CVE Vulnerability Catalog

In PHP versions 4.x to 4.3.9 and 5.x to 5.0.2, the safe mode checks truncate the file path before passing data to the realpath function, which could allow attackers to bypass safe mode restrictions.

Buffer overflow in the exif_read_data function in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to execute arbitrary code via a long section name in an image file.

An off-by-one error in the mysasl_canon_user function in Cyrus IMAP Server 2.2.9 and earlier leads to a buffer overflow, which may allow remote attackers to execute arbitrary code via the username.

Integer signedness error in the ssh2_rdpkt function in PuTTY before 0.56 allows remote attackers to execute arbitrary code via a SSH2_MSG_DEBUG packet with a modified stringlen parameter, which leads to a buffer overflow.

In Veritas Backup Exec versions 8.x before 8.60.3878 Hotfix 68 and 9.x before 9.1.4691 Hotfix 40, the Agent Browser component contains a stack-based buffer overflow. A remote attacker can exploit this vulnerability by sending a registration request with a long hostname, allowing arbitrary code execution.

The load_elf_binary function in the binfmt_elf loader in Linux kernel 2.4.x up to 2.4.27 and 2.6.x up to 2.6.8 does not properly check return values from calls to the kernel_read function, which may allow local users to modify sensitive memory in a setuid program and execute arbitrary code.

Untrusted execution path vulnerability in invscout in IBM AIX 5.1.0, 5.2.0, and 5.3.0 allows local users to gain privileges by modifying the PATH environment variable to point to a malicious 'uname' program, which is executed from lsvpd after lsvpd has been invoked by invscout.

The init scripts in Great Internet Mersenne Prime Search (GIMPS) 23.9 and earlier execute user-owned programs with root privileges, which allows local users to gain privileges by modifying the programs.

Untrusted execution path vulnerability in chcod on AIX IBM 5.1.0, 5.2.0, and 5.3.0 allows local users to execute arbitrary programs by modifying the PATH environment variable to point to a malicious 'grep' program, which is executed from chcod.

The vulnerability in Cisco Secure Access Control Server for Windows and Solution Engine version 3.3.1, when EAP-TLS protocol is enabled, improperly handles expired or untrusted certificates. This allows a remote attacker to bypass authentication and gain unauthorized access using a cryptographically correct certificate with valid fields such as the username.

Multiple buffer overflows in ProZilla 1.3.6-r2 and earlier in files http.c, http-retr.c, main.c and other network protocol handling code allow remote servers to execute arbitrary code via a long Location header.

Multiple vulnerabilities in the IGMP functionality for Linux kernel 2.4.22 to 2.4.28, and 2.6.x to 2.6.9, allow local and remote attackers to cause a denial of service or execute arbitrary code via (1) the ip_mc_source function, which decrements a counter to -1, or (2) the igmp_marksources function, which does not properly validate IGMP message parameters and performs an out-of-bounds read.

Heap-based buffer overflow in the pnm_get_chunk function for xine 0.99.2, and other packages such as MPlayer that use the same code, allows remote attackers to execute arbitrary code via long PNA_TAG values, a different vulnerability than CVE-2004-1188.

Buffer overflow in the WodFtpDLX.ocx (WeOnlyDo!) ActiveX component before version 2.3.2.97, used in CoffeeCup Direct FTP 6.2.0.62 and CoffeeCup Free FTP 3.0.0.10, and possibly other applications, allows remote attackers to execute arbitrary code via a long filename.

Multiple buffer overflows in the preparse function in asp2php 0.76.23 allow remote attackers to execute arbitrary code via crafted ASP scripts.

Format string vulnerability in the lprintf function in Citadel/UX 6.27 and earlier allows remote attackers to execute arbitrary code via format string specifiers sent to the server.

Buffer overflow in the auto_filter_extern function in auto.c for NapShare 1.2, with the extern filter enabled, allows remote attackers to execute arbitrary code via a crafted gnutella response.

An integer overflow in libtiff versions 3.5.7 and 3.7.0 in tif_dirread.c and tif_fax3.c allows remote attackers to execute arbitrary code via a crafted TIFF file with a TIFF_ASCII or TIFF_UNDEFINED directory entry having an entry count of -1, leading to a heap-based buffer overflow.

A vulnerability in Safari 1.x allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the 'window injection' vulnerability, a different vulnerability than CVE-2004-1122.

Buffer overflow vulnerability in the put_words function in subs.c of abcm2ps version 3.7.20. A remote attacker can execute arbitrary code via crafted ABC files.