deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-7102
Published: 2007-03-03
Description: Multiple PHP remote file inclusion vulnerabilities in phpBurningPortal quiz-modul 1.0.1, and possibly earlier, allow remote attackers to execute arbitrary PHP code via a URL in the lang_path parameter to (1) quest_delete.php, (2) quest_edit.php, or (3) quest_news.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/20547; https://exchange.xforce.ibmcloud.com/vulnerabilities/29558; https://www.exploit-db.com/exploits/2563
CVE: CVE-2006-7103
Published: 2007-03-03
Description: Multiple directory traversal vulnerabilities in EZOnlineGallery 1.3 and earlier, and possibly other versions before 1.3.2 Beta, allow remote attackers to (1) determine directory existence via a ".." in the album parameter in a show_album action to (a) ezgallery.php, which produces different responses depending on existence; and read arbitrary image files via a ".." in the album or (2) image parameter to (b) image.php.
CVSS Score: 6.4 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/050364.html; http://securityreason.com/securityalert/2362; http://www.ezonlinegallery.com/changelog.txt
CVE: CVE-2006-7104
Published: 2007-03-03
Description: PHP remote file inclusion vulnerability in htmltemplate.php in the Chad Auld MOStlyContent Editor (MOStlyCE) as created on May 2006, a component for Mambo 4.5.4, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/2363; http://www.securityfocus.com/archive/1/448786; http://www.securityfocus.com/bid/20549
CVE: CVE-2006-7105
Published: 2007-03-03
Description: PHP remote file inclusion vulnerability in libs/Smarty.class.php in Smarty 2.6.9 allows remote attackers to execute arbitrary PHP code via a URL in the filename parameter.  NOTE: in the original disclosure, filename is used in a function definition, so this report is probably incorrect
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: http://www.security-express.com/archives/fulldisclosure/2006-10/0292.html; http://www.security-express.com/archives/fulldisclosure/2006-10/0299.html; http://www.securityfocus.com/bid/20557
CVE: CVE-2006-7106
Published: 2007-03-03
Description: PHP remote file inclusion vulnerability in config.inc.php3 in Power Phlogger 2.0.9 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the rel_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/20638; http://www.securityfocus.com/bid/20644; https://exchange.xforce.ibmcloud.com/vulnerabilities/29701
CVE: CVE-2006-7107
Published: 2007-03-03
Description: PHP remote file inclusion vulnerability in upgrade.php in Coalescent Systems freePBX 2.1.3 allows remote attackers to execute arbitrary PHP code via a URL in the amp_conf[AMPWEBROOT] parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/20785; https://exchange.xforce.ibmcloud.com/vulnerabilities/29879; https://www.exploit-db.com/exploits/2665
CVE: CVE-2007-1260
Published: 2007-03-03
Description: Stack-based buffer overflow in the connectHandle function in server.cpp in WebMod 0.48 allows remote attackers to execute arbitrary code via a long string in the Content-Length HTTP header.
CVSS Score: 7.5 (HIGH)
References: http://cybermind.user.stfunoob.com/w48crash/; http://osvdb.org/33834; http://secunia.com/advisories/24346
CVE: CVE-2007-1261
Published: 2007-03-03
Description: Unspecified vulnerability in the reports system in OpenBiblio before 0.6.0 allows attackers to gain privileges via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/35998; http://sourceforge.net/project/shownotes.php?group_id=50071&release_id=488061; http://www.vupen.com/english/advisories/2007/0790
CVE: CVE-2006-7108
Published: 2007-03-04
Description: login in util-linux-2.12a skips pam_acct_mgmt and chauth_tok when authentication is skipped, such as when a Kerberos krlogin session has been established, which might allow users to bypass intended access policies that would be enforced by pam_acct_mgmt and chauth_tok.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/25098; http://secunia.com/advisories/25530; http://secunia.com/advisories/25692
CVE: CVE-2007-0774
Published: 2007-03-04
Description: Stack-based buffer overflow in the map_uri_to_worker function (native/common/jk_uri_worker_map.c) in mod_jk.so for Apache Tomcat JK Web Server Connector 1.2.19 and 1.2.20, as used in Tomcat 4.1.34 and 5.5.20, allows remote attackers to execute arbitrary code via a long URL that triggers the overflow in a URI worker map routine.
