Gentoo Linux 1.4

The set_default_speeds function in backend/backend.c in NVidia NVClock before 0.8b2 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/nvclock temporary file.

Published: 2007-07-25T17:00:00.000Z
Updated: 2024-08-07T14:21:36.106Z

Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and possibly other vectors involving the action variable.

Published: 2007-02-21T17:00:00.000Z
Updated: 2024-08-07T12:43:22.436Z

The configuration of NetHack 3.4.3-r1 and earlier, Falcon's Eye 1.9.4a and earlier, and Slash'EM 0.0.760 and earlier on Gentoo Linux allows local users in the games group to modify saved games files to execute arbitrary code via buffer overflows and overwrite arbitrary files via symlink attacks.

Published: 2006-03-25T00:00:00.000Z
Updated: 2024-08-07T17:12:21.262Z

Heap-based buffer overflow in psd.c for ImageMagick 6.1.0, 6.1.7, and possibly earlier versions allows remote attackers to execute arbitrary code via a .PSD image file with a large number of layers.

Published: 2005-01-19T05:00:00.000Z
Updated: 2024-08-07T20:57:40.834Z

The arch_get_unmapped_area function in mmap.c in the PaX patches for Linux kernel 2.6, when Address Space Layout Randomization (ASLR) is enabled, allows local users to cause a denial of service (infinite loop) via unknown attack vectors.

Published: 2005-05-10T04:00:00.000Z
Updated: 2024-08-08T01:07:49.194Z

SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.

Published: 2005-02-26T05:00:00.000Z
Updated: 2024-08-08T01:00:37.152Z

Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a wrapper line.

Published: 2005-02-13T05:00:00.000Z
Updated: 2024-08-08T00:53:23.983Z

Tomcat before 5.0.27-r3 in Gentoo Linux sets the default permissions on the init scripts as tomcat:tomcat, but executes the scripts with root privileges, which could allow local users in the tomcat group to execute arbitrary commands as root by modifying the scripts.

Published: 2005-02-13T05:00:00.000Z
Updated: 2024-08-08T00:53:23.647Z

Archive::Zip Perl module before 1.14, when used by antivirus programs such as amavisd-new, allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system.

Published: 2004-12-01T05:00:00.000Z
Updated: 2024-08-08T00:39:00.876Z

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.6.0-pl2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the PmaAbsoluteUri parameter, (2) the zero_rows parameter in read_dump.php, (3) the confirm form, or (4) an error message generated by the internal phpMyAdmin parser.

Published: 2004-11-24T05:00:00.000Z
Updated: 2024-08-08T00:39:00.403Z

Sophos Anti-Virus before 3.87.0, and Sophos Anti-Virus for Windows 95, 98, and Me before 3.88.0, allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system.

Published: 2004-11-19T05:00:00.000Z
Updated: 2024-08-08T00:31:48.243Z

RAV antivirus allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system.

Published: 2004-11-19T05:00:00.000Z
Updated: 2024-08-08T00:31:48.229Z

Eset Anti-Virus before 1.020 (16th September 2004) allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system.

Published: 2004-11-19T05:00:00.000Z
Updated: 2024-08-08T00:31:48.168Z

Kaspersky 3.x to 4.x allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system.

Published: 2004-11-19T05:00:00.000Z
Updated: 2024-08-08T00:31:48.124Z

Computer Associates (CA) InoculateIT 6.0, eTrust Antivirus r6.0 through r7.1, eTrust Antivirus for the Gateway r7.0 and r7.1, eTrust Secure Content Manager, eTrust Intrusion Detection, EZ-Armor 2.0 through 2.4, and EZ-Antivirus 6.1 through 6.3 allow remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system.

Published: 2004-11-19T05:00:00.000Z
Updated: 2024-08-08T00:31:47.979Z

McAfee Anti-Virus Engine DATS drivers before 4398 released on Oct 13th 2004 and DATS Driver before 4397 October 6th 2004 allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system.

Published: 2004-11-19T05:00:00.000Z
Updated: 2024-08-08T00:31:48.096Z

Buffer overflow in the MSN protocol handler for gaim 0.79 to 1.0.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an "unexpected sequence of MSNSLP messages" that results in an unbounded copy operation that writes to the wrong buffer.

Published: 2004-10-21T04:00:00.000Z
Updated: 2024-08-08T00:31:47.791Z

getmail 4.x before 4.2.0, and other versions before 3.2.5, when run as root, allows local users to write files in arbitrary directories via a symlink attack on subdirectories in the maildir.

