CVE Vulnerability Catalog

Buffer overflow in the get_attr function in html.c for vilistextum 2.6.6 allows remote attackers to execute arbitrary code via a crafted web page.

A buffer overflow vulnerability in the ReadFontTbl function in reader.c of rtf2latex2e 1.0fc2 allows remote attackers to execute arbitrary code via a crafted RTF file.

Buffer overflow vulnerability in qwik-smtpd allows a remote attacker to use the server as an SMTP spam relay by sending a long HELO command, which overwrites the adjacent localIP data buffer.

Buffer overflow vulnerability in the process_moves function in pgn2web.c of pgn2web 0.3 allows remote attackers to execute arbitrary code via a crafted PGN file.

In Veritas Backup Exec versions 8.x before 8.60.3878 Hotfix 68 and 9.x before 9.1.4691 Hotfix 40, the Agent Browser component contains a stack-based buffer overflow. A remote attacker can exploit this vulnerability by sending a registration request with a long hostname, allowing arbitrary code execution.

The unison command in scponly before version 4.0 does not properly restrict programs that can be run, which could allow remote authenticated users to bypass intended access restrictions and execute arbitrary programs via the -rshcmd or -sshcmd flags.

A vulnerability in rssh version 2.2.2 and earlier allows remote authenticated users to bypass intended access restrictions and execute arbitrary programs via rdist -P, rsync, or scp -S commands.

Integer overflow vulnerability in the Samba daemon (smbd) in Samba versions 2.x and 3.0.x through 3.0.9 allows remote authenticated users to cause a denial of service (application crash) and potentially execute arbitrary code via a Samba request with a large number of security descriptors, triggering a heap-based buffer overflow.

Multiple buffer overflows in the sys32_ni_syscall and sys32_vm86_warning functions in sys_ia32.c for Linux 2.6.x may allow local attackers to modify kernel memory and gain privileges.

The vulnerability in Computer Associates eTrust EZ Antivirus versions 7.0.0 to 7.0.4 (including 7.0.1.4) installs its files with insecure permissions (ACLs), allowing local users to gain privileges by replacing critical programs with malicious ones, as demonstrated using VetMsg.exe.

Buffer overflow in CMailCOM.dll in CMailServer 5.2 allows remote attackers to execute arbitrary code via an attachment with a long filename.

A buffer overflow in Open Dc Hub 0.7.14 in the RedirectAll command allows a remote attacker with administrator privileges to execute arbitrary code.

Buffer overflow in the Gfx::doImage function in Gfx.cc for xpdf 3.00, and other products that share code such as tetex-bin and kpdf in KDE 3.2.x to 3.2.3 and 3.3.x to 3.3.2, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted PDF file that causes the boundaries of a maskColors array to be exceeded.

The vulnerability in Safari versions 1.x to 1.2.4 (and possibly others) allows inactive windows to display dialog boxes. A remote attacker can exploit this flaw to spoof dialog boxes from other websites, leading to a 'Dialog Box Spoofing' attack. This is a different vulnerability than CVE-2004-1314.

The init scripts in ChessBrain 20407 and earlier execute user-owned programs with root privileges, which allows local users to gain privileges by modifying the programs.

A buffer overflow in the handling of command line arguments in Skype 1.0.x.94 through 1.0.x.98 allows remote attackers to execute arbitrary code via a callto:// URL with a long non-existent username.

SQL injection vulnerability in SQLgrey Postfix greylisting service before version 1.2.0 allows remote attackers to execute arbitrary SQL commands via the sender or recipient email addresses.

Format string vulnerability in the cherokee_logger_ncsa_write_string function in Cherokee 0.4.17 and earlier, when authenticating via auth_pam, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via format string specifiers in the URL.

Buffer overflow in InnerMedia DynaZip DUNZIP32.dll file version 5.00.03 and earlier allows remote attackers to execute arbitrary code via a ZIP file containing a file with a long filename. This affects multiple products including RealPlayer, CheckMark Software, dtSearch, McAfee VirusScan, and IBM Lotus Notes.

Multiple integer overflows in the image handler for imlib 1.9.14 and earlier, which is used by gkrellm and several window managers, allow remote attackers to cause a denial of service (application crash) and execute arbitrary code via certain image files.