun Solaris 10 Unspecified vulnerability in the NFS server in Sun Solaris 10 before 20070613 allows remote attackers to cause a denial of service (system crash) via certain XDR data in NFS requests, probably related to processing of data by the xdr_bool and xdrmblk_getint32 functions. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 10 The operating system installed on the system is Sun Solaris 10 for x86. Jonathan Baker DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 10 The operating system installed on the system is Sun Solaris 10 for SPARC. Jonathan Baker DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Internet Explorer Microsoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Javascript BODY onload event that calls the window function, aka "Mismatched Document Object Model Objects Memory Corruption Vulnerability." Robert L. Hollis DRAFT Robert L. Hollis INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Jeff Cheng INTERIM Jeff Cheng ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Operating System The RichEdit component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1; Office 2000 SP3, XP SP3, 2003 SP2, and Office 2004 for Mac; and Learning Essentials for Microsoft Office 1.0, 1.1, and 1.5 allows user-assisted remote attackers to execute arbitrary code via a malformed OLE object in an RTF file, which triggers memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED Clifford Farrugia INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Windows 2000 Buffer overflow in ntdll.dll on Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers to execute arbitrary code, as demonstrated via a WebDAV request to IIS 5.0. Tiffany Bergeron Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to modify HTTP headers of XML HTTP requests via XMLHttpRequest, and possibly use the client to exploit vulnerabilities in servers or proxies. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Outlook Express Stack-based buffer overflow in the news reader for Microsoft Outlook Express (MSOE.DLL) 5.5 SP2, 6, and 6 SP1 allows remote malicious NNTP servers to execute arbitrary code via a LIST response with a long second field. Ingrid Skoog DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla The JavaScript engine in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 does not properly handle temporary variables that are not garbage collected, which might allow remote attackers to trigger operations on freed memory and cause memory corruption. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 postgresql The tsearch2 module in PostgreSQL 7.4 through 8.0.x declares the (1) dex_init, (2) snb_en_init, (3) snb_ru_init, (4) spell_init, and (5) syn_init functions as "internal" even when they do not take an internal argument, which allows attackers to cause a denial of service (application crash) and possibly have other impacts via SQL commands that call other functions that accept internal arguments. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 9 Unspecified vulnerability in Sun Solaris 9, when Solaris Auditing (BSM) is enabled for file read, write, attribute modify, create, or delete audit classes, allows local users to cause a denial of service (panic) via unknown vectors, possibly related to the audit_savepath function. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Internet Explorer Microsoft Internet Explorer 5.01 and 6 allows remote attackers to execute arbitrary code by instantiating certain COM objects from Urlmon.dll, which triggers memory corruption during a call to the IObjectSafety function. Sudhir Gandhe DRAFT Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 A version of Microsoft Windows Server 2003 Service Pack 2 (x86) is installed. Sudhir Gandhe DRAFT INTERIM Robert L. Hollis ACCEPTED ACCEPTED Microsoft Windows XP The operating system installed on the system is Microsoft Windows XP SP2 (64-bit). Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Outlook Unspecified vulnerability in Microsoft Outlook 2000 through 2003, Exchange 5.0 Server SP2 and 5.5 SP4, Exchange 2000 SP3, and Office allows remote attackers to execute arbitrary code via an e-mail message with a crafted Transport Neutral Encapsulation Format (TNEF) MIME attachment, related to message length validation. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 zgrep zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Ximian Evolution Ximian Evolution Mail User Agent 1.2.2 and earlier allows remote attackers to cause a denial of service (memory consumption) via a mail message that is uuencoded multiple times. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 NetBIOS Interactions between the CIFS Browser Protocol and NetBIOS as implemented in Microsoft Windows 95, 98, NT, and 2000 allow remote attackers to modify dynamic NetBIOS name cache entries via a spoofed Browse Frame Request in a unicast or UDP broadcast datagram. Tiffany Bergeron INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Internet Explorer Unspecified vulnerability in Internet Explorer 6.0 on Microsoft Windows XP SP2 allows remote attackers to execute arbitrary code via "exceptional conditions" that trigger memory corruption, as demonstrated using an exception handler and nested object tags, a variant of CVE-2006-1992. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT SQL Server 2000 Multiple buffer overflows in SQL Server 2000 Resolution Service allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434 in which (1) a 0x04 byte causes the SQL Monitor thread to generate a long registry key name, or (2) a 0x08 byte with a long string causes heap corruption. Tiffany Bergeron INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Ingrid Skoog Ingrid Skoog INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft ASN.1 Library Double-free vulnerability in the ASN.1 library as used in Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service and possibly execute arbitrary code. David Proulx INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Telephony Service Buffer overflow in the Telephony Application Programming Interface (TAPI) for Microsoft Windows 98, Windows 98 SE, Windows ME, Windows 2000, Windows XP, and Windows Server 2003 allows attackers elevate privileges or execute arbitrary code via a crafted message. Andrew Buttner DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 10 Perl Integer overflow in the format string functionality (Perl_sv_vcatpvfn) in Perl 5.9.2 and 5.8.6 Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via format string specifiers with large values, which causes an integer wrap and leads to a buffer overflow, as demonstrated using format string vulnerabilities in Perl applications. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 4 mozilla Firefox before 1.0.5 allows remote attackers to steal information and possibly execute arbitrary code by using standalone applications such as Flash and QuickTime to open a javascript: URL, which is run in the context of the previous page, and may lead to code execution if the standalone application loads a privileged chrome: URL. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Remote Procedure Call (RPC) The DCOM RPC interface for Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause network communications via an "alter context" call that contains additional data, aka the "Object Identity Vulnerability." Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows XP MSDTC The MIDL_user_allocate function in the Microsoft Distributed Transaction Coordinator (MSDTC) proxy (MSDTCPRX.DLL) allocates a 4K page of memory regardless of the required size, which allows attackers to overwrite arbitrary memory locations using an incorrect size value that is provided to the NdrAllocate function, which writes management data to memory outside of the allocated buffer. