# CVEs published 2009-05-26

17 CVEs were published on May 26, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-1796](https://cve.now/CVE-2009-1796.md): Cross-site scripting (XSS) vulnerability in Sun Java System Portal Server 6.3.1, 7.1, and 7.2 allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2008-3869](https://cve.now/CVE-2008-3869.md): Heap-based buffer overflow in sadmind in Sun Solaris 8 and 9 allows remote attackers to execute arbitrary code via a crafted RPC request, re (no CVSS)
- [CVE-2008-3870](https://cve.now/CVE-2008-3870.md): Integer overflow in sadmind in Sun Solaris 8 and 9 allows remote attackers to execute arbitrary code via a crafted RPC request that triggers (no CVSS)
- [CVE-2009-1791](https://cve.now/CVE-2009-1791.md): Heap-based buffer overflow in aiff\_read\_header in libsndfile 1.0.15 through 1.0.19, as used in Winamp 5.552 and possibly other media program (no CVSS)
- [CVE-2009-1787](https://cve.now/CVE-2009-1787.md): Multiple SQL injection vulnerabilities in PHP Dir Submit (aka WebsiteSubmitter and Submitter Script) allow remote attackers to bypass authen (no CVSS)
- [CVE-2009-1788](https://cve.now/CVE-2009-1788.md): Heap-based buffer overflow in voc\_read\_header in libsndfile 1.0.15 through 1.0.19, as used in Winamp 5.552 and possibly other media programs (no CVSS)
- [CVE-2009-1789](https://cve.now/CVE-2009-1789.md): mod/server.mod/servmsg.c in Eggheads Eggdrop and Windrop 1.6.19 and earlier allows remote attackers to cause a denial of service (crash) via (no CVSS)
- [CVE-2009-1790](https://cve.now/CVE-2009-1790.md): Cross-site scripting (XSS) vulnerability in CGI RESCUE Trees before 2.11 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2009-1373](https://cve.now/CVE-2009-1373.md): Buffer overflow in the XMPP SOCKS5 bytestream server in Pidgin (formerly Gaim) before 2.5.6 allows remote authenticated users to execute arb (no CVSS)
- [CVE-2009-1374](https://cve.now/CVE-2009-1374.md): Buffer overflow in the decrypt\_out function in Pidgin (formerly Gaim) before 2.5.6 allows remote attackers to cause a denial of service (app (no CVSS)
- [CVE-2009-1375](https://cve.now/CVE-2009-1375.md): The PurpleCircBuffer implementation in Pidgin (formerly Gaim) before 2.5.6 does not properly maintain a certain buffer, which allows remote (no CVSS)
- [CVE-2009-1376](https://cve.now/CVE-2009-1376.md): Multiple integer overflows in the msn\_slplink\_process\_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (no CVSS)
- [CVE-2009-1476](https://cve.now/CVE-2009-1476.md): Buffer overflow in lib/load\_http.c in ippool in Darren Reed IPFilter (aka IP Filter) 4.1.31 allows local users to gain privileges via vector (no CVSS)
- [CVE-2009-1634](https://cve.now/CVE-2009-1634.md): The WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 does not properly implement session management mechan (no CVSS)
- [CVE-2009-1636](https://cve.now/CVE-2009-1636.md): Multiple buffer overflows in the Internet Agent (aka GWIA) component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow re (no CVSS)
- [CVE-2009-1754](https://cve.now/CVE-2009-1754.md): The PackageManagerService class in services/java/com/android/server/PackageManagerService.java in Android 1.5 through 1.5 CRB42 does not pro (no CVSS)
- [CVE-2009-1786](https://cve.now/CVE-2009-1786.md): The malloc subsystem in libc in IBM AIX 5.3 and 6.1 allows local users to create or overwrite arbitrary files via a symlink attack on the lo (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-05-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.