CVE Vulnerability Catalog

In Ethereal versions 0.9.15 and earlier, a heap-based buffer overflow allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the SOCKS dissector.

Buffer overflow in the CDE libDtHelp library allows local users to execute arbitrary code via modified DTHELPUSERSEARCHPATH, DTSEARCHPATH, or LOGNAME environment variables.

CVE-2003-1216 describes an SQL injection vulnerability in search.php for phpBB versions 2.0.6 and earlier. This allows remote attackers to execute arbitrary SQL and gain privileges via the search_id parameter.

SQL injection vulnerability in getmember.asp in VieBoard 2.6 Beta 1 allows remote attackers to execute arbitrary SQL commands via the msn variable.

Unknown vulnerability in the libraries for the PGX32 frame buffer in Solaris 2.5.1 and 2.6 through 9 allows local users to gain root access.

A stack-based buffer overflow in mod_gzip_printf for mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode, allows remote attackers to execute arbitrary code via a long filename in a GET request with an 'Accept-Encoding: gzip' header.

Opera versions 7.11 and 7.20 have a heap-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code via an HREF with a large number of escaped characters in the server name.

Internet Explorer versions 5.01 through 6.0 improperly handle object tags returned from a Web server during XML data binding, allowing remote attackers to execute arbitrary code via an HTML email message or web page.

The loadClass method of the sun.applet.AppletClassLoader class in the Java Virtual Machine (JVM) in Sun SDK and JRE 1.4.1_03 and earlier allows remote attackers to bypass sandbox restrictions and execute arbitrary code via a loaded class name that contains '/' instead of '.'

Buffer overflow in net.c for cfengine 2.x before version 2.0.8 allows remote attackers to execute arbitrary code via certain packets with modified length values, which are trusted by the ReceiveTransaction function.

Buffer overflows in PHP before 4.3.3 have unknown impact and unknown attack vectors.

Buffer overflow in Troubleshooter ActiveX Control (Tshoot.ocx) in Microsoft Windows 2000 SP4 and earlier allows remote attackers to execute arbitrary code via an HTML document with a long argument to the RunQuery2 method.

The PAM conversation function in OpenSSH 3.7.1 and 3.7.1p1 interprets an array of structures as an array of pointers, allowing attackers to modify the stack and possibly gain privileges.

The TCP reassembly functionality in libnids before 1.18 allows remote attackers to cause "memory corruption" and possibly execute arbitrary code via "overlarge TCP packets."

The Messenger Service for Windows NT through Server 2003 does not properly verify the length of the message, allowing remote attackers to execute arbitrary code via a buffer overflow attack.

A stack-based buffer overflow in webfs before version 1.20 allows attackers to execute arbitrary code by creating directories that result in a long pathname.

CVE-2003-0865 involves a heap-based buffer overflow in the readstring function of httpget.c for mpg123 versions 0.59r and 0.59s. This allows remote attackers to execute arbitrary code via a long request.

Integer overflows in PHP versions before 4.3.3 in base64_encode and the GD library have unknown impact and attack vectors.

Multiple buffer overflows in asf_http_request of MPlayer before 0.92 allow remote attackers to execute arbitrary code via an ASX header with a long hostname.

CVE-2001-1411 describes a format string vulnerability in gm4 (also known as m4) on Mac OS X that may allow local users to gain privileges if gm4 is called by setuid programs.