CVE Vulnerability Catalog

Woltlab Burning Book 1.0 Gold, 1.1.1e, and possibly other versions contain an SQL injection vulnerability in addentry.php. Remote attackers can execute arbitrary SQL commands via the user-agent parameter.

Multiple vulnerabilities in libXpm version 6.8.1 and earlier, used in XFree86 and other packages, include integer overflows, out-of-bounds memory accesses, directory traversal, shell metacharacter handling, endless loops, and memory leaks. These could allow remote attackers to obtain sensitive information, cause denial of service (application crash), or execute arbitrary code via a crafted XPM image file.

Multiple buffer overflows in the IMAP service in Mercury/32 4.01a allow remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via long arguments to the (1) EXAMINE, (2) SUBSCRIBE, (3) STATUS, (4) APPEND, (5) CHECK, (6) CLOSE, (7) EXPUNGE, (8) FETCH, (9) RENAME, (10) DELETE, (11) LIST, (12) SEARCH, (13) CREATE, or (14) UNSUBSCRIBE commands.

Unknown vulnerability in the bsd.a kernel networking for SGI IRIX versions 6.5.22 through 6.5.25, and possibly earlier, in which 't_unbind changes t_bind's behavior.'

The load_elf_binary function in the binfmt_elf loader in Linux kernel 2.4.x up to 2.4.27 and 2.6.x up to 2.6.8 does not properly check return values from calls to the kernel_read function, which may allow local users to modify sensitive memory in a setuid program and execute arbitrary code.

Buffer overflow in the exif_read_data function in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to execute arbitrary code via a long section name in an image file.

In PHP versions 4.x to 4.3.9 and 5.x to 5.0.2, the safe mode checks truncate the file path before passing data to the realpath function, which could allow attackers to bypass safe mode restrictions.

Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CVE-2004-0901.

The HyperTerminal application in Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value saved in a session file, allowing remote attackers to execute arbitrary code via a malicious .ht session file, website, or Telnet URL in an email, triggering a buffer overflow.

The vulnerability in the LSASS (Local Security Authority Subsystem Service) on Windows 2000 Server and Windows Server 2003 is due to improper validation of connection information. This allows a local user to elevate privileges by running a specially crafted program.

An integer overflow in the real_setup_and_get_header function in real.c for Unix MPlayer 1.0pre5 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a Real RTSP streaming media file with a -1 content-length field, which leads to a heap-based buffer overflow.

A format string vulnerability in Kreed 1.05 and earlier allows remote attackers to execute arbitrary code via format specifiers in a nickname or message text.

The pnm_get_chunk function in xine 0.99.2 and earlier, and other packages such as MPlayer that use the same code, does not properly verify that the chunk size is less than the PREAMBLE_SIZE, which causes a read operation with a negative length that leads to a buffer overflow via RMF_TAG, DATA_TAG, PROP_TAG, MDPR_TAG, and CONT_TAG values.

A buffer overflow vulnerability in the C2S module of the open source Jabber 2.x server (Jabberd) allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long username.

An off-by-one error in the mysasl_canon_user function in Cyrus IMAP Server 2.2.9 and earlier leads to a buffer overflow, which may allow remote attackers to execute arbitrary code via the username.

In Veritas Backup Exec versions 8.x before 8.60.3878 Hotfix 68 and 9.x before 9.1.4691 Hotfix 40, the Agent Browser component contains a stack-based buffer overflow. A remote attacker can exploit this vulnerability by sending a registration request with a long hostname, allowing arbitrary code execution.

Buffer overflow vulnerability in hpsockd before version 0.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code.

A stack-based buffer overflow in IN_CDDA.dll in Winamp 5.05 (and possibly 5.06) allows remote attackers to execute arbitrary code via a crafted .m3u playlist file.

phpMyAdmin versions 2.6.0-pl2 and earlier before 2.6.1, with external transformations enabled, allows remote attackers to execute arbitrary commands via shell metacharacters.

Vulnerability in PHP 4.x up to 4.3.9 and PHP 5.x up to 5.0.2, running in safe mode on a multithreaded Unix webserver, allows local users to bypass safe_mode_exec_dir restrictions and execute commands outside of the intended directory by using shell metacharacters in the current directory name.