# CVEs published 2008-09-10

39 CVEs were published on September 10, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-2326](https://cve.now/CVE-2008-2326.md): mDNSResponder in the Bonjour Namespace Provider in Apple Bonjour for Windows before 1.0.5 allows attackers to cause a denial of service (NUL (no CVSS)
- [CVE-2008-3612](https://cve.now/CVE-2008-3612.md): The Networking subsystem in Apple iPod touch 2.0 through 2.0.2, and iPhone 2.0 through 2.0.2, uses predictable TCP initial sequence numbers, (no CVSS)
- [CVE-2008-3614](https://cve.now/CVE-2008-3614.md): Integer overflow in Apple QuickTime before 7.5.5 on Windows allows remote attackers to execute arbitrary code or cause a denial of service ( (no CVSS)
- [CVE-2008-3615](https://cve.now/CVE-2008-3615.md): ir50\_32.qtx in an unspecified third-party Indeo v5 codec for QuickTime, when used with Apple QuickTime before 7.5.5 on Windows, accesses uni (no CVSS)
- [CVE-2008-3624](https://cve.now/CVE-2008-3624.md): Heap-based buffer overflow in Apple QuickTime before 7.5.5 allows remote attackers to execute arbitrary code or cause a denial of service (a (no CVSS)
- [CVE-2008-3625](https://cve.now/CVE-2008-3625.md): Stack-based buffer overflow in Apple QuickTime before 7.5.5 allows remote attackers to execute arbitrary code or cause a denial of service ( (no CVSS)
- [CVE-2008-3626](https://cve.now/CVE-2008-3626.md): The CallComponentFunctionWithStorage function in Apple QuickTime before 7.5.5 does not properly handle a large entry in the sample\_size\_tabl (no CVSS)
- [CVE-2008-3627](https://cve.now/CVE-2008-3627.md): Apple QuickTime before 7.5.5 does not properly handle (1) MDAT atoms in MP4 video files within QuickTimeH264.qtx, (2) MDAT atoms in mov vide (no CVSS)
- [CVE-2008-3628](https://cve.now/CVE-2008-3628.md): Apple QuickTime before 7.5.5 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) v (no CVSS)
- [CVE-2008-3629](https://cve.now/CVE-2008-3629.md): Apple QuickTime before 7.5.5 allows remote attackers to cause a denial of service (application crash) via a crafted PICT image that triggers (no CVSS)
- [CVE-2008-3630](https://cve.now/CVE-2008-3630.md): mDNSResponder in Apple Bonjour for Windows before 1.0.5, when an application uses the Bonjour API for unicast DNS, does not choose random va (no CVSS)
- [CVE-2008-3631](https://cve.now/CVE-2008-3631.md): Application Sandbox in Apple iPod touch 2.0 through 2.0.2, and iPhone 2.0 through 2.0.2, does not properly isolate third-party applications, (no CVSS)
- [CVE-2008-3632](https://cve.now/CVE-2008-3632.md): Use-after-free vulnerability in WebKit in Apple iPod touch 1.1 through 2.0.2, and iPhone 1.0 through 2.0.2, allows remote attackers to execu (no CVSS)
- [CVE-2008-3634](https://cve.now/CVE-2008-3634.md): Apple iTunes before 8.0 on Mac OS X 10.4.11, when iTunes Music Sharing is enabled but blocked by the host-based firewall, presents misleadin (no CVSS)
- [CVE-2008-3635](https://cve.now/CVE-2008-3635.md): Stack-based buffer overflow in QuickTimeInternetExtras.qtx in an unspecified third-party Indeo v3.2 (aka IV32) codec for QuickTime, when use (no CVSS)
- [CVE-2008-3636](https://cve.now/CVE-2008-3636.md): Integer overflow in the IopfCompleteRequest API in the kernel in Microsoft Windows 2000, XP, Server 2003, and Vista allows context-dependent (no CVSS)
- [CVE-2007-5348](https://cve.now/CVE-2007-5348.md): Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2 (no CVSS)
- [CVE-2007-6717](https://cve.now/CVE-2007-6717.md): Buffer overflow in tftp in bos.net.tcp.client in IBM AIX 5.2.0 and 5.3.0 allows local users to gain privileges via unspecified vectors. (no CVSS)
- [CVE-2008-2253](https://cve.now/CVE-2008-2253.md): Unspecified vulnerability in Microsoft Windows Media Player 11 allows remote attackers to execute arbitrary code via a crafted audio-only fi (no CVSS)