Published: 2004-09-24T04:00:00.000Z
Updated: 2024-08-08T00:31:47.634Z

getmail 4.x before 4.2.0, when run as root, allows local users to overwrite arbitrary files via a symlink attack on an mbox file.

Published: 2004-09-24T04:00:00.000Z
Updated: 2024-08-08T00:31:47.817Z

Format string vulnerability in Speedtouch USB driver before 1.3.1 allows local users to execute arbitrary code via (1) modem_run, (2) pppoa2, or (3) pppoa3.

Published: 2004-10-20T04:00:00.000Z
Updated: 2024-08-08T00:31:47.532Z

The mod_dav module in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (child process crash) via a certain sequence of LOCK requests for a location that allows WebDAV authoring access.

Published: 2004-09-17T04:00:00.000Z
Updated: 2024-08-08T00:31:47.844Z

The mod_authz_svn module in Subversion 1.0.7 and earlier does not properly restrict access to all metadata on unreadable paths, which could allow remote attackers to gain sensitive information via (1) svn log -v, (2) svn propget, or (3) svn blame, and other commands that follow renames.

Published: 2004-11-19T05:00:00.000Z
Updated: 2024-08-08T00:31:46.965Z

Konqueror in KDE 3.2.3 and earlier allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk, .plc.uk and .firm.in, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session.

Published: 2004-09-14T04:00:00.000Z
Updated: 2024-08-08T00:31:46.647Z

Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 may allow remote attackers to execute arbitrary messages via format string specifiers in certain log messages for HTTPS that are handled by the ssl_log function.

Published: 2004-07-21T04:00:00.000Z
Updated: 2024-08-08T00:24:27.061Z

Rule Set Based Access Control (RSBAC) 1.2.2 through 1.2.3 allows access to sys_creat, sys_open, and sys_mknod inside jails, which could allow local users to gain elevated privileges.

Published: 2004-07-13T04:00:00.000Z
Updated: 2024-08-08T00:24:27.023Z

Buffer overflow in write_packet in control.c for l2tpd may allow remote attackers to execute arbitrary code.

Published: 2004-07-13T04:00:00.000Z
Updated: 2024-08-08T00:24:27.036Z

The Unreal Engine, as used in DeusEx 1.112fm and earlier, Devastation 390 and earlier, Mobile Forces 20000 and earlier, Nerf Arena Blast 1.2 and earlier, Postal 2 1337 and earlier, Rune 107 and earlier, Tactical Ops 3.4.0 and earlier, Unreal 1 226f and earlier, Unreal II XMP 7710 and earlier, Unreal Tournament 451b and earlier, Unreal Tournament 2003 2225 and earlier, Unreal Tournament 2004 before 3236, Wheel of Time 333b and earlier, and X-com Enforcer, allows remote attackers to execute arbitrary code via a UDP packet containing a secure query with a long value, which overwrites memory.

Published: 2004-06-30T04:00:00.000Z
Updated: 2024-08-08T00:24:26.584Z

The HTTP client and server in giFT-FastTrack 0.8.6 and earlier allows remote attackers to cause a denial of service (crash), possibly via an empty search query, which triggers a NULL dereference.

Published: 2004-06-30T04:00:00.000Z
Updated: 2024-08-08T00:24:26.708Z

Multiple buffer overflows in the st_wavstartread function in wav.c for Sound eXchange (SoX) 12.17.2 through 12.17.4 allow remote attackers to execute arbitrary code via certain WAV file header fields.

Published: 2004-08-02T04:00:00.000Z
Updated: 2024-08-08T00:24:26.063Z

Linux kernel 2.4.x and 2.6.x for x86 allows local users to cause a denial of service (system crash), possibly via an infinite loop that triggers a signal handler with a certain sequence of fsave and frstor instructions, as originally demonstrated using a "crash.c" program.

Published: 2004-06-15T04:00:00.000Z
Updated: 2024-08-08T00:24:26.084Z

Multiple stack-based buffer overflows in the word-list-compress functionality in compress.c for Aspell allow local users to execute arbitrary code via a long entry in the wordlist that is not properly handled when using the (1) "c" compress option or (2) "d" decompress option.

Published: 2004-06-11T04:00:00.000Z
Updated: 2024-08-08T00:24:25.709Z

The e1000 driver for Linux kernel 2.4.26 and earlier does not properly initialize memory before using it, which allows local users to read portions of kernel memory. NOTE: this issue was originally incorrectly reported as a "buffer overflow" by some sources.

