# definitions

definition_id: oval:org.debian:def:302398480618719661759273474285073383836
title: CVE-1999-0199 glibc
description:
manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of a tree's root, which might allow attackers to access a dangling pointer in an application whose developer was unaware of a documentation update from 1999.


definition_id: oval:org.debian:def:235219172302950797077809285042175390515
title: CVE-1999-0710 squid
description:
The Squid package in Red Hat Linux 5.2 and 6.0, and other distributions, installs cachemgr.cgi in a public web directory, which allows remote attackers to use it as an intermediary to connect to other systems.


definition_id: oval:org.debian:def:166558133375782793613486575811727984470
title: CVE-1999-1332 gzip
description:
gzexe in the gzip package on Red Hat Linux 5.0 and earlier allows local users to overwrite files of other users via a symlink attack on a temporary file.


definition_id: oval:org.debian:def:313589023679974423032770666567212652739
title: CVE-1999-1572 cpio
description:
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files.


definition_id: oval:org.debian:def:167202378807244186201063116068555261984
title: CVE-2000-0992 openssh
description:
Directory traversal vulnerability in scp in sshd 1.2.xx allows a remote malicious scp server to overwrite arbitrary files via a .. (dot dot) attack.


definition_id: oval:org.debian:def:129546325307286332647603852062540430177
title: CVE-2000-1219 gcc-3.3
description:
The -ftrapv compiler option in gcc and g++ 3.3.3 and earlier does not handle all types of integer overflows, which may leave applications vulnerable to vulnerabilities related to overflows.


definition_id: oval:org.debian:def:104698741100185136105137139436802110621
title: CVE-2000-1220 lpr
description:
The line printer daemon (lpd) in the lpr package in multiple Linux operating systems allows local users to gain root privileges by causing sendmail to execute with arbitrary command line arguments, as demonstrated using the -C option to specify a configuration file.


definition_id: oval:org.debian:def:108961867959073689837027836085963050979
title: CVE-2000-1221 lpr
description:
The line printer daemon (lpd) in the lpr package in multiple Linux operating systems authenticates by comparing the reverse-resolved hostname of the local machine to the hostname of the print server as returned by gethostname, which allows remote attackers to bypass intended access controls by modifying the DNS for the attacking IP.


definition_id: oval:org.debian:def:71593346027219921863635031092378452738
title: CVE-2000-1226 snort
description:
Snort 1.6, when running in straight ASCII packet logging mode or IDS mode with straight decoded ASCII packet logging selected, allows remote attackers to cause a denial of service (crash) by sending non-IP protocols that Snort does not know about, as demonstrated by an nmap protocol scan.


definition_id: oval:org.debian:def:320184266433173710812525100521655883890
title: CVE-2000-1254 openssl
description:
crypto/rsa/rsa_gen.c in OpenSSL before 0.9.6 mishandles C bitwise-shift operations that exceed the size of an expression, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging improper RSA key generation on 64-bit HP-UX platforms.


definition_id: oval:org.debian:def:6469489469207672770354917039227729233
title: CVE-2001-0735 cfingerd
description:
Buffer overflow in cfingerd 1.4.3 and earlier with the ALLOW_LINE_PARSING option enabled allows local users to execute arbitrary code via a long line in the .nofinger file.


definition_id: oval:org.debian:def:204669160796808581501267177419542615284
title: CVE-2001-0775 xli
description:
Buffer overflow in xloadimage 4.1 (aka xli 1.16 and 1.17) in Linux allows remote attackers to execute arbitrary code via a FACES format image containing a long (1) Firstname or (2) Lastname field.


definition_id: oval:org.debian:def:20176290259228143294806206248322607503
title: CVE-2001-1034 hylafax
description:
Format string vulnerability in Hylafax on FreeBSD allows local users to execute arbitrary code via format specifiers in the -h hostname argument for (1) faxrm or (2) faxalter.


definition_id: oval:org.debian:def:338645179874549277280794412385645778862
title: CVE-2001-1413 ncompress
description:
Stack-based buffer overflow in the comprexx function for ncompress 4.2.4 and earlier, when used in situations that cross security boundaries (such as FTP server), may allow remote attackers to execute arbitrary code via a long filename argument.


definition_id: oval:org.debian:def:124410350536103928411653351816689549094
title: CVE-2001-1442 inn2
description:
Buffer overflow in innfeed for ISC InterNetNews (INN) before 2.3.0 allows local users in the "news" group to gain privileges via a long -c command line argument.


definition_id: oval:org.debian:def:98291247925283786994312363719559499400
title: CVE-2001-1459 openssh
description:
OpenSSH 2.9 and earlier does not initiate a Pluggable Authentication Module (PAM) session if commands are executed with no pty, which allows local users to bypass resource limits (rlimits) set in pam.d.


definition_id: oval:org.debian:def:55167306672327785163242176967835361975
title: CVE-2001-1494 util-linux
description:
script command in the util-linux package before 2.11n allows local users to overwrite arbitrary files by setting a hardlink from the typescript log file to any file on the system, then having root execute the script command.


definition_id: oval:org.debian:def:132581614758836399562230955179721160237
title: CVE-2001-1505 tinc
description:
tinc 1.0pre3 and 1.0pre4 allows remote attackers to inject data into user sessions by sniffing and replaying packets.


definition_id: oval:org.debian:def:119149569065501755709830342602435195358
title: CVE-2001-1507 openssh
description:
OpenSSH before 3.0.1 with Kerberos V enabled does not properly authenticate users, which could allow remote attackers to login unchallenged.


definition_id: oval:org.debian:def:271595489430757945121555869108501568731
title: CVE-2001-1558 snort
description:
Unknown vulnerability in IP defragmenter (frag2) in Snort before 1.8.3 allows attackers to cause a denial of service (crash).


definition_id: oval:org.debian:def:246139315421383303467711825851543923500
title: CVE-2001-1562 nvi
description:
Format string vulnerability in nvi before 1.79 allows local users to gain privileges via format string specifiers in a filename.


definition_id: oval:org.debian:def:35166805332089132598547417629055614268
title: CVE-2001-1566 vanessa-logger
description:
Format string vulnerability in libvanessa_logger 0.0.1 in Perdition 0.1.8 allows remote attackers to execute arbitrary code via format string specifiers in the __vanessa_logger_log function.


definition_id: oval:org.debian:def:75476148081331502013618590951901882535
title: CVE-2001-1593 a2ps
description:
The tempname_ensure function in lib/routines.h in a2ps 4.14 and earlier, as used by the spy_user function and possibly other functions, allows local users to modify arbitrary files via a symlink attack on a temporary file.


definition_id: oval:org.debian:def:221816357774887071070586037382001211305
title: CVE-2002-0380 tcpdump
description:
Buffer overflow in tcpdump 3.6.2 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via an NFS packet.


definition_id: oval:org.debian:def:108242103438661738914699283179011366939
title: CVE-2002-0388 mailman
description:
Cross-site scripting vulnerabilities in Mailman before 2.0.11 allow remote attackers to execute script via (1) the admin login page, or (2) the Pipermail index summaries.


definition_id: oval:org.debian:def:53357321979038336204243430875149899557
title: CVE-2002-0391 acm
description:
Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd.


definition_id: oval:org.debian:def:311181466843787045886666997262558531283
title: CVE-2002-0392 apache2
description:
Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.


definition_id: oval:org.debian:def:268120104458253278499689727481730618737
title: CVE-2002-0639 openssh
description:
Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResponseAuthentication) when OpenSSH is using SKEY or BSD_AUTH authentication.


definition_id: oval:org.debian:def:36163060455645820137832665815694216455
title: CVE-2002-0640 openssh
description:
Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt).


definition_id: oval:org.debian:def:195724250649231708572873209251015270825
title: CVE-2002-0651 glibc
description:
Buffer overflow in the DNS resolver code used in libc, glibc, and libbind, as derived from ISC BIND, allows remote malicious DNS servers to cause a denial of service and possibly execute arbitrary code via the stub resolvers.


definition_id: oval:org.debian:def:229120595795918884482109354125098332171
title: CVE-2002-0654 apache2
description:
Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file, which leaks the pathname in the resulting error message, or (2) via an error message that occurs when a script (child process) cannot be invoked.


definition_id: oval:org.debian:def:320129660965106672613968478792732655056
title: CVE-2002-0655 openssl
description:
OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, does not properly handle ASCII representations of integers on 64 bit platforms, which could allow attackers to cause a denial of service and possibly execute arbitrary code.


definition_id: oval:org.debian:def:109947019128610444835638792820720351004
title: CVE-2002-0656 openssl
description:
Buffer overflows in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allow remote attackers to execute arbitrary code via (1) a large client master key in SSL2 or (2) a large session ID in SSL3.


definition_id: oval:org.debian:def:157304092054200654981557871335822257527
title: CVE-2002-0657 openssl
description:
Buffer overflow in OpenSSL 0.9.7 before 0.9.7-beta3, with Kerberos enabled, allows attackers to execute arbitrary code via a long master key.


definition_id: oval:org.debian:def:322784343506609522632330684108510683535
title: CVE-2002-0658 mm
description:
OSSP mm library (libmm) before 1.2.0 allows the local Apache user to gain privileges via temporary files, possibly via a symbolic link attack.


definition_id: oval:org.debian:def:109979686688988462524729939069328441860
title: CVE-2002-0659 openssl
description:
The ASN1 library in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allows remote attackers to cause a denial of service via invalid encodings.


definition_id: oval:org.debian:def:259058553504042813444847039825759318540
title: CVE-2002-0661 apache2
description:
Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to read arbitrary files and execute commands via .. (dot dot) sequences containing \ (backslash) characters.


definition_id: oval:org.debian:def:43949698121683033753393051572625084656
title: CVE-2002-0684 glibc
description:
Buffer overflow in DNS resolver functions that perform lookup of network names and addresses, as used in BIND 4.9.8 and ported to glibc 2.2.5 and earlier, allows remote malicious DNS servers to execute arbitrary code through a subroutine used by functions such as getnetbyname and getnetbyaddr.


definition_id: oval:org.debian:def:320396751711969985200233673145156051944
title: CVE-2002-0703 perl
description:
An interaction between the Perl MD5 module (perl-Digest-MD5) and Perl could produce incorrect MD5 checksums for UTF-8 data, which could prevent a system from properly verifying the integrity of the data.


definition_id: oval:org.debian:def:278018419740989929847670879681113654458
title: CVE-2002-0713 squid
description:
Buffer overflows in Squid before 2.4.STABLE6 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code (1) via the MSNT auth helper (msnt_auth) when using denyusers or allowusers files, (2) via the gopher client, or (3) via the FTP server directory listing parser when HTML output is generated.


definition_id: oval:org.debian:def:252602367718889859131240982978741623827
title: CVE-2002-0714 squid
description:
FTP proxy in Squid before 2.4.STABLE6 does not compare the IP addresses of control and data connections with the FTP server, which allows remote attackers to bypass firewall rules or spoof FTP server responses.


definition_id: oval:org.debian:def:112292254503344807179145080576824610815
title: CVE-2002-0715 squid
description:
Vulnerability in Squid before 2.4.STABLE6 related to proxy authentication credentials may allow remote web sites to obtain the user's proxy login and password.


definition_id: oval:org.debian:def:284922515202889125769311984545021684150
title: CVE-2002-0738 mhonarc
description:
MHonArc 2.5.2 and earlier does not properly filter Javascript from archived e-mail messages, which could allow remote attackers to execute script in web clients by (1) splitting the SCRIPT tag into smaller pieces, (2) including the script in a SRC argument to an IMG tag, or (3) using "&={script}" syntax.


definition_id: oval:org.debian:def:160590837087301065612575364050834263250
title: CVE-2002-0740 slrn
description:
Buffer overflow in slrnpull for the SLRN package, when installed setuid or setgid, allows local users to gain privileges via a long -d (SPOOLDIR) argument.


definition_id: oval:org.debian:def:7954843992669709933546613591677238979
title: CVE-2002-0765 openssh
description:
sshd in OpenSSH 3.2.2, when using YP with netgroups and under certain conditions, may allow users to successfully authenticate and log in with another user's password.


definition_id: oval:org.debian:def:268712887230946210844472915780410655668
title: CVE-2002-0817 super
description:
Format string vulnerability in super for Linux allows local users to gain root privileges via a long command line argument.


definition_id: oval:org.debian:def:160024564454443156442450028664635341699
title: CVE-2002-0825 libnss-ldap
description:
Buffer overflow in the DNS SRV code for nss_ldap before nss_ldap-198 allows remote attackers to cause a denial of service and possibly execute arbitrary code.


definition_id: oval:org.debian:def:129840822702019473158847712923603196720
title: CVE-2002-0838 gv
description:
Buffer overflow in (1) gv 3.5.8 and earlier, (2) gvv 1.0.2 and earlier, (3) ggv 1.99.90 and earlier, (4) gnome-gv, and (5) kghostview in kdegraphics 2.2.2 and earlier, allows attackers to execute arbitrary code via a malformed (a) PDF or (b) PostScript file, which is processed by an unsafe call to sscanf.


definition_id: oval:org.debian:def:336689864647028795090382919625007680380
title: CVE-2002-0840 apache2
description:
Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.


definition_id: oval:org.debian:def:20370436468116481585229537597200738278
title: CVE-2002-0844 cvs
description:
Off-by-one overflow in the CVS PreservePermissions of rcs.c for CVSD before 1.11.2 allows local users to execute arbitrary code.


definition_id: oval:org.debian:def:15486642727479491682819244235245972235
title: CVE-2002-0847 tinyproxy
description:
tinyproxy HTTP proxy 1.5.0, 1.4.3, and earlier allows remote attackers to execute arbitrary code via memory that is freed twice (double-free).


definition_id: oval:org.debian:def:35538637527125407679744197379667568387
title: CVE-2002-0851 isdnutils
description:
Format string vulnerability in ISDN Point to Point Protocol (PPP) daemon (ipppd) in the ISDN4Linux (i4l) package allows local users to gain root privileges via format strings in the device name command line argument, which is not properly handled in a call to syslog.


definition_id: oval:org.debian:def:201162294530571391458866236020069871127
title: CVE-2002-0855 mailman
description:
Cross-site scripting vulnerability in Mailman before 2.0.12 allows remote attackers to execute script as other users via a subscriber's list subscription options in the (1) adminpw or (2) info parameters to the ml-name feature.


definition_id: oval:org.debian:def:315557677775857367541491720094378408943
title: CVE-2002-0871 xinetd
description:
xinetd 2.3.4 leaks file descriptors for the signal pipe to services that are launched by xinetd, which could allow those services to cause a denial of service via the pipe.


definition_id: oval:org.debian:def:142520869694630829414485980598187913088
title: CVE-2002-0875 fam
description:
Vulnerability in FAM 2.6.8, 2.6.6, and other versions allows unprivileged users to obtain the names of files whose access is restricted to the root group.


definition_id: oval:org.debian:def:294520558454606495377643876420150202255
title: CVE-2002-0896 swatch
description:
The throttle capability in Swatch may fail to report certain events if (1) the same type of event occurs after the throttle period, or (2) when multiple events matching the same "watchfor" expression do not occur after the throttle period, which could allow attackers to avoid detection.


definition_id: oval:org.debian:def:6921510870279854121226500080228840890
title: CVE-2002-0901 amanda
description:
Multiple buffer overflows in Advanced Maryland Automatic Network Disk Archiver (AMANDA) 2.3.0.4 allow (1) remote attackers to execute arbitrary code via long commands to the amindexd daemon, or certain local users to execute arbitrary code via long command line arguments to the programs (2) amcheck, (3) amgetidx, (4) amtrmidx, (5) createindex-dump, or (6) createindex-gnutar.


definition_id: oval:org.debian:def:150474452819596519928018104303339022673
title: CVE-2002-0904 kismet
description:
SayText function in Kismet 2.2.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters (backtick or pipe) in the essid argument.


definition_id: oval:org.debian:def:32269380001467364054412601147898191030
title: CVE-2002-0906 sendmail
description:
Buffer overflow in Sendmail before 8.12.5, when configured to use a custom DNS map to query TXT records, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malicious DNS server.


definition_id: oval:org.debian:def:318745446482724936763971958665370886298
title: CVE-2002-0914 courier
description:
Double Precision Courier e-mail MTA allows remote attackers to cause a denial of service (CPU consumption) via a message with an extremely large or negative value for the year, which causes a tight loop.


definition_id: oval:org.debian:def:265997510894720342670080834363694276871
title: CVE-2002-0916 squid
description:
Format string vulnerability in the allowuser code for the Stellar-X msntauth authentication module, as distributed in Squid 2.4.STABLE6 and earlier, allows remote attackers to execute arbitrary code via format strings in the user name, which are not properly handled in a syslog call.


definition_id: oval:org.debian:def:159943915689429576125711890311859974108
title: CVE-2002-1049 hylafax
description:
Format string vulnerability in HylaFAX faxgetty before 4.1.3 allows remote attackers to cause a denial of service (crash) via the TSI data element.


definition_id: oval:org.debian:def:28005874768576655098520559650643310381
title: CVE-2002-1050 hylafax
description:
Buffer overflow in HylaFAX faxgetty before 4.1.3 allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long line of image data.


definition_id: oval:org.debian:def:227461068787908568800251634938296318586
title: CVE-2002-1090 libesmtp
description:
Buffer overflow in read_smtp_response of protocol.c in libesmtp before 0.8.11 allows a remote SMTP server to (1) execute arbitrary code via a certain response or (2) cause a denial of service via long server responses.


definition_id: oval:org.debian:def:132824557853449380499825859665842988614
title: CVE-2002-1124 purity
description:
Multiple buffer overflows in purity 1-16 allow local users to gain privileges and modify high scores tables.


definition_id: oval:org.debian:def:288311962928255176124225389022529128218
title: CVE-2002-1146 glibc
description:
The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such as glibc 2.2.5 and earlier, libc, and libresolv, use the maximum buffer size instead of the actual size when processing a DNS response, which causes the stub resolvers to read past the actual boundary ("read buffer overflow"), allowing remote attackers to cause a denial of service (crash).


definition_id: oval:org.debian:def:9225947988468862866670018928894777172
title: CVE-2002-1154 analog
description:
anlgform.pl in Analog before 5.23 does not restrict access to the PROGRESSFREQ progress update command, which allows remote attackers to cause a denial of service (disk consumption) by using the command to report updates more frequently and fill the web server error log.


definition_id: oval:org.debian:def:105556560948858760571700045724218947260
title: CVE-2002-1156 apache2
description:
Apache 2.0.42 allows remote attackers to view the source code of a CGI script via a POST request to a directory with both WebDAV and CGI enabled.


definition_id: oval:org.debian:def:7279986790218941483867674527077931251
title: CVE-2002-1158 canna
description:
Buffer overflow in the irw_through function for Canna 3.5b2 and earlier allows local users to execute arbitrary code as the bin user.


definition_id: oval:org.debian:def:14716201020082964211856014636613586651
title: CVE-2002-1159 canna
description:
Canna 3.6 and earlier does not properly validate requests, which allows remote attackers to cause a denial of service or information leak.


definition_id: oval:org.debian:def:192699887744050582766063408077577657626
title: CVE-2002-1165 sendmail
description:
Sendmail Consortium's Restricted Shell (SMRSH) in Sendmail 8.12.6, 8.11.6-15, and possibly other versions after 8.11 from 5/19/1998, allows attackers to bypass the intended restrictions of smrsh by inserting additional commands after (1) "||" sequences or (2) "/" characters, which are not properly filtered or verified.


definition_id: oval:org.debian:def:96165860981734199923699417095938680492
title: CVE-2002-1170 net-snmp
description:
The handle_var_requests function in snmp_agent.c for the SNMP daemon in the Net-SNMP (formerly ucd-snmp) package 5.0.1 through 5.0.5 allows remote attackers to cause a denial of service (crash) via a NULL dereference.


definition_id: oval:org.debian:def:49137084793857442534511930621148689428
title: CVE-2002-1174 fetchmail
description:
Buffer overflows in Fetchmail 6.0.0 and earlier allow remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) long headers that are not properly processed by the readheaders function, or (2) via long Received: headers, which are not properly parsed by the parse_received function.


definition_id: oval:org.debian:def:28553614157656739948362826774379022878
title: CVE-2002-1175 fetchmail
description:
The getmxrecord function in Fetchmail 6.0.0 and earlier does not properly check the boundary of a particular malformed DNS packet from a malicious DNS server, which allows remote attackers to cause a denial of service (crash) when Fetchmail attempts to read data beyond the expected boundary.


definition_id: oval:org.debian:def:269277334986611373822928281192929991706
title: CVE-2002-1200 syslog-ng
description:
Balabit Syslog-NG 1.4.x before 1.4.15, and 1.5.x before 1.5.20, when using template filenames or output, does not properly track the size of a buffer when constant characters are encountered during macro expansion, which allows remote attackers to cause a denial of service and possibly execute arbitrary code.


definition_id: oval:org.debian:def:141429372744616885875352394054149861340
title: CVE-2002-1215 heartbeat
description:
Multiple format string vulnerabilities in heartbeat 0.4.9 and earlier (claimed as buffer overflows in some sources) allow remote attackers to execute arbitrary code via certain packets to UDP port 694 (incorrectly claimed as TCP in some sources).


definition_id: oval:org.debian:def:234963085762816181109328926093758814659
title: CVE-2002-1216 tar
description:
GNU tar 1.13.19 and other versions before 1.13.25 allows remote attackers to overwrite arbitrary files via a symlink attack, as the result of a modification that effectively disabled the security check.


definition_id: oval:org.debian:def:107802229844561876322608382730219193020
title: CVE-2002-1225 heimdal
description:
Multiple buffer overflows in Heimdal before 0.5, possibly in both the (1) kadmind and (2) kdc servers, may allow remote attackers to gain root access.


definition_id: oval:org.debian:def:241890081140575262953578433509456955214
title: CVE-2002-1226 heimdal
description:
Unknown vulnerabilities in Heimdal before 0.5 with unknown impact, possibly in the (1) kadmind and (2) kdc servers, may allow remote or local attackers to gain root or other access, but not via buffer overflows (CVE-2002-1225).


definition_id: oval:org.debian:def:124126858919769028586848998248573570394
title: CVE-2002-1227 pam
description:
PAM 0.76 treats a disabled password as if it were an empty (null) password, which allows local and remote attackers to gain privileges as disabled users.


definition_id: oval:org.debian:def:194875159108193093715619986778160094100
title: CVE-2002-1232 nis
description:
Memory leak in ypdb_open in yp_db.c for ypserv before 2.5 in the NIS package 3.9 and earlier allows remote attackers to cause a denial of service (memory consumption) via a large number of requests for a map that does not exist.


