# CVEs published 2009-01-15

24 CVEs were published on January 15, 2009: 0 critical, 2 high. Days are UTC.

- [CVE-2008-5902](https://cve.now/CVE-2008-5902.md): Buffer overflow in the xrdp\_bitmap\_invalidate function in xrdp/xrdp\_bitmap.c in xrdp 0.4.1 and earlier allows remote attackers to execute ar (no CVSS)
- [CVE-2008-5903](https://cve.now/CVE-2008-5903.md): Array index error in the xrdp\_bitmap\_def\_proc function in xrdp/funcs.c in xrdp 0.4.1 and earlier allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2008-5904](https://cve.now/CVE-2008-5904.md): The rdp\_rdp\_process\_color\_pointer\_pdu function in rdp/rdp\_rdp.c in xrdp 0.4.1 and earlier allows remote RDP servers to have an unknown impac (no CVSS)
- [CVE-2008-5905](https://cve.now/CVE-2008-5905.md): The web interface plugin in KTorrent before 3.1.4 allows remote attackers to bypass intended access restrictions and upload arbitrary torren (no CVSS)
- [CVE-2008-5906](https://cve.now/CVE-2008-5906.md): Eval injection vulnerability in the web interface plugin in KTorrent before 3.1.4 allows remote attackers to execute arbitrary PHP code via (no CVSS)
- [CVE-2008-5907](https://cve.now/CVE-2008-5907.md): The png\_check\_keyword function in pngwutil.c in libpng before 1.0.42, and 1.2.x before 1.2.34, might allow context-dependent attackers to se (no CVSS)
- [CVE-2009-0029](https://cve.now/CVE-2009-0029.md): The ABI in the Linux kernel 2.6.28 and earlier on s390, powerpc, sparc64, and mips 64-bit platforms requires that a 32-bit argument in a 64- (no CVSS)
- [CVE-2009-0122](https://cve.now/CVE-2009-0122.md): hplip.postinst in HP Linux Imaging and Printing (HPLIP) 2.7.7 and 2.8.2 on Ubuntu allows local users to change the ownership of arbitrary fi (no CVSS)
- [CVE-2009-0123](https://cve.now/CVE-2009-0123.md): Unspecified vulnerability in Apple Safari on Mac OS X 10.5 and Windows allows remote attackers to read arbitrary files on a client machine v (no CVSS)
- [CVE-2009-0124](https://cve.now/CVE-2009-0124.md): The tqsl\_verifyDataBlock function in openssl\_cert.cpp in American Radio Relay League (ARRL) tqsllib 2.0 does not properly check the return v (no CVSS)
- [CVE-2009-0125](https://cve.now/CVE-2009-0125.md): NOTE: this issue has been disputed by the upstream vendor. (no CVSS)
- [CVE-2009-0126](https://cve.now/CVE-2009-0126.md): The decrypt\_public function in lib/crypt.cpp in the client in Berkeley Open Infrastructure for Network Computing (BOINC) 6.2.14 and 6.4.5 do (no CVSS)
- [CVE-2009-0127](https://cve.now/CVE-2009-0127.md): M2Crypto does not properly check the return value from the OpenSSL EVP\_VerifyFinal, DSA\_verify, ECDSA\_verify, DSA\_do\_verify, and ECDSA\_do\_ve (no CVSS)
- [CVE-2009-0128](https://cve.now/CVE-2009-0128.md): plugins/crypto/openssl/crypto\_openssl.c in Simple Linux Utility for Resource Management (aka SLURM or slurm-llnl) does not properly check th (no CVSS)
- [CVE-2009-0129](https://cve.now/CVE-2009-0129.md): libcrypt-openssl-dsa-perl does not properly check the return value from the OpenSSL DSA\_verify and DSA\_do\_verify functions, which might allo (no CVSS)
- [CVE-2009-0130](https://cve.now/CVE-2009-0130.md): lib/crypto/c\_src/crypto\_drv.c in erlang does not properly check the return value from the OpenSSL DSA\_do\_verify function, which might allow (CVSS 7.5)
- [CVE-2009-0131](https://cve.now/CVE-2009-0131.md): The UFS implementation in the kernel in Sun OpenSolaris snv\_29 through snv\_90 allows local users to cause a denial of service (panic) via th (no CVSS)
- [CVE-2009-0132](https://cve.now/CVE-2009-0132.md): Integer overflow in the aio\_suspend function in Sun Solaris 8 through 10 and OpenSolaris, when 32-bit mode is enabled, allows local users to (no CVSS)
- [CVE-2009-0133](https://cve.now/CVE-2009-0133.md): Buffer overflow in Microsoft HTML Help Workshop 4.74 and earlier allows context-dependent attackers to execute arbitrary code via a .hhp fil (no CVSS)
- [CVE-1999-1593](https://cve.now/CVE-1999-1593.md): Windows Internet Naming Service (WINS) allows remote attackers to cause a denial of service (connectivity loss) or steal credentials via a 1 (no CVSS)
- [CVE-2003-1566](https://cve.now/CVE-2003-1566.md): Microsoft Internet Information Services (IIS) 5.0 does not log requests that use the TRACK method, which allows remote attackers to obtain s (no CVSS)
- [CVE-2003-1567](https://cve.now/CVE-2003-1567.md): The undocumented TRACK method in Microsoft Internet Information Services (IIS) 5.0 returns the content of the original request in the body o (CVSS 7.5)
- [CVE-2009-0120](https://cve.now/CVE-2009-0120.md): The IBM WebSphere DataPower XML Security Gateway XS40 with firmware 3.6.1.5 allows remote attackers to cause a denial of service (device reb (no CVSS)
- [CVE-2009-0121](https://cve.now/CVE-2009-0121.md): SQL injection vulnerability in frontpage.php in Goople CMS 1.8.2 allows remote attackers to execute arbitrary SQL commands via the password (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-01-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.