CVE Vulnerability Catalog

CVE-2003-1216 describes an SQL injection vulnerability in search.php for phpBB versions 2.0.6 and earlier. This allows remote attackers to execute arbitrary SQL and gain privileges via the search_id parameter.

SQL injection vulnerability in getmember.asp in VieBoard 2.6 Beta 1 allows remote attackers to execute arbitrary SQL commands via the msn variable.

Unknown vulnerability in the libraries for the PGX32 frame buffer in Solaris 2.5.1 and 2.6 through 9 allows local users to gain root access.

Buffer overflows in PHP before 4.3.3 have unknown impact and unknown attack vectors.

A stack-based buffer overflow in mod_gzip_printf for mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode, allows remote attackers to execute arbitrary code via a long filename in a GET request with an 'Accept-Encoding: gzip' header.

The loadClass method of the sun.applet.AppletClassLoader class in the Java Virtual Machine (JVM) in Sun SDK and JRE 1.4.1_03 and earlier allows remote attackers to bypass sandbox restrictions and execute arbitrary code via a loaded class name that contains '/' instead of '.'

Opera versions 7.11 and 7.20 have a heap-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code via an HREF with a large number of escaped characters in the server name.

Internet Explorer versions 5.01 through 6.0 improperly handle object tags returned from a Web server during XML data binding, allowing remote attackers to execute arbitrary code via an HTML email message or web page.

Buffer overflow in net.c for cfengine 2.x before version 2.0.8 allows remote attackers to execute arbitrary code via certain packets with modified length values, which are trusted by the ReceiveTransaction function.

CVE-2001-1411 describes a format string vulnerability in gm4 (also known as m4) on Mac OS X that may allow local users to gain privileges if gm4 is called by setuid programs.

Buffer overflow in Troubleshooter ActiveX Control (Tshoot.ocx) in Microsoft Windows 2000 SP4 and earlier allows remote attackers to execute arbitrary code via an HTML document with a long argument to the RunQuery2 method.

A stack-based buffer overflow in webfs before version 1.20 allows attackers to execute arbitrary code by creating directories that result in a long pathname.

The Messenger Service for Windows NT through Server 2003 does not properly verify the length of the message, allowing remote attackers to execute arbitrary code via a buffer overflow attack.

Integer overflows in PHP versions before 4.3.3 in base64_encode and the GD library have unknown impact and attack vectors.

The TCP reassembly functionality in libnids before 1.18 allows remote attackers to cause "memory corruption" and possibly execute arbitrary code via "overlarge TCP packets."

CVE-2003-0865 involves a heap-based buffer overflow in the readstring function of httpget.c for mpg123 versions 0.59r and 0.59s. This allows remote attackers to execute arbitrary code via a long request.

Multiple buffer overflows in asf_http_request of MPlayer before 0.92 allow remote attackers to execute arbitrary code via an ASX header with a long hostname.

ProFTPD versions 1.2.7 through 1.2.9rc2 do not properly translate newline characters when transferring files in ASCII mode, allowing remote attackers to execute arbitrary code via a buffer overflow using certain files.

Versions gv 3.5.8 and possibly earlier allow remote attackers to execute arbitrary commands via shell metacharacters in the filename for (1) a PDF file or (2) a gzip file.

The php_check_safe_mode_include_dir function in fopen_wrappers.c of PHP 4.3.x returns a success value (0) when the safe_mode_include_dir variable is not specified in configuration. This differs from the previous failure value and may allow remote attackers to exploit file include vulnerabilities in PHP applications.