definition_id: oval:org.debian:def:191766188687786681553299286913666359642
title: CVE-2002-1235 heimdal
description:
The kadm_ser_in function in (1) the Kerberos v4compatibility administration daemon (kadmind4) in the MIT Kerberos 5 (krb5) krb5-1.2.6 and earlier, (2) kadmind in KTH Kerberos 4 (eBones) before 1.2.1, and (3) kadmind in KTH Kerberos 5 (Heimdal) before 0.5.1 when compiled with Kerberos 4 support, does not properly verify the length field of a request, which allows remote attackers to execute arbitrary code via a buffer overflow attack.


definition_id: oval:org.debian:def:106085155906490802919315651522946986472
title: CVE-2002-1271 libmailtools-perl
description:
The Mail::Mailer Perl module in the perl-MailTools package 1.47 and earlier uses mailx as the default mailer, which allows remote attackers to execute arbitrary commands by inserting them into the mail body, which is then processed by mailx.


definition_id: oval:org.debian:def:76407639701056588254283013437460118927
title: CVE-2002-1275 html2ps
description:
Unknown vulnerability in html2ps HTML/PostScript converter 1.0, when used within LPRng, allows remote attackers to execute arbitrary code via "unsanitized input."


definition_id: oval:org.debian:def:119052001027602342639975989454051010181
title: CVE-2002-1277 wmaker
description:
Buffer overflow in Window Maker (wmaker) 0.80.0 and earlier may allow remote attackers to execute arbitrary code via a certain image file that is not properly handled when Window Maker uses width and height information to allocate a buffer.


definition_id: oval:org.debian:def:84158770323327420851655109043857930564
title: CVE-2002-1307 mhonarc
description:
Cross-site scripting vulnerability (XSS) in MHonArc 2.5.12 and earlier allows remote attackers to insert script or HTML via an email message with the script in a MIME header name.


definition_id: oval:org.debian:def:293795808144539770472806061152665015157
title: CVE-2002-1311 courier
description:
Courier sqwebmail before 0.40.0 does not quickly drop privileges after startup in certain cases, which could allow local users to read arbitrary files.


definition_id: oval:org.debian:def:193789328715219659079978586263287148237
title: CVE-2002-1313 nullmailer
description:
nullmailer 1.00RC5 and earlier allows local users to cause a denial of service via an email to a local user that does not exist, which generates an error that causes nullmailer to stop sending mail to all users.


definition_id: oval:org.debian:def:274067316409251993325355315627604487102
title: CVE-2002-1318 samba
description:
Buffer overflow in samba 2.2.2 through 2.2.6 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an encrypted password that causes the overflow during decryption in which a DOS codepage string is converted to a little-endian UCS2 unicode string.


definition_id: oval:org.debian:def:196703294578623283062666794304012492198
title: CVE-2002-1323 perl
description:
Safe.pm 2.0.7 and earlier, when used in Perl 5.8.0 and earlier, may allow attackers to break out of safe compartments in (1) Safe::reval or (2) Safe::rdo using a redefined @_ variable, which is not reset between successive calls.


definition_id: oval:org.debian:def:162166695995136150336883446163611865931
title: CVE-2002-1335 w3m
description:
Cross-site scripting (XSS) vulnerability in w3m 0.3.2 does not escape an HTML tag in a frame, which allows remote attackers to insert arbitrary web script or HTML and access files or cookies.


definition_id: oval:org.debian:def:159836568595420961797830823264553423281
title: CVE-2002-1336 tightvnc
description:
TightVNC before 1.2.6 generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users.


definition_id: oval:org.debian:def:262982149794551855347959872003588849686
title: CVE-2002-1337 sendmail
description:
Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.


definition_id: oval:org.debian:def:4135756937911923305300882819029560525
title: CVE-2002-1342 smb2www
description:
Unknown vulnerability in smb2www 980804-16 and earlier allows remote attackers to execute arbitrary commands.


definition_id: oval:org.debian:def:30028554545492851328735360534974776530
title: CVE-2002-1344 wget
description:
Directory traversal vulnerability in wget before 1.8.2-4 allows a remote FTP server to create or overwrite files as the wget user via filenames containing (1) /absolute/path or (2) .. (dot dot) sequences.


definition_id: oval:org.debian:def:45550839335090971954022969577820988141
title: CVE-2002-1347 cyrus-sasl2
description:
Multiple buffer overflows in Cyrus SASL library 2.1.9 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) long inputs during user name canonicalization, (2) characters that need to be escaped during LDAP authentication using saslauthd, or (3) an off-by-one error in the log writer, which does not allocate space for the null character that terminates a string.


definition_id: oval:org.debian:def:156770450637188697082851806977686652247
title: CVE-2002-1348 w3m
description:
w3m before 0.3.2.2 does not properly escape HTML tags in the ALT attribute of an IMG tag, which could allow remote attackers to access files or cookies.


definition_id: oval:org.debian:def:261893500063637506014950198350194770705
title: CVE-2002-1350 tcpdump
description:
The BGP decoding routines in tcpdump 3.6.x before 3.7 do not properly copy data, which allows remote attackers to cause a denial of service (application crash).


definition_id: oval:org.debian:def:155427031141342192296696519272387931374
title: CVE-2002-1365 fetchmail
description:
Heap-based buffer overflow in Fetchmail 6.1.3 and earlier does not account for the "@" character when determining buffer lengths for local addresses, which allows remote attackers to execute arbitrary code via a header with a large number of local addresses.


definition_id: oval:org.debian:def:23630485354930704308659513746933828359
title: CVE-2002-1366 cups
description:
Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allows local users with lp privileges to create or overwrite arbitrary files via file race conditions, as demonstrated by ice-cream.


definition_id: oval:org.debian:def:261962969051170883191988683814142188114
title: CVE-2002-1367 cups
description:
Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allows remote attackers to add printers without authentication via a certain UDP packet, which can then be used to perform unauthorized activities such as stealing the local root certificate for the administration server via a "need authorization" page, as demonstrated by new-coke.


definition_id: oval:org.debian:def:202587321622273178825352261551070049278
title: CVE-2002-1368 cups
description:
Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by causing negative arguments to be fed into memcpy() calls via HTTP requests with (1) a negative Content-Length value or (2) a negative length in a chunked transfer encoding.


definition_id: oval:org.debian:def:251292331555747249787388567230015234764
title: CVE-2002-1369 cups
description:
jobs.c in Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly use the strncat function call when processing the options string, which allows remote attackers to execute arbitrary code via a buffer overflow attack.


definition_id: oval:org.debian:def:92577349109084450890218131862771379448
title: CVE-2002-1371 cups
description:
filters/image-gif.c in Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check for zero-length GIF images, which allows remote attackers to execute arbitrary code via modified chunk headers, as demonstrated by nogif.


definition_id: oval:org.debian:def:42501775270070151187698546752582354112
title: CVE-2002-1372 cups
description:
Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check the return values of various file and socket operations, which could allow a remote attacker to cause a denial of service (resource exhaustion) by causing file descriptors to be assigned and not released, as demonstrated by fanta.


definition_id: oval:org.debian:def:298750169194920144233053521011196859427
title: CVE-2002-1377 vim
description:
vim 6.0 and 6.1, and possibly other versions, allows attackers to execute arbitrary commands using the libcall feature in modelines, which are not sandboxed but may be executed when vim is used to edit a malicious file, as demonstrated using mutt.


definition_id: oval:org.debian:def:80943948710397362389842337884125858809
title: CVE-2002-1381 exim4
description:
Format string vulnerability in daemon.c for Exim 4.x through 4.10, and 3.x through 3.36, allows exim administrative users to execute arbitrary code by modifying the pid_file_path value.


definition_id: oval:org.debian:def:88539313603305412716295154570188905546
title: CVE-2002-1383 cups
description:
Multiple integer overflows in Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allow remote attackers to execute arbitrary code via (1) the CUPSd HTTP interface, as demonstrated by vanilla-coke, and (2) the image handling code in CUPS filters, as demonstrated by mksun.


definition_id: oval:org.debian:def:33435554413041667644445112522346103276
title: CVE-2002-1384 cups
description:
Integer overflow in pdftops, as used in Xpdf 2.01 and earlier, xpdf-i, and CUPS before 1.1.18, allows local users to execute arbitrary code via a ColorSpace entry with a large number of elements, as demonstrated by cups-pdf.


definition_id: oval:org.debian:def:184958893743329986797023779329464599442
title: CVE-2002-1388 mhonarc
description:
Cross-site scripting (XSS) vulnerability in MHonArc before 2.5.14 allows remote attackers to inject arbitrary HTML into web archive pages via HTML mail messages.


definition_id: oval:org.debian:def:134102060012283414627347710183177642482
title: CVE-2002-1389 typespeed
description:
Buffer overflow in typespeed 0.4.2 and earlier allows local users to gain privileges via long input.


definition_id: oval:org.debian:def:87241782083580956441631967666590399236
title: CVE-2002-1390 geneweb
description:
The daemon for GeneWeb before 4.09 does not properly handle requested paths, which allows remote attackers to read arbitrary files via a crafted URL.


definition_id: oval:org.debian:def:68476529945649455025533311281389194960
title: CVE-2002-1391 mgetty
description:
Buffer overflow in cnd-program for mgetty before 1.1.29 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a Caller ID string with a long CallerName argument.


definition_id: oval:org.debian:def:34700846113369185135780494928682899695
title: CVE-2002-1392 mgetty
description:
faxspool in mgetty before 1.1.29 uses a world-writable spool directory for outgoing faxes, which allows local users to modify fax transmission privileges.


definition_id: oval:org.debian:def:47501793979857379264076127297332615815
title: CVE-2002-1395 im
description:
Internet Message (IM) 141-18 and earlier uses predictable file and directory names, which allows local users to (1) obtain unauthorized directory permissions via a temporary directory used by impwagent, and (2) overwrite and create arbitrary files via immknmz.


definition_id: oval:org.debian:def:192856658229235177974837248545839134239
title: CVE-2002-1405 lynx
description:
CRLF injection vulnerability in Lynx 2.8.4 and earlier allows remote attackers to inject false HTTP headers into an HTTP request that is provided on the command line, via a URL containing encoded carriage return, line feed, and other whitespace characters.


definition_id: oval:org.debian:def:153683893634543060615438280848067120539
title: CVE-2002-1424 mpack
description:
Buffer overflow in munpack in mpack 1.5 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code.


definition_id: oval:org.debian:def:326840797651248896184483021485217603771
title: CVE-2002-1425 mpack
description:
Directory traversal vulnerability in munpack in mpack 1.5 and earlier allows remote attackers to create new files in the parent directory via a ../ (dot-dot) sequence in the filename to be extracted.


definition_id: oval:org.debian:def:83413869786556775862810447363433517131
title: CVE-2002-1471 evolution
description:
The camel component for Ximian Evolution 1.0.x and earlier does not verify certificates when it establishes a new SSL connection after previously verifying a certificate, which could allow remote attackers to monitor or modify sessions via a man-in-the-middle attack.


definition_id: oval:org.debian:def:199595726896954974424910504317003902272
title: CVE-2002-1477 cacti
description:
graphs.php in Cacti before 0.6.8 allows remote authenticated Cacti administrators to execute arbitrary commands via shell metacharacters in the title during edit mode.


definition_id: oval:org.debian:def:208243367055004092695264322142413447820
title: CVE-2002-1478 cacti
description:
Cacti before 0.6.8 allows attackers to execute arbitrary commands via the "Data Input" option in console mode.


definition_id: oval:org.debian:def:319853388238496623903462101255914499000
title: CVE-2002-1479 cacti
description:
Cacti before 0.6.8 stores a MySQL username and password in plaintext in config.php, which has world-readable permissions, which allows local users to modify databases as the Cacti user and possibly gain privileges.


definition_id: oval:org.debian:def:69776841438617731819441951883282154572
title: CVE-2002-1563 stunnel4
description:
stunnel 4.0.3 and earlier allows attackers to cause a denial of service (crash) via SIGCHLD signal handler race conditions that cause an inconsistency in the child counter.


definition_id: oval:org.debian:def:338652031660082232163171667336279014079
title: CVE-2002-1565 wget
description:
Buffer overflow in url_filename function for wget 1.8.1 allows attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a long URL.


definition_id: oval:org.debian:def:108428038200410032571534240599533178194
title: CVE-2002-1566 netris
description:
netris 0.5, and possibly other versions before 0.52, when running with the -w (wait) option, allows remote attackers to cause a denial of service (crash) via a long string to port 9284.


definition_id: oval:org.debian:def:80480799154108992552991120882937725996
title: CVE-2002-1568 openssl
description:
OpenSSL 0.9.6e uses assertions when detecting buffer overflow attacks instead of less severe mechanisms, which allows remote attackers to cause a denial of service (crash) via certain messages that cause OpenSSL to abort from a failed assertion, as demonstrated using SSLv2 CLIENT_MASTER_KEY messages, which are not properly handled in s2_srvr.c.


definition_id: oval:org.debian:def:185973488250356109125182809218534564133
title: CVE-2002-1569 gv
description:
gv 3.5.8, and possibly earlier versions, allows remote attackers to execute arbitrary commands via shell metacharacters in the filename for (1) a PDF file or (2) a gzip file.


definition_id: oval:org.debian:def:336423283347988412807771906615956918276
title: CVE-2002-1580 cyrus-imapd
description:
Integer overflow in imapparse.c for Cyrus IMAP server 1.4 and 2.1.10 allows remote attackers to execute arbitrary code via a large length value that facilitates a buffer overflow attack, a different vulnerability than CVE-2002-1347.


definition_id: oval:org.debian:def:309384112791657663075772780553752247091
title: CVE-2002-1592 apache2
description:
The ap_log_rerror function in Apache 2.0 through 2.035, when a CGI application encounters an error, sends error messages to the client that include the full path for the server, which allows remote attackers to obtain sensitive information.


definition_id: oval:org.debian:def:47950730748723412941117629505046298575
title: CVE-2002-1593 apache2
description:
mod_dav in Apache before 2.0.42 does not properly handle versioning hooks, which may allow remote attackers to kill a child process via a null dereference and cause a denial of service (CPU consumption) in a preforked multi-processing module.


definition_id: oval:org.debian:def:329275111348861994371581456690286088410
title: CVE-2002-1653 cryptcat
description:
Farm9 Cryptcat, when started in server mode with the -e option, does not enable encryption, which allows clients to communicate without encryption despite intended configuration, and may allow remote attackers to sniff sensitive information.


definition_id: oval:org.debian:def:111541023192650644956589142174508313460
title: CVE-2002-1697 vtun
description:
Electronic Code Book (ECB) mode in VTun 2.0 through 2.5 uses a weak encryption algorithm that produces the same ciphertext from the same plaintext blocks, which could allow remote attackers to gain sensitive information.


definition_id: oval:org.debian:def:132769720419020106527044846742243259387
title: CVE-2002-1746 vtun
description:
Vtun 2.5b1 allows remote attackers to inject data into user sessions by sniffing and replaying packets.


definition_id: oval:org.debian:def:225254500427216031168334467399575445196
title: CVE-2002-1747 vtun
description:
Vtun 2.5b1 does not authenticate forwarded packets, which allows remote attackers to inject data into user sessions without detection, and possibly control the data contents via cut-and-paste attacks on ECB.


definition_id: oval:org.debian:def:46622883220771834285224835960325677580
title: CVE-2002-1755 tinc
description:
tinc 1.0pre3 and 1.0pre4 VPN does not authenticate forwarded packets, which allows remote attackers to inject data into user sessions without detection, and possibly control the data contents via cut-and-paste attacks on CBC.


definition_id: oval:org.debian:def:202489364336436888089177623672625544257
title: CVE-2002-1765 evolution
description:
Evolution 1.0.3 and 1.0.4 allows remote attackers to cause a denial of service (memory consumption and crash) via an email with a malformed MIME header.


definition_id: oval:org.debian:def:320059705956996076202156666133384695257
title: CVE-2002-1782 uw-imap
description:
The default configuration of University of Washington IMAP daemon (wu-imapd), when running on a system that does not allow shell access, allows a local user with a valid IMAP account to read arbitrary files as that user.


definition_id: oval:org.debian:def:89785024936792407107532562901994197651
title: CVE-2002-1788 nn
description:
Format string vulnerability in the nn_exitmsg function in nn 6.6.0 through 6.6.3 allows remote NNTP servers to execute arbitrary code via format strings in server responses.


definition_id: oval:org.debian:def:103579060506578192664013889974547786278
title: CVE-2002-1827 sendmail
description:
Sendmail 8.9.0 through 8.12.3 allows local users to cause a denial of service by obtaining an exclusive lock on the (1) alias, (2) map, (3) statistics, and (4) pid files.


definition_id: oval:org.debian:def:16855670929024195657405908143401304382
title: CVE-2002-1850 apache2
description:
mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CGI script to send a large amount of data to stderr, which results in a read/write deadlock between httpd and the CGI script.


definition_id: oval:org.debian:def:317330411395037320349274276073609749908
title: CVE-2002-1896 alsaplayer
description:
Buffer overflow in Alsaplayer 0.99.71, when installed setuid root, allows local users to execute arbitrary code via a long (1) -f or (2) -o command line argument.


definition_id: oval:org.debian:def:308286224719731719030813682518174148031
title: CVE-2002-1914 dump
description:
dump 0.4 b10 through b29 allows local users to cause a denial of service (execution prevention) by using flock() to lock the /etc/dumpdates file.


definition_id: oval:org.debian:def:146146462657075837271214348145752208439
title: CVE-2002-1956 rox
description:
ROX Filer 1.1.9 and 1.2 is installed with world writable permissions, which allows local users to write to arbitrary files.


definition_id: oval:org.debian:def:240782097681586148229547799183108140629
title: CVE-2002-2016 user-mode-linux
description:
User-mode Linux (UML) 2.4.17-8 does not restrict access to kernel address space, which allows local users to execute arbitrary code.


definition_id: oval:org.debian:def:125442445101825967872980802673950691449
title: CVE-2002-2047 sketch
description:
The file preview functionality in Sketch 0.6.12 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an encapsulated Postscript (EPS) file.


definition_id: oval:org.debian:def:291310605182533688211626044229665212206
title: CVE-2002-2097 maradns
description:
The compression code in MaraDNS before 0.9.01 allows remote attackers to cause a denial of service via crafted DNS packets.


definition_id: oval:org.debian:def:107192818219402250547860111570645088498
title: CVE-2002-2102 jzlib
description:
InfBlocks.java in JCraft JZlib before 0.0.7 allow remote attackers to cause a denial of service (NullPointerException) via an invalid block of deflated data.


definition_id: oval:org.debian:def:222548804185964837796648318090336324781
title: CVE-2002-2196 samba
description:
Samba before 2.2.5 does not properly terminate the enum_csc_policy data structure, which may allow remote attackers to execute arbitrary code via a buffer overflow attack.


definition_id: oval:org.debian:def:96419186886905532384310613286265594650
title: CVE-2002-2207 ssldump
description:
Buffer overflow in ssldump 0.9b2 and earlier, when running in decryption mode, allows remote attackers to execute arbitrary code via a long RSA PreMasterSecret.


definition_id: oval:org.debian:def:255332582625331081665059229412306784810
title: CVE-2002-2227 ssldump
description:
Buffer underflow in ssldump 0.9b2 and earlier allows remote attackers to cause a denial of service (memory corruption) via a crafted SSLv2 challenge value.


definition_id: oval:org.debian:def:46063683995860249978748017638737203686
title: CVE-2002-2261 sendmail
description:
Sendmail 8.9.0 through 8.12.6 allows remote attackers to bypass relaying restrictions enforced by the 'check_relay' function by spoofing a blank DNS hostname.


definition_id: oval:org.debian:def:317943041686457713669973326201258582896
title: CVE-2002-2267 bogofilter
description:
bogopass in bogofilter 0.9.0.4 allows local users to overwrite arbitrary files via a symlink attack on the bogopass temporary file.


definition_id: oval:org.debian:def:199990289356893556839262475479436284938
title: CVE-2002-2443 krb5
description:
schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly validate UDP packets before sending responses, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged packet that triggers a communication loop, as demonstrated by krb_pingpong.nasl, a related issue to CVE-1999-0103.


definition_id: oval:org.debian:def:132157018815137062861113569972518863942
title: CVE-2003-0015 cvs
description:
Double-free vulnerability in CVS 1.11.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed Directory request, as demonstrated by bypassing write checks to execute Update-prog and Checkin-prog commands.


definition_id: oval:org.debian:def:194137484783778826825219023184299619533
title: CVE-2003-0020 apache2
description:
Apache does not filter terminal escape sequences from its error logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences.


definition_id: oval:org.debian:def:213576455127969331000849270405669252298
title: CVE-2003-0021 eterm
description:
The "screen dump" feature in Eterm 0.9.1 and earlier allows attackers to overwrite arbitrary files via a certain character escape sequence when it is echoed to a user's terminal, e.g. when the user views a file containing the malicious sequence.


definition_id: oval:org.debian:def:152281592073012790848536541755716913868
title: CVE-2003-0028 dietlibc
description:
Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, glibc, and dietlibc, allows remote attackers to execute arbitrary code via certain integer values in length fields, a different vulnerability than CVE-2002-0391.


definition_id: oval:org.debian:def:273414502219437697090078459937610365152
title: CVE-2003-0031 libmcrypt
description:
Multiple buffer overflows in libmcrypt before 2.5.5 allow attackers to cause a denial of service (crash).


definition_id: oval:org.debian:def:41246850748079263498133615606672404541
title: CVE-2003-0032 libmcrypt
description:
Memory leak in libmcrypt before 2.5.5 allows attackers to cause a denial of service (memory exhaustion) via a large number of requests to the application, which causes libmcrypt to dynamically load algorithms via libtool.


definition_id: oval:org.debian:def:38273263887606840418117267352803716316
title: CVE-2003-0033 snort
description:
Buffer overflow in the RPC preprocessor for Snort 1.8 and 1.9.x before 1.9.1 allows remote attackers to execute arbitrary code via fragmented RPC packets.


definition_id: oval:org.debian:def:182472339882036200985951324142303967070
title: CVE-2003-0038 mailman
description:
Cross-site scripting (XSS) vulnerability in options.py for Mailman 2.1 allows remote attackers to inject script or HTML into web pages via the (1) email or (2) language parameters.


definition_id: oval:org.debian:def:147103346462874331432600578534489544050
title: CVE-2003-0040 courier
description:
SQL injection vulnerability in the PostgreSQL auth module for courier 0.40 and earlier allows remote attackers to execute SQL code via the user name.