- [CVE-2008-2464](https://cve.now/CVE-2008-2464.md): The mld\_input function in sys/netinet6/mld6.c in the kernel in NetBSD 4.0, FreeBSD, and KAME, when INET6 is enabled, allows remote attackers (no CVSS)
- [CVE-2008-3007](https://cve.now/CVE-2008-3007.md): Argument injection vulnerability in a URI handler in Microsoft Office XP SP3, 2003 SP2 and SP3, 2007 Office System Gold and SP1, and Office (no CVSS)
- [CVE-2008-3008](https://cve.now/CVE-2008-3008.md): Stack-based buffer overflow in the WMEncProfileManager ActiveX control in wmex.dll in Microsoft Windows Media Encoder 9 Series allows remote (no CVSS)
- [CVE-2008-3012](https://cve.now/CVE-2008-3012.md): gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, (no CVSS)
- [CVE-2008-3013](https://cve.now/CVE-2008-3013.md): gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, (no CVSS)
- [CVE-2008-3014](https://cve.now/CVE-2008-3014.md): Buffer overflow in gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and (no CVSS)
- [CVE-2008-3015](https://cve.now/CVE-2008-3015.md): Integer overflow in gdiplus.dll in GDI+ in Microsoft Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visi (no CVSS)
- [CVE-2008-3539](https://cve.now/CVE-2008-3539.md): Unspecified vulnerability in HP OpenView Select Identity (HPSI) Connectors on Windows, as used in HPSI Active Directory Connector 2.30 and e (no CVSS)
- [CVE-2008-3962](https://cve.now/CVE-2008-3962.md): The from\_format function in ssmtp.c in ssmtp 2.61 and 2.62, in certain configurations, uses uninitialized memory for the From: field of an e (no CVSS)
- [CVE-2008-3963](https://cve.now/CVE-2008-3963.md): MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does not properly handle a b'' (b single-quote single-quote) token, aka an (no CVSS)
- [CVE-2008-3964](https://cve.now/CVE-2008-3964.md): Multiple off-by-one errors in libpng before 1.2.32beta01, and 1.4 before 1.4.0beta34, allow context-dependent attackers to cause a denial of (no CVSS)
- [CVE-2008-3965](https://cve.now/CVE-2008-3965.md): SQL injection vulnerability in misc.php in MyBB (aka MyBulletinBoard) before 1.4.1 allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2008-3966](https://cve.now/CVE-2008-3966.md): Multiple cross-site scripting (XSS) vulnerabilities in MyBB (aka MyBulletinBoard) before 1.4.1 allow remote attackers to inject arbitrary we (no CVSS)
- [CVE-2008-3967](https://cve.now/CVE-2008-3967.md): moderation.php in MyBB (aka MyBulletinBoard) before 1.4.1 does not properly check for moderator privileges, which has unknown impact and rem (no CVSS)
- [CVE-2008-3968](https://cve.now/CVE-2008-3968.md): Cross-site scripting (XSS) vulnerability in userlist.php in PunBB before 1.2.20 allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2008-3969](https://cve.now/CVE-2008-3969.md): Multiple unspecified vulnerabilities in BitlBee before 1.2.3 allow remote attackers to "overwrite" and "hijack" existing accounts via unknow (no CVSS)
- [CVE-2008-3970](https://cve.now/CVE-2008-3970.md): pam\_mount 0.10 through 0.45, when luserconf is enabled, does not verify mountpoint and source ownership before mounting a user-defined volum (no CVSS)
- [CVE-2008-3971](https://cve.now/CVE-2008-3971.md): Heap-based buffer overflow in the open\_man\_file function in callbacks.c in gmanedit 0.4.1 allows remote attackers to execute arbitrary code (no CVSS)
- [CVE-2008-3972](https://cve.now/CVE-2008-3972.md): pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart card unless the card's label matches the "OpenSC" string, whi (no CVSS)
- [CVE-2008-4018](https://cve.now/CVE-2008-4018.md): swcons in bos.rte.console in IBM AIX 5.2.0 through 6.1.1 allows local users in the system group to create or overwrite an arbitrary file, an (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-09-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.