CVSS Score: 7.5 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795; http://secunia.com/advisories/24398; http://secunia.com/advisories/24558
CVE: CVE-2006-7109
Published: 2007-03-05
Description: Unrestricted file upload vulnerability in IMCE before 1.6, a Drupal module, allows remote authenticated users to upload arbitrary PHP code via a filename with a double extension such as .php.gif.
CVSS Score: 6.5 (MEDIUM)
References: http://drupal.org/node/87101; http://secunia.com/advisories/22261; http://www.vupen.com/english/advisories/2006/3892
CVE: CVE-2006-7110
Published: 2007-03-05
Description: Directory traversal vulnerability in the delete function in IMCE before 1.6, a Drupal module, allows remote authenticated users to delete arbitrary files via ".." sequences.
CVSS Score: 5.5 (MEDIUM)
References: http://drupal.org/node/87101; http://secunia.com/advisories/22261; http://www.securityfocus.com/bid/20312
CVE: CVE-2006-7111
Published: 2007-03-05
Description: Unspecified vulnerability in Futomi's CGI Cafe KMail CGI 1.0.3 and earlier allows remote attackers to bypass authentication and obtain unauthorized email access via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://futomi.com/library/info/20061012.html; http://secunia.com/advisories/22351; http://www.securityfocus.com/bid/20506
CVE: CVE-2007-1276
Published: 2007-03-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in chooser.cgi in Webmin before 1.330 and Usermin before 1.260 allow remote attackers to inject arbitrary web script or HTML via a crafted filename.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/33832; http://secunia.com/advisories/24321; http://www.securitytracker.com/id?1017711
CVE: CVE-2007-1277
Published: 2007-03-05
Description: WordPress 2.1.1, as downloaded from some official distribution sites during February and March 2007, contains an externally introduced backdoor that allows remote attackers to execute arbitrary commands via (1) an eval injection vulnerability in the ix parameter to wp-includes/feed.php, and (2) an untrusted passthru call in the iz parameter to wp-includes/theme.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://ifsec.blogspot.com/2007/03/wordpress-code-compromised-to-enable.html; http://secunia.com/advisories/24374; http://wordpress.org/development/2007/03/upgrade-212/
CVE: CVE-2007-0711
Published: 2007-03-05
Description: Integer overflow in Apple QuickTime before 7.1.5, when installed on Windows operating systems, allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted 3GP video file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://docs.info.apple.com/article.html?artnum=305149; http://lists.apple.com/archives/Security-announce/2007/Mar/msg00000.html; http://osvdb.org/33905
CVE: CVE-2007-0712
Published: 2007-03-05
Description: Heap-based buffer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MIDI file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://docs.info.apple.com/article.html?artnum=305149; http://lists.apple.com/archives/Security-announce/2007/Mar/msg00000.html; http://osvdb.org/33904
CVE: CVE-2007-0713
Published: 2007-03-05
Description: Heap-based buffer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted QuickTime movie file.
CVSS Score: 5.8 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=305149; http://lists.apple.com/archives/Security-announce/2007/Mar/msg00000.html; http://secunia.com/advisories/24359
CVE: CVE-2007-0714
Published: 2007-03-05
Description: Integer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted QuickTime movie with a User Data Atom (UDTA) with an Atom size field with a large value.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-03/0003.html; http://docs.info.apple.com/article.html?artnum=305149; http://lists.apple.com/archives/Security-announce/2007/Mar/msg00000.html
CVE: CVE-2007-0715
Published: 2007-03-05
Description: Heap-based buffer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PICT file.
CVSS Score: 5.8 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=305149; http://lists.apple.com/archives/Security-announce/2007/Mar/msg00000.html; http://osvdb.org/33901
CVE: CVE-2007-0716
Published: 2007-03-05
Description: Stack-based buffer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted QTIF file.