definition_id: oval:org.debian:def:64550288884508863088802777446781028844
title: CVE-2003-0048 putty
description:
PuTTY 0.53b and earlier does not clear logon credentials from memory, including plaintext passwords, which could allow attackers with access to memory to steal the SSH credentials.


definition_id: oval:org.debian:def:289763115956078102568094064958384465823
title: CVE-2003-0058 krb5
description:
MIT Kerberos V5 Key Distribution Center (KDC) before 1.2.5 allows remote authenticated attackers to cause a denial of service (crash) on KDCs within the same realm via a certain protocol request that causes a null dereference.


definition_id: oval:org.debian:def:17793977041646395655862478644936386951
title: CVE-2003-0059 krb5
description:
Unknown vulnerability in the chk_trans.c of the libkrb5 library for MIT Kerberos V5 before 1.2.5 allows users from one realm to impersonate users in other realms that have the same inter-realm keys.


definition_id: oval:org.debian:def:258511068374771929271533729369663211819
title: CVE-2003-0060 krb5
description:
Format string vulnerabilities in the logging routines for MIT Kerberos V5 Key Distribution Center (KDC) before 1.2.5 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in Kerberos principal names.


definition_id: oval:org.debian:def:49166344926769625219033326830003015593
title: CVE-2003-0068 eterm
description:
The Eterm terminal emulator 0.9.1 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.


definition_id: oval:org.debian:def:61675929530004628335519524327307199962
title: CVE-2003-0069 putty
description:
The PuTTY terminal emulator 0.53 allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.


definition_id: oval:org.debian:def:11253634623250707559888760637760765806
title: CVE-2003-0070 vte
description:
VTE, as used by default in gnome-terminal terminal emulator 2.2 and as an option in gnome-terminal 2.0, allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.


definition_id: oval:org.debian:def:180703008832937439845521023178039627832
title: CVE-2003-0072 krb5
description:
The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes an out-of-bounds read of an array (aka "array overrun").


definition_id: oval:org.debian:def:253957418974562571418756979410970804028
title: CVE-2003-0074 plptools
description:
Format string vulnerability in mpmain.c for plpnfsd of the plptools package allows remote attackers to execute arbitrary code via the functions (1) debuglog, (2) errorlog, and (3) infolog.


definition_id: oval:org.debian:def:223912864952095900178804779214458676820
title: CVE-2003-0078 openssl
description:
ssl3_get_record in s3_pkt.c for OpenSSL before 0.9.7a and 0.9.6 before 0.9.6i does not perform a MAC computation if an incorrect block cipher padding is used, which causes an information leak (timing discrepancy) that may make it easier to launch cryptographic attacks that rely on distinguishing between padding and MAC verification errors, possibly leading to extraction of the original plaintext, aka the "Vaudenay timing attack."


definition_id: oval:org.debian:def:296149860767140081857199625098379378963
title: CVE-2003-0082 krb5
description:
The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes the KDC to corrupt its heap (aka "buffer underrun").


definition_id: oval:org.debian:def:183297136512649652301542083640514799083
title: CVE-2003-0083 apache2
description:
Apache 1.3 before 1.3.25 and Apache 2.0 before version 2.0.46 does not filter terminal escape sequences from its access logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences, a different vulnerability than CVE-2003-0020.


definition_id: oval:org.debian:def:323884440868326541271621424411686172489
title: CVE-2003-0085 samba
description:
Buffer overflow in the SMB/CIFS packet fragment re-assembly code for SMB daemon (smbd) in Samba before 2.2.8, and Samba-TNG before 0.3.1, allows remote attackers to execute arbitrary code.


definition_id: oval:org.debian:def:180926762981140121721828344948053683836
title: CVE-2003-0086 samba
description:
The code for writing reg files in Samba before 2.2.8 allows local users to overwrite arbitrary files via a race condition involving chown.


definition_id: oval:org.debian:def:51291264442533344443917709085404493888
title: CVE-2003-0093 tcpdump
description:
The RADIUS decoder in tcpdump 3.6.2 and earlier allows remote attackers to cause a denial of service (crash) via an invalid RADIUS packet with a header length field of 0, which causes tcpdump to generate data within an infinite loop.


definition_id: oval:org.debian:def:101573534422953401605611610088757599693
title: CVE-2003-0098 apcupsd
description:
Unknown vulnerability in apcupsd before 3.8.6, and 3.10.x before 3.10.5, allows remote attackers to gain root privileges, possibly via format strings in a request to a slave server.


definition_id: oval:org.debian:def:95742191056042727697977098461440941907
title: CVE-2003-0099 apcupsd
description:
Multiple buffer overflows in apcupsd before 3.8.6, and 3.10.x before 3.10.5, may allow attackers to cause a denial of service or execute arbitrary code, related to usage of the vsprintf function.


definition_id: oval:org.debian:def:88797691824616188086212801745751152875
title: CVE-2003-0102 file
description:
Buffer overflow in tryelf() in readelf.c of the file command allows attackers to execute arbitrary code as the user running file, possibly via a large entity size value in an ELF header (elfhdr.e_shentsize).


definition_id: oval:org.debian:def:18297700291874604578779691095549565852
title: CVE-2003-0107 zlib
description:
Buffer overflow in the gzprintf function in zlib 1.1.4, when zlib is compiled without vsnprintf or when long inputs are truncated using vsnprintf, allows attackers to cause a denial of service or possibly execute arbitrary code.


definition_id: oval:org.debian:def:4054803336222866078706506640780667394
title: CVE-2003-0108 tcpdump
description:
isakmp_sub_print in tcpdump 3.6 through 3.7.1 allows remote attackers to cause a denial of service (CPU consumption) via a certain malformed ISAKMP packet to UDP port 500, which causes tcpdump to enter an infinite loop.


definition_id: oval:org.debian:def:296392077652504783535128313021455586363
title: CVE-2003-0120 mhc
description:
adb2mhc in the mhc-utils package before 0.25+20010625-7.1 allows local users to overwrite arbitrary files via a symlink attack on a default temporary directory with a predictable name.


definition_id: oval:org.debian:def:291782130059281699705394610180291363234
title: CVE-2003-0128 evolution
description:
The try_uudecoding function in mail-format.c for Ximian Evolution Mail User Agent 1.2.2 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a malicious uuencoded (UUE) header, possibly triggering a heap-based buffer overflow.


definition_id: oval:org.debian:def:138349387915123853333724502256534313622
title: CVE-2003-0129 evolution
description:
Ximian Evolution Mail User Agent 1.2.2 and earlier allows remote attackers to cause a denial of service (memory consumption) via a mail message that is uuencoded multiple times.


definition_id: oval:org.debian:def:234556699090319299846638271648584005973
title: CVE-2003-0130 evolution
description:
The handle_image function in mail-format.c for Ximian Evolution Mail User Agent 1.2.2 and earlier does not properly escape HTML characters, which allows remote attackers to inject arbitrary data and HTML via a MIME Content-ID header in a MIME-encoded image.


definition_id: oval:org.debian:def:37548535806670260698261689909680929880
title: CVE-2003-0131 openssl
description:
The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the "Klima-Pokorny-Rosa attack."


definition_id: oval:org.debian:def:3140128271315585483598406161402950220
title: CVE-2003-0132 apache2
description:
A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed.


definition_id: oval:org.debian:def:148113571025760921531731437561727885940
title: CVE-2003-0133 evolution
description:
GtkHTML, as included in Evolution before 1.2.4, allows remote attackers to cause a denial of service (crash) via certain malformed messages.


definition_id: oval:org.debian:def:64274989675009231980078005666598158165
title: CVE-2003-0134 apache2
description:
Unknown vulnerability in filestat.c for Apache running on OS2, versions 2.0 through 2.0.45, allows unknown attackers to cause a denial of service via requests related to device names.


definition_id: oval:org.debian:def:175249462335327437027010904002746789388
title: CVE-2003-0136 lprng
description:
psbanner in the LPRng package allows local users to overwrite arbitrary files via a symbolic link attack on the /tmp/before file.


definition_id: oval:org.debian:def:14752550446656411324397654756087136623
title: CVE-2003-0138 heimdal
description:
Version 4 of the Kerberos protocol (krb4), as used in Heimdal and other packages, allows an attacker to impersonate any principal in a realm via a chosen-plaintext attack.


definition_id: oval:org.debian:def:67654283748435964306309847540745485040
title: CVE-2003-0139 krb5
description:
Certain weaknesses in the implementation of version 4 of the Kerberos protocol (krb4) in the krb5 distribution, when triple-DES keys are used to key krb4 services, allow an attacker to create krb4 tickets for unauthorized principals using a cut-and-paste attack and "ticket splicing."


definition_id: oval:org.debian:def:26091137882793615748486505365552333025
title: CVE-2003-0140 mutt
description:
Buffer overflow in Mutt 1.4.0 and possibly earlier versions, 1.5.x up to 1.5.3, and other programs that use Mutt code such as Balsa before 2.0.10, allows a remote malicious IMAP server to cause a denial of service (crash) and possibly execute arbitrary code via a crafted folder.


definition_id: oval:org.debian:def:57010964703573428273605936963938405359
title: CVE-2003-0144 lpr
description:
Buffer overflow in the lprm command in the lprold lpr package on SuSE 7.1 through 7.3, OpenBSD 3.2 and earlier, and possibly other operating systems, allows local users to gain root privileges via long command line arguments such as (1) request ID or (2) user name.


definition_id: oval:org.debian:def:243405599226719185107994051071232064786
title: CVE-2003-0145 tcpdump
description:
Unknown vulnerability in tcpdump before 3.7.2 related to an inability to "Handle unknown RADIUS attributes properly," allows remote attackers to cause a denial of service (infinite loop), a different vulnerability than CAN-2003-0093.


definition_id: oval:org.debian:def:289729490314134153642633223636114698471
title: CVE-2003-0146 lpr
description:
Multiple vulnerabilities in NetPBM 9.20 and earlier, and possibly other versions, may allow remote attackers to cause a denial of service or execute arbitrary code via "maths overflow errors" such as (1) integer signedness errors or (2) integer overflows, which lead to buffer overflows.


definition_id: oval:org.debian:def:186281796550514497439261042828341144032
title: CVE-2003-0147 openssl
description:
OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms ("Karatsuba" and normal).


definition_id: oval:org.debian:def:312102760969015511840874998864105474206
title: CVE-2003-0161 sendmail
description:
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.


definition_id: oval:org.debian:def:105161104944685785562515896208906310040
title: CVE-2003-0165 eog
description:
Format string vulnerability in Eye Of Gnome (EOG) allows attackers to execute arbitrary code via format string specifiers in a command line argument for the file to display.


definition_id: oval:org.debian:def:282787589777121790272851866207022036034
title: CVE-2003-0167 balsa
description:
Multiple off-by-one buffer overflows in the IMAP capability for Mutt 1.3.28 and earlier, and Balsa 1.2.4 and earlier, allow a remote malicious IMAP server to cause a denial of service (crash) and possibly execute arbitrary code via a specially crafted mail folder, a different vulnerability than CVE-2003-0140.


definition_id: oval:org.debian:def:207766006096277015596550370296088859775
title: CVE-2003-0173 xfsdump
description:
xfsdq in xfsdump does not create quota information files securely, which allows local users to gain root privileges.


definition_id: oval:org.debian:def:100601611618567582431934705624764124690
title: CVE-2003-0188 lv
description:
lv reads a .lv file from the current working directory, which allows local users to execute arbitrary commands as other lv users by placing malicious .lv files into other directories.


definition_id: oval:org.debian:def:213749967061707970986723368954421627242
title: CVE-2003-0189 apache2
description:
The authentication module for Apache 2.0.40 through 2.0.45 on Unix does not properly handle threads safely when using the crypt_r or crypt functions, which allows remote attackers to cause a denial of service (failed Basic authentication with valid usernames and passwords) when a threaded MPM is used.


definition_id: oval:org.debian:def:6967496180128886085154047536692702241
title: CVE-2003-0190 openssh
description:
OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.


definition_id: oval:org.debian:def:276921291294986801549567345217113917384
title: CVE-2003-0192 apache2
description:
Apache 2 before 2.0.47, and certain versions of mod_ssl for Apache 1.3, do not properly handle "certain sequences of per-directory renegotiations and the SSLCipherSuite directive being used to upgrade from a weak ciphersuite to a strong one," which could cause Apache to use the weak ciphersuite.


definition_id: oval:org.debian:def:206282586826615944820748992454735210392
title: CVE-2003-0193 catdoc
description:
msxlsview.sh in xlsview for catdoc 0.91 and earlier allows local users to overwrite arbitrary files via a symlink attack on predictable temporary file names ("word$$.html").


definition_id: oval:org.debian:def:131323735775780188020346760635285867742
title: CVE-2003-0195 cups
description:
CUPS before 1.1.19 allows remote attackers to cause a denial of service via a partial printing request to the IPP port (631), which does not time out.


definition_id: oval:org.debian:def:121322731031705684111210630589582364209
title: CVE-2003-0196 samba
description:
Multiple buffer overflows in Samba before 2.2.8a may allow remote attackers to execute arbitrary code or cause a denial of service, as discovered by the Samba team and a different vulnerability than CVE-2003-0201.


definition_id: oval:org.debian:def:217579008810733434732077520780840891872
title: CVE-2003-0201 samba
description:
Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x versions, and Samba-TNG before 0.3.2, allows remote attackers to execute arbitrary code.


definition_id: oval:org.debian:def:206833308016271868073579607169352664988
title: CVE-2003-0209 snort
description:
Integer overflow in the TCP stream reassembly module (stream4) for Snort 2.0 and earlier allows remote attackers to execute arbitrary code via large sequence numbers in packets, which enable a heap-based buffer overflow.


definition_id: oval:org.debian:def:41185005830569391373873238978160872690
title: CVE-2003-0211 xinetd
description:
Memory leak in xinetd 2.3.10 allows remote attackers to cause a denial of service (memory consumption) via a large number of rejected connections.


definition_id: oval:org.debian:def:339936749229430153814938219718228705830
title: CVE-2003-0212 rinetd
description:
handleAccept in rinetd before 0.62 does not properly resize the connection list when it becomes full and sets an array index incorrectly, which allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large number of connections.


definition_id: oval:org.debian:def:180023543998353472463579446688176135238
title: CVE-2003-0213 pptpd
description:
ctrlpacket.c in PoPToP PPTP server before 1.1.4-b3 allows remote attackers to cause a denial of service via a length field of 0 or 1, which causes a negative value to be fed into a read operation, leading to a buffer overflow.


definition_id: oval:org.debian:def:188747937356241623526319161355015379400
title: CVE-2003-0214 mime-support
description:
run-mailcap in mime-support 3.22 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:182076029355634248172849298393435766798
title: CVE-2003-0245 apache2
description:
Vulnerability in the apr_psprintf function in the Apache Portable Runtime (APR) library for Apache 2.0.37 through 2.0.45 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long strings, as demonstrated using XML objects to mod_dav, and possibly other vectors.


definition_id: oval:org.debian:def:69816042885564594868669039206356742071
title: CVE-2003-0251 nis
description:
ypserv NIS server before 2.7 allows remote attackers to cause a denial of service via a TCP client request that does not respond to the server, which causes ypserv to block.


definition_id: oval:org.debian:def:44875367190873536601353394946071009569
title: CVE-2003-0252 nfs-utils
description:
Off-by-one error in the xlog function of mountd in the Linux NFS utils package (nfs-utils) before 1.0.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain RPC requests to mountd that do not contain newlines.


definition_id: oval:org.debian:def:271126985210178207308865177383964799866
title: CVE-2003-0253 apache2
description:
The prefork MPM in Apache 2 before 2.0.47 does not properly handle certain errors from accept, which could lead to a denial of service.


definition_id: oval:org.debian:def:58607592160652052008881302714014379754
title: CVE-2003-0254 apache2
description:
Apache 2 before 2.0.47, when running on an IPv6 host, allows attackers to cause a denial of service (CPU consumption by infinite loop) when the FTP proxy server fails to create an IPv6 socket.


definition_id: oval:org.debian:def:105517415830309550916179985170253349057
title: CVE-2003-0261 fuzz
description:
fuzz 0.6 and earlier creates temporary files insecurely, which could allow local users to gain root privileges.


definition_id: oval:org.debian:def:254608681470318583859519374893343377365
title: CVE-2003-0282 unzip
description:
Directory traversal vulnerability in UnZip 5.50 allows attackers to overwrite arbitrary files via invalid characters between two . (dot) characters, which are filtered and result in a ".." sequence.


definition_id: oval:org.debian:def:270020269986144400576029648708357354248
title: CVE-2003-0296 evolution
description:
The IMAP Client for Evolution 1.2.4 allows remote malicious IMAP servers to cause a denial of service and possibly execute arbitrary code via certain large literal size values that cause either integer signedness errors or integer overflow errors.


definition_id: oval:org.debian:def:84848653030364157686269185499041642934
title: CVE-2003-0297 uw-imap
description:
c-client IMAP Client, as used in imap-2002b and Pine 4.53, allows remote malicious IMAP servers to cause a denial of service (crash) and possibly execute arbitrary code via certain large (1) literal and (2) mailbox size values that cause either integer signedness errors or integer overflow errors.


definition_id: oval:org.debian:def:99989827288352435739290977923520308270
title: CVE-2003-0308 sendmail
description:
The Sendmail 8.12.3 package in Debian GNU/Linux 3.0 does not securely create temporary files, which could allow local users to gain additional privileges via (1) expn, (2) checksendmail, or (3) doublebounce.pl.


definition_id: oval:org.debian:def:46608861693234132348802585429163285744
title: CVE-2003-0323 epic4
description:
Multiple buffer overflows in ircII 20020912 allows remote malicious IRC servers to cause a denial of service (crash) and possibly execute arbitrary code via responses that are not properly fed to the my_strcat function by (1) ctcp_buffer, (2) cannot_join_channel, (3) status_make_printable for Statusbar drawing, (4) create_server_list, and possibly other functions.


definition_id: oval:org.debian:def:108487355779049509171656314989212063889
title: CVE-2003-0324 epic4
description:
Buffer overflows in EPIC IRC Client (EPIC4) 1.0.1 allows remote malicious IRC servers to cause a denial of service (crash) and possibly execute arbitrary code via long replies that are not properly handled by the (1) userhost_cmd_returned function, or (2) Statusbar capability.


definition_id: oval:org.debian:def:82076982847040099866482621815198119115
title: CVE-2003-0328 epic4
description:
EPIC IRC Client (EPIC4) pre2.002, pre2.003, and possibly later versions, allows remote malicious IRC servers to cause a denial of service (crash) and possibly execute arbitrary code via a CTCP request from a large nickname, which causes an incorrect length calculation.


definition_id: oval:org.debian:def:72369009901629017309364925188401934442
title: CVE-2003-0358 nethack
description:
Buffer overflow in (1) nethack 3.4.0 and earlier, and (2) falconseye 1.9.3 and earlier, which is based on nethack, allows local users to gain privileges via a long -s command line option.


definition_id: oval:org.debian:def:68776577196284898124186118862656892253
title: CVE-2003-0359 nethack
description:
nethack 3.4.0 and earlier installs certain setgid binaries with insecure permissions, which allows local users to gain privileges by replacing the original binaries with malicious code.


definition_id: oval:org.debian:def:15511516621779860215929642191981994799
title: CVE-2003-0366 lyskom-server
description:
lyskom-server 2.0.7 and earlier allows unauthenticated users to cause a denial of service (CPU consumption) via a large query.


definition_id: oval:org.debian:def:185322800014361080283821086134327441836
title: CVE-2003-0367 gzip
description:
znew in the gzip package allows local users to overwrite arbitrary files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:9338076791747594742093522360204398463
title: CVE-2003-0380 atftp
description:
Buffer overflow in atftp daemon (atftpd) 0.6.1 and earlier, and possibly later versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long filename.


definition_id: oval:org.debian:def:53736271391447432115235740650318910252
title: CVE-2003-0381 noweb
description:
Multiple vulnerabilities in noweb 2.9 and earlier creates temporary files insecurely, which allows local users to overwrite arbitrary files via multiple vectors including the noroff script.


definition_id: oval:org.debian:def:227961371438490472545149861655223655375
title: CVE-2003-0382 eterm
description:
Buffer overflow in Eterm 0.9.2 allows local users to gain privileges via a long ETERMPATH environment variable.


definition_id: oval:org.debian:def:266247903938498824773606495655882522498
title: CVE-2003-0385 xaos
description:
Buffer overflow in xaos 3.0-23 and earlier, when running setuid, allows local users to gain root privileges via a long -language option.


definition_id: oval:org.debian:def:119119865674376473406896465232143799536
title: CVE-2003-0386 openssh
description:
OpenSSH 3.6.1 and earlier, when restricting host access by numeric IP addresses and with VerifyReverseMapping disabled, allows remote attackers to bypass "from=" and "user@host" address restrictions by connecting to a host from a system whose reverse DNS hostname contains the numeric IP address.


definition_id: oval:org.debian:def:283739340140214951354809633461872479458
title: CVE-2003-0390 opt
description:
Multiple buffer overflows in Options Parsing Tool (OPT) shared library 3.18 and earlier, when used in setuid programs, may allow local users to execute arbitrary code via long command line options that are fed into macros such as opt_warn_2, as used in functions such as opt_atoi.


definition_id: oval:org.debian:def:183086353917409235274173943057723830560
title: CVE-2003-0396 linux-atm
description:
Buffer overflow in les for ATM on Linux (linux-atm) before 2.4.1, if used setuid, allows local users to gain privileges via a long -f command line argument.


definition_id: oval:org.debian:def:305126335809046519615998182340326666222
title: CVE-2003-0407 gbatnav
description:
Buffer overflow in gbnserver for Gnome Batalla Naval 1.0.4 allows remote attackers to execute arbitrary code via a long connection string.


definition_id: oval:org.debian:def:231054629167159442399146409856778622843
title: CVE-2003-0427 mikmod
description:
Buffer overflow in mikmod 3.1.6 and earlier allows remote attackers to execute arbitrary code via an archive file that contains a file with a long filename.


definition_id: oval:org.debian:def:199624352343878371879063344869797318193
title: CVE-2003-0434 xpdf
description:
Various PDF viewers including (1) Adobe Acrobat 5.06 and (2) Xpdf 1.01 allow remote attackers to execute arbitrary commands via shell metacharacters in an embedded hyperlink.


definition_id: oval:org.debian:def:285012947958894790223475952297699449396
title: CVE-2003-0435 typespeed
description:
Buffer overflow in net_swapscore for typespeed 0.4.1 and earlier allows remote attackers to execute arbitrary code.