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Exchange Server Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2000 SP1 through SP3, when running Outlook Web Access (OWA), allows user-assisted remote attackers to inject arbitrary HTML or web script via unknown vectors related to "HTML parsing." Robert L. Hollis DRAFT INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Ximian Evolution The try_uudecoding function in mail-format.c for Ximian Evolution Mail User Agent 1.2.2 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a malicious uuencoded (UUE) header, possibly triggering a heap-based buffer overflow. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft PowerPoint Unspecified vulnerability in Microsoft PowerPoint in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP1 and SP2, Office 2004 for Mac, and v. X for Mac allows user-assisted attackers to execute arbitrary code via a PowerPoint document with a malformed record, which triggers memory corruption. Robert L. Hollis DRAFT Matthew Wojcik Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Information Server (IIS) Buffer overflow in Internet Printing ISAPI extension in Windows 2000 allows remote attackers to gain root privileges via a long print request that is passed to the extension through IIS 5.0. Christine Walzer INTERIM ACCEPTED Ingrid Skoog INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System Microsoft JScript 5.1, 5.5, and 5.6 on Windows 2000 SP4, and 5.6 on Windows XP, Server 2003, Windows 98 and Windows Me, will "release objects early" in certain cases, which results in memory corruption and allows remote attackers to execute arbitrary code. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Remote Procedure Call (RPC) The DCOM RPC interface for Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause network communications via an "alter context" call that contains additional data, aka the "Object Identity Vulnerability." Christine Walzer INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Multiple format string vulnerabilities in (1) neon 0.24.4 and earlier, and other products that use neon including (2) Cadaver, (3) Subversion, and (4) OpenOffice, allow remote malicious WebDAV servers to execute arbitrary code. Jay Beale INTERIM ACCEPTED Matthew Wojcik Matthew Wojcik Matthew Wojcik Matthew Wojcik INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Enhanced Metafile (EMF) Windows Metafile (WMF) Buffer overflow in the rendering for (1) Windows Metafile (WMF) or (2) Enhanced Metafile (EMF) image formats in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, and XP SP1 allows remote attackers to execute arbitrary code via a malformed WMF or EMF image. Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allow remote attackers to execute arbitrary code via crafted Windows Metafile (WMF) and Enhanced Metafile (EMF) format images that lead to heap-based buffer overflows, as demonstrated using MRBP16::bCheckRecord. Robert L. Hollis DRAFT INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Remote Procedure Call (RPC) The DCOM RPC interface for Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause network communications via an "alter context" call that contains additional data, aka the "Object Identity Vulnerability." Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, including (1) devenum.dll, (2) diactfrm.dll, (3) wmm2filt.dll, (4) fsusd.dll, (5) dmdskmgr.dll, (6) browsewm.dll, (7) browseui.dll, (8) shell32.dll, (9) mshtml.dll, (10) inetcfg.dll, (11) infosoft.dll, (12) query.dll, (13) syncui.dll, (14) clbcatex.dll, (15) clbcatq.dll, (16) comsvcs.dll, and (17) msconf.dll, which causes memory corruption, aka "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2087. Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 CVS before 1.11 allows CVS clients to read arbitrary files via .. (dot dot) sequences in filenames via CVS client requests, a different vulnerability than CVE-2004-0180. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Ethereal Ethereal 0.9.12 and earlier does not handle certain strings properly, with unknown consequences, in the (1) BGP, (2) WTP, (3) DNS, (4) 802.11, (5) ISAKMP, (6) WSP, (7) CLNP, (8) ISIS, and (9) RMI dissectors. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Certificate Validation Microsoft Windows 98 and Windows NT 4.0 do not properly verify the Basic Constraints of digital certificates, allowing remote attackers to execute code, aka "New Variant of Certificate Validation Flaw Could Enable Identity Spoofing" (CAN-2002-0862). Christine Walzer Christine Walzer Christine Walzer INTERIM ACCEPTED INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Internet Explorer Integer overflow in the Vector Markup Language (VML) implementation (vgx.dll) in Microsoft Internet Explorer 5.01, 6, and 7 on Windows 2000 SP4, XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted web page that contains unspecified integer properties that cause insufficient memory allocation and trigger a buffer overflow, aka the "VML Buffer Overrun Vulnerability." Sudhir Gandhe DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista A version of Microsoft Internet Explorer 7 is installed. Sudhir Gandhe DRAFT INTERIM Andrew Buttner ACCEPTED ACCEPTED Microsoft Windows XP HTML Help Facility Integer overflow in Microsoft Windows 98, 2000, XP SP2 and earlier, and Server 2003 SP1 and earlier allows remote attackers to execute arbitrary code via a crafted compiled Help (.CHM) file with a large size field that triggers a heap-based buffer overflow, as demonstrated using a "ms-its:" URL in Internet Explorer. Andrew Buttner DRAFT INTERIM ACCEPTED Jeff Ito INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft CryptoAPI The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS. Christine Walzer Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Outlook Express Unspecified vulnerability in Microsoft Outlook Express 6 and earlier allows remote attackers to execute arbitrary code via a crafted contact record in a Windows Address Book (WAB) file. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Outlook Express 5.5 SP2 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Outlook Express 6 SP1 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Outlook Express 6 for Windows XP/2003 is installed Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Windows logon process (winlogon) Buffer overflow in the Windows logon process (winlogon) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, and XP SP1, when a member of a domain, allows remote attackers to execute arbitrary code. Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Compressed Folders Integer overflow in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition allows remote attackers to execute arbitrary code via compressed (zipped) folders that involve an "unchecked buffer" and improper length validation. David Proulx DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Rockliffe MailSite Express Cross-site scripting (XSS) vulnerability in Rockliffe MailSite Express before 6.1.22 allows remote attackers to inject arbitrary web script or HTML via a message body. Rahul Mohandas DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Information Server (IIS) Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "\" characters twice. Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Flash Player Unspecified vulnerability in Adobe (Macromedia) Flash Player 8.0.24.0 allows remote attackers to execute arbitrary commands via a malformed .swf file that results in "multiple improper memory access" errors. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 OpenSSL The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read. Matt Busby Matt Busby INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Sun Solaris 7 Sun Solaris 8 snmpdx Vulnerabilities in a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via SNMPv1 trap handling, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor. This and other SNMP-related candidates will be updated when more accurate information is available. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Operating System Buffer overflow in the SNMP Service in Microsoft Windows 2000 SP4, XP SP2, Server 2003, Server 2003 SP1, and possibly other versions allows remote attackers to execute arbitrary code via a crafted SNMP packet, aka "SNMP Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Utility Manager The Utility Manager in Microsoft Windows 2000 executes winhlp32.exe with system privileges, which allows local users to execute arbitrary code via a "Shatter" style attack using a Windows message that accesses the context sensitive help button in the GUI, as demonstrated using the File Open dialog in the Help window, a different vulnerability than CVE-2004-0213. Harvey Rubinovitz INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Print Spooler Service Buffer overflow in the Print Spooler service (Spoolsv.exe) for Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code via a malicious message. Matthew Burton DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 X Multiple integer overflows in XFree86 before 4.3.0 allow user-assisted attackers to execute arbitrary code via a crafted pixmap image. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 The client for CVS before 1.11 allows a remote malicious CVS server to create arbitrary files using certain RCS diff files that use absolute pathnames during checkouts or updates, a different vulnerability than CVE-2004-0405. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Remote Procedure Call (RPC) The DCOM RPC interface for Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause network communications via an "alter context" call that contains additional data, aka the "Object Identity Vulnerability." Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft XML Core Services Unspecified vulnerability in the setRequestHeader method in the XMLHTTP (XML HTTP) ActiveX Control 4.0 in Microsoft XML Core Services 4.0 on Windows, when accessed by Internet Explorer, allows remote attackers to execute arbitrary code via crafted arguments that lead to memory corruption, a different vulnerability than CVE-2006-4685. NOTE: some of these details are obtained from third party information. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft XML Core Services 6 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Data Access Components 2.7 Buffer overflow in a component of SQL-DMO for Microsoft Data Access Components (MDAC) 2.5 through 2.7 allows remote attackers to execute arbitrary code via a long response to a broadcast request to UDP port 1434. Christine Walzer Christine Walzer INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 fetchmail Buffer overflow in the POP3 client in Fetchmail before 6.2.5.2 allows remote POP3 servers to cause a denial of service and possibly execute arbitrary code via long UIDL responses. NOTE: a typo in an advisory accidentally used the wrong CVE identifier for the Fetchmail issue. This is the correct identifier. Jay Beale DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to execute arbitrary code by using an eval in an XBL method binding (XBL.method.eval) to create Javascript functions that are compiled with extra privileges. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Veritas Backup Exec 8.5 Veritas Backup Exec 8.5 and earlier requires that the "RestrictAnonymous" registry key for Microsoft Exchange 2000 must be set to 0, which enables anonymous listing of the SAM database and shares. Tiffany Bergeron INTERIM Ingrid Skoog INTERIM Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Stack-based buffer overflow in the ncp_lookup function for ncpfs in Linux kernel 2.4.x allows local users to gain privileges. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 SquirrelMail SQL injection vulnerability in SquirrelMail before 1.4.3 RC1 allows remote attackers to execute unauthorized SQL statements, with unknown impact, probably via abook_database.php. Jay Beale INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Help and Support Center (HSC) Help and Support Center in Microsoft Windows XP and Windows Server 2003 SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code, as demonstrated using certain hcp:// URLs that access the DVD Upgrade capability (dvdupgrd.htm). Harvey Rubinovitz DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED HP-UX 11 swagentd Unspecified vulnerability in swagentd in HP-UX B.11.00, B.11.04, and B.11.11 allows remote attackers to cause a denial of service (application crash) via unspecified vectors. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 COM Internet Services Buffer overflow in the COM Internet Services and in the RPC over HTTP Proxy components for Microsoft Windows NT Server 4.0, NT 4.0 Terminal Server Edition, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service via a crafted request. Christine Walzer INTERIM ACCEPTED Andrew Buttner INTERIM Andrew Buttner ACCEPTED ACCEPTED Microsoft Windows NT Locator service Buffer overflow in the RPC Locator service for Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows local users to execute arbitrary code via an RPC call to the service containing certain parameter information. Tiffany Bergeron ACCEPTED HP-UX 11 ftpd The FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in. Robert L. Hollis DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Microsoft Outlook Express The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability." Andrew Buttner INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft DirectPlay IDirectPlay4 Application Programming Interface (API) of Microsoft DirectPlay 7.0a thru 9.0b, as used in Windows Server 2003 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed packet. Tiffany Bergeron INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Explorer The legacy <script> data-island capability for XML in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to read arbitrary XML files, and portions of other files, via a URL whose "src" attribute redirects to a local file. Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows NT SQL Server 2000 The registry key containing the SQL Server service account information in Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, has insecure permissions, which allows local users to gain privileges, aka "Incorrect Permission on SQL Server Service Account Registry Key." Tiffany Bergeron INTERIM ACCEPTED Jonathan Baker INTERIM INTERIM ACCEPTED Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog Ingrid Skoog INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 NetBIOS A component service related to NETBIOS is running. Tiffany Bergeron INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows NT The registry in Windows NT can be accessed remotely by users who are not administrators. Tiffany Bergeron DRAFT INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Exchange Server Microsoft Exchange Server 2000 System Attendant gives "Everyone" group privileges to the WinReg key, which could allow remote attackers to read or modify registry keys. Tiffany Bergeron INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows NT The Remote Registry server in Windows NT 4.0 allows local authenticated users to cause a denial of service via a malformed request, which causes the winlogon process to fail, aka the "Remote Registry Access Authentication" vulnerability. Tiffany Bergeron INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Buffer overflow in URLMON.DLL in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via a crafted URL with an International Domain Name (IDN) using double-byte character sets (DBCS), aka the "Double Byte Character Parsing Memory Corruption Vulnerability." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 7 rpc.yppasswdd Buffer overflow in rpc.yppasswdd (yppasswd server) in Solaris 2.6, 7 and 8 allows remote attackers to gain root access via a long username. David Proulx ACCEPTED Microsoft Windows NT Microsoft Internet Information Server (IIS) Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "\" characters twice. Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Unknown vulnerability in Linux kernel before 2.4.22 allows local users to gain privileges, related to "R128 DRI limits checking." Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Lightweight Directory Access Protocol (LDAP) Unknown vulnerability in the Local Security Authority Subsystem Service (LSASS) in Windows 2000 domain controllers allows remote attackers to cause a denial of service via a crafted LDAP message. Tiffany Bergeron INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability." Matthew Burton DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jeff Cheng INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 5.5 and 6.0 allows remote attackers to cause the File Download dialogue box to misrepresent the name of the file in the dialogue in a way that could fool users into thinking that the file type is safe to download. Tiffany Bergeron INTERIM ACCEPTED INTERIM Harvey Rubinovitz ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 Red Hat Enteprise Linux 3 Real time clock (RTC) routines in Linux kernel 2.4.23 and earlier do not properly initialize their structures, which could leak kernel data to user space. Jay Beale INTERIM ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 SquirrelMail Cross-site scripting (XSS) vulnerability in mime.php for SquirrelMail before 1.4.3 allows remote attackers to insert arbitrary HTML and script via the content-type mail header, as demonstrated using read_body.php. Jay Beale INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Internet Information Server (IIS) IIS 5.0 and 5.1 allows remote attackers to cause a denial of service (crash) via malformed WebDAV requests that cause a large amount of memory to be assigned. Christine Walzer INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Outlook Express The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability." Andrew Buttner INTERIM ACCEPTED ACCEPTED Red Hat Linux 9 Ethereal The tvb_get_nstringz0 function in Ethereal 0.9.12 and earlier does not properly handle a zero-length buffer size, with unknown consequences. Jay Beale INTERIM Jay Beale ACCEPTED Thomas R. Jones INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft Internet Information Server (IIS) IIS 5.0 and 5.1 allows remote attackers to cause a denial of service (crash) via malformed WebDAV requests that cause a large amount of memory to be assigned. Christine Walzer INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Help and Support Center (HSC) Help and Support Center in Microsoft Windows XP and Windows Server 2003 SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code, as demonstrated using certain hcp:// URLs that access the DVD Upgrade capability (dvdupgrd.htm). Harvey Rubinovitz DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Microsoft ASN.1 Library Double-free vulnerability in the ASN.1 library as used in Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service and possibly execute arbitrary code. David Proulx INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 SquirrelMail Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php. Jay Beale INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Internet Explorer Internet Explorer 5.01, 5.5, and 6 does not properly validate buffers when handling certain DHTML methods including the createControlRange Javascript function, which allows remote attackers to execute arbitrary code, aka the "DHTML Method Heap Memory Corruption Vulnerability." Harvey Rubinovitz DRAFT INTERIM ACCEPTED Robert L. Hollis ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Windows XP Windows XP allows local users to execute arbitrary programs by creating a task at an elevated privilege level through the eventtriggers.exe command-line tool or the Task Scheduler service, aka "Windows Management Vulnerability." Harvey Rubinovitz INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 CVS serve_notify in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle empty data lines, which may allow remote attackers to perform an "out-of-bounds" write for a single byte to execute arbitrary code or modify critical program data. Jay Beale INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft XML Core Services 4 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 libtiff Integer overflow in (1) tif_dirread.c and (2) tif_fax3.c for libtiff 3.5.7 and 3.7.0 allows remote attackers to execute arbitrary code via a TIFF file containing a TIFF_ASCII or TIFF_UNDEFINED directory entry with a -1 entry count, which leads to a heap-based buffer overflow. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 libtiff Multiple integer overflows in libtiff 3.6.1 and earlier allow remote attackers to cause a denial of service (crash or memory corruption) via TIFF images that lead to incorrect malloc calls. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 libtiff Vulnerability in tif_dirread.c for libtiff allows remote attackers to cause a denial of service (application crash) via a TIFF image that causes a divide-by-zero error when the number of row bytes is zero, a different vulnerability than CVE-2005-2452. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 libtiff Multiple vulnerabilities in the RLE (run length encoding) decoders for libtiff 3.6.1 and earlier, related to buffer overflows and integer overflows, allow remote attackers to execute arbitrary code via TIFF files. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 XDM X Display Manager (XDM) on Solaris 8 allows remote attackers to cause a denial of service (XDM crash) via an invalid X Display Manager Control Protocol (XDMCP) request. Robert L. Hollis Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Apache Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Apache mod_access in Apache 1.3 before 1.3.30, when running big-endian 64-bit platforms, does not properly parse Allow/Deny rules using IP addresses without a netmask, which could allow remote attackers to bypass intended access restrictions. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Apache Apache 1.4.x before 1.3.30, and 2.0.x before 2.0.49, when using multiple listening sockets on certain platforms, allows remote attackers to cause a denial of service (blocked new connections) via a "short-lived connection on a rarely-accessed listening socket." Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Apache Apache does not filter terminal escape sequences from its error logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 Sun Solaris 9 Apache mod_digest for Apache before 1.3.31 does not properly verify the nonce of a client response by using a AuthNonce secret. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox before 1.0.5 and Mozilla before 1.7.9 allows a child frame to call top.focus and other methods in a parent frame, even when the parent is in a different domain, which violates the same origin policy and allows remote attackers to steal sensitive information such as cookies and passwords from web sites whose child frames do not verify that they are in the same domain as their parents. Robert L. Hollis Christine Walzer Jonathan Baker INTERIM ACCEPTED John Hoyland INTERIM John Hoyland ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System Unknown vulnerability in the PKINIT Protocol for Microsoft Windows 2000, Windows XP, and Windows Server 2003 could allow a local user to obtain information and spoof a server via a man-in-the-middle (MITM) attack between a client and a domain controller when PKINIT smart card authentication is being used. Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System Unknown vulnerability in Microsoft Windows 2000 Server and Windows Server 2003 domain controllers allows remote authenticated users to cause a denial of service (system crash) via a crafted Kerberos message. Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System Unknown vulnerability in the PKINIT Protocol for Microsoft Windows 2000, Windows XP, and Windows Server 2003 could allow a local user to obtain information and spoof a server via a man-in-the-middle (MITM) attack between a client and a domain controller when PKINIT smart card authentication is being used. Robert L. Hollis INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System Unknown vulnerability in Microsoft Windows 2000 Server and Windows Server 2003 domain controllers allows remote authenticated users to cause a denial of service (system crash) via a crafted Kerberos message. Robert L. Hollis INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Unknown vulnerability in the PKINIT Protocol for Microsoft Windows 2000, Windows XP, and Windows Server 2003 could allow a local user to obtain information and spoof a server via a man-in-the-middle (MITM) attack between a client and a domain controller when PKINIT smart card authentication is being used. Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Unknown vulnerability in Microsoft Windows 2000 Server and Windows Server 2003 domain controllers allows remote authenticated users to cause a denial of service (system crash) via a crafted Kerberos message. Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Unknown vulnerability in the PKINIT Protocol for Microsoft Windows 2000, Windows XP, and Windows Server 2003 could allow a local user to obtain information and spoof a server via a man-in-the-middle (MITM) attack between a client and a domain controller when PKINIT smart card authentication is being used. Robert L. Hollis INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 3 CVS Integer overflow in the "Max-dotdot" CVS protocol command (serve_max_dotdot) for CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to cause a server crash, which could cause temporary data to remain undeleted and consume disk space. Jay Beale INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Unknown vulnerability in Microsoft Windows 2000 Server and Windows Server 2003 domain controllers allows remote authenticated users to cause a denial of service (system crash) via a crafted Kerberos message. Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Unknown vulnerability in the PKINIT Protocol for Microsoft Windows 2000, Windows XP, and Windows Server 2003 could allow a local user to obtain information and spoof a server via a man-in-the-middle (MITM) attack between a client and a domain controller when PKINIT smart card authentication is being used. Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Unknown vulnerability in Microsoft Windows 2000 Server and Windows Server 2003 domain controllers allows remote authenticated users to cause a denial of service (system crash) via a crafted Kerberos message. Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System Unknown vulnerability in the PKINIT Protocol for Microsoft Windows 2000, Windows XP, and Windows Server 2003 could allow a local user to obtain information and spoof a server via a man-in-the-middle (MITM) attack between a client and a domain controller when PKINIT smart card authentication is being used. Robert L. Hollis INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Operating System Unknown vulnerability in Microsoft Windows 2000 Server and Windows Server 2003 domain controllers allows remote authenticated users to cause a denial of service (system crash) via a crafted Kerberos message. Robert L. Hollis INTERIM ACCEPTED Anna Min INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System The Microsoft Windows kernel in Microsoft Windows 2000 Server, Windows XP, and Windows Server 2003 allows remote attackers to cause a denial of service (crash) via crafted Remote Desktop Protocol (RDP) requests. Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 Operating System Buffer overflow in the Telephony Application Programming Interface (TAPI) for Microsoft Windows 98, Windows 98 SE, Windows ME, Windows 2000, Windows XP, and Windows Server 2003 allows attackers elevate privileges or execute arbitrary code via a crafted message. Robert L. Hollis INTERIM ACCEPTED John Hoyland DEPRECATED DEPRECATED Microsoft Windows XP Operating System Buffer overflow in the Telephony Application Programming Interface (TAPI) for Microsoft Windows 98, Windows 98 SE, Windows ME, Windows 2000, Windows XP, and Windows Server 2003 allows attackers elevate privileges or execute arbitrary code via a crafted message. Robert L. Hollis INTERIM ACCEPTED John Hoyland DEPRECATED DEPRECATED Microsoft Windows XP Operating System Buffer overflow in the Telephony Application Programming Interface (TAPI) for Microsoft Windows 98, Windows 98 SE, Windows ME, Windows 2000, Windows XP, and Windows Server 2003 allows attackers elevate privileges or execute arbitrary code via a crafted message. Robert L. Hollis INTERIM ACCEPTED John Hoyland DEPRECATED DEPRECATED Microsoft Windows XP Operating System Buffer overflow in the Telephony Application Programming Interface (TAPI) for Microsoft Windows 98, Windows 98 SE, Windows ME, Windows 2000, Windows XP, and Windows Server 2003 allows attackers elevate privileges or execute arbitrary code via a crafted message. Robert L. Hollis INTERIM ACCEPTED John Hoyland DEPRECATED DEPRECATED Microsoft Windows Server 2003 Microsoft Internet Explorer Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, including (1) devenum.dll, (2) diactfrm.dll, (3) wmm2filt.dll, (4) fsusd.dll, (5) dmdskmgr.dll, (6) browsewm.dll, (7) browseui.dll, (8) shell32.dll, (9) mshtml.dll, (10) inetcfg.dll, (11) infosoft.dll, (12) query.dll, (13) syncui.dll, (14) clbcatex.dll, (15) clbcatq.dll, (16) comsvcs.dll, and (17) msconf.dll, which causes memory corruption, aka "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2087. Robert L. Hollis INTERIM ACCEPTED John Hoyland DEPRECATED DEPRECATED Microsoft Windows Server 2003 Microsoft Internet Explorer Unknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to obtain information and possibly execute code when browsing from a web site to a web folder view using WebDAV, aka "Web Folder Behaviors Cross-Domain Vulnerability". Robert L. Hollis INTERIM ACCEPTED John Hoyland DEPRECATED DEPRECATED Microsoft Windows XP Operating System Buffer overflow in the Print Spooler service (Spoolsv.exe) for Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code via a malicious message. Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Operating System Stack-based buffer overflow in the Plug and Play (PnP) service for Microsoft Windows 2000 and Windows XP Service Pack 1 allows remote attackers to execute arbitrary code via a crafted packet, and local users to gain privileges via a malicious application, as exploited by the Zotob (aka Mytob) worm. Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox before 1.0 and Mozilla before 1.7.5 allow remote attackers to load local files via links "with a custom getter and toString method" that are middle-clicked by the user to be opened in a new tab. Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox 0.9, Thunderbird 0.6 and other versions before 0.9, and Mozilla 1.7 before 1.7.5 save temporary files with world-readable permissions, which allows local users to read certain web content or attachments that belong to other users, e.g. content that is managed by helper applications such as PDF. Robert L. Hollis Jonathan Baker INTERIM ACCEPTED INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Firefox before 1.0 and Mozilla before 1.7.5 display the SSL lock icon when an insecure page loads a binary file from a trusted site, which could facilitate phishing attacks. Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Firefox before 1.0 and Mozilla before 1.7.5 display the secure site lock icon when a view-source: URL references a secure SSL site while an insecure page is being loaded, which could facilitate phishing attacks. Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Firefox before 1.0 and Mozilla before 1.7.5 allow inactive (background) tabs to focus on input being entered in the active tab, as originally reported using form fields, which allows remote attackers to steal sensitive data that is intended for other sites, which could facilitate phishing attacks. Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Thunderbird Heap-based buffer overflow in MSG_UnEscapeSearchUrl in nsNNTPProtocol.cpp for Mozilla 1.7.3 and earlier allows remote attackers to cause a denial of service (application crash) via an NNTP URL (news:) with a trailing '\' (backslash) character, which prevents a string from being NULL terminated. Robert L. Hollis Christine Walzer INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Firefox Firefox before 1.0 does not properly distinguish between user-generated and synthetic click events, which allows remote attackers to use Javascript to bypass the file download prompt when the user uses the Alt-click feature. Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Firefox mozilla Firefox before 1.0 and Mozilla before 1.7.5 allows inactive (background) tabs to launch dialog boxes, which can allow remote attackers to spoof the dialog boxes from web sites in other windows and facilitate phishing attacks, aka the "Dialog Box Spoofing Vulnerability." Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Firefox before 1.0 and Mozilla before 1.7.5, when configured to use a proxy, respond to 407 proxy auth requests from arbitrary servers, which allows remote attackers to steal NTLM or SPNEGO credentials. Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Thunderbird Thunderbird before 0.9, when running on Windows systems, uses the default handler when processing javascript: links, which invokes Internet Explorer and may expose the Thunderbird user to vulnerabilities in the version of Internet Explorer that is installed on the user's system. NOTE: since the invocation between multiple products is a common practice, and the vulnerabilities inherent in multi-product interactions are not easily enumerable, this issue might be REJECTED in the future. Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Thunderbird 0.6 through 0.9 and Mozilla 1.7 through 1.7.3 does not obey the network.cookie.disableCookieForMailNews preference, which could allow remote attackers bypass the user's intended privacy and security policy by using cookies in e-mail messages. Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Firefox Firefox before 1.0 allows the user to store a (1) javascript: or (2) data: URLs as a Livefeed bookmark, then executes it in the security context of the currently loaded page when the user later accesses the bookmark, which could allow remote attackers to execute arbitrary code. Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Mozilla before 1.7.6, and Firefox before 1.0.1, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability. Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote attackers to spoof the SSL "secure site" lock icon via (1) a web site that does not finish loading, which shows the lock of the previous site, (2) a non-HTTP server that uses SSL, which causes the lock to be displayed when the SSL handshake is completed, or (3) a URL that generates an HTTP 204 error, which updates the icon and location information but does not change the display of the original site. Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Thunderbird Heap-based buffer overflow in the UTF8ToNewUnicode function for Firefox before 1.0.1 and Mozilla before 1.7.6 might allow remote attackers to cause a denial of service (crash) or execute arbitrary code via invalid sequences in a UTF8 encoded string that result in a zero length value. Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Firefox before 1.0.1 allows remote attackers to spoof the (1) security and (2) download modal dialog boxes, which could be used to trick users into executing script or downloading and executing a file, aka "Firespoofing." Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Thunderbird The installation confirmation dialog in Firefox before 1.0.1, Thunderbird before 1.0.1, and Mozilla before 1.7.6 allows remote attackers to use InstallTrigger to spoof the hostname of the host performing the installation via a long "user:pass" sequence in the URL, which appears before the real hostname. Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Thunderbird String handling functions in Mozilla 1.7.3, Firefox 1.0, and Thunderbird before 1.0.2, such as the nsTSubstring_CharT::Replace function, do not properly check the return values of other functions that resize the string, which allows remote attackers to cause a denial of service and possibly execute arbitrary code by forcing an out-of-memory state that causes a reallocation to fail and return a pointer to a fixed address, which leads to heap corruption. Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Firefox The Form Fill feature in Firefox before 1.0.1 allows remote attackers to steal potentially sensitive information via an input control that monitors the values that are generated by the autocomplete capability. Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Firefox before 1.0.1 and Mozilla before 1.7.6 does not restrict xsl:include and xsl:import tags in XSLT stylesheets to the current domain, which allows remote attackers to determine the existence of files on the local system. Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Thunderbird Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to overwrite arbitrary files by tricking the user into downloading a .LNK (link) file twice, which overwrites the file that was referenced in the first .LNK file. Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to spoof the extensions of files to download via the Content-Disposition header, which could be used to trick users into downloading dangerous content. Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Firefox before 1.0.1 and Mozilla before 1.7.6 truncates long sub-domains or paths for display, which may allow remote malicious web sites to spoof legitimate sites and facilitate phishing attacks. Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Firefox before 1.0.1 and Mozilla before 1.7.6, when displaying the HTTP Authentication dialog, do not change the focus to the tab that generated the prompt, which could facilitate spoofing and phishing attacks. Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Thunderbird Firefox 1.0 does not prevent the user from dragging an executable file to the desktop when it has an image/gif content type but has a dangerous extension such as .bat or .exe, which allows remote attackers to bypass the intended restriction and execute arbitrary commands via malformed GIF files that can still be parsed by the Windows batch file parser, aka "firedragging." Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Firefox 1.0 does not invoke the Javascript Security Manager when a user drags a javascript: or data: URL to a tab, which allows remote attackers to bypass the security model, aka "firetabbing." Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Firefox 1.0 allows remote attackers to execute arbitrary code via plugins that load "privileged content" into frames, as demonstrated using certain XUL events when a user drags a scrollbar two times, aka "Firescrolling." Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox The International Domain Name (IDN) support in Firefox 1.0, Camino .8.5, and Mozilla before 1.7.6 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks. Robert L. Hollis Christine Walzer INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Thunderbird Heap-based buffer overflow in GIF2.cpp in Firefox before 1.0.2, Mozilla before to 1.7.6, and Thunderbird before 1.0.2, and possibly other applications that use the same library, allows remote attackers to execute arbitrary code via a GIF image with a crafted Netscape extension 2 block and buffer size. Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Firefox Firefox before 1.0.2 allows remote attackers to execute arbitrary code by tricking a user into saving a page as a Firefox sidebar panel, then using the sidebar panel to inject Javascript into a privileged page. Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox FireFox 1.0.1 and Mozilla before 1.7.6 do not sufficiently address all attack vectors for loading chrome files and hijacking drag and drop events, which allows remote attackers to execute arbitrary XUL code by tricking a user into dragging a scrollbar, a variant of CVE-2005-0527, aka "Firescrolling 2." Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox The find_replen function in jsstr.c in the the Javascript engine for Mozilla Suite 1.7.6, Firefox 1.0.1 and 1.0.2, and Netscape 7.2 allows remote attackers to read portions of heap memory in a Javascript string via the lambda replace method. Robert L. Hollis INTERIM Matthew Wojcik ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Firefox The Plugin Finder Service (PFS) in Firefox before 1.0.3 allows remote attackers to execute arbitrary code via a javascript: URL in the PLUGINSPAGE attribute of an EMBED tag. Robert L. Hollis INTERIM Matthew Wojcik ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Firefox before 1.0.3 and Mozilla Suite before 1.7.7, when blocking a popup, allows remote attackers to execute arbitrary code via a javascript: URL that is executed when the user selects the "Show javascript" option. Robert L. Hollis INTERIM Matthew Wojcik Matthew Wojcik ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Firefox before 1.0.3 and Mozilla Suite before 1.7.7 allows remote attackers to execute arbitrary script in other domains via a setter function for a variable in the target domain, which is executed when the user visits that domain, aka "Cross-site scripting through global scope pollution." Robert L. Hollis INTERIM Matthew Wojcik ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox The favicon functionality in Firefox before 1.0.3 and Mozilla Suite before 1.7.7 allows remote attackers to execute arbitrary code via a <LINK rel="icon"> tag with a javascript: URL in the href attribute, aka "Firelinking." Robert L. Hollis INTERIM Matthew Wojcik ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Firefox before 1.0.3, Mozilla Suite before 1.7.7, and Netscape 7.2 allows remote attackers to execute arbitrary script and code via a new search plugin using sidebar.addSearchEngine, aka "Firesearching 1." Robert L. Hollis INTERIM Matthew Wojcik ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Firefox Multiple "missing security checks" in Firefox before 1.0.3 allow remote attackers to inject arbitrary Javascript into privileged pages using the _search target of the Firefox sidebar. Robert L. Hollis INTERIM Matthew Wojcik ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox The native implementations of InstallTrigger and other functions in Firefox before 1.0.3 and Mozilla Suite before 1.7.7 do not properly verify the types of objects being accessed, which causes the Javascript interpreter to continue execution at the wrong memory address, which may allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code by passing objects of the wrong type. Robert L. Hollis INTERIM Matthew Wojcik ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox The privileged "chrome" UI code in Firefox before 1.0.3 and Mozilla Suite before 1.7.7 allows remote attackers to gain privileges by overriding certain properties or methods of DOM nodes, as demonstrated using multiple attacks involving the eval function or the Script object. Robert L. Hollis INTERIM Matthew Wojcik Matthew Wojcik ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla The InstallTrigger.install method in Firefox before 1.0.5 and Mozilla before 1.7.9 allows remote attackers to execute a callback function in the context of another domain by forcing a page navigation after the install method has been called, which causes the callback to be run in the context of the new page and results in a same origin violation. Robert L. Hollis Christine Walzer Jonathan Baker INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Firefox before 1.0.4 and Mozilla Suite before 1.7.8 does not properly implement certain security checks for script injection, which allows remote attackers to execute script via "Wrapped" javascript: URLs, as demonstrated using (1) a javascript: URL in a view-source: URL, (2) a javascript: URL in a jar: URL, or (3) "a nested variant." Robert L. Hollis Jonathan Baker INTERIM Matthew Wojcik ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Anna Min INTERIM ACCEPTED Daniel Tarnu INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Firefox before 1.0.4 and Mozilla Suite before 1.7.8 do not properly limit privileges of Javascript eval and Script objects in the calling context, which allows remote attackers to conduct unauthorized activities via "non-DOM property overrides," a variant of CVE-2005-1160. Robert L. Hollis Jonathan Baker INTERIM Matthew Wojcik ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Anna Min INTERIM ACCEPTED Daniel Tarnu INTERIM Jonathan Baker Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox The browser user interface in Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 does not properly distinguish between user-generated events and untrusted synthetic events, which makes it easier for remote attackers to perform dangerous actions that normally could only be performed manually by the user. Robert L. Hollis Jonathan Baker INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED John Hoyland INTERIM John Hoyland ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Thunderbird Firefox before 1.0.5, Thunderbird before 1.0.5, Mozilla before 1.7.9, Netscape 8.0.2, and K-Meleon 0.9 runs XBL scripts even when Javascript has been disabled, which