Published: 2004-06-08T04:00:00.000Z
Updated: 2024-08-08T00:24:26.913Z

Buffer overflow in the MSN protocol plugins (1) object.c and (2) slp.c for Gaim before 0.82 allows remote attackers to cause a denial of service and possibly execute arbitrary code via MSNSLP protocol messages that are not properly handled in a strncpy call.

Published: 2004-09-02T04:00:00.000Z
Updated: 2024-08-08T00:17:15.132Z

Multiple unknown vulnerabilities in Linux kernel 2.4 and 2.6 allow local users to gain privileges or access kernel memory, as found by the Sparse source code checking tool.

Published: 2004-06-23T04:00:00.000Z
Updated: 2024-08-08T00:17:15.147Z

The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters.

Published: 2004-06-30T04:00:00.000Z
Updated: 2024-08-08T00:17:15.258Z

Stack-based buffer overflow in pavuk 0.9pl28, 0.9pl27, and possibly other versions allows remote web sites to execute arbitrary code via a long HTTP Location header.

Published: 2004-07-06T04:00:00.000Z
Updated: 2024-08-08T00:17:14.989Z

ProFTPD 1.2.9 treats the Allow and Deny directives for CIDR based ACL entries as if they were AllowAll, which could allow FTP clients to bypass intended access restrictions.

Published: 2004-05-05T04:00:00.000Z
Updated: 2024-08-08T00:17:15.157Z

XDM in XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0, which could allow remote attackers to connect to the port, in violation of the intended restrictions.

Published: 2004-06-03T04:00:00.000Z
Updated: 2024-08-08T00:17:14.693Z

serve_notify in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle empty data lines, which may allow remote attackers to perform an "out-of-bounds" write for a single byte to execute arbitrary code or modify critical program data.

Published: 2004-06-11T04:00:00.000Z
Updated: 2024-08-08T00:17:14.976Z

Integer overflow in the "Max-dotdot" CVS protocol command (serve_max_dotdot) for CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to cause a server crash, which could cause temporary data to remain undeleted and consume disk space.

Published: 2004-06-11T04:00:00.000Z
Updated: 2024-08-08T00:17:14.946Z

Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code.

Published: 2004-06-11T04:00:00.000Z
Updated: 2024-08-08T00:17:14.603Z

CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle malformed "Entry" lines, which prevents a NULL terminator from being used and may lead to a denial of service (crash), modification of critical program data, or arbitrary code execution.

Published: 2004-06-11T04:00:00.000Z
Updated: 2024-08-08T00:17:14.669Z

Buffer overflow in the HTTP parser for MPlayer 1.0pre3 and earlier, 0.90, and 0.91 allows remote attackers to execute arbitrary code via a long Location header.

Published: 2004-04-07T04:00:00.000Z
Updated: 2024-08-08T00:17:14.357Z

Buffer overflow in the UUDeview package, as used in WinZip 6.2 through WinZip 8.1 SR-1, and possibly other packages, allows remote attackers to execute arbitrary code via a MIME archive with certain long MIME parameters.

Published: 2004-03-18T05:00:00.000Z
Updated: 2024-08-08T00:17:14.219Z

Multiple format string vulnerabilities in Midnight Commander (mc) before 4.6.0 may allow attackers to cause a denial of service or execute arbitrary code.

Published: 2004-05-05T04:00:00.000Z
Updated: 2024-08-08T00:10:03.655Z

Multiple vulnerabilities in Midnight Commander (mc) before 4.6.0, with unknown impact, related to "Insecure temporary file and directory creations."

Published: 2004-05-05T04:00:00.000Z
Updated: 2024-08-08T00:10:03.983Z

The framebuffer driver in Linux kernel 2.6.x does not properly use the fb_copy_cmap function, with unknown impact.

Published: 2004-05-05T04:00:00.000Z
Updated: 2024-08-08T00:10:03.802Z

Multiple buffer overflows in Midnight Commander (mc) before 4.6.0 may allow attackers to cause a denial of service or execute arbitrary code.

Published: 2004-05-05T04:00:00.000Z
Updated: 2024-08-08T00:10:03.623Z

Multiple buffer overflows in (1) iso2022jp.c or (2) shiftjis.c for Courier-IMAP before 3.0.0, Courier before 0.45, and SqWebMail before 4.0.0 may allow remote attackers to execute arbitrary code "when Unicode character is out of BMP range."

Published: 2004-03-16T05:00:00.000Z
Updated: 2024-08-08T00:10:03.739Z