CVSS Score: 5.8 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=305149; http://lists.apple.com/archives/Security-announce/2007/Mar/msg00000.html; http://osvdb.org/33900
CVE: CVE-2007-0717
Published: 2007-03-05
Description: Integer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted QTIF file.
CVSS Score: 5.8 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=305149; http://lists.apple.com/archives/Security-announce/2007/Mar/msg00000.html; http://osvdb.org/33899
CVE: CVE-2007-0718
Published: 2007-03-05
Description: Heap-based buffer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a QTIF file with a Video Sample Description containing a Color table ID of 0, which triggers memory corruption when QuickTime assumes that a color table exists.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-119
References: http://docs.info.apple.com/article.html?artnum=305149; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=486; http://lists.apple.com/archives/Security-announce/2007/Mar/msg00000.html
CVE: CVE-2007-0994
Published: 2007-03-06
Description: A regression error in Mozilla Firefox 2.x before 2.0.0.2 and 1.x before 1.5.0.10, and SeaMonkey 1.1 before 1.1.1 and 1.0 before 1.0.8, allows remote attackers to execute arbitrary JavaScript as the user via an HTML mail message with a javascript: URI in an (1) img, (2) link, or (3) style tag, which bypasses the access checks and executes code with chrome privileges.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc; ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc; http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=230733
CVE: CVE-2006-7112
Published: 2007-03-06
Description: Directory traversal vulnerability in error.php in MD-Pro 1.0.76 and earlier allows remote authenticated users to read and include arbitrary files via the PNSVlang cookie, as demonstrated by uploading a GIF image using AddDownload or injecting PHP code into a log file, then accessing it.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/20912; https://exchange.xforce.ibmcloud.com/vulnerabilities/30026; https://www.exploit-db.com/exploits/2712
CVE: CVE-2006-7113
Published: 2007-03-06
Description: Unrestricted file upload vulnerability in P-News 2.0 allows remote attackers to upload and execute arbitrary files via an avatar file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/23103; http://www.securityfocus.com/bid/21344; http://www.vupen.com/english/advisories/2006/4770
CVE: CVE-2006-7114
Published: 2007-03-06
Description: P-News 2.0 stores db/user.txt under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as usernames and password hashes via a direct request.  NOTE: this might be the same issue as CVE-2006-6888.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/23103; http://www.vupen.com/english/advisories/2006/4770; https://exchange.xforce.ibmcloud.com/vulnerabilities/30578
CVE: CVE-2006-7115
Published: 2007-03-06
Description: SQL injection vulnerability in PHPKit 1.6.1 RC2 allows remote attackers to inject arbitrary SQL commands via the catid parameter to include.php when the path parameter is set to faq/faq.php, and other unspecified vectors involving guestbook/print.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17479; http://securityreason.com/securityalert/2357; http://www.bb-pcsecurity.de/websecurity/532/org/PHPKit_1.6.1_RC2_%28faq-faq.php%29_Remote_SQL_Injection_Exploit.htm
CVE: CVE-2006-7116
Published: 2007-03-06
Description: SQL injection vulnerability in includes/functions.php in Kubix 0.7 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via the member_id parameter ($id variable) to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/21352; https://exchange.xforce.ibmcloud.com/vulnerabilities/30571; https://www.exploit-db.com/exploits/2863
CVE: CVE-2006-7117
Published: 2007-03-06
Description: Multiple directory traversal vulnerabilities in Kubix 0.7 and earlier allow remote attackers to (1) include and execute arbitrary local files via ".." sequences in the theme cookie to index.php, which is not properly handled by includes/head.php; and (2) read arbitrary files via ".." sequences in the file parameter in an add_dl action to adm_index.php, as demonstrated by reading connect.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/21352; https://exchange.xforce.ibmcloud.com/vulnerabilities/30570; https://exchange.xforce.ibmcloud.com/vulnerabilities/30572