definition_id: oval:org.debian:def:133884355416028547449059287591922900424
title: CVE-2003-0438 eldav
description:
eldav WebDAV client for Emacs, version 0.7.2 and earlier, allows local users to create or overwrite arbitrary files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:106808918305771307647647302623977799314
title: CVE-2003-0440 semi
description:
The (1) semi MIME library 1.14.5 and earlier, and (2) wemi 1.14.0 and possibly other versions, allows local users to overwrite arbitrary files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:260911145811033878014869173813419980764
title: CVE-2003-0441 orville-write
description:
Multiple buffer overflows in Orville Write (orville-write) 2.53 and earlier allow local users to gain privileges.


definition_id: oval:org.debian:def:249501338743780797567537938387077423632
title: CVE-2003-0445 webfs
description:
Buffer overflow in webfs before 1.17.1 allows remote attackers to execute arbitrary code via an HTTP request with a long Request-URI.


definition_id: oval:org.debian:def:124956963263645576924885969038902495106
title: CVE-2003-0454 xgalaga
description:
Multiple buffer overflows in xgalaga 2.0.34 and earlier allow local users to gain privileges via a long HOME environment variable.


definition_id: oval:org.debian:def:83649238973198126526637421718391018932
title: CVE-2003-0455 imagemagick
description:
The imagemagick libmagick library 5.5 and earlier creates temporary files insecurely, which allows local users to create or overwrite arbitrary files.


definition_id: oval:org.debian:def:199237604032842727777782369389766566434
title: CVE-2003-0468 postfix
description:
Postfix 1.1.11 and earlier allows remote attackers to use Postfix to conduct "bounce scans" or DDos attacks of other hosts via an email address to the local host containing the target IP address and service name followed by a "!" string, which causes Postfix to attempt to use SMTP to communicate with the target on the associated port.


definition_id: oval:org.debian:def:109156523494744049956293419605059690312
title: CVE-2003-0489 tcptraceroute
description:
tcptraceroute 1.4 and earlier does not fully drop privileges after obtaining a file descriptor for capturing packets, which may allow local users to gain access to the descriptor via a separate vulnerability in tcptraceroute.


definition_id: oval:org.debian:def:303772429217438736643638344373183045484
title: CVE-2003-0516 mgetty
description:
cnd.c in mgetty 1.1.28 and earlier does not properly filter non-printable characters and quotes, which may allow remote attackers to execute arbitrary commands via shell metacharacters in (1) caller ID or (2) caller name strings.


definition_id: oval:org.debian:def:303436281343391373746972644669398836289
title: CVE-2003-0517 mgetty
description:
faxrunqd.in in mgetty 1.1.28 and earlier allows local users to overwrite files via a symlink attack on JOB files.


definition_id: oval:org.debian:def:109895627451767289657343209317320572961
title: CVE-2003-0537 liece
description:
The liece Emacs IRC client 2.0+0.20030527 and earlier creates temporary files insecurely, which could allow local users to overwrite arbitrary files as other users.


definition_id: oval:org.debian:def:275933620097534784424817209587818138459
title: CVE-2003-0539 ddskk
description:
skk (Simple Kana to Kanji conversion program) 12.1 and earlier, and the ddskk package which is based on skk, creates temporary files insecurely, which allows local users to overwrite arbitrary files.


definition_id: oval:org.debian:def:205439398929110031666426736914763189580
title: CVE-2003-0540 postfix
description:
The address parser code in Postfix 1.1.12 and earlier allows remote attackers to cause a denial of service (lock) via (1) a malformed envelope address to a local host that would generate a bounce and contains the ".!" string in the MAIL FROM or Errors-To headers, which causes nqmgr to lock up, or (2) via a valid MAIL FROM with a RCPT TO containing a ".!" string, which causes an instance of the SMTP listener to lock up.


definition_id: oval:org.debian:def:134882700064552782360600596446543659187
title: CVE-2003-0542 apache2
description:
Multiple stack-based buffer overflows in (1) mod_alias and (2) mod_rewrite for Apache before 1.3.29 allow attackers to create configuration files to cause a denial of service (crash) or execute arbitrary code via a regular expression with more than 9 captures.


definition_id: oval:org.debian:def:333817748598746900407930454690904489337
title: CVE-2003-0543 openssl
description:
Integer overflow in OpenSSL 0.9.6 and 0.9.7 allows remote attackers to cause a denial of service (crash) via an SSL client certificate with certain ASN.1 tag values.


definition_id: oval:org.debian:def:301405717310659095996012131521714430126
title: CVE-2003-0544 openssl
description:
OpenSSL 0.9.6 and 0.9.7 does not properly track the number of characters in certain ASN.1 inputs, which allows remote attackers to cause a denial of service (crash) via an SSL client certificate that causes OpenSSL to read past the end of a buffer when the long form is used.


definition_id: oval:org.debian:def:33520856873467784340287803235302027480
title: CVE-2003-0545 openssl
description:
Double free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an SSL client certificate with a certain invalid ASN.1 encoding.


definition_id: oval:org.debian:def:164612807711500499423042249671519315230
title: CVE-2003-0577 mpg123
description:
mpg123 0.59r allows remote attackers to cause a denial of service and possibly execute arbitrary code via an MP3 file with a zero bitrate, which creates a negative frame size.


definition_id: oval:org.debian:def:59777348932666079994259224957284811208
title: CVE-2003-0581 xfstt
description:
X Fontserver for Truetype fonts (xfstt) 1.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a (1) FS_QueryXExtents8 or (2) FS_QueryXBitmaps8 packet, and possibly other types of packets, with a large num_ranges value, which causes an out-of-bounds array access.


definition_id: oval:org.debian:def:234615991200590123635301482046108328680
title: CVE-2003-0596 fdclone
description:
FDclone 2.00a, and other versions before 2.02a, creates temporary directories with predictable names and uses them if they already exist, which allows local users to read or modify files of other fdclone users by creating the directory ahead of time.


definition_id: oval:org.debian:def:4782644406810050249067748705104217802
title: CVE-2003-0606 sup
description:
sup 1.8 and earlier does not properly create temporary files, which allows local users to overwrite arbitrary files.


definition_id: oval:org.debian:def:138005159357221683192280956183318278337
title: CVE-2003-0612 crafty
description:
Multiple buffer overflows in main.c for Crafty 19.3 allow local users to gain group "games" privileges via long command line arguments to crafty.bin.


definition_id: oval:org.debian:def:205647121894131345157596038832809195901
title: CVE-2003-0615 perl
description:
Cross-site scripting (XSS) vulnerability in start_form() of CGI.pm allows remote attackers to insert web script via a URL that is fed into the form's action parameter.


definition_id: oval:org.debian:def:100422600494932362590193772249811616467
title: CVE-2003-0618 perl
description:
Multiple vulnerabilities in suidperl 5.6.1 and earlier allow a local user to obtain sensitive information about files for which the user does not have appropriate permissions.


definition_id: oval:org.debian:def:41833431868371037638927355693496165637
title: CVE-2003-0620 man-db
description:
Multiple buffer overflows in man-db 2.4.1 and earlier, when installed setuid, allow local users to gain privileges via (1) MANDATORY_MANPATH, MANPATH_MAP, and MANDB_MAP arguments to add_to_dirlist in manp.c, (2) a long pathname to ult_src in ult_src.c, (3) a long .so argument to test_for_include in ult_src.c, (4) a long MANPATH environment variable, or (5) a long PATH environment variable.


definition_id: oval:org.debian:def:77762589551701347345954784664630806451
title: CVE-2003-0625 xfstt
description:
Off-by-one error in certain versions of xfstt allows remote attackers to read potentially sensitive memory via a malformed client request in the connection handshake, which leaks the memory in the server's response.


definition_id: oval:org.debian:def:16137188709847489561037166238550118807
title: CVE-2003-0630 atari800
description:
Multiple buffer overflows in the atari800.svgalib setuid program of the Atari 800 emulator (atari800) before 1.2.2 allow local users to gain privileges via long command line arguments, as demonstrated with the -osa_rom argument.


definition_id: oval:org.debian:def:255635603152328526156173855602407757801
title: CVE-2003-0644 kdbg
description:
Kdbg 1.1.0 through 1.2.8 does not check permissions of the .kdbgrc file, which allows local users to execute arbitrary commands.


definition_id: oval:org.debian:def:86745367519903451592547977313994683019
title: CVE-2003-0645 man-db
description:
man-db 2.3.12 and 2.3.18 to 2.4.1 uses certain user-controlled DEFINE directives from the ~/.manpath file, even when running setuid, which could allow local users to gain privileges.


definition_id: oval:org.debian:def:146412946071277370978696181460232358348
title: CVE-2003-0648 fte
description:
Multiple buffer overflows in vfte, based on FTE, before 0.50, allow local users to execute arbitrary code.


definition_id: oval:org.debian:def:317028367960584069314807185605119395036
title: CVE-2003-0681 sendmail
description:
A "potential buffer overflow in ruleset parsing" for Sendmail 8.12.9, when using the nonstandard rulesets (1) recipient (2), final, or (3) mailer-specific envelope recipients, has unknown consequences.


definition_id: oval:org.debian:def:37122365898651630468786520521654691281
title: CVE-2003-0682 openssh
description:
"Memory bugs" in OpenSSH 3.7.1 and earlier, with unknown impact, a different set of vulnerabilities than CVE-2003-0693 and CVE-2003-0695.


definition_id: oval:org.debian:def:179147089607618400442978691857875124134
title: CVE-2003-0685 netris
description:
Buffer overflow in Netris 0.52 and earlier, and possibly other versions, allows remote malicious Netris servers to execute arbitrary code on netris clients via a long server response.


definition_id: oval:org.debian:def:135641934123341056414028557059269489023
title: CVE-2003-0688 sendmail
description:
The DNS map code in Sendmail 8.12.8 and earlier, when using the "enhdnsbl" feature, does not properly initialize certain data structures, which allows remote attackers to cause a denial of service (process crash) via an invalid DNS response that causes Sendmail to free incorrect data.


definition_id: oval:org.debian:def:315746148519062107394230932142933108851
title: CVE-2003-0689 glibc
description:
The getgrouplist function in GNU libc (glibc) 2.2.4 and earlier allows attackers to cause a denial of service (segmentation fault) and execute arbitrary code when a user is a member of a large number of groups, which can cause a buffer overflow.


definition_id: oval:org.debian:def:239084348406492547614464873404411288637
title: CVE-2003-0693 openssh
description:
A "buffer management error" in buffer_append_space of buffer.c for OpenSSH before 3.7 may allow remote attackers to execute arbitrary code by causing an incorrect amount of memory to be freed and corrupting the heap, a different vulnerability than CVE-2003-0695.


definition_id: oval:org.debian:def:44279220020005541825576488975347856434
title: CVE-2003-0694 sendmail
description:
The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c.


definition_id: oval:org.debian:def:152557808898076766766757988915569857447
title: CVE-2003-0695 openssh
description:
Multiple "buffer management errors" in OpenSSH before 3.7.1 may allow attackers to cause a denial of service or execute arbitrary code using (1) buffer_init in buffer.c, (2) buffer_free in buffer.c, or (3) a separate function in channels.c, a different vulnerability than CVE-2003-0693.


definition_id: oval:org.debian:def:113363625360057644941836592569588234734
title: CVE-2003-0706 mah-jong
description:
Unknown vulnerability in mah-jong 1.5.6 and earlier allows remote attackers to cause a denial of service (tight loop).


definition_id: oval:org.debian:def:291295765852543372548894992378591340429
title: CVE-2003-0709 whois
description:
Buffer overflow in the whois client, which is not setuid but is sometimes called from within CGI programs, may allow remote attackers to execute arbitrary code via a long command line option.


definition_id: oval:org.debian:def:228199730367945993672682863464208232855
title: CVE-2003-0723 gkrellm
description:
Buffer overflow in gkrellmd for gkrellm 2.1.x before 2.1.14 may allow remote attackers to execute arbitrary code.


definition_id: oval:org.debian:def:2090722625917406361714339823605302056
title: CVE-2003-0734 libnss-ldap
description:
Unknown vulnerability in the pam_filter mechanism in pam_ldap before version 162, when LDAP based authentication is being used, allows users to bypass host-based access restrictions and log onto the system.


definition_id: oval:org.debian:def:231276616235562950560633786287442566762
title: CVE-2003-0740 stunnel4
description:
Stunnel 4.00, and 3.24 and earlier, leaks a privileged file descriptor returned by listen(), which allows local users to hijack the Stunnel server.


definition_id: oval:org.debian:def:39300625157427755219893858035377745255
title: CVE-2003-0744 leafnode
description:
The fetchnews NNTP client in leafnode 1.9.3 to 1.9.41 allows remote attackers to cause a denial of service (process hang and termination) via certain malformed Usenet news articles that cause fetchnews to hang while waiting for input.


definition_id: oval:org.debian:def:303154686357328529209543163451108409623
title: CVE-2003-0761 asterisk
description:
Buffer overflow in the get_msg_text of chan_sip.c in the Session Initiation Protocol (SIP) protocol implementation for Asterisk releases before August 15, 2003, allows remote attackers to execute arbitrary code via certain (1) MESSAGE or (2) INFO requests.


definition_id: oval:org.debian:def:320186348347337908164002696890640488064
title: CVE-2003-0771 libapache-gallery-perl
description:
Gallery.pm in Apache::Gallery (aka A::G) uses predictable temporary filenames when running Inline::C, which allows local users to execute arbitrary code by creating and modifying the files before Apache::Gallery does.


definition_id: oval:org.debian:def:339150693266855362596648479832685488022
title: CVE-2003-0773 sane-backends
description:
saned in sane-backends 1.0.7 and earlier does not check the IP address of the connecting host during the SANE_NET_INIT RPC call, which allows remote attackers to use that call even if they are restricted in saned.conf.


definition_id: oval:org.debian:def:13895563434712368067913115492913072493
title: CVE-2003-0774 sane-backends
description:
saned in sane-backends 1.0.7 and earlier does not quickly handle connection drops, which allows remote attackers to cause a denial of service (segmentation fault) when invalid memory is accessed.


definition_id: oval:org.debian:def:150602585860551084668024287030696335183
title: CVE-2003-0775 sane-backends
description:
saned in sane-backends 1.0.7 and earlier calls malloc with an arbitrary size value if a connection is dropped before the size value has been sent, which allows remote attackers to cause a denial of service (memory consumption or crash).


definition_id: oval:org.debian:def:107514176140264196734099834507950853468
title: CVE-2003-0776 sane-backends
description:
saned in sane-backends 1.0.7 and earlier does not properly "check the validity of the RPC numbers it gets before getting the parameters," with unknown consequences.


definition_id: oval:org.debian:def:135663298104766439211945938115032150445
title: CVE-2003-0777 sane-backends
description:
saned in sane-backends 1.0.7 and earlier, when debug messages are enabled, does not properly handle dropped connections, which can prevent strings from being null terminated and cause a denial of service (segmentation fault).


definition_id: oval:org.debian:def:14324463409118701077248829106057388838
title: CVE-2003-0778 sane-backends
description:
saned in sane-backends 1.0.7 and earlier, and possibly later versions, does not properly allocate memory in certain cases, which could allow attackers to cause a denial of service (memory consumption).


definition_id: oval:org.debian:def:320712198335677212078457706771329505088
title: CVE-2003-0779 asterisk
description:
SQL injection vulnerability in the Call Detail Record (CDR) logging functionality for Asterisk allows remote attackers to execute arbitrary SQL via a CallerID string.


definition_id: oval:org.debian:def:62180018481966960389677824589199972536
title: CVE-2003-0786 openssh
description:
The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege Separation is disabled, does not check the result of the authentication attempt, which can allow remote attackers to gain privileges.


definition_id: oval:org.debian:def:85447956078213641281560384569071554687
title: CVE-2003-0787 openssh
description:
The PAM conversation function in OpenSSH 3.7.1 and 3.7.1p1 interprets an array of structures as an array of pointers, which allows attackers to modify the stack and possibly gain privileges.


definition_id: oval:org.debian:def:141573010660789312358482679787558342340
title: CVE-2003-0788 cups
description:
Unknown vulnerability in the Internet Printing Protocol (IPP) implementation in CUPS before 1.1.19 allows remote attackers to cause a denial of service (CPU consumption from a "busy loop") via certain inputs to the IPP port (TCP 631).


definition_id: oval:org.debian:def:6820640287312072165979261947213850808
title: CVE-2003-0789 apache2
description:
mod_cgid in Apache before 2.0.48, when using a threaded MPM, does not properly handle CGI redirect paths, which could cause Apache to send the output of a CGI program to the wrong client.


definition_id: oval:org.debian:def:337687250157305069634596710002037798967
title: CVE-2003-0792 fetchmail
description:
Fetchmail 6.2.4 and earlier does not properly allocate memory for long lines, which allows remote attackers to cause a denial of service (crash) via a certain email.


definition_id: oval:org.debian:def:77093598878179608837792669401462034862
title: CVE-2003-0795 quagga
description:
The vty layer in Quagga before 0.96.4, and Zebra 0.93b and earlier, does not verify that sub-negotiation is taking place when processing the SE marker, which allows remote attackers to cause a denial of service (crash) via a malformed telnet command to the telnet CLI port, which may trigger a null dereference.


definition_id: oval:org.debian:def:56595581037866535541245749223757518945
title: CVE-2003-0805 gopher
description:
Multiple buffer overflows in UMN gopher daemon (gopherd) 2.x and 3.x before 3.0.6 allows attackers to execute arbitrary code via (1) a long filename as a result of a LIST command, and (2) the GSisText function, which calculates the view-type.


definition_id: oval:org.debian:def:253230138964629999312120143271970597425
title: CVE-2003-0826 lsh-utils
description:
lsh daemon (lshd) does not properly return from certain functions in (1) read_line.c, (2) channel_commands.c, or (3) client_keyexchange.c when long input is provided, which could allow remote attackers to execute arbitrary code via a heap-based buffer overflow attack.


definition_id: oval:org.debian:def:166050218021175449628020010620435740996
title: CVE-2003-0828 freesweep
description:
Buffer overflow in freesweep in Debian GNU/Linux 3.0 allows local users to gain "games" group privileges when processing environment variables.


definition_id: oval:org.debian:def:1102504772520268812647209662449550874
title: CVE-2003-0832 webfs
description:
Directory traversal vulnerability in webfs before 1.20 allows remote attackers to read arbitrary files via .. (dot dot) sequences in a Hostname header.


definition_id: oval:org.debian:def:1314309289922683769723514455405364838
title: CVE-2003-0833 webfs
description:
Stack-based buffer overflow in webfs before 1.20 allows attackers to execute arbitrary code by creating directories that result in a long pathname.


definition_id: oval:org.debian:def:270367525498290840038698158439800301398
title: CVE-2003-0850 libnids
description:
The TCP reassembly functionality in libnids before 1.18 allows remote attackers to cause "memory corruption" and possibly execute arbitrary code via "overlarge TCP packets."


definition_id: oval:org.debian:def:4008577068707288160661982673423251054
title: CVE-2003-0853 coreutils
description:
An integer overflow in ls in the fileutils or coreutils packages may allow local users to cause a denial of service or execute arbitrary code via a large -w value, which could be remotely exploited via applications that use ls, such as wu-ftpd.


definition_id: oval:org.debian:def:301313780124692463442003738323415068721
title: CVE-2003-0854 coreutils
description:
ls in the fileutils or coreutils packages allows local users to consume a large amount of memory via a large -w value, which can be remotely exploited via applications that use ls, such as wu-ftpd.


definition_id: oval:org.debian:def:177813020407266191807678774480854912421
title: CVE-2003-0855 pan
description:
Pan 0.13.3 and earlier allows remote attackers to cause a denial of service (crash) via a news post with a long author email address.


definition_id: oval:org.debian:def:237256346994539454416026341888901728567
title: CVE-2003-0858 quagga
description:
Zebra 0.93b and earlier, and quagga before 0.95, allows local users to cause a denial of service by sending spoofed messages as other users to the kernel netlink interface.


definition_id: oval:org.debian:def:937105925243086364110838496321623064
title: CVE-2003-0864 ircd-irc2
description:
Buffer overflow in m_join in channel.c for IRCnet IRCD 2.10.x to 2.10.3p3 allows remote attackers to cause a denial of service.


definition_id: oval:org.debian:def:52371391366336685419923692485579545106
title: CVE-2003-0865 mpg123
description:
Heap-based buffer overflow in readstring of httpget.c for mpg123 0.59r and 0.59s allows remote attackers to execute arbitrary code via a long request.


definition_id: oval:org.debian:def:330166570084262338459585293997150085547
title: CVE-2003-0885 xscreensaver
description:
Xscreensaver 4.14 contains certain debugging code that should have been omitted, which causes Xscreensaver to create temporary files insecurely in the (1) apple2, (2) xanalogtv, and (3) pong screensavers, and allows local users to overwrite arbitrary files via a symlink attack.


definition_id: oval:org.debian:def:49144594092449978093540061636766995687
title: CVE-2003-0886 hylafax
description:
Format string vulnerability in hfaxd for Hylafax 4.1.7 and earlier allows remote attackers to execute arbitrary code.


definition_id: oval:org.debian:def:308232401820628306144666734422287755844
title: CVE-2003-0900 perl
description:
Perl 5.8.1 on Fedora Core does not properly initialize the random number generator when forking, which makes it easier for attackers to predict random numbers.


definition_id: oval:org.debian:def:90487877966157308861125971885606227039
title: CVE-2003-0924 netpbm-free
description:
netpbm 9.25 and earlier does not properly create temporary files, which allows local users to overwrite arbitrary files.


definition_id: oval:org.debian:def:218996532039579804795555671450711202359
title: CVE-2003-0932 omega-rpg
description:
Buffer overflow in omega-rpg 0.90 allows local users to execute arbitrary code via a long (1) command line or (2) environment variable.


definition_id: oval:org.debian:def:304155829079923439004941175261221590696
title: CVE-2003-0935 net-snmp
description:
Net-SNMP before 5.0.9 allows a user or community to access data in MIB objects, even if that data is not allowed to be viewed.


definition_id: oval:org.debian:def:74368951491963878942339002494809334325
title: CVE-2003-0946 clamav
description:
Format string vulnerability in clamav-milter for Clam AntiVirus 0.60 through 0.60p, and other versions before 0.65, allows remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in the email address argument of a "MAIL FROM" command.


definition_id: oval:org.debian:def:92509169736938087242076824444498848164
title: CVE-2003-0949 xsok
description:
xsok 1.02 does not properly drop privileges before finding and executing the "gunzip" program, which allows local users to execute arbitrary commands.


