# CVEs published 2008-11-26

23 CVEs were published on November 26, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-2378](https://cve.now/CVE-2008-2378.md): Untrusted search path vulnerability in hfkernel in hf 0.7.3 and 0.8 allows local users to gain privileges via a Trojan horse killall program (no CVSS)
- [CVE-2008-5162](https://cve.now/CVE-2008-5162.md): The arc4random function in the kernel in FreeBSD 6.3 through 7.1 does not have a proper entropy source for a short time period immediately a (no CVSS)
- [CVE-2008-2429](https://cve.now/CVE-2008-2429.md): Multiple SQL injection vulnerabilities in Calendarix Basic 0.8.20071118 allow remote attackers to execute arbitrary SQL commands via (1) the (no CVSS)
- [CVE-2008-2431](https://cve.now/CVE-2008-2431.md): Multiple buffer overflows in Novell iPrint Client before 5.06 allow remote attackers to execute arbitrary code by calling the Novell iPrint (no CVSS)
- [CVE-2008-2432](https://cve.now/CVE-2008-2432.md): Insecure method vulnerability in the GetFileList method in an unspecified ActiveX control in Novell iPrint Client before 5.06 allows remote (no CVSS)
- [CVE-2008-5231](https://cve.now/CVE-2008-5231.md): Stack-based buffer overflow in the ExecuteRequest method in the Novell iPrint ActiveX control in ienipp.ocx in Novell iPrint Client 5.06 and (no CVSS)
- [CVE-2008-5232](https://cve.now/CVE-2008-5232.md): Buffer overflow in the CallHTMLHelp method in the Microsoft Windows Media Services ActiveX control in nskey.dll 4.1.00.3917 in Windows Media (no CVSS)
- [CVE-2008-5233](https://cve.now/CVE-2008-5233.md): xine-lib 1.1.12, and other versions before 1.1.15, does not check for failure of malloc in circumstances including (1) the mymng\_process\_hea (no CVSS)
- [CVE-2008-5234](https://cve.now/CVE-2008-5234.md): Multiple heap-based buffer overflows in xine-lib 1.1.12, and other versions before 1.1.15, allow remote attackers to execute arbitrary code (no CVSS)
- [CVE-2008-5235](https://cve.now/CVE-2008-5235.md): Heap-based buffer overflow in the demux\_real\_send\_chunk function in src/demuxers/demux\_real.c in xine-lib before 1.1.15 allows remote attack (no CVSS)
- [CVE-2008-5236](https://cve.now/CVE-2008-5236.md): Multiple heap-based buffer overflows in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allow remote attackers to execute arbitrary (no CVSS)
- [CVE-2008-5237](https://cve.now/CVE-2008-5237.md): Multiple integer overflows in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allow remote attackers to cause a denial of service (c (no CVSS)
- [CVE-2008-5238](https://cve.now/CVE-2008-5238.md): Integer overflow in the real\_parse\_mdpr function in demux\_real.c in xine-lib 1.1.12, and other versions before 1.1.15, allows remote attacke (no CVSS)
- [CVE-2008-5239](https://cve.now/CVE-2008-5239.md): xine-lib 1.1.12, and other 1.1.15 and earlier versions, does not properly handle (a) negative and (b) zero values during unspecified read fu (no CVSS)
- [CVE-2008-5240](https://cve.now/CVE-2008-5240.md): xine-lib 1.1.12, and other 1.1.15 and earlier versions, relies on an untrusted input value to determine the memory allocation and does not c (no CVSS)
- [CVE-2008-5241](https://cve.now/CVE-2008-5241.md): Integer underflow in demux\_qt.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allows remote attackers to cause a denial of serv (no CVSS)
- [CVE-2008-5242](https://cve.now/CVE-2008-5242.md): demux\_qt.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, does not validate the count field before calling calloc for STSD\_ATOM (no CVSS)
- [CVE-2008-5243](https://cve.now/CVE-2008-5243.md): The real\_parse\_headers function in demux\_real.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, relies on an untrusted input leng (no CVSS)
- [CVE-2008-5244](https://cve.now/CVE-2008-5244.md): Unspecified vulnerability in xine-lib before 1.1.15 has unknown impact and attack vectors related to libfaad. (no CVSS)
- [CVE-2008-5245](https://cve.now/CVE-2008-5245.md): xine-lib before 1.1.15 performs V4L video frame preallocation before ascertaining the required length, which has unknown impact and attack v (no CVSS)
- [CVE-2008-5246](https://cve.now/CVE-2008-5246.md): Multiple heap-based buffer overflows in xine-lib before 1.1.15 allow remote attackers to execute arbitrary code via vectors that send ID3 da (no CVSS)
- [CVE-2008-5247](https://cve.now/CVE-2008-5247.md): The real\_parse\_audio\_specific\_data function in demux\_real.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, uses an untrusted hei (no CVSS)
- [CVE-2008-5248](https://cve.now/CVE-2008-5248.md): xine-lib before 1.1.15 allows remote attackers to cause a denial of service (crash) via "MP3 files with metadata consisting only of separato (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-11-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.