CVE Vulnerability Catalog

Buffer overflow in Zinf 2.2.1 on Windows and other older versions for Linux allows remote attackers or local users to execute arbitrary code via certain values in a .pls file.

Apple Remote Desktop Client 1.2.4 executes a GUI application as root when started by an Apple Remote Desktop Administrator application, allowing remote authenticated users to execute arbitrary code when loginwindow is active via Fast User Switching.

The (1) pj-gs.sh, (2) ps2epsi, (3) pv.sh, and (4) sysvlp.sh scripts in the ESP Ghostscript (espgs) package in Trustix Secure Linux 1.5 through 2.1, and other operating systems, allow local users to overwrite files via a symlink attack on temporary files.

A vulnerability in Sophos Anti-Virus before version 3.87.0 and the version for Windows 95, 98, and Me before 3.88.0 allows a remote attacker to bypass antivirus protection via a compressed file with both local and global headers set to zero. Such a file can be opened on the target system without being detected by the antivirus software.

Buffer overflow vulnerability in the getauthfromURL function in httpget.c in mpg123 before version 0.59s and mpg123 0.59r. An attacker can remotely or locally execute arbitrary code via an mp3 file containing a long string before the @ sign in a URL.

The vulnerability in the stmkfont tool in HP-UX B.11.00 through B.11.23 relies on the user-specified PATH when executing certain commands, which allows local users to execute arbitrary code by modifying the PATH environment variable to point to malicious programs.

A heap-based buffer overflow in the DEC2EXE module of the Symantec AntiVirus Library allows remote attackers to execute arbitrary code via a UPX compressed file containing a negative virtual offset in a crafted PE header.

The International Domain Name (IDN) support in Firefox 1.0, Camino .8.5, and Mozilla before 1.7.6 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.

Buffer overflow vulnerability in Microsoft Office XP allows remote attackers to execute arbitrary code via a specially crafted link with long inputs after '%00' (null byte) in .doc filenames or '%0a' (carriage return) in .rtf filenames.

Format string vulnerability in the movemail utility in Emacs 20.x, 21.3, and possibly other versions, and XEmacs 21.4 and earlier, allows remote malicious POP3 servers to execute arbitrary code via crafted packets.

Multiple buffer overflows in the enable command for SCO OpenServer 5.0.6 and 5.0.7 allow local users to execute arbitrary code via long command line arguments.

Format string vulnerability in the Log_Resolver function in log.c in ngIRCd 0.8.2 and earlier, when compiled with IDENT, logging to SYSLOG, and with DEBUG enabled, allows remote attackers to execute arbitrary code.

PHP remote file inclusion vulnerability in Squirrelmail 1.2.6 allows remote attackers to execute arbitrary code via URL manipulation.

Buffer overflow vulnerability in gram.y in PostgreSQL 8.0.0 and earlier may allow attackers to execute arbitrary code via a large number of arguments to a refcursor function, leading to a heap-based buffer overflow. This is a different vulnerability than CVE-2005-0247.

A buffer overflow vulnerability in the socket_getline function in Newspost 2.1.1 and earlier allows a remote malicious NNTP server to execute arbitrary code via a long string without a newline character.

WebWasher Classic versions 2.2.1 and 3.3, when running in server mode, improperly handle CONNECT requests to localhost from external systems, which could allow remote attackers to bypass intended access restrictions.

The libsasl and libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASL_PATH environment variable to find all available SASL plug-ins, which allows local users to execute arbitrary code by modifying the SASL_PATH to point to malicious programs.

Multiple directory traversal vulnerabilities in Magic Winmail Server 4.0 Build 1112 allow remote attackers to upload arbitrary files via upload.php or read arbitrary files via download.php, and remote authenticated users to read, create, or delete arbitrary directories and files via IMAP commands CREATE, EXAMINE, SELECT, or DELETE.

Buffer overflow vulnerability in the QFILEPATHINFO request handler in Samba 3.0.x through 3.0.7. A remote attacker can exploit this flaw to execute arbitrary code by sending a specially crafted TRANSACT2_QFILEPATHINFO request with a small 'maximum data bytes' value.

The vulnerability in SUSE Linux Enterprise Server 9 on the S/390 platform is due to improper handling of a certain privileged instruction, allowing local users to gain root privileges.