definition_id: oval:org.debian:def:239197382897576021336285518171532685821
title: CVE-2003-0962 rsync
description:
Heap-based buffer overflow in rsync before 2.5.7, when running in server mode, allows remote attackers to execute arbitrary code and possibly escape the chroot jail.


definition_id: oval:org.debian:def:197921929974896330075296036293946332738
title: CVE-2003-0963 lftp
description:
Buffer overflows in (1) try_netscape_proxy and (2) try_squid_eplf for lftp 2.6.9 and earlier allow remote HTTP servers to execute arbitrary code via long directory names that are processed by the ls or rels commands.


definition_id: oval:org.debian:def:323503371324023975359564821671650354131
title: CVE-2003-0965 mailman
description:
Cross-site scripting (XSS) vulnerability in the admin CGI script for Mailman before 2.1.4 allows remote attackers to steal session cookies and conduct unauthorized activities.


definition_id: oval:org.debian:def:280974582466980871932648133571010490771
title: CVE-2003-0967 freeradius
description:
rad_decode in FreeRADIUS 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via a short RADIUS string attribute with a tag, which causes memcpy to be called with a -1 length argument, as demonstrated using the Tunnel-Password attribute.


definition_id: oval:org.debian:def:222564810299262166051501170460382282522
title: CVE-2003-0968 freeradius
description:
Stack-based buffer overflow in SMB_Logon_Server of the rlm_smb experimental module for FreeRADIUS 0.9.3 and earlier allows remote attackers to execute arbitrary code via a long User-Password attribute.


definition_id: oval:org.debian:def:73314095013675931700345882439849539717
title: CVE-2003-0969 mpg321
description:
mpg321 0.2.10 allows remote attackers to overwrite memory and possibly execute arbitrary code via an mp3 file that passes certain strings to the printf function, possibly triggering a format string vulnerability.


definition_id: oval:org.debian:def:214065769571782265190740927187048425779
title: CVE-2003-0972 screen
description:
Integer signedness error in ansi.c for GNU screen 4.0.1 and earlier, and 3.9.15 and earlier, allows local users to execute arbitrary code via a large number of ";" (semicolon) characters in escape sequences, which leads to a buffer overflow.


definition_id: oval:org.debian:def:230261865244007931390350787685885095233
title: CVE-2003-0977 cvs
description:
CVS server before 1.11.10 may allow attackers to cause the CVS server to create directories and files in the file system root directory via malformed module requests.


definition_id: oval:org.debian:def:424097465515069792866158392497233768
title: CVE-2003-0989 tcpdump
description:
tcpdump before 3.8.1 allows remote attackers to cause a denial of service (infinite loop) via certain ISAKMP packets, a different vulnerability than CVE-2004-0057.


definition_id: oval:org.debian:def:188553497824503159319447142879286218084
title: CVE-2003-0991 mailman
description:
Unknown vulnerability in the mail command handler in Mailman before 2.0.14 allows remote attackers to cause a denial of service (crash) via malformed e-mail commands.


definition_id: oval:org.debian:def:112516674541995007322759190044436517458
title: CVE-2003-0992 mailman
description:
Cross-site scripting (XSS) vulnerability in the create CGI script for Mailman before 2.1.3 allows remote attackers to steal cookies of other users.


definition_id: oval:org.debian:def:65422629614795266067755130648245998495
title: CVE-2003-1000 xchat
description:
xchat 2.0.6 allows remote attackers to cause a denial of service (crash) via a passive DCC request with an invalid ID number, which causes a null dereference.


definition_id: oval:org.debian:def:125634882477151719382646161730064331821
title: CVE-2003-1023 mc
description:
Stack-based buffer overflow in vfs_s_resolve_symlink of vfs/direntry.c for Midnight Commander (mc) 4.6.0 and earlier, and possibly later versions, allows remote attackers to execute arbitrary code during symlink conversion.


definition_id: oval:org.debian:def:84529503119670892992704918587635790248
title: CVE-2003-1029 tcpdump
description:
The L2TP protocol parser in tcpdump 3.8.1 and earlier allows remote attackers to cause a denial of service (infinite loop and memory consumption) via a packet with invalid data to UDP port 1701, which causes l2tp_avp_print to use a bad length value when calling print_octets.


definition_id: oval:org.debian:def:54528623581469582777270909217685252270
title: CVE-2003-1053 xshisen
description:
Multiple buffer overflows in XShisen allow attackers to execute arbitrary code via a long (1) -KCONV command line option or (2) XSHISENLIB environment variable.


definition_id: oval:org.debian:def:163463731451436358235576458510196452951
title: CVE-2003-1092 file
description:
Unknown vulnerability in the "Automatic File Content Type Recognition (AFCTR) Tool version of the file package before 3.41, related to "a memory allocation problem," has unknown impact.


definition_id: oval:org.debian:def:129557957540041601369759652288324540591
title: CVE-2003-1164 mldonkey
description:
Cross-site scripting (XSS) vulnerability in Mldonkey 2.5-4 allows remote attackers to inject arbitrary web script or HTML via the URI, which is injected into the HTML error page.


definition_id: oval:org.debian:def:187173035963168464916816939186071276847
title: CVE-2003-1294 xscreensaver
description:
Xscreensaver before 4.15 creates temporary files insecurely in (1) driver/passwd-kerberos.c, (2) driver/xscreensaver-getimage-video, (3) driver/xscreensaver.kss.in, and the (4) vidwhacker and (5) webcollage screensavers, which allows local users to overwrite arbitrary files via a symlink attack.


definition_id: oval:org.debian:def:333290439963224079129956126959934714126
title: CVE-2003-1295 xscreensaver
description:
Unspecified vulnerability in xscreensaver 4.12, and possibly other versions, allows attackers to cause xscreensaver to crash via unspecified vectors "while verifying the user-password."


definition_id: oval:org.debian:def:252724946029357341886022577559362328523
title: CVE-2003-1308 fvwm
description:
CRLF injection vulnerability in fvwm-menu-directory for fvwm 2.5.x before 2.5.10 and 2.4.x before 2.4.18 allows local users to execute arbitrary commands via carriage returns in a filename.


definition_id: oval:org.debian:def:267656904736516144242291688026658452211
title: CVE-2003-1399 eject
description:
eject 2.0.10, when installed setuid on systems such as SuSE Linux 7.3, generates different error messages depending on whether a specified file exists or not, which allows local users to obtain sensitive information.


definition_id: oval:org.debian:def:58325702665754034351237906122826037257
title: CVE-2003-1557 spamassassin
description:
Off-by-one buffer overflow in spamc of SpamAssassin 2.40 through 2.43, when using BSMTP mode ("-B"), allows remote attackers to execute arbitrary code via email containing headers with leading "." characters.


definition_id: oval:org.debian:def:273459533817004489312086134190001151083
title: CVE-2003-1562 openssh
description:
sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful, a different vulnerability than CVE-2003-0190.


definition_id: oval:org.debian:def:3292145749126164019809230440958024988
title: CVE-2003-1598 wordpress
description:
SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the posts variable.


definition_id: oval:org.debian:def:141890607538638904554749991580780504592
title: CVE-2004-0014 nd
description:
Multiple buffer overflows in the nd WebDAV interface 0.8.2 and earlier allows remote web servers to execute arbitrary code via certain long strings.


definition_id: oval:org.debian:def:126974623560052934192125089377115215626
title: CVE-2004-0042 vsftpd
description:
vsftpd 1.1.3 generates different error messages depending on whether or not a valid username exists, which allows remote attackers to identify valid usernames.


definition_id: oval:org.debian:def:134834050721719500741022162034522807850
title: CVE-2004-0045 inn2
description:
Buffer overflow in the ARTpost function in art.c in the control message handling code for INN 2.4.0 may allow remote attackers to execute arbitrary code.


definition_id: oval:org.debian:def:192293980082831757073355695881057505966
title: CVE-2004-0055 tcpdump
description:
The print_attr_string function in print-radius.c for tcpdump 3.8.1 and earlier allows remote attackers to cause a denial of service (segmentation fault) via a RADIUS attribute with a large length value.


definition_id: oval:org.debian:def:196981957814868828268979623623639973459
title: CVE-2004-0057 tcpdump
description:
The rawprint function in the ISAKMP decoding routines (print-isakmp.c) for tcpdump 3.8.1 and earlier allows remote attackers to cause a denial of service (segmentation fault) via malformed ISAKMP packets that cause invalid "len" or "loc" values to be used in a loop, a different vulnerability than CVE-2003-0989.


definition_id: oval:org.debian:def:274370616133984188570611810276493460344
title: CVE-2004-0078 mutt
description:
Buffer overflow in the index menu code (menu_pad_string of menu.c) for Mutt 1.4.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain mail messages.


definition_id: oval:org.debian:def:236235228864783005668290324559075687863
title: CVE-2004-0079 openssl
description:
The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference.


definition_id: oval:org.debian:def:278253696958204122470115932495847600010
title: CVE-2004-0081 openssl
description:
OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the Codenomicon TLS Test Tool.


definition_id: oval:org.debian:def:241477526229006561409577297241798923976
title: CVE-2004-0082 samba
description:
The mksmbpasswd shell script (mksmbpasswd.sh) in Samba 3.0.0 and 3.0.1, when creating an account but marking it as disabled, may overwrite the user password with an uninitialized buffer, which could enable the account with a more easily guessable password.


definition_id: oval:org.debian:def:316886731512858708871269647998853872589
title: CVE-2004-0103 crawl
description:
crawl before 4.0.0 beta23 does not properly "apply a size check" when copying a certain environment variable, which may allow local users to gain privileges, possibly as a result of a buffer overflow.


definition_id: oval:org.debian:def:119044697936882966421170844030785650518
title: CVE-2004-0107 sysstat
description:
The (1) post and (2) trigger scripts in sysstat 4.0.7 and earlier allow local users to overwrite arbitrary files via symlink attacks on temporary files, a different vulnerability than CVE-2004-0108.


definition_id: oval:org.debian:def:150884282787840469507528205955089491022
title: CVE-2004-0108 sysstat
description:
The isag utility, which processes sysstat data, allows local users to overwrite arbitrary files via a symlink attack on temporary files, a different vulnerability than CAN-2004-0107.


definition_id: oval:org.debian:def:72246003578957103966085237039693593109
title: CVE-2004-0110 libxml2
description:
Buffer overflow in the (1) nanohttp or (2) nanoftp modules in XMLSoft Libxml 2 (Libxml2) 2.6.0 through 2.6.5 allow remote attackers to execute arbitrary code via a long URL.


definition_id: oval:org.debian:def:248193287655932751400047906230907299458
title: CVE-2004-0111 gdk-pixbuf
description:
gdk-pixbuf before 0.20 allows attackers to cause a denial of service (crash) via a malformed bitmap (BMP) file.


definition_id: oval:org.debian:def:108010984987250336456465424732391666333
title: CVE-2004-0112 openssl
description:
The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.


definition_id: oval:org.debian:def:101217039889179649064228836727629434420
title: CVE-2004-0113 apache2
description:
Memory leak in ssl_engine_io.c for mod_ssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service (memory consumption) via plain HTTP requests to the SSL port of an SSL-enabled server.


definition_id: oval:org.debian:def:134671306979651170149727274536177540678
title: CVE-2004-0154 nfs-utils
description:
rpc.mountd in nfs-utils after 1.0.3 and before 1.0.6 allows attackers to cause a denial of service (crash) via an NFS mount of a directory from a client whose reverse DNS lookup name is different from the forward lookup name.


definition_id: oval:org.debian:def:163629897652666662063411553431421828763
title: CVE-2004-0157 xonix
description:
x11.c in xonix 1.4 and earlier uses the current working directory to find and execute the rmail program, which allows local users to execute arbitrary code by modifying the path to point to a malicious rmail program.


definition_id: oval:org.debian:def:126801958121771868883818792024804176068
title: CVE-2004-0158 lbreakout2
description:
Buffer overflow in lbreakout2 allows local users to gain 'games' group privileges via a large HOME environment variable to (1) editor.c, (2) theme.c, (3) manager.c, (4) config.c, (5) game.c, (6) levels.c, or (7) main.c.


definition_id: oval:org.debian:def:340017010946529911687679357643738433950
title: CVE-2004-0175 openssh
description:
Directory traversal vulnerability in scp for OpenSSH before 3.4p1 allows remote malicious servers to overwrite arbitrary files.  NOTE: this may be a rediscovery of CVE-2000-0992.


definition_id: oval:org.debian:def:153726492451590288322075068151068150151
title: CVE-2004-0180 cvs
description:
The client for CVS before 1.11 allows a remote malicious CVS server to create arbitrary files using certain RCS diff files that use absolute pathnames during checkouts or updates, a different vulnerability than CVE-2004-0405.


definition_id: oval:org.debian:def:67718977140314284567934471894593244153
title: CVE-2004-0183 tcpdump
description:
TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via ISAKMP packets containing a Delete payload with a large number of SPI's, which causes an out-of-bounds read, as demonstrated by the Striker ISAKMP Protocol Test Suite.


definition_id: oval:org.debian:def:267552708535620697515232737820781360513
title: CVE-2004-0184 tcpdump
description:
Integer underflow in the isakmp_id_print for TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with an Identification payload with a length that becomes less than 8 during byte order conversion, which causes an out-of-bounds read, as demonstrated by the Striker ISAKMP Protocol Test Suite.


definition_id: oval:org.debian:def:205674862840404930954022999954956850556
title: CVE-2004-0186 samba
description:
smbmnt in Samba 2.x and 3.x on Linux 2.6, when installed setuid, allows local users to gain root privileges by mounting a Samba share that contains a setuid root program, whose setuid attributes are not cleared when the share is mounted.


definition_id: oval:org.debian:def:140035715337117923316440905105256164381
title: CVE-2004-0188 calife
description:
Heap-based buffer overflow in Calife 2.8.5 and earlier may allow local users to execute arbitrary code via a long password.


definition_id: oval:org.debian:def:329618856930096208351678283289487633188
title: CVE-2004-0189 squid
description:
The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass url_regex ACLs via a URL with a NULL ("%00") character, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists.


definition_id: oval:org.debian:def:307896900091794514754827996907889472996
title: CVE-2004-0224 courier
description:
Multiple buffer overflows in (1) iso2022jp.c or (2) shiftjis.c for Courier-IMAP before 3.0.0, Courier before 0.45, and SqWebMail before 4.0.0 may allow remote attackers to execute arbitrary code "when Unicode character is out of BMP range."


definition_id: oval:org.debian:def:12220904718940925450861429000048360237
title: CVE-2004-0226 mc
description:
Multiple buffer overflows in Midnight Commander (mc) before 4.6.0 may allow attackers to cause a denial of service or execute arbitrary code.


definition_id: oval:org.debian:def:78366665517879268393455640679083225918
title: CVE-2004-0231 mc
description:
Multiple vulnerabilities in Midnight Commander (mc) before 4.6.0, with unknown impact, related to "Insecure temporary file and directory creations."


definition_id: oval:org.debian:def:93807015109471662506512067080627567244
title: CVE-2004-0232 mc
description:
Multiple format string vulnerabilities in Midnight Commander (mc) before 4.6.0 may allow attackers to cause a denial of service or execute arbitrary code.


definition_id: oval:org.debian:def:128676645125537352151716545763511134372
title: CVE-2004-0256 libtool
description:
GNU libtool before 1.5.2, during compile time, allows local users to overwrite arbitrary files via a symlink attack on libtool directories in /tmp.


definition_id: oval:org.debian:def:157999562258624304098665136691757880489
title: CVE-2004-0270 clamav
description:
libclamav in Clam AntiVirus 0.65 allows remote attackers to cause a denial of service (crash) via a uuencoded e-mail message with an invalid line length (e.g., a lowercase character), which causes an assert error in clamd that terminates the calling program.


definition_id: oval:org.debian:def:317127846636507201064011891153034835677
title: CVE-2004-0274 eggdrop
description:
Share.mod in Eggheads Eggdrop IRC bot 1.6.10 through 1.6.15 can mistakenly assign STAT_OFFERED status to a bot that is not a sharebot, which allows remote attackers to use STAT_OFFERED to promote a bot to a sharebot and conduct unauthorized activities.


definition_id: oval:org.debian:def:186676776557472318418642201987305094554
title: CVE-2004-0333 uudeview
description:
Buffer overflow in the UUDeview package, as used in WinZip 6.2 through WinZip 8.1 SR-1, and possibly other packages, allows remote attackers to execute arbitrary code via a MIME archive with certain long MIME parameters.


definition_id: oval:org.debian:def:329985401566363725024176629119015914755
title: CVE-2004-0371 heimdal
description:
Heimdal 0.6.x before 0.6.1 and 0.5.x before 0.5.3 does not properly perform certain consistency checks for cross-realm requests, which allows remote attackers with control of a realm to impersonate others in the cross-realm trust path.


definition_id: oval:org.debian:def:148181381293109310545479678860555536931
title: CVE-2004-0372 xine-ui
description:
xine allows local users to overwrite arbitrary files via a symlink attack on a bug report email that is generated by the (1) xine-bugreport or (2) xine-check scripts.


definition_id: oval:org.debian:def:127585088474146925552473318166495531212
title: CVE-2004-0386 mplayer
description:
Buffer overflow in the HTTP parser for MPlayer 1.0pre3 and earlier, 0.90, and 0.91 allows remote attackers to execute arbitrary code via a long Location header.


definition_id: oval:org.debian:def:77308516595006668604148864108336153938
title: CVE-2004-0393 rlpr
description:
Format string vulnerability in the msg function for rlpr daemon (rlprd) 2.0.4 allows remote attackers to execute arbitrary code via format string specifiers in a buffer that can not be resolved, which is provided to the syslog function.


definition_id: oval:org.debian:def:85819165160759956377984713841708300199
title: CVE-2004-0395 gatos
description:
The xatitv program in the gatos package does not properly drop root privileges when the configuration file does not exist, which allows local users to execute arbitrary commands via shell metacharacters in a system call.


definition_id: oval:org.debian:def:315975998228961299828793688009466110440
title: CVE-2004-0396 cvs
description:
Heap-based buffer overflow in CVS 1.11.x up to 1.11.15, and 1.12.x up to 1.12.7, when using the pserver mechanism allows remote attackers to execute arbitrary code via Entry lines.


definition_id: oval:org.debian:def:122002889650644834379168703795621692134
title: CVE-2004-0397 subversion
description:
Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code via a (1) DAV2 REPORT query or (2) get-dated-rev svn-protocol command.


definition_id: oval:org.debian:def:80213808003600841865922919501640108947
title: CVE-2004-0398 cadaver
description:
Heap-based buffer overflow in the ne_rfc1036_parse date parsing function for the neon library (libneon) 0.24.5 and earlier, as used by cadaver before 0.22, allows remote WebDAV servers to execute arbitrary code on the client.


definition_id: oval:org.debian:def:119368634853897494576645949738208064338
title: CVE-2004-0399 exim4
description:
Stack-based buffer overflow in Exim 3.35, and other versions before 4, when the sender_verify option is true, allows remote attackers to cause a denial of service and possibly execute arbitrary code during sender verification.


definition_id: oval:org.debian:def:82273969384206528071626682639525201295
title: CVE-2004-0400 exim4
description:
Stack-based buffer overflow in Exim 4 before 4.33, when the headers_check_syntax option is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code during the header check.


definition_id: oval:org.debian:def:280492955839848577152087736398264997795
title: CVE-2004-0404 logcheck
description:
logcheck before 1.1.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary directory in /var/tmp.


definition_id: oval:org.debian:def:155393857166850234939809873208594997797
title: CVE-2004-0405 cvs
description:
CVS before 1.11 allows CVS clients to read arbitrary files via .. (dot dot) sequences in filenames via CVS client requests, a different vulnerability than CVE-2004-0180.


definition_id: oval:org.debian:def:54242403177912604502376045596127268440
title: CVE-2004-0408 ident2
description:
Buffer overflow in the child_service function in the ident2 ident daemon allows remote attackers to execute arbitrary code.


definition_id: oval:org.debian:def:306604364442547701262881999948440907486
title: CVE-2004-0409 xchat
description:
Stack-based buffer overflow in the Socks-5 proxy code for XChat 1.8.0 to 2.0.8, with socks5 traversal enabled, allows remote attackers to execute arbitrary code.


definition_id: oval:org.debian:def:305922107182867564510540269282096077989
title: CVE-2004-0412 mailman
description:
Mailman before 2.1.5 allows remote attackers to obtain user passwords via a crafted email request to the Mailman server.


definition_id: oval:org.debian:def:286848947184588346989128759278160182680
title: CVE-2004-0413 subversion
description:
libsvn_ra_svn in Subversion 1.0.4 trusts the length field of (1) svn://, (2) svn+ssh://, and (3) other svn protocol URL strings, which allows remote attackers to cause a denial of service (memory consumption) and possibly execute arbitrary code via an integer overflow that leads to a heap-based buffer overflow.


definition_id: oval:org.debian:def:288975305286976935461578109972545434206
title: CVE-2004-0414 cvs
description:
CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle malformed "Entry" lines, which prevents a NULL terminator from being used and may lead to a denial of service (crash), modification of critical program data, or arbitrary code execution.


definition_id: oval:org.debian:def:193707792295403987501757878207785961754
title: CVE-2004-0416 cvs
description:
Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code.


definition_id: oval:org.debian:def:316591062670434561575982482841179331204
title: CVE-2004-0417 cvs
description:
Integer overflow in the "Max-dotdot" CVS protocol command (serve_max_dotdot) for CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to cause a server crash, which could cause temporary data to remain undeleted and consume disk space.


definition_id: oval:org.debian:def:210145643248917373108872922002943703061
title: CVE-2004-0418 cvs
description:
serve_notify in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle empty data lines, which may allow remote attackers to perform an "out-of-bounds" write for a single byte to execute arbitrary code or modify critical program data.


definition_id: oval:org.debian:def:186918514584388560785645852335694169139
title: CVE-2004-0422 flim
description:
flim before 1.14.3 creates temporary files insecurely, which allows local users to overwrite arbitrary files of the Emacs user via a symlink attack.


definition_id: oval:org.debian:def:190590693153870220426258617254788977350
title: CVE-2004-0426 rsync
description:
rsync before 2.6.1 does not properly sanitize paths when running a read/write daemon without using chroot, which allows remote attackers to write files outside of the module's path.


definition_id: oval:org.debian:def:12116674473372242073150882813646435055
title: CVE-2004-0433 mplayer
description:
Multiple buffer overflows in the Real-Time Streaming Protocol (RTSP) client for (1) MPlayer before 1.0pre4 and (2) xine lib (xine-lib) before 1-rc4, when playing Real RTSP (realrtsp) streams, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (a) long URLs, (b) long Real server responses, or (c) long Real Data Transport (RDT) packets.


