CVE Vulnerability Catalog

The pop_msg function in qpopper 4.0.x before 4.0.5fc2 does not null terminate a message buffer after a call to Qvsnprintf, which could allow authenticated users to execute arbitrary code via a buffer overflow in a mdef command with a long macro name.

Clearswift MAILsweeper 4.x allows remote attackers to bypass attachment detection via an attachment that does not specify a MIME-Version header field, which is processed by some mail clients.

Buffer overflow in the RPC preprocessor for Snort 1.8 and 1.9.x before 1.9.1 allows remote attackers to execute arbitrary code via fragmented RPC packets.

Apple Darwin Streaming Administration Server version 4.1.2 and QuickTime Streaming Server version 4.1.1 allow remote attackers to execute certain code via a request to port 7070 with the script in an argument to the rtsp DESCRIBE method. This code is inserted into a log file and executed when the log is viewed using a browser.

Buffer overflow in the MP3 broadcasting module of Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute arbitrary code via a long filename.

parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute arbitrary code via shell metacharacters.

Buffer overflow in the gzprintf function in zlib 1.1.4, when zlib is compiled without vsnprintf or when long inputs are truncated using vsnprintf, allows attackers to cause a denial of service or possibly execute arbitrary code.

Buffer overflow in Sendmail versions 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments processed by the crackaddr function in headers.c.

CVE-2002-0842 describes a format string vulnerability in certain modifications to mod_dav used for logging 502 Bad Gateway messages. Remote attackers can exploit this vulnerability to execute arbitrary code via a specially crafted URI.

The Eterm terminal emulator 0.9.1 and earlier allows attackers to modify the window title via a certain character escape sequence, which could lead to injecting malicious commands into the user's command line.

A vulnerability in xdm allows arbitrary attackers to connect to the X server if the authComplain variable is set to false and the xdm auth directory does not exist.

The uxterm terminal emulator allows attackers to modify the window title via a certain character escape sequence, which could lead to inserting it back into the command line in the user's terminal.

Multiple buffer overflows in Oracle 9i Database and earlier versions allow remote attackers to execute arbitrary code. The attack can be carried out through long arguments in the TO_TIMESTAMP_TZ, TZ_OFFSET, or BFILENAME functions.

The menuBar feature in aterm 0.42 allows attackers to modify menu options and execute arbitrary commands via a certain character escape sequence that inserts the commands into the menu.

Multiple buffer overflows in apcupsd before version 3.8.6 and in 3.10.x before 3.10.5 may allow attackers to cause a denial of service or execute arbitrary code, related to the usage of the vsprintf function.

The CVE-2002-1472 vulnerability in libX11.so in xfree86, when used in setuid or setgid programs, allows local users to gain root privileges via a modified LD_PRELOAD environment variable pointing to a malicious module.

Buffer overflow in ORACLE.EXE for Oracle Database Server 9i, 8i, 8.1.7, and 8.0.6 allows remote attackers to execute arbitrary code via a long username provided during login.

The rxvt terminal emulator 2.7.8 and earlier allows attackers to modify the window title via a certain character escape sequence, which could lead to inserting it back into the user's command line.

Buffer overflow in the libIM library (libIM.a) for National Language Support (NLS) on AIX 4.3 through 5.2 allows local users to gain privileges via several possible attack vectors, including a long -im argument to aixterm.

Unknown vulnerability in apcupsd before version 3.8.6 and in 3.10.x before 3.10.5 allows remote attackers to gain root privileges, possibly via format strings in a request to a slave server.