# CVEs published 2009-12-08

21 CVEs were published on December 8, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-1298](https://cve.now/CVE-2009-1298.md): The ip\_frag\_reasm function in net/ipv4/ip\_fragment.c in the Linux kernel 2.6.32-rc8, and 2.6.29 and later versions before 2.6.32, calls IP\_I (no CVSS)
- [CVE-2009-1568](https://cve.now/CVE-2009-1568.md): Stack-based buffer overflow in ienipp.ocx in Novell iPrint Client 5.30, and possibly other versions before 5.32, allows remote attackers to (no CVSS)
- [CVE-2009-1569](https://cve.now/CVE-2009-1569.md): Multiple stack-based buffer overflows in Novell iPrint Client 4.38, 5.30, and possibly other versions before 5.32 allow remote attackers to (no CVSS)
- [CVE-2009-3844](https://cve.now/CVE-2009-3844.md): Stack-based buffer overflow in the OmniInet process in HP OpenView Data Protector Application Recovery Manager 5.50 and 6.0 allows remote at (no CVSS)
- [CVE-2009-4236](https://cve.now/CVE-2009-4236.md): The process function in data/class/pages/admin/customer/LC\_Page\_Admin\_Customer\_SearchCustomer.php in EC-CUBE Ver2 2.4.0 RC1 through 2.4.1, a (no CVSS)
- [CVE-2009-4033](https://cve.now/CVE-2009-4033.md): A certain Red Hat patch for acpid 1.0.4 effectively triggers a call to the open function with insufficient arguments, which might allow loca (no CVSS)
- [CVE-2009-4229](https://cve.now/CVE-2009-4229.md): Multiple SQL injection vulnerabilities in ActiveWebSoftwares Active Bids allow remote attackers to execute arbitrary SQL commands via (1) th (no CVSS)
- [CVE-2009-4230](https://cve.now/CVE-2009-4230.md): Multiple stack-based buffer overflows in src/Task.cc in the FastCGI program in IIPImage Server before 0.9.8 might allow remote attackers to (no CVSS)
- [CVE-2009-4231](https://cve.now/CVE-2009-4231.md): Directory traversal vulnerability in as/lib/plugins.php in SweetRice 0.5.3 and earlier allows remote attackers to include and execute arbitr (no CVSS)
- [CVE-2009-4232](https://cve.now/CVE-2009-4232.md): The Kide Shoutbox (com\_kide) component 0.4.6 for Joomla! does not properly perform authentication, which allows remote attackers to post mes (no CVSS)
- [CVE-2009-4233](https://cve.now/CVE-2009-4233.md): Cross-site scripting (XSS) vulnerability in modules/mod\_yj\_whois.php in the YJ Whois component 1.0x and 1.5.x for Joomla! allows remote atta (no CVSS)
- [CVE-2009-4234](https://cve.now/CVE-2009-4234.md): Cross-site scripting (XSS) vulnerability in loginpages/error\_user.shtml on the Micronet Network Access Controller SP1910 allows remote attac (no CVSS)
- [CVE-2009-4235](https://cve.now/CVE-2009-4235.md): acpid 1.0.4 sets an unrestrictive umask, which might allow local users to leverage weak permissions on /var/log/acpid, and obtain sensitive (no CVSS)
- [CVE-2009-3586](https://cve.now/CVE-2009-3586.md): Off-by-one error in src/http.c in CoreHTTP 0.5.3.1 and earlier allows remote attackers to cause a denial of service or possibly execute arbi (no CVSS)
- [CVE-2009-4225](https://cve.now/CVE-2009-4225.md): Stack-based buffer overflow in the PestPatrol ActiveX control (ppctl.dll) 5.6.7.9 in CA eTrust PestPatrol allows remote attackers to execute (no CVSS)
- [CVE-2009-4226](https://cve.now/CVE-2009-4226.md): Race condition in the IP module in the kernel in Sun OpenSolaris snv\_106 through snv\_124 allows remote attackers to cause a denial of servic (no CVSS)
- [CVE-2009-4227](https://cve.now/CVE-2009-4227.md): Stack-based buffer overflow in the read\_1\_3\_textobject function in f\_readold.c in Xfig 3.2.5b and earlier, and in the read\_textobject functi (no CVSS)
- [CVE-2009-4228](https://cve.now/CVE-2009-4228.md): Stack consumption vulnerability in u\_bound.c in Xfig 3.2.5b and earlier allows remote attackers to cause a denial of service (application cr (no CVSS)
- [CVE-2009-2749](https://cve.now/CVE-2009-2749.md): Feature Pack for Communications Enabled Applications (CEA) before 1.0.0.1 for IBM WebSphere Application Server 7.0.0.7 uses predictable sess (no CVSS)
- [CVE-2009-2843](https://cve.now/CVE-2009-2843.md): Java for Mac OS X 10.5 before Update 6 and 10.6 before Update 1 accepts expired certificates for applets, which makes it easier for remote a (no CVSS)
- [CVE-2009-3994](https://cve.now/CVE-2009-3994.md): Stack-based buffer overflow in the GetUID function in src-IL/src/il\_dicom.c in DevIL 1.7.8 allows remote attackers to cause a denial of serv (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-12-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.