definition_id: oval:org.debian:def:188008483017852013490959746709023436167
title: CVE-2004-0434 heimdal
description:
k5admind (kadmind) for Heimdal allows remote attackers to execute arbitrary code via a Kerberos 4 compatibility administration request whose framing length is less than 2, which leads to a heap-based buffer overflow.


definition_id: oval:org.debian:def:320686124586828146599472796859718647105
title: CVE-2004-0451 sup
description:
Multiple format string vulnerabilities in the (1) logquit, (2) logerr, or (3) loginfo functions in Software Upgrade Protocol (SUP) allows remote attackers to execute arbitrary code via format string specifiers in messages that are logged by syslog.


definition_id: oval:org.debian:def:192576543269059163698237669603325504129
title: CVE-2004-0452 perl
description:
Race condition in the rmtree function in the File::Path module in Perl 5.6.1 and 5.8.4 sets read/write permissions for the world, which allows local users to delete arbitrary files and directories, and possibly read files and directories, via a symlink attack.


definition_id: oval:org.debian:def:234745392079983720090627111058787277563
title: CVE-2004-0453 vice
description:
Format string vulnerability in the monitor "memory dump" command in VICE 1.6 to 1.14 allows local users to cause a denial of service (emulator crash) and possibly execute arbitrary code via format string specifiers in an output string.


definition_id: oval:org.debian:def:51529149312857727860571297226241325608
title: CVE-2004-0454 rlpr
description:
Buffer overflow in the msg function for rlpr daemon (rlprd) 2.04 allows local users to execute arbitrary code.


definition_id: oval:org.debian:def:298237165175625277118802707024900892643
title: CVE-2004-0458 mah-jong
description:
mah-jong before 1.6.2 allows remote attackers to cause a denial of service (server crash) via a missing argument, which triggers a null pointer dereference.


definition_id: oval:org.debian:def:19877106081587531146485781053806307491
title: CVE-2004-0488 apache2
description:
Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.


definition_id: oval:org.debian:def:255706984856246838560037644650484178050
title: CVE-2004-0493 apache2
description:
The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters.


definition_id: oval:org.debian:def:263683162294490572584607928597985961032
title: CVE-2004-0523 krb5
description:
Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root.


definition_id: oval:org.debian:def:85343018724845453106045668293029090382
title: CVE-2004-0536 tripwire
description:
Format string vulnerability in Tripwire commercial 4.0.1 and earlier, including 2.4, and open source 2.3.1 and earlier, allows local users to gain privileges via format string specifiers in a file name, which is used in the generation of an email report.


definition_id: oval:org.debian:def:285068976580598544254847469249282154474
title: CVE-2004-0541 squid
description:
Buffer overflow in the ntlm_check_auth (NTLM authentication) function for Squid Web Proxy Cache 2.5.x and 3.x, when compiled with NTLM handlers enabled, allows remote attackers to execute arbitrary code via a long password ("pass" variable).


definition_id: oval:org.debian:def:148051383043773686071994274583579911580
title: CVE-2004-0548 aspell
description:
Multiple stack-based buffer overflows in the word-list-compress functionality in compress.c for Aspell allow local users to execute arbitrary code via a long entry in the wordlist that is not properly handled when using the (1) "c" compress option or (2) "d" decompress option.


definition_id: oval:org.debian:def:306573645013923372875892384780026092006
title: CVE-2004-0557 sox
description:
Multiple buffer overflows in the st_wavstartread function in wav.c for Sound eXchange (SoX) 12.17.2 through 12.17.4 allow remote attackers to execute arbitrary code via certain WAV file header fields.


definition_id: oval:org.debian:def:69975008784768698256872250155898963108
title: CVE-2004-0558 cups
description:
The Internet Printing Protocol (IPP) implementation in CUPS before 1.1.21 allows remote attackers to cause a denial of service (service hang) via a certain UDP packet to the IPP port.


definition_id: oval:org.debian:def:94458330759627952176888393277847690515
title: CVE-2004-0560 gopher
description:
Integer overflow in gopher daemon (gopherd) 3.0.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted content of a certain size that triggers the overflow.


definition_id: oval:org.debian:def:102606086413546173871830768866925464492
title: CVE-2004-0561 gopher
description:
Format string vulnerability in the log routine for gopher daemon (gopherd) 3.0.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code.


definition_id: oval:org.debian:def:182038135891952076577127082766165969586
title: CVE-2004-0564 rp-pppoe
description:
Roaring Penguin pppoe (rp-ppoe), if installed or configured to run setuid root contrary to its design, allows local users to overwrite arbitrary files.  NOTE: the developer has publicly disputed the claim that this is a vulnerability because pppoe "is NOT designed to run setuid-root."  Therefore this identifier applies *only* to those configurations and installations under which pppoe is run setuid root despite the developer's warnings.


definition_id: oval:org.debian:def:63541159122412552097698113634265324075
title: CVE-2004-0579 super
description:
Format string vulnerability in super before 3.23 allows local users to execute arbitrary code as root.


definition_id: oval:org.debian:def:92910807902180870802183880174488972856
title: CVE-2004-0591 courier
description:
Cross-site scripting (XSS) vulnerability in the print_header_uc function for SqWebMail 4.0.4 and earlier, and possibly 3.x, allows remote attackers to inject arbitrary web script or HRML via (1) e-mail headers or (2) a message with a "message/delivery-status" MIME Content-Type.


definition_id: oval:org.debian:def:126441645791003144384593887038349932106
title: CVE-2004-0600 samba
description:
Buffer overflow in the Samba Web Administration Tool (SWAT) in Samba 3.0.2 to 3.0.4 allows remote attackers to execute arbitrary code via an invalid base-64 character during HTTP basic authentication.


definition_id: oval:org.debian:def:60637507767331961930997758342505928051
title: CVE-2004-0601 distcc
description:
distcc before 2.16, when running on 64-bit platforms, does not interpret IP-based access control rules correctly, which could allow remote attackers to bypass intended restrictions.


definition_id: oval:org.debian:def:163400519546945175973124679588192504598
title: CVE-2004-0642 krb5
description:
Double free vulnerabilities in the error handling code for ASN.1 decoders in the (1) Key Distribution Center (KDC) library and (2) client library for MIT Kerberos 5 (krb5) 1.3.4 and earlier may allow remote attackers to execute arbitrary code.


definition_id: oval:org.debian:def:290036661735542396308642197124000292679
title: CVE-2004-0643 krb5
description:
Double free vulnerability in the krb5_rd_cred function for MIT Kerberos 5 (krb5) 1.3.1 and earlier may allow local users to execute arbitrary code.


definition_id: oval:org.debian:def:57637946763967160670544837340132028972
title: CVE-2004-0644 krb5
description:
The asn1buf_skiptail function in the ASN.1 decoder library for MIT Kerberos 5 (krb5) 1.2.2 through 1.3.4 allows remote attackers to cause a denial of service (infinite loop) via a certain BER encoding.


definition_id: oval:org.debian:def:287010250529901039632122131651365728961
title: CVE-2004-0645 abiword
description:
Buffer overflow in the wvHandleDateTimePicture function in wv library (wvWare) 0.7.4 through 0.7.6 and 1.0.0 allows remote attackers to execute arbitrary code via a document with a long DateTime field.


definition_id: oval:org.debian:def:60802588976894182624444697046779955258
title: CVE-2004-0647 shorewall
description:
shorewall 1.4.10c and earlier, and 2.0.x before 2.0.3a, allows local users to overwrite arbitrary files via a symlink attack on the chains-$$ temporary file.


definition_id: oval:org.debian:def:56213811012358504398183014595118676711
title: CVE-2004-0656 pure-ftpd
description:
The accept_client function in PureFTPd 1.0.18 and earlier allows remote attackers to cause a denial of service by exceeding the maximum number of connections.


definition_id: oval:org.debian:def:319752843265055740730238236453196117310
title: CVE-2004-0657 ntp
description:
Integer overflow in the NTP daemon (NTPd) before 4.0 causes the NTP server to return the wrong date/time offset when a client requests a date/time that is more than 34 years away from the server's time.


definition_id: oval:org.debian:def:325135576676683069931698156873043560278
title: CVE-2004-0686 samba
description:
Buffer overflow in Samba 2.2.x to 2.2.9, and 3.0.0 to 3.0.4, when the "mangling method = hash" option is enabled in smb.conf, has unknown impact and attack vectors.


definition_id: oval:org.debian:def:275283268427430093861149239272486309308
title: CVE-2004-0708 moin
description:
MoinMoin 1.2.1 and earlier allows remote attackers to gain privileges by creating a user with the same name as an existing group that has higher privileges.


definition_id: oval:org.debian:def:130333294065112628886269382669492905053
title: CVE-2004-0747 apache2
description:
Buffer overflow in Apache 2.0.50 and earlier allows local users to gain apache privileges via a .htaccess file that causes the overflow during expansion of environment variables.


definition_id: oval:org.debian:def:14427106254117245459741045487822401243
title: CVE-2004-0748 apache2
description:
mod_ssl in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (CPU consumption) by aborting an SSL connection in a way that causes an Apache child process to enter an infinite loop.


definition_id: oval:org.debian:def:234328938994043659791674664511955874105
title: CVE-2004-0749 subversion
description:
The mod_authz_svn module in Subversion 1.0.7 and earlier does not properly restrict access to all metadata on unreadable paths, which could allow remote attackers to gain sensitive information via (1) svn log -v, (2) svn propget, or (3) svn blame, and other commands that follow renames.


definition_id: oval:org.debian:def:182305480025352708275384318424569999785
title: CVE-2004-0751 apache2
description:
The char_buffer_read function in the mod_ssl module for Apache 2.x, when using reverse proxying to an SSL server, allows remote attackers to cause a denial of service (segmentation fault).


definition_id: oval:org.debian:def:194288987511042973016476293301022032304
title: CVE-2004-0753 gdk-pixbuf
description:
The BMP image processor for (1) gdk-pixbuf before 0.22 and (2) gtk2 before 2.2.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted BMP file.


definition_id: oval:org.debian:def:290356831229051959018436588358932269323
title: CVE-2004-0770 dgen
description:
romload.c in DGen Emulator 1.23 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files during decompression of (1) gzip or (2) bzip ROM files.


definition_id: oval:org.debian:def:322366316582948557299144296966737986368
title: CVE-2004-0772 krb5
description:
Double free vulnerabilities in error handling code in krb524d for MIT Kerberos 5 (krb5) 1.2.8 and earlier may allow remote attackers to execute arbitrary code.


definition_id: oval:org.debian:def:18479766823772236835541660480713337908
title: CVE-2004-0777 courier
description:
Format string vulnerability in the auth_debug function in Courier-IMAP 1.6.0 through 2.2.1 and 3.x through 3.0.3, when login debugging (DEBUG_LOGIN) is enabled, allows remote attackers to execute arbitrary code.


definition_id: oval:org.debian:def:278507219709250385203501613794425456316
title: CVE-2004-0778 cvs
description:
CVS 1.11.x before 1.11.17, and 1.12.x before 1.12.9, allows remote attackers to determine the existence of arbitrary files and directories via the -X command for an alternate history file, which causes different error messages to be returned.


definition_id: oval:org.debian:def:37039116686806767461883804464188457478
title: CVE-2004-0782 gdk-pixbuf
description:
Integer overflow in pixbuf_create_from_xpm (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier, and gdk-pixbuf before 0.22, allows remote attackers to execute arbitrary code via certain n_col and cpp values that enable a heap-based buffer overflow.  NOTE: this identifier is ONLY for gtk+.  It was incorrectly referenced in an advisory for a different issue (CVE-2004-0687).


definition_id: oval:org.debian:def:23506924568495850683472540322121044763
title: CVE-2004-0783 gtk+2.0
description:
Stack-based buffer overflow in xpm_extract_color (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier, and gdk-pixbuf before 0.22, may allow remote attackers to execute arbitrary code via a certain color string.  NOTE: this identifier is ONLY for gtk+.  It was incorrectly referenced in an advisory for a different issue (CVE-2004-0688).


definition_id: oval:org.debian:def:213161837619213478891330906665613019756
title: CVE-2004-0786 apache2
description:
The IPv6 URI parsing routines in the apr-util library for Apache 2.0.50 and earlier allow remote attackers to cause a denial of service (child process crash) via a certain URI, as demonstrated using the Codenomicon HTTP Test Tool.


definition_id: oval:org.debian:def:158395385867744331222035067741235364458
title: CVE-2004-0788 gdk-pixbuf
description:
Integer overflow in the ICO image decoder for (1) gdk-pixbuf before 0.22 and (2) gtk2 before 2.2.4 allows remote attackers to cause a denial of service (application crash) via a crafted ICO file.


definition_id: oval:org.debian:def:15282305834983849360401014636987177669
title: CVE-2004-0792 rsync
description:
Directory traversal vulnerability in the sanitize_path function in util.c for rsync 2.6.2 and earlier, when chroot is disabled, allows attackers to read or write certain files.


definition_id: oval:org.debian:def:249587429736480456191805395249360559963
title: CVE-2004-0793 bsdmainutils
description:
The calendar program in bsdmainutils 6.0 through 6.0.14 does not drop root privileges when executed with the -a flag, which allows attackers to execute arbitrary commands via a calendar event file.


definition_id: oval:org.debian:def:299802039095778974060997676360624871817
title: CVE-2004-0796 spamassassin
description:
SpamAssassin 2.5x, and 2.6x before 2.64, allows remote attackers to cause a denial of service via certain malformed messages.


definition_id: oval:org.debian:def:330741050728951117950529167803266715731
title: CVE-2004-0797 zlib
description:
The error handling in the (1) inflate and (2) inflateBack functions in ZLib compression library 1.2.x allows local users to cause a denial of service (application crash).


definition_id: oval:org.debian:def:184194073943248982922231098112691918732
title: CVE-2004-0801 foomatic-filters
description:
Unknown vulnerability in foomatic-rip in Foomatic before 3.0.2 allows local users or remote attackers with access to CUPS to execute arbitrary commands.


definition_id: oval:org.debian:def:335041801470327813167719960965845186347
title: CVE-2004-0802 imlib2
description:
Buffer overflow in the BMP loader in imlib2 before 1.1.2 allows remote attackers to execute arbitrary code via a specially-crafted BMP image, a different vulnerability than CVE-2004-0817.


definition_id: oval:org.debian:def:255982129154728912488502834716451116588
title: CVE-2004-0803 tiff
description:
Multiple vulnerabilities in the RLE (run length encoding) decoders for libtiff 3.6.1 and earlier, related to buffer overflows and integer overflows, allow remote attackers to execute arbitrary code via TIFF files.


definition_id: oval:org.debian:def:120551406761139497747062765602286975342
title: CVE-2004-0804 tiff
description:
Vulnerability in tif_dirread.c for libtiff allows remote attackers to cause a denial of service (application crash) via a TIFF image that causes a divide-by-zero error when the number of row bytes is zero, a different vulnerability than CVE-2005-2452.


definition_id: oval:org.debian:def:206967479843821855629230240617852356909
title: CVE-2004-0805 mpg123
description:
Buffer overflow in layer2.c in mpg123 0.59r and possibly mpg123 0.59s allows remote attackers to execute arbitrary code via a certain (1) mp3 or (2) mp2 file.


definition_id: oval:org.debian:def:160224444816435943740580329035792371630
title: CVE-2004-0807 samba
description:
Samba 3.0.6 and earlier allows remote attackers to cause a denial of service (infinite loop and memory exhaustion) via certain malformed requests that cause new processes to be spawned and enter an infinite loop.


definition_id: oval:org.debian:def:310354800827200273189706221655625987028
title: CVE-2004-0808 samba
description:
The process_logon_packet function in the nmbd server for Samba 3.0.6 and earlier, when domain logons are enabled, allows remote attackers to cause a denial of service via a SAM_UAS_CHANGE request with a length value that is larger than the number of structures that are provided.


definition_id: oval:org.debian:def:109353331146218420543859976051081024514
title: CVE-2004-0809 apache2
description:
The mod_dav module in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (child process crash) via a certain sequence of LOCK requests for a location that allows WebDAV authoring access.


definition_id: oval:org.debian:def:22340264975191462178422363557014927001
title: CVE-2004-0811 apache2
description:
Unknown vulnerability in Apache 2.0.51 prevents "the merging of the Satisfy directive," which could allow attackers to obtain access to restricted resources contrary to the specified authentication configuration.


definition_id: oval:org.debian:def:292193567902569849510969369524560536127
title: CVE-2004-0815 samba
description:
The unix_clean_name function in Samba 2.2.x through 2.2.11, and 3.0.x before 3.0.2a, trims certain directory names down to absolute paths, which could allow remote attackers to bypass the specified share restrictions and read, write, or list arbitrary files via "/.////" style sequences in pathnames.


definition_id: oval:org.debian:def:291131907686958138525205782662638297816
title: CVE-2004-0827 imagemagick
description:
Multiple buffer overflows in the ImageMagick graphics library 5.x before 5.4.4, and 6.x before 6.0.6.2, allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via malformed (1) AVI, (2) BMP, or (3) DIB files.


definition_id: oval:org.debian:def:83145108526985734879319046311635130996
title: CVE-2004-0829 samba
description:
smbd in Samba before 2.2.11 allows remote attackers to cause a denial of service (daemon crash) by sending a FindNextPrintChangeNotify request without a previous FindFirstPrintChangeNotify, as demonstrated by the SMB client in Windows XP SP2.


definition_id: oval:org.debian:def:201327757059783019798267318977373761673
title: CVE-2004-0832 squid
description:
The (1) ntlm_fetch_string and (2) ntlm_get_string functions in Squid 2.5.6 and earlier, with NTLM authentication enabled, allow remote attackers to cause a denial of service (application crash) via an NTLMSSP packet that causes a negative value to be passed to memcpy.


definition_id: oval:org.debian:def:58832614032047737730706110069245906643
title: CVE-2004-0833 sendmail
description:
Sendmail before 8.12.3 on Debian GNU/Linux, when using sasl and sasl-bin, uses a Sendmail configuration script with a fixed username and password, which could allow remote attackers to use Sendmail as an open mail relay and send spam messages.


definition_id: oval:org.debian:def:95257164403590296257543165576804233523
title: CVE-2004-0851 net-acct
description:
The (1) write_list and (2) dump_curr_list functions in Net-Acct before 0.71 allows local users to overwrite arbitrary files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:337180512842283778270229071159048209819
title: CVE-2004-0880 getmail
description:
getmail 4.x before 4.2.0, when run as root, allows local users to overwrite arbitrary files via a symlink attack on an mbox file.


definition_id: oval:org.debian:def:338227771699567702169561173591294742790
title: CVE-2004-0881 getmail
description:
getmail 4.x before 4.2.0, and other versions before 3.2.5, when run as root, allows local users to write files in arbitrary directories via a symlink attack on subdirectories in the maildir.


definition_id: oval:org.debian:def:146095074317167433987388700912128091011
title: CVE-2004-0882 samba
description:
Buffer overflow in the QFILEPATHINFO request handler in Samba 3.0.x through 3.0.7 may allow remote attackers to execute arbitrary code via a TRANSACT2_QFILEPATHINFO request with a small "maximum data bytes" value.


definition_id: oval:org.debian:def:204116752278162001951936821630895308964
title: CVE-2004-0884 cyrus-sasl2
description:
The (1) libsasl and (2) libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASL_PATH environment variable to find all available SASL plug-ins, which allows local users to execute arbitrary code by modifying the SASL_PATH to point to malicious programs.


definition_id: oval:org.debian:def:1037448704787667340438191441353525071
title: CVE-2004-0885 apache2
description:
The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.


definition_id: oval:org.debian:def:300836125367966381786560533020474709171
title: CVE-2004-0886 tiff
description:
Multiple integer overflows in libtiff 3.6.1 and earlier allow remote attackers to cause a denial of service (crash or memory corruption) via TIFF images that lead to incorrect malloc calls.


definition_id: oval:org.debian:def:95413297925644619535889070241226982261
title: CVE-2004-0888 cups
description:
Multiple integer overflows in xpdf 2.0 and 3.0, and other packages that use xpdf code such as CUPS, gpdf, and kdegraphics, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, a different set of vulnerabilities than those identified by CVE-2004-0889.


definition_id: oval:org.debian:def:13973755168949719661426703098450310441
title: CVE-2004-0889 xpdf
description:
Multiple integer overflows in xpdf 3.0, and other packages that use xpdf code such as CUPS, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, a different set of vulnerabilities than those identified by CVE-2004-0888.


definition_id: oval:org.debian:def:42152297673988187878681222029745118651
title: CVE-2004-0911 netkit-telnet
description:
telnetd for netkit 0.17 and earlier, and possibly other versions, on Debian GNU/Linux allows remote attackers to cause a denial of service (free of an invalid pointer), a different vulnerability than CVE-2001-0554.


definition_id: oval:org.debian:def:231624240890557149159954462567129434192
title: CVE-2004-0916 cabextract
description:
Directory traversal vulnerability in cabextract before 1.1 allows remote attackers to overwrite arbitrary files via a cabinet file containing .. (dot dot) sequences in a filename.


definition_id: oval:org.debian:def:132142021857703588727909610569775986028
title: CVE-2004-0918 squid
description:
The asn_parse_header function (asn1.c) in the SNMP module for Squid Web Proxy Cache before 2.4.STABLE7 allows remote attackers to cause a denial of service (server restart) via certain SNMP packets with negative length fields that trigger a memory allocation error.


definition_id: oval:org.debian:def:205711783132357070828154486317611362301
title: CVE-2004-0923 cups
description:
CUPS 1.1.20 and earlier records authentication information for a device URI in the error_log file, which allows local users to obtain user names and passwords.


definition_id: oval:org.debian:def:271696420285528002191945132803607963684
title: CVE-2004-0930 samba
description:
The ms_fnmatch function in Samba 3.0.4 and 3.0.7 and possibly other versions allows remote authenticated users to cause a denial of service (CPU consumption) via a SAMBA request that contains multiple * (wildcard) characters.


definition_id: oval:org.debian:def:5899672074026591067558039574761020182
title: CVE-2004-0938 freeradius
description:
FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (server crash) by sending an Ascend-Send-Secret attribute without the required leading packet.


definition_id: oval:org.debian:def:28161362399048397487149666709063461196
title: CVE-2004-0941 libgd2
description:
Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and earlier may allow remote attackers to execute arbitrary code via malformed image files that trigger the overflows due to improper calls to the gdMalloc function, a different set of vulnerabilities than CVE-2004-0990.