CVE: CVE-2006-7118
Published: 2007-03-06
Description: SQL injection vulnerability in index.asp in DMXReady Site Engine Manager 1.0 allows remote attackers to execute arbitrary SQL commands via the mid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/2358; http://www.securityfocus.com/archive/1/451535/100/0/threaded; http://www.securityfocus.com/bid/21064
CVE: CVE-2006-7119
Published: 2007-03-06
Description: PHP remote file inclusion vulnerability in kernel/system/startup.php in J. He PHPGiggle 12.08 and earlier, as distributed on comscripts.com, allows remote attackers to execute arbitrary PHP code via a URL in the CFG_PHPGIGGLE_ROOT parameter.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/30072; https://www.exploit-db.com/exploits/2732; https://exchange.xforce.ibmcloud.com/vulnerabilities/30072
CVE: CVE-2006-7120
Published: 2007-03-06
Description: PHP remote file inclusion vulnerability in lib/php/phphtmllib-2.5.4/examples/example6.php for maintain 3.0.0-RC2 allows remote attackers to execute arbitrary PHP code via a URL in the phphtmllib parameter.  NOTE: this issue might be in phpHtmlLib.  NOTE: CVE disputes this issue for proper installations of maintain, since $phphtmllib is set in includes.inc before being used in example6.php
CVSS Score: 10.0 (HIGH)
References: http://securityreason.com/securityalert/2359; http://www.securityfocus.com/archive/1/448780/100/0/threaded; http://www.securityfocus.com/bid/20560
CVE: CVE-2006-7121
Published: 2007-03-06
Description: The HTTP server in Linksys SPA-921 VoIP Desktop Phone allows remote attackers to cause a denial of service (reboot) via (1) a long URL, or a long (2) username or (3) password during Basic Authentication.
CVSS Score: 7.8 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-10/0089.html; http://secunia.com/advisories/22267; http://www.osvdb.org/29671
CVE: CVE-2006-7122
Published: 2007-03-06
Description: Cross-site scripting (XSS) vulnerability in the IP Address Lookup functionality in BSQ Sitestats (component for Joomla) 1.8.0, and possibly other versions before 2.2.1, allows remote attackers to inject arbitrary web script and HTML via the ip parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/secunia_research/2006-63/advisory/; http://securityreason.com/securityalert/2360; http://www.securityfocus.com/archive/1/447356/100/0/threaded
CVE: CVE-2006-7123
Published: 2007-03-06
Description: Multiple SQL injection vulnerabilities in BSQ Sitestats (component for Joomla) 1.8.0, and possibly other versions before 2.2.1, allow remote attackers to execute arbitrary SQL commands via (1) unspecified parameters when importing the (a) ip-to-country.csv file; and the (2) HTTP Referer, (3) HTTP User Agent, and (4) HTTP Accept Language headers to (b) bsqtemplateinc.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/secunia_research/2006-63/advisory/; http://securityreason.com/securityalert/2360; http://www.securityfocus.com/archive/1/447356/100/0/threaded
CVE: CVE-2006-7124
Published: 2007-03-06
Description: PHP remote file inclusion vulnerability in external/rssfeeds.php in BSQ Sitestats (component for Joomla) 1.8.0, and possibly other versions before 2.2.1, allows remote attackers to execute arbitrary PHP code via the baseDir parameter.
CVSS Score: 7.5 (HIGH)
References: http://developer.joomla.org/sf/sfmain/do/viewProject/projects.bsq_sitestats; http://secunia.com/secunia_research/2006-63/advisory/; http://securityreason.com/securityalert/2360
CVE: CVE-2006-7125
Published: 2007-03-06
Description: Cross-site scripting (XSS) vulnerability in Joomla BSQ Sitestats 1.8.0 and 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header, which is not properly handled when the administrator views site statistics.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/secunia_research/2006-65/advisory/; http://www.securityfocus.com/archive/1/449125/100/0/threaded; http://www.securityfocus.com/bid/20614
CVE: CVE-2006-7126
Published: 2007-03-06
Description: SQL injection vulnerability in Joomla BSQ Sitestats 1.8.0 and 2.2.1 allows remote attackers to execute arbitrary SQL commands via the query string, possibly PHP_SELF.
