CVE Vulnerability Catalog

Buffer overflow vulnerability in the get_field_headers function in csv2xml.cpp of csv2xml version 0.5.1. A remote attacker can exploit a crafted CSV file to execute arbitrary code.

An integer overflow in libtiff versions 3.5.7 and 3.7.0 in tif_dirread.c and tif_fax3.c allows remote attackers to execute arbitrary code via a crafted TIFF file with a TIFF_ASCII or TIFF_UNDEFINED directory entry having an entry count of -1, leading to a heap-based buffer overflow.

Untrusted execution path vulnerability in chcod on AIX IBM 5.1.0, 5.2.0, and 5.3.0 allows local users to execute arbitrary programs by modifying the PATH environment variable to point to a malicious 'grep' program, which is executed from chcod.

A buffer overflow in the mailListIsPdf function in Adobe Acrobat Reader 5.09 for Unix allows remote attackers to execute arbitrary code via an e-mail message with a crafted PDF attachment.

Buffer overflow in the auto_filter_extern function in auto.c for NapShare 1.2, with the extern filter enabled, allows remote attackers to execute arbitrary code via a crafted gnutella response.

Format string vulnerability in the lprintf function in Citadel/UX 6.27 and earlier allows remote attackers to execute arbitrary code via format string specifiers sent to the server.

Multiple vulnerabilities in the IGMP functionality for Linux kernel 2.4.22 to 2.4.28, and 2.6.x to 2.6.9, allow local and remote attackers to cause a denial of service or execute arbitrary code via (1) the ip_mc_source function, which decrements a counter to -1, or (2) the igmp_marksources function, which does not properly validate IGMP message parameters and performs an out-of-bounds read.

Multiple buffer overflows in ProZilla 1.3.6-r2 and earlier in files http.c, http-retr.c, main.c and other network protocol handling code allow remote servers to execute arbitrary code via a long Location header.

The vulnerability in Cisco Secure Access Control Server for Windows and Solution Engine version 3.3.1, when EAP-TLS protocol is enabled, improperly handles expired or untrusted certificates. This allows a remote attacker to bypass authentication and gain unauthorized access using a cryptographically correct certificate with valid fields such as the username.

The init scripts in Great Internet Mersenne Prime Search (GIMPS) 23.9 and earlier execute user-owned programs with root privileges, which allows local users to gain privileges by modifying the programs.

Multiple integer overflows in xzgv 0.8 and earlier allow remote attackers to execute arbitrary code via images with large width and height values, which trigger a heap-based buffer overflow, as demonstrated in the read_prf_file function in readprf.c.

Buffer overflow vulnerability in the readObjectChunk function in 3dsimp.cpp of the convex-tool program in Convex 3D 0.8pre1. A remote attacker can exploit a crafted 3DS file to execute arbitrary code.

Buffer overflow in the save_embedded_address function in filter.c for elm/bolthole filter 2.6.1 allows remote attackers to execute arbitrary code via a crafted email message.

Multiple buffer overflows in the event_text and event_specific functions in abc2midi 2004.12.04 allow remote attackers to execute arbitrary code via crafted ABC files.

An off-by-one error in the mysasl_canon_user function in Cyrus IMAP Server 2.2.9 and earlier leads to a buffer overflow, which may allow remote attackers to execute arbitrary code via the username.

Buffer overflow in the exif_read_data function in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to execute arbitrary code via a long section name in an image file.

Format string vulnerability in the cherokee_logger_ncsa_write_string function in Cherokee 0.4.17 and earlier, when authenticating via auth_pam, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via format string specifiers in the URL.

The vulnerability in the changepassword.cgi script of ChangePassword 0.8, when installed setuid, allows local users to execute arbitrary code by modifying the PATH environment variable to point to a malicious 'make' program.

In PHP versions 4.x to 4.3.9 and 5.x to 5.0.2, the safe mode checks truncate the file path before passing data to the realpath function, which could allow attackers to bypass safe mode restrictions.

Stack-based buffer overflow in Cyrus IMAP Server versions 2.2.4 through 2.2.8 with the imapmagicplus option enabled. A remote attacker can execute arbitrary code by sending a long PROXY or LOGIN command.