definition_id: oval:org.debian:def:81940065276209040367466553880961122814
title: CVE-2004-0942 apache2
description:
Apache webserver 2.0.52 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an HTTP GET request with a MIME header containing multiple lines with a large number of space characters.


definition_id: oval:org.debian:def:328549552363928891092360136889836325139
title: CVE-2004-0960 freeradius
description:
FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (core dump) via malformed USR vendor-specific attributes (VSA) that cause a memcpy operation with a -1 argument.


definition_id: oval:org.debian:def:163314429320294510012074660809896998092
title: CVE-2004-0961 freeradius
description:
Memory leak in FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (memory exhaustion) via a series of Access-Request packets with (1) Ascend-Send-Secret, (2) Ascend-Recv-Secret, or (3) Tunnel-Password attributes.


definition_id: oval:org.debian:def:62791320173915369558279775182313344436
title: CVE-2004-0966 gettext
description:
The (1) autopoint and (2) gettextize scripts in the GNU gettext package 1.14 and later versions, as used in Trustix Secure Linux 1.5 through 2.1 and other operating systems, allows local users to overwrite files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:122774509054674805524081609623028443209
title: CVE-2004-0968 glibc
description:
The catchsegv script in glibc 2.3.2 and earlier allows local users to overwrite files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:254298300661541688194674795611789411460
title: CVE-2004-0969 groff
description:
The groffer script in the Groff package 1.18 and later versions, as used in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:79747474932119981674665102672098347108
title: CVE-2004-0970 gzip
description:
The (1) gzexe, (2) zdiff, and (3) znew scripts in the gzip package, as used by other packages such as ncompress, allows local users to overwrite files via a symlink attack on temporary files.  NOTE: the znew vulnerability may overlap CVE-2003-0367.


definition_id: oval:org.debian:def:274641842890007704090774369938262692529
title: CVE-2004-0974 netatalk
description:
The netatalk package in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:321266730855348800821518539961428589454
title: CVE-2004-0975 openssl
description:
The der_chop script in the openssl package in Trustix Secure Linux 1.5 through 2.1 and other operating systems allows local users to overwrite files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:229398097047031626195194568823069242950
title: CVE-2004-0976 perl
description:
Multiple scripts in the perl package in Trustix Secure Linux 1.5 through 2.1 and other operating systems allows local users to overwrite files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:151043485007986775239183017438955167764
title: CVE-2004-0980 ez-ipupdate
description:
Format string vulnerability in ez-ipupdate.c for ez-ipupdate 3.0.10 through 3.0.11b8, when running in daemon mode with certain service types in use, allows remote servers to execute arbitrary code.


definition_id: oval:org.debian:def:89201309205802835260825043725283718827
title: CVE-2004-0981 graphicsmagick
description:
Buffer overflow in the EXIF parsing routine in ImageMagick before 6.1.0 allows remote attackers to execute arbitrary code via a certain image file.


definition_id: oval:org.debian:def:210732020250232323046822897968288448653
title: CVE-2004-0982 mpg123
description:
Buffer overflow in the getauthfromURL function in httpget.c in mpg123 pre0.59s and mpg123 0.59r could allow remote attackers or local users to execute arbitrary code via an mp3 file that contains a long string before the @ (at sign) in a URL.


definition_id: oval:org.debian:def:304470613425973445158548468769932931702
title: CVE-2004-0984 mailutils
description:
Unknown vulnerability in the dotlock implementation in mailutils before 1:0.5-4 on Debian GNU/Linux allows attackers to gain privileges.


definition_id: oval:org.debian:def:156604626252496836329922512925733572437
title: CVE-2004-0986 iptables
description:
Iptables before 1.2.11, under certain conditions, does not properly load the required modules at system startup, which causes the firewall rules to fail to load and protect the system from remote attackers.


definition_id: oval:org.debian:def:290906250380809003066954270355502246775
title: CVE-2004-0989 libxml2
description:
Multiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2), and possibly other versions, may allow remote attackers to execute arbitrary code via (1) a long FTP URL that is not properly handled by the xmlNanoFTPScanURL function, (2) a long proxy URL containing FTP data that is not properly handled by the xmlNanoFTPScanProxy function, and other overflows related to manipulation of DNS length values, including (3) xmlNanoFTPConnect, (4) xmlNanoHTTPConnectHost, and (5) xmlNanoHTTPConnectHost.


definition_id: oval:org.debian:def:176046247789530718285483953171583289291
title: CVE-2004-0990 libgd2
description:
Integer overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary code via PNG image files with large image rows values that lead to a heap-based buffer overflow in the gdImageCreateFromPngCtx function, a different set of vulnerabilities than CVE-2004-0941.


definition_id: oval:org.debian:def:85704730434002469263761969315268208579
title: CVE-2004-0991 mpg123
description:
Buffer overflow in mpg123 before 0.59s-r9 allows remote attackers to execute arbitrary code via frame headers in MP2 or MP3 files.


definition_id: oval:org.debian:def:68837773384117259390870633756348920843
title: CVE-2004-0993 hpsockd
description:
Buffer overflow in hpsockd before 0.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code.


definition_id: oval:org.debian:def:215704658868876522408886189397200792863
title: CVE-2004-0994 xzgv
description:
Multiple integer overflows in xzgv 0.8 and earlier allow remote attackers to execute arbitrary code via images with large width and height values, which trigger a heap-based buffer overflow, as demonstrated in the read_prf_file function in readprf.c.  NOTE: CVE-2004-0994 and CVE-2004-1095 identify sets of bugs that only partially overlap, despite having the same developer.  Therefore, they should be regarded as distinct.


definition_id: oval:org.debian:def:211225806289756159908900938708739086289
title: CVE-2004-0996 cscope
description:
main.c in cscope 15-4 and 15-5 creates temporary files with predictable filenames, which allows local users to overwrite arbitrary files via a symlink attack.


definition_id: oval:org.debian:def:306968707642329023597522712623503469606
title: CVE-2004-1000 lintian
description:
lintian 1.23 and earlier removes the working directory even if it was not created by lintian, which may allow local users to delete arbitrary files or directories via a symlink attack.


definition_id: oval:org.debian:def:262584133008915005707202521109096685220
title: CVE-2004-1001 shadow
description:
Unknown vulnerability in the passwd_check function in Shadow 4.0.4.1, and possibly other versions before 4.0.5, allows local users to conduct unauthorized activities when an error from a pam_chauthtok function call is not properly handled.


definition_id: oval:org.debian:def:107778479515352723044614042033720294254
title: CVE-2004-1002 ppp
description:
Integer underflow in pppd in cbcp.c for ppp 2.4.1 allows remote attackers to cause a denial of service (daemon crash) via a CBCP packet with an invalid length value that causes pppd to access an incorrect memory location.


definition_id: oval:org.debian:def:323283544305194981914546609257614478487
title: CVE-2004-1004 mc
description:
Multiple format string vulnerabilities in Midnight Commander (mc) 4.5.55 and earlier allow remote attackers to have an unknown impact.


definition_id: oval:org.debian:def:204253195224692845995758829779830080113
title: CVE-2004-1005 mc
description:
Multiple buffer overflows in Midnight Commander (mc) 4.5.55 and earlier allow remote attackers to have an unknown impact.


definition_id: oval:org.debian:def:203724279523124619378757517928918338405
title: CVE-2004-1007 bogofilter
description:
The quoted-printable decoder in bogofilter 0.17.4 to 0.92.7 allows remote attackers to cause a denial of service (application crash) via mail headers that cause a line feed (LF) to be replaced by a null byte that is written to an incorrect memory address.


definition_id: oval:org.debian:def:16169114200724522980251187242889628767
title: CVE-2004-1008 putty
description:
Integer signedness error in the ssh2_rdpkt function in PuTTY before 0.56 allows remote attackers to execute arbitrary code via a SSH2_MSG_DEBUG packet with a modified stringlen parameter, which leads to a buffer overflow.


definition_id: oval:org.debian:def:150298700447703739554143001690897856318
title: CVE-2004-1009 mc
description:
Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service (infinite loop) via unknown attack vectors.


definition_id: oval:org.debian:def:317218742615911494645843951015589670736
title: CVE-2004-1010 zip
description:
Buffer overflow in Info-Zip 2.3 and possibly earlier versions, when using recursive folder compression, allows remote attackers to execute arbitrary code via a ZIP file containing a long pathname.


definition_id: oval:org.debian:def:189626370664170455039009641502318793234
title: CVE-2004-1012 cyrus-imapd
description:
The argument parser of the PARTIAL command in Cyrus IMAP Server 2.2.6 and earlier allows remote authenticated users to execute arbitrary code via a certain command ("body[p") that is treated as a different command ("body.peek") and causes an index increment error that leads to an out-of-bounds memory corruption.


definition_id: oval:org.debian:def:292478360656452565761599899666323132664
title: CVE-2004-1013 cyrus-imapd
description:
The argument parser of the FETCH command in Cyrus IMAP Server 2.2.x through 2.2.8 allows remote authenticated users to execute arbitrary code via certain commands such as (1) "body[p", (2) "binary[p", or (3) "binary[p") that cause an index increment error that leads to an out-of-bounds memory corruption.


definition_id: oval:org.debian:def:240525625903236935155196290639460455933
title: CVE-2004-1014 nfs-utils
description:
statd in nfs-utils 1.257 and earlier does not ignore the SIGPIPE signal, which allows remote attackers to cause a denial of service (server process crash) via a TCP connection that is prematurely terminated.


definition_id: oval:org.debian:def:11211239019253595742635342385823884349
title: CVE-2004-1026 imlib2
description:
Multiple integer overflows in the image handler for imlib 1.9.14 and earlier, which is used by gkrellm and several window managers, allow remote attackers to cause a denial of service (application crash) and execute arbitrary code via certain image files.


definition_id: oval:org.debian:def:188296827062882991171690703297817854991
title: CVE-2004-1034 kaffeine
description:
Buffer overflow in the http_open function in Kaffeine before 0.5, whose code is also used in gxine before 0.3.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long Content-Type header for a Real Audio Media (.ram) playlist file.


definition_id: oval:org.debian:def:69790132433062090682011264966965556514
title: CVE-2004-1035 up-imapproxy
description:
Multiple integer signedness errors in (1) imapcommon.c, (2) main.c, (3) request.c, and (4) select.c for up-imapproxy IMAP proxy 1.2.2 allow remote attackers to cause a denial of service (server crash) and possibly leak sensitive information via certain literal values that are not properly handled when using the IMAP_Line_Read function.


definition_id: oval:org.debian:def:190355562510748521629415560441388580696
title: CVE-2004-1051 sudo
description:
sudo before 1.6.8p2 allows local users to execute arbitrary commands by using "()" style environment variables to create functions that have the same name as any program within the bash script that is called without using the program's full pathname.


definition_id: oval:org.debian:def:75914484664310895945679898813882498843
title: CVE-2004-1076 atari800
description:
Multiple buffer overflows in the RtConfigLoad function in rt-config.c for Atari800 before 1.3.4 allow local users to execute arbitrary code via large values in the configuration file.


definition_id: oval:org.debian:def:204694876097528368434653181991921561051
title: CVE-2004-1090 mc
description:
Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service via "a corrupt section header."


definition_id: oval:org.debian:def:328176071986380864167903432749085092020
title: CVE-2004-1091 mc
description:
Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service by triggering a null dereference.


definition_id: oval:org.debian:def:275843693946280391075687114634691505336
title: CVE-2004-1092 mc
description:
Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service by causing mc to free unallocated memory.


definition_id: oval:org.debian:def:25659621293801591005878664582585067409
title: CVE-2004-1093 mc
description:
Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service via "use of already freed memory."


definition_id: oval:org.debian:def:328701322086160922344446185395173417790
title: CVE-2004-1096 libarchive-zip-perl
description:
Archive::Zip Perl module before 1.14, when used by antivirus programs such as amavisd-new, allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system.


definition_id: oval:org.debian:def:87173168189798895838773071224899306174
title: CVE-2004-1110 mtink
description:
The mtink status monitor before 1.0.5 for Epson printers allows local users to overwrite arbitrary files via a symlink attack on the epson temporary file.


definition_id: oval:org.debian:def:56889444975697060625793282622718466217
title: CVE-2004-1113 sqlgrey
description:
SQL injection vulnerability in SQLgrey Postfix greylisting service before 1.2.0 allows remote attackers to execute arbitrary SQL commands via the (1) sender or (2) recipient e-mail addresses.


definition_id: oval:org.debian:def:293703960726983145235807922221197519459
title: CVE-2004-1125 cups
description:
Buffer overflow in the Gfx::doImage function in Gfx.cc for xpdf 3.00, and other products that share code such as tetex-bin and kpdf in KDE 3.2.x to 3.2.3 and 3.3.x to 3.3.2, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted PDF file that causes the boundaries of a maskColors array to be exceeded.


definition_id: oval:org.debian:def:192409834347383040276500034485399683113
title: CVE-2004-1138 vim
description:
VIM before 6.3 and gVim before 6.3 allow local users to execute arbitrary commands via a file containing a crafted modeline that is executed when the file is viewed using options such as (1) termcap, (2) printdevice, (3) titleold, (4) filetype, (5) syntax, (6) backupext, (7) keymap, (8) patchmode, or (9) langmenu.


definition_id: oval:org.debian:def:225631990349928454412435468806418044636
title: CVE-2004-1143 mailman
description:
The password generation in mailman before 2.1.5 generates only 5 million unique passwords, which makes it easier for remote attackers to guess passwords via a brute force attack.


definition_id: oval:org.debian:def:294931113762494031335243020440418584718
title: CVE-2004-1154 samba
description:
Integer overflow in the Samba daemon (smbd) in Samba 2.x and 3.0.x through 3.0.9 allows remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via a Samba request with a large number of security descriptors that triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:89135559689250371593682731796707320194
title: CVE-2004-1170 a2ps
description:
a2ps 4.13 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename.


definition_id: oval:org.debian:def:98464831614507291473661048093292703731
title: CVE-2004-1174 mc
description:
direntry.c in Midnight Commander (mc) 4.5.55 and earlier allows attackers to cause a denial of service by "manipulating non-existing file handles."


definition_id: oval:org.debian:def:173115308192927044813035696798101070172
title: CVE-2004-1175 mc
description:
fish.c in midnight commander allows remote attackers to execute arbitrary programs via "insecure filename quoting," possibly using shell metacharacters.


definition_id: oval:org.debian:def:127354227048737480092458567074744100803
title: CVE-2004-1176 mc
description:
Buffer underflow in extfs.c in Midnight Commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code.


definition_id: oval:org.debian:def:186483172522282325720122946032559986542
title: CVE-2004-1177 mailman
description:
Cross-site scripting (XSS) vulnerability in the driver script in mailman before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via a URL, which is not properly escaped in the resulting error page.


definition_id: oval:org.debian:def:281463555298777156310278048469573418479
title: CVE-2004-1179 debmake
description:
The debstd script in debmake 3.6.x before 3.6.10 and 3.7.x before 3.7.7 allows local users to overwrite arbitrary files via a symlink attack on temporary directories.


definition_id: oval:org.debian:def:159612843908356418772690281297654042303
title: CVE-2004-1180 netkit-rwho
description:
Unknown vulnerability in the rwho daemon (rwhod) before 0.17, on little endian architectures, allows remote attackers to cause a denial of service (application crash).


definition_id: oval:org.debian:def:186883880430817092677213011558068356568
title: CVE-2004-1182 hylafax
description:
hfaxd in HylaFAX before 4.2.1, when installed with a "weak" hosts.hfaxd file, allows remote attackers to authenticate and bypass intended access restrictions via a crafted (1) username or (2) hostname that satisfies a regular expression that is matched against a hosts.hfaxd entry without a password.


definition_id: oval:org.debian:def:147084593722200778138410780130172073160
title: CVE-2004-1183 tiff
description:
Integer overflow in the tiffdump utility for libtiff 3.7.1 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted TIFF file.


definition_id: oval:org.debian:def:276398068149741588500407054113602920956
title: CVE-2004-1184 enscript
description:
The EPSF pipe support in enscript 1.6.3 allows remote attackers or local users to execute arbitrary commands via shell metacharacters.


definition_id: oval:org.debian:def:134426502286187283252035722616510851104
title: CVE-2004-1185 enscript
description:
Enscript 1.6.3 does not sanitize filenames, which allows remote attackers or local users to execute arbitrary commands via crafted filenames.


definition_id: oval:org.debian:def:133806225993534730418302442380565831534
title: CVE-2004-1186 enscript
description:
Multiple buffer overflows in enscript 1.6.3 allow remote attackers or local users to cause a denial of service (application crash).


definition_id: oval:org.debian:def:126052690207364090189641197872421950024
title: CVE-2004-1189 krb5
description:
The add_to_history function in svr_principal.c in libkadm5srv for MIT Kerberos 5 (krb5) up to 1.3.5, when performing a password change, does not properly track the password policy's history count and the maximum number of keys, which can cause an array index out-of-bounds error and may allow authenticated users to execute arbitrary code via a heap-based buffer overflow.


definition_id: oval:org.debian:def:242824173992734775927784143367421857580
title: CVE-2004-1204 fluxbox
description:
FluxBox 0.9.10 and earlier versions allows local users to cause a denial of service (application crash) by calling Xman with a long -title value, possibly triggering a buffer overflow.


definition_id: oval:org.debian:def:198588260193485033915260543478072025410
title: CVE-2004-1224 mtr
description:
Off-by-one error in the mtr_curses_keyaction function for mtr 0.55 through 0.65 allows local users to hijack raw sockets, as demonstrated using the "s" keybinding, which leaves a buffer without a NULL terminator.


definition_id: oval:org.debian:def:253505332156141197375922549725557715522
title: CVE-2004-1256 abcmidi
description:
Multiple buffer overflows in the (1) event_text and (2) event_specific functions in abc2midi 2004.12.04 allow remote attackers to execute arbitrary code via crafted ABC files.


definition_id: oval:org.debian:def:55904292049874342294974698323181410218
title: CVE-2004-1258 abcm2ps
description:
Buffer overflow in the put_words function in subs.c for abcm2ps 3.7.20 allows remote attackers to execute arbitrary code via crafted ABC files.


definition_id: oval:org.debian:def:70368506723052713908531433054471815018
title: CVE-2004-1267 cups
description:
Buffer overflow in the ParseCommand function in hpgl-input.c in the hpgltops program for CUPS 1.1.22 allows remote attackers to execute arbitrary code via a crafted HPGL file.


definition_id: oval:org.debian:def:275059012102657788968285123736313030789
title: CVE-2004-1268 cups
description:
lppasswd in CUPS 1.1.22 ignores write errors when modifying the CUPS passwd file, which allows local users to corrupt the file by filling the associated file system and triggering the write errors.


definition_id: oval:org.debian:def:169723965271355357020153023822052570513
title: CVE-2004-1269 cups
description:
lppasswd in CUPS 1.1.22 does not remove the passwd.new file if it encounters a file-size resource limit while writing to passwd.new, which causes subsequent invocations of lppasswd to fail.


definition_id: oval:org.debian:def:164063385421988095877785307395338990406
title: CVE-2004-1270 cups
description:
lppasswd in CUPS 1.1.22, when run in environments that do not ensure that file descriptors 0, 1, and 2 are open when lppasswd is called, does not verify that the passwd.new file is different from STDERR, which allows local users to control output to passwd.new via certain user input that triggers an error message.


definition_id: oval:org.debian:def:111228694561066335477975193158810027015
title: CVE-2004-1272 filter
description:
Buffer overflow in the save_embedded_address function in filter.c for elm/bolthole filter 2.6.1 allows remote attackers to execute arbitrary code via a crafted email message.


definition_id: oval:org.debian:def:46271115806518594960517763750656635374
title: CVE-2004-1284 mpg123
description:
Buffer overflow in the find_next_file function in playlist.c for mpg123 0.59r allows remote attackers to execute arbitrary code via a crafted MP3 playlist.


definition_id: oval:org.debian:def:330518977363561735461735697594074494206
title: CVE-2004-1287 nasm
description:
Buffer overflow in the error function in preproc.c for NASM 0.98.38 1.2 allows attackers to execute arbitrary code via a crafted asm file, a different vulnerability than CVE-2005-1194.


definition_id: oval:org.debian:def:185137014617954439420152044153595937068
title: CVE-2004-1289 pcal
description:
Multiple buffer overflows in (1) the getline function in pcalutil.c and (2) the get_holiday function in readfile.c for pcal 4.7.1 allow remote attackers to execute arbitrary code via a crafted calendar file.


definition_id: oval:org.debian:def:113773261851847024015651600511609877591
title: CVE-2004-1294 tnftp
description:
The mget function in cmds.c for tnftp 20030825 allows remote FTP servers to overwrite arbitrary files via FTP responses containing file names with / (slash) characters.


definition_id: oval:org.debian:def:185371602900863311390930565225478934309
title: CVE-2004-1296 groff
description:
The (1) eqn2graph and (2) pic2graph scripts in groff 1.18.1 allow local users to overwrite arbitrary files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:286235496068713258418509840437422091805
title: CVE-2004-1297 unrtf
description:
Buffer overflow in the process_font_table function in convert.c for unrtf 0.19.3 allows remote attackers to execute arbitrary code via a crafted RTF file.


definition_id: oval:org.debian:def:164798079514466135705503552830708920727
title: CVE-2004-1304 file
description:
Stack-based buffer overflow in the ELF header parsing code in file before 4.12 allows attackers to execute arbitrary code via a crafted ELF file.


definition_id: oval:org.debian:def:227332568622229393077522048530804790205
title: CVE-2004-1307 tiff
description:
Integer overflow in the TIFFFetchStripThing function in tif_dirread.c for libtiff 3.6.1 allows remote attackers to execute arbitrary code via a TIFF file with the STRIPOFFSETS flag and a large number of strips, which causes a zero byte buffer to be allocated and leads to a heap-based buffer overflow.


definition_id: oval:org.debian:def:291937424250852242083211932088107750078
title: CVE-2004-1308 tiff
description:
Integer overflow in (1) tif_dirread.c and (2) tif_fax3.c for libtiff 3.5.7 and 3.7.0 allows remote attackers to execute arbitrary code via a TIFF file containing a TIFF_ASCII or TIFF_UNDEFINED directory entry with a -1 entry count, which leads to a heap-based buffer overflow.


definition_id: oval:org.debian:def:37687525848176736807232629960531024290
title: CVE-2004-1309 mplayer
description:
Heap-based buffer overflow in the demux_open_bmp function in demux_bmp.c for Unix MPlayer 1.0pre5 allows remote attackers to execute arbitrary code via a bitmap (BMP) file containing a large biClrUsed field.