CVSS Score: 6.8 (MEDIUM)
References: http://developer.joomla.org/sf/sfmain/do/viewProject/projects.bsq_sitestats; http://secunia.com/secunia_research/2006-65/advisory/; http://www.securityfocus.com/archive/1/449125/100/0/threaded
CVE: CVE-2006-7127
Published: 2007-03-06
Description: Multiple PHP remote file inclusion vulnerabilities in JAF CMS 4.0 and 4.0 RC2 allow remote attackers to execute arbitrary PHP code via a URL in the main_dir parameter to (1) forum/main.php and (2) forum/headlines.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/22143; http://www.rahim.webd.pl/exploity/Exploits/92.txt; http://www.securityfocus.com/bid/20329
CVE: CVE-2006-7128
Published: 2007-03-06
Description: PHP remote file inclusion vulnerability in forum/forum.php JAF CMS 4.0 RC1 allows remote attackers to execute arbitrary PHP code via a URL in the website parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22143; http://www.rahim.webd.pl/exploity/Exploits/92.txt; http://www.securityfocus.com/bid/20310
CVE: CVE-2006-7129
Published: 2007-03-06
Description: ISS BlackICE PC Protection 3.6 cpj and cpu, and possibly earlier versions, allows local users to bypass the protection scheme by using the ZwDeleteFile API function to delete the critical filelock.txt file, which stores information about protected files.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-10/0298.html; http://securityreason.com/securityalert/2361; http://www.matousec.com/info/advisories/BlackICE-Filelock-protection-bypass.php
CVE: CVE-2006-7130
Published: 2007-03-06
Description: PHP remote file inclusion vulnerability in backend/primitives/cache/media.php in Jinzora 2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter, a different vector than CVE-2006-6770.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/2351; http://www.securityfocus.com/archive/1/448290/100/0/threaded; http://www.securityfocus.com/bid/20446
CVE: CVE-2006-7131
Published: 2007-03-06
Description: PHP remote file inclusion vulnerability in extras/mt.php in Jinzora 2.6 allows remote attackers to execute arbitrary PHP code via the web_root parameter.
CVSS Score: 10.0 (HIGH)
References: http://securityreason.com/securityalert/2352; http://www.securityfocus.com/archive/1/448703/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/29556
CVE: CVE-2006-7132
Published: 2007-03-06
Description: Directory traversal vulnerability in pmd-config.php in PHPMyDesk 1.0beta allows remote attackers to include arbitrary local files via the pmdlang parameter to viewticket.php.
CVSS Score: 10.0 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/29872; https://www.exploit-db.com/exploits/2664; https://exchange.xforce.ibmcloud.com/vulnerabilities/29872
CVE: CVE-2006-7133
Published: 2007-03-06
Description: Directory traversal vulnerability in upload/bin/download.php in Upload Tool for PHP 1.0 allows remote attackers to read arbitrary files via (1) ".." sequences or (2) absolute pathnames in the filename parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22973; http://www.craigheffner.com/security/exploits/upload_tool_php.txt; http://www.securityfocus.com/bid/21150
CVE: CVE-2006-7134
Published: 2007-03-06
Description: Unrestricted file upload vulnerability in main_user.php in Upload Tool for PHP 1.0 allows remote attackers to upload and execute arbitrary files with executable extensions such as .php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/22973; http://www.securityfocus.com/bid/21150; http://www.vupen.com/english/advisories/2006/4575
CVE: CVE-2007-1281
Published: 2007-03-06
Description: Kaspersky AntiVirus Engine 6.0.1.411 for Windows and 5.5-10 for Linux allows remote attackers to cause a denial of service (CPU consumption) via a crafted UPX compressed file with a negative offset, which triggers an infinite loop during decompression.
CVSS Score: 7.8 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=485; http://secunia.com/advisories/24391; http://www.securityfocus.com/bid/22795
CVE: CVE-2007-1282
Published: 2007-03-06
Description: Integer overflow in Mozilla Thunderbird before 1.5.0.10 and SeaMonkey before 1.0.8 allows remote attackers to trigger a buffer overflow and possibly execute arbitrary code via a text/enhanced or text/richtext e-mail message with an extremely long line.
CVSS Score: 9.3 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc; http://fedoranews.org/cms/node/2747; http://fedoranews.org/cms/node/2749