makes it easier for remote attackers to bypass such protection. Robert L. Hollis Jonathan Baker INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED John Hoyland INTERIM John Hoyland ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Firefox Firefox 1.0.3 and 1.0.4, and Netscape 8.0.2, allows remote attackers to execute arbitrary code by tricking the user into using the "Set As Wallpaper" (in Firefox) or "Set as Background" (in Netscape) context menu on an image URL that is really a javascript: URL with an eval statement, aka "Firewalling." Robert L. Hollis INTERIM Matthew Wojcik Matthew Wojcik ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Matthew Wojcik ACCEPTED John Hoyland INTERIM Jonathan Baker Jonathan Baker Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Firefox The InstallTrigger.install method in Firefox before 1.0.5 and Mozilla before 1.7.9 allows remote attackers to execute a callback function in the context of another domain by forcing a page navigation after the install method has been called, which causes the callback to be run in the context of the new page and results in a same origin violation. Robert L. Hollis Christine Walzer INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Firefox Firefox before 1.0.5 allows remote attackers to steal sensitive information by opening a malicious link in the Firefox sidebar using the _search target, then injecting script into other pages via a data: URL. Robert L. Hollis INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 allows remote attackers to cause a denial of service (access violation and crash), and possibly execute arbitrary code, by calling InstallVersion.compareTo with an object instead of a string. Robert L. Hollis Jonathan Baker INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED John Hoyland INTERIM John Hoyland ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla A regression error in Firefox 1.0.3 and Mozilla 1.7.7 allows remote attackers to inject arbitrary Javascript from one page into the frameset of another site, aka the frame injection spoofing vulnerability, a re-introduction of a vulnerability that was originally identified and addressed by CVE-2004-0718. Robert L. Hollis Jonathan Baker Christine Walzer INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED John Hoyland INTERIM John Hoyland ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Firefox Firefox before 1.0.5 allows remote attackers to steal information and possibly execute arbitrary code by using standalone applications such as Flash and QuickTime to open a javascript: URL, which is run in the context of the previous page, and may lead to code execution if the standalone application loads a privileged chrome: URL. Robert L. Hollis Christine Walzer Jonathan Baker INTERIM Matthew Wojcik ACCEPTED INTERIM ACCEPTED Matthew Wojcik Matthew Wojcik INTERIM ACCEPTED John Hoyland INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox before 1.0.5 and Mozilla before 1.7.9 does not clearly associate a Javascript dialog box with the web page that generated it, which allows remote attackers to spoof a dialog box from a trusted site and facilitates phishing attacks, aka the "Dialog Origin Spoofing Vulnerability." Robert L. Hollis Christine Walzer Jonathan Baker Matthew Wojcik INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED John Hoyland INTERIM John Hoyland ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 does not properly verify the associated types of DOM node names within the context of their namespaces, which allows remote attackers to modify certain tag properties, possibly leading to execution of arbitrary script or code, as demonstrated using an XHTML document with IMG tags with custom properties ("XHTML node spoofing"). Robert L. Hollis Jonathan Baker INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED John Hoyland INTERIM John Hoyland ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox before 1.0.5 and Mozilla before 1.7.9 does not properly clone base objects, which allows remote attackers to execute arbitrary code by navigating the prototype chain to reach a privileged object. Robert L. Hollis Jonathan Baker INTERIM ACCEPTED INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED John Hoyland INTERIM John Hoyland ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla Firefox 1.0.3 allows remote attackers to execute arbitrary Javascript in other domains by using an IFRAME and causing the browser to navigate to a previous javascript: URL, which can lead to arbitrary code execution when combined with CVE-2005-1477. Robert L. Hollis Jonathan Baker INTERIM Matthew Wojcik ACCEPTED Anna Min INTERIM ACCEPTED Daniel Tarnu INTERIM ACCEPTED ACCEPTED Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 mozilla The install function in Firefox 1.0.3 allows remote web sites on the browser's whitelist, such as update.mozilla.org or addon.mozilla.org, to execute arbitrary Javascript with chrome privileges, leading to arbitrary code execution on the system when combined with vulnerabilities such as CVE-2005-1476, as demonstrated using a javascript: URL as the package icon and a cross-site scripting (XSS) attack on a vulnerable whitelist site. Robert L. Hollis Jonathan Baker INTERIM Matthew Wojcik ACCEPTED Anna Min INTERIM ACCEPTED Daniel Tarnu INTERIM ACCEPTED ACCEPTED Microsoft Windows XP Help and Support Center (HSC) Help and Support Center in Microsoft Windows XP SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code via quotation marks in an hcp:// URL, which are not quoted when constructing the argument list to HelpCtr.exe. Harvey Rubinovitz DRAFT Harvey Rubinovitz INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED John Hoyland INTERIM Anna Min ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Internet Explorer Stack-based buffer overflow in the Vector Graphics Rendering engine (vgx.dll), as used in Microsoft Outlook and Internet Explorer 6.0 on Windows XP SP2, and possibly other versions, allows remote attackers to execute arbitrary code via a Vector Markup Language (VML) file with a long fill parameter within a rect tag. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 A version of Microsoft Windows Server 2003 Service Pack 1 (x86) is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 The application Microsoft Internet Explorer 6 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows XP The operating system installed on the system is Microsoft Windows XP SP2. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows XP The operating system installed on the system is Microsoft Windows XP SP1 (64-bit). Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 The application Microsoft Internet Explorer 5.01 SP4 is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED Robert L. Hollis INTERIM ACCEPTED ACCEPTED Microsoft Windows 2000 The operating system installed on the system is Microsoft Windows 2000 SP4. Robert L. Hollis DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED Microsoft Windows Server 2003 A version of Microsoft Windows Server 2003 (x86) Gold is installed. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Sun Solaris 8 xlock Heap overflow in xlock in Solaris 2.6 through 8 allows local users to gain root privileges via a long (1) XFILESEARCHPATH or (2) XUSERFILESEARCHPATH environmental variable. David Proulx ACCEPTED Microsoft Windows XP The operating system installed on the system is Microsoft Windows XP SP1 (32-bit). Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED Microsoft Windows XP The operating system installed on the system is Microsoft Windows XP. Andrew Buttner ACCEPTED Jonathan Baker INTERIM ACCEPTED ACCEPTED