definition_id: oval:org.debian:def:58110218638284578222831596402130594413
title: CVE-2004-1310 mplayer
description:
Stack-based buffer overflow in the asf_mmst_streaming.c functionality for MPlayer 1.0pre5 allows remote attackers to execute arbitrary code via a large MMST stream packet.


definition_id: oval:org.debian:def:213570753732381560774231444125698888545
title: CVE-2004-1311 mplayer
description:
Integer overflow in the real_setup_and_get_header function in real.c for Unix MPlayer 1.0pre5 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a Real RTSP streaming media file with a -1 content-length field, which leads to a heap-based buffer overflow.


definition_id: oval:org.debian:def:65193528651712974079622097764330619180
title: CVE-2004-1318 namazu2
description:
Cross-site scripting (XSS) vulnerability in namazu.cgi for Namazu 2.0.13 and earlier allows remote attackers to inject arbitrary HTML and web script via a query that starts with a tab ("%09") character, which prevents the rest of the query from being properly sanitized.


definition_id: oval:org.debian:def:266011729192868897702914041745368188727
title: CVE-2004-1340 libpam-radius-auth
description:
Debian GNU/Linux 3.0 installs the libpam-radius-auth package with the pam_radius_auth.conf set to be world-readable, which allows local users to obtain sensitive information.


definition_id: oval:org.debian:def:144267597133814611004188646028820414628
title: CVE-2004-1341 info2www
description:
Cross-site scripting (XSS) vulnerability in info2www before 1.2.2.9 allows remote attackers to inject arbitrary web script or HTML via the arguments to info2www.


definition_id: oval:org.debian:def:303823812219944963662715543144333610643
title: CVE-2004-1342 cvs
description:
CVS 1.12 and earlier on Debian GNU/Linux, when using the repouid patch, allows remote attackers to bypass authentication via the pserver access method.


definition_id: oval:org.debian:def:26551941138944524300159773914066148964
title: CVE-2004-1343 cvs
description:
CVS 1.12 and earlier on Debian GNU/Linux does not properly handle when a mapping for the current repository does not exist in the cvs-repouids file, which allows remote attackers to cause a denial of service (server crash).


definition_id: oval:org.debian:def:287503723613106787615900001340040093915
title: CVE-2004-1377 a2ps
description:
The (1) fixps (aka fixps.in) and (2) psmandup (aka psmandup.in) scripts in a2ps before 4.13 allow local users to overwrite arbitrary files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:326690548479994264963377255046330974327
title: CVE-2004-1382 glibc
description:
The glibcbug script in glibc 2.3.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files, a different vulnerability than CVE-2004-0968.


definition_id: oval:org.debian:def:245678567935479623831387305880824058257
title: CVE-2004-1388 gpsd
description:
Format string vulnerability in the gpsd_report function for BerliOS GPD daemon (gpsd, formerly pygps) 1.9.0 through 2.7 allows remote attackers to execute arbitrary code via certain GPS requests containing format string specifiers that are not properly handled in syslog calls.


definition_id: oval:org.debian:def:302540833103695614032702239130713962766
title: CVE-2004-1397 usemod-wiki
description:
Cross-site scripting (XSS) vulnerability in UseModWiki 1.0 allows remote attackers to inject arbitrary web script or HTML via an argument to wiki.pl.


definition_id: oval:org.debian:def:265773438794044166919198376110729700117
title: CVE-2004-1405 mediawiki
description:
MediaWiki 1.3.8 and earlier, when used with Apache mod_mime, does not properly handle files with two file extensions, such as .php.rar, which allows remote attackers to upload and execute arbitrary code.


definition_id: oval:org.debian:def:241695987574301651972894524579246553765
title: CVE-2004-1438 subversion
description:
The mod_authz_svn Apache module for Subversion 1.0.4-r1 and earlier allows remote authenticated users, with write access to the repository, to read unauthorized parts of the repository via the svn copy command.


definition_id: oval:org.debian:def:222824453724191204177370043947990785595
title: CVE-2004-1440 putty
description:
Multiple heap-based buffer overflows in the modpow function in PuTTY before 0.55 allow (1) remote attackers to execute arbitrary code via an SSH2 packet with a base argument that is larger than the mod argument, which causes the modpow function to write memory before the beginning of its buffer, and (2) remote malicious servers to cause a denial of service (client crash) and possibly execute arbitrary code via a large bignum during authentication.


definition_id: oval:org.debian:def:153006036038106910453068224852733691163
title: CVE-2004-1453 glibc
description:
GNU glibc 2.3.4 before 2.3.4.20040619, 2.3.3 before 2.3.3.20040420, and 2.3.2 before 2.3.2-r10 does not restrict the use of LD_DEBUG for a setuid program, which allows local users to gain sensitive information, such as the list of symbols used by the program.


definition_id: oval:org.debian:def:9522617911886087066107931332271555058
title: CVE-2004-1462 moin
description:
Unknown vulnerability in MoinMoin 1.2.2 and earlier allows remote attackers to gain unauthorized access to administrator functions such as (1) revert and (2) delete.


definition_id: oval:org.debian:def:15261943035696547711066789902678804425
title: CVE-2004-1463 moin
description:
Unknown vulnerability in the PageEditor in MoinMoin 1.2.2 and earlier, related to Access Control Lists (ACL), has unknown impact.


definition_id: oval:org.debian:def:80824687703032632514083656500774476574
title: CVE-2004-1471 cvs
description:
Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a wrapper line.


definition_id: oval:org.debian:def:318903085222938456501663337745153056910
title: CVE-2004-1476 libcdio
description:
Stack-based buffer overflow in the VideoCD (VCD) code in xine-lib 1-rc2 through 1-rc5, as derived from libcdio, allows attackers to execute arbitrary code via a VideoCD with an unterminated disk label.


definition_id: oval:org.debian:def:194628148429816798232423406821477493835
title: CVE-2004-1484 socat
description:
Format string vulnerability in the _msg function in error.c in socat 1.4.0.3 and earlier, when used as an HTTP proxy client and run with the -ly option, allows remote attackers or local users to execute arbitrary code via format string specifiers in a syslog message.


definition_id: oval:org.debian:def:261203339746301570618966264661497384753
title: CVE-2004-1487 wget
description:
wget 1.8.x and 1.9.x allows a remote malicious web server to overwrite certain files via a redirection URL containing a ".." that resolves to the IP address of the malicious server, which bypasses wget's filtering for ".." sequences.


definition_id: oval:org.debian:def:325301271948490051088172977442167120827
title: CVE-2004-1488 wget
description:
wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP responses to the terminal, which may allow remote malicious web servers to inject terminal escape sequences and execute arbitrary code.


definition_id: oval:org.debian:def:280962396166995071794617664033814951076
title: CVE-2004-1559 wordpress
description:
Multiple cross-site scripting (XSS) vulnerabilities in Wordpress 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) redirect_to, text, popupurl, or popuptitle parameters to wp-login.php, (2) redirect_url parameter to admin-header.php, (3) popuptitle, popupurl, content, or post_title parameters to bookmarklet.php, (4) cat_ID parameter to categories.php, (5) s parameter to edit.php, or (6) s or mode parameter to edit-comments.php.


definition_id: oval:org.debian:def:199038740823274077395098069382023625977
title: CVE-2004-1561 icecast2
description:
Buffer overflow in Icecast 2.0.1 and earlier allows remote attackers to execute arbitrary code via an HTTP request with a large number of headers.


definition_id: oval:org.debian:def:151239305153815001382522136756568690611
title: CVE-2004-1584 wordpress
description:
CRLF injection vulnerability in wp-login.php in WordPress 1.2 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the text parameter.


definition_id: oval:org.debian:def:313517164809928370810790141608431551653
title: CVE-2004-1617 lynx
description:
Lynx, lynx-ssl, and lynx-cur before 2.8.6dev.8 allow remote attackers to cause a denial of service (infinite loop) via a web page or HTML email that contains invalid HTML including (1) a TEXTAREA tag with a large COLS value and (2) a large tag name in an element that is not terminated, as demonstrated by mangleme.  NOTE: a followup suggests that the relevant trigger for this issue is the large COLS value.


definition_id: oval:org.debian:def:169593843769837861053602335033378618959
title: CVE-2004-1689 sudo
description:
sudoedit (aka sudo -e) in sudo 1.6.8 opens a temporary file with root privileges, which allows local users to read arbitrary files via a symlink attack on the temporary file before quitting sudoedit.


definition_id: oval:org.debian:def:121779201495035117466826036446730299535
title: CVE-2004-1717 gv
description:
Multiple buffer overflows in the psscan function in ps.c for gv (ghostview) allow remote attackers to execute arbitrary code via a Postscript file with a long (1) BoundingBox, (2) comment, (3) Orientation, (4) PageOrder, or (5) Pages value.


definition_id: oval:org.debian:def:173540122316034527349692245296764380495
title: CVE-2004-1735 sympa
description:
Cross-site scripting (XSS) vulnerability in the create list option in Sympa 4.1.x and earlier allows remote authenticated users to inject arbitrary web script or HTML via the description field.


definition_id: oval:org.debian:def:237909845215163107224529103615011592015
title: CVE-2004-1736 cacti
description:
Cacti 0.8.5a allows remote attackers to gain sensitive information via an HTTP request to (1) auth.php, (2) auth_login.php, (3) auth_changepassword.php, and possibly other php files, which reveal the installation path in a PHP error message.


definition_id: oval:org.debian:def:65344853757191982138648264828948175750
title: CVE-2004-1737 cacti
description:
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.


definition_id: oval:org.debian:def:118626458732437133806708536100912989961
title: CVE-2004-1772 sharutils
description:
Stack-based buffer overflow in shar in GNU sharutils 4.2.1 allows local users to execute arbitrary code via a long -o command line argument.


definition_id: oval:org.debian:def:294392688578823946862986430507258657086
title: CVE-2004-1773 sharutils
description:
Multiple buffer overflows in sharutils 4.2.1 and earlier may allow attackers to execute arbitrary code via (1) long output from wc to shar, or (2) unknown vectors in unshar.


definition_id: oval:org.debian:def:122497797282685305415556357898489322882
title: CVE-2004-1834 apache2
description:
mod_disk_cache in Apache 2.0 through 2.0.49 stores client headers, including authentication information, on the hard disk, which could allow local users to gain sensitive information.


definition_id: oval:org.debian:def:115887492254808150575144608775896551342
title: CVE-2004-1876 clamav
description:
The "%f" feature in the VirusEvent directive in Clam AntiVirus daemon (clamd) before 0.70 allows local users to execute arbitrary commands via shell metacharacters in a file name.


definition_id: oval:org.debian:def:239636266842554732826354235038645774689
title: CVE-2004-1909 clamav
description:
Claim Anti-Virus (ClamAV) 0.68 and earlier allows remote attackers to cause a denial of service (crash) via certain RAR archives, such as those generated by the Beagle/Bagle worm.


definition_id: oval:org.debian:def:85875469708649168499538975003282069461
title: CVE-2004-1915 lcdproc
description:
Buffer overflow in the parse_all_client_messages function in LCDproc 0.4.x up to 0.4.4 allows remote attackers to execute arbitrary code via a large number of arguments.


definition_id: oval:org.debian:def:329981618724928658266694444603248680738
title: CVE-2004-1916 lcdproc
description:
Multiple buffer overflows in LCDProc 0.4.1, and possibly other 0.4.x versions up to 0.4.4, allows remote attackers to execute arbitrary code via (1) a long invalid command to parse_all_client_messages function, or (2) long argv command to test_func_func function.


definition_id: oval:org.debian:def:168131169337291705744587432139888463802
title: CVE-2004-1917 lcdproc
description:
Format string vulnerability in test_func_func in LCDProc 0.4.1 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the str variable.


definition_id: oval:org.debian:def:170169174737625622505072158513716084955
title: CVE-2004-1948 ncftp
description:
NcFTP client 3.1.6 and 3.1.7, when the username and password are included in an FTP URL that is provided on the command line, allows local users to obtain sensitive information via "ps aux," which displays the URL in the process list.


definition_id: oval:org.debian:def:12977930574836444209952782715006931543
title: CVE-2004-1951 xine-ui
description:
xine 1.x alpha, 1.x beta, and 1.0rc through 1.0rc3a, and xine-ui 0.9.21 to 0.9.23 allows remote attackers to overwrite arbitrary files via the (1) audio.sun_audio_device or (2) dxr3.devicename options in an MRL link.


definition_id: oval:org.debian:def:58558458302110819363923292400580813794
title: CVE-2004-2014 wget
description:
Wget 1.9 and 1.9.1 allows local users to overwrite arbitrary files via a symlink attack on the name of the file being downloaded.


definition_id: oval:org.debian:def:114561311123192859288506699817382023632
title: CVE-2004-2027 icecast2
description:
Buffer overflow in Icecast 2.0.0 and earlier allows remote attackers to cause a denial of service (crash) via a long Basic Authorization header that triggers an out-of-bounds read.


definition_id: oval:org.debian:def:84326907094380030923645449534791831923
title: CVE-2004-2069 openssh
description:
sshd.c in OpenSSH 3.6.1p2 and 3.7.1p2 and possibly other versions, when using privilege separation, does not properly signal the non-privileged process when a session has been terminated after exceeding the LoginGraceTime setting, which leaves the connection open and allows remote attackers to cause a denial of service (connection consumption).


definition_id: oval:org.debian:def:288806948975359988719211115718081138239
title: CVE-2004-2093 rsync
description:
Buffer overflow in the open_socket_out function in socket.c for rsync 2.5.7 and earlier allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long RSYNC_PROXY environment variable.  NOTE: since rsync is not setuid, this issue does not provide any additional privileges beyond those that are already available to the user.  Therefore this issue may be REJECTED in the future.


definition_id: oval:org.debian:def:68970772059335660497607164486557101745
title: CVE-2004-2148 fprobe
description:
Unknown local vulnerability in the "change user" feature of Slava Astashonok Fprobe 1.0.5 and earlier has unknown impact and attack vectors.


definition_id: oval:org.debian:def:103808431931725020453352553677925402588
title: CVE-2004-2152 mediawiki
description:
Cross-site scripting (XSS) vulnerability in 'raw' page output mode for MediaWiki 1.3.4 and earlier allows remote attackers to inject arbitrary web script or HTML.


definition_id: oval:org.debian:def:106800156031412297279768849942288310154
title: CVE-2004-2154 cups
description:
CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowercase letters that are different from what is specified in the directive.


definition_id: oval:org.debian:def:78175047397336172062877871130370250226
title: CVE-2004-2159 xmlstarlet
description:
Multiple buffer overflows in XMLStarlet Command Line XML Toolkit 0.9.3 have unknown impact and attack vectors via (1) xml_elem.c and (2) xml_select.c.


definition_id: oval:org.debian:def:311530648400642271608121075976603347381
title: CVE-2004-2160 xmlstarlet
description:
Format string vulnerability in xml_elem.c for XMLStarlet Command Line XML Toolkit 0.9.3 may allow attackers to cause a denial of service or execute arbitrary code.


definition_id: oval:org.debian:def:44195357570454247785121673047981063250
title: CVE-2004-2167 latex2rtf
description:
Multiple buffer overflows in LaTeX2rtf 1.9.15, and possibly other versions, allow remote attackers to execute arbitrary code via (1) the expandmacro function, and possibly (2) Environments and (3) TranslateCommand.


definition_id: oval:org.debian:def:16121193309897947437500583012202312595
title: CVE-2004-2185 mediawiki
description:
Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki 1.3.5 allow remote attackers to execute arbitrary scripts and/or SQL queries via (1) the UnicodeConverter extension, (2) raw page views, (3) SpecialIpblocklist, (4) SpecialEmailuser, (5) SpecialMaintenance, and (6) ImagePage.


definition_id: oval:org.debian:def:20002294801494316373305866654980293724
title: CVE-2004-2186 mediawiki
description:
SQL injection vulnerability in MediaWiki 1.3.5 allows remote attackers to execute arbitrary SQL commands via SpecialMaintenance.


definition_id: oval:org.debian:def:319270969160759720064432794266012969890
title: CVE-2004-2187 mediawiki
description:
Unknown vulnerability in ImagePage for MediaWiki 1.3.5, related to "filename validation," has unknown impact and attack vectors.


definition_id: oval:org.debian:def:233217256227530100258476045840336677089
title: CVE-2004-2215 rxvt-unicode
description:
RXVT-Unicode 3.4 and 3.5 does not properly close file descriptors, which allows local users to access the terminals of other users and possibly gain privileges.


definition_id: oval:org.debian:def:268944488056087071770205587362895044378
title: CVE-2004-2259 vsftpd
description:
vsftpd before 1.2.2, when under heavy load, allows attackers to cause a denial of service (crash) via a SIGCHLD signal during a malloc or free call, which is not re-entrant.


definition_id: oval:org.debian:def:113222334118705312817623700661152574859
title: CVE-2004-2265 uudeview
description:
UUDeview 0.5.20 and earlier handles temporary files insecurely during decoding, with unknown attack vectors and impact.


definition_id: oval:org.debian:def:3463819448195411434205735362761140855
title: CVE-2004-2269 pads
description:
Stack-based buffer overflow in pads.c in Passive Asset Detection System (Pads) might allow local users to execute arbitrary code via a long report file name argument. NOTE: since Pads is not normally installed setuid, this may not be a vulnerability.


definition_id: oval:org.debian:def:66684183196612352421376456833882122875
title: CVE-2004-2303 mtools
description:
MTools Mformat before 3.9.9, when installed setuid root, creates files with world-readable and world-writable permissions, which allows local users to read and overwrite files.


definition_id: oval:org.debian:def:300131596699054787688823060148310284699
title: CVE-2004-2372 bochs
description:
Buffer overflow in Bochs before 2.1.1, if installed setuid, allows local users to execute arbitrary code via a long HOME environment variable, which is used if the .bochsrc, bochsrc, and bochsrc.txt cannot be found in a known path.  NOTE: some external documents recommend that Bochs be installed setuid root, so this should be treated as a vulnerability.


definition_id: oval:org.debian:def:183808805462985838577957999327017135517
title: CVE-2004-2409 samhain
description:
Buffer overflow in the sh_hash_compdata function for Samhain 1.8.9 through 2.0.1, when running in update mode ("-t update"), might allow attackers to execute arbitrary code.


definition_id: oval:org.debian:def:31501624302010471858446013324857599336
title: CVE-2004-2410 samhain
description:
Unknown vulnerability in sh_hash_compdata for Samhain 1.8.9 through 2.0.1 might allow attackers to cause a denial of service (null pointer dereference).


definition_id: oval:org.debian:def:323782732204019092573202899770556322249
title: CVE-2004-2440 proxytunnel
description:
Unspecified vulnerability in cmdline.c in proxytunnel 1.1.3 and earlier allows local users to obtain proxy credentials (username or password) of other users.


definition_id: oval:org.debian:def:156579452503604973469229985464510613746
title: CVE-2004-2459 gnubiff
description:
Unknown vulnerability in gnubiff 1.2.0 and earlier allows local users to obtain passwords, related to the password table.


definition_id: oval:org.debian:def:148325960597183954547013527746481841250
title: CVE-2004-2460 gnubiff
description:
Unknown vulnerability in POP3 in gnubiff before 2.0.0 allows remote attackers to cause a denial of service (application crash) via an "infinite" Unique IDentification Listing (UIDL) list.


definition_id: oval:org.debian:def:88902548195020791640859964539569570525
title: CVE-2004-2461 gnubiff
description:
Buffer overflow in pop3.c in gnubiff before 2.0.0 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code.


definition_id: oval:org.debian:def:294307626763788270315368667480761296414
title: CVE-2004-2462 cplay
description:
cplay 1.49 on Linux allows local users to overwrite arbitrary files via a symlink attack on the cplay_control temporary file.


definition_id: oval:org.debian:def:297975359153906320628334628253184513318
title: CVE-2004-2479 squid
description:
Squid Web Proxy Cache 2.5 might allow remote attackers to obtain sensitive information via URLs containing invalid hostnames that cause DNS operations to fail, which results in references to previously used error messages.


definition_id: oval:org.debian:def:229994681947100381278738699920488570923
title: CVE-2004-2480 squid
description:
Squid Web Proxy Cache 2.3.STABLE5 allows remote attackers to bypass security controls and access arbitrary websites via "@@" sequences in a URL within Internet Explorer.


definition_id: oval:org.debian:def:3034471452875654544797561275393965027
title: CVE-2004-2486 dropbear
description:
The DSS verification code in Dropbear SSH Server before 0.43 frees uninitialized variables, which might allow remote attackers to gain access.


definition_id: oval:org.debian:def:127334497129940281251777330718288610187
title: CVE-2004-2541 cscope
description:
Buffer overflow in Cscope 15.5, and possibly multiple overflows, allows remote attackers to execute arbitrary code via a C file with a long #include line that is later browsed by the target.


definition_id: oval:org.debian:def:144860435248500505137525694341298645343
title: CVE-2004-2546 samba
description:
Multiple memory leaks in Samba before 3.0.6 allow attackers to cause a denial of service (memory consumption).


definition_id: oval:org.debian:def:132851006878908785546670528211923224984
title: CVE-2004-2552 xboard
description:
Buffer overflow in XBoard 4.2.7 and earlier might allow local users to execute arbitrary code via a long -icshost command line argument. NOTE: since the program is not setuid and not normally called from remote programs, there may not be a typical attack vector for the issue that crosses privilege boundaries.  Therefore this may not be a vulnerability.


definition_id: oval:org.debian:def:323409002784141443967325265802465825590
title: CVE-2004-2571 isoqlog
description:
Multiple buffer overflows in EnderUNIX isoqlog 2.1.1 allow remote attackers to execute arbitrary code via the (1) parseQmailFromBytesLine, (2) parseQmailToRemoteLine, (3) parseQmailToLocalLine, (4) parseSendmailFromBytesLine, (5) parseSendmailToLine, (6) parseEximFromBytesLine, and (7) parseEximToLine functions in Parser.c; allow local users to execute arbitrary code via the (8) lowercase and (9) check_syslog_date functions in Parser.c, and (10) unspecified functions in Dir.c; and allow unspecified attackers to execute arbitrary code via the (11) loadconfig and (12) removespaces functions in loadconfig.c, the (13) loadLang function in LangCfg.c, and (14) unspecified functions in Html.c.


definition_id: oval:org.debian:def:141703004956915226857341132701151039222
title: CVE-2004-2652 snort
description:
The DecodeTCPOptions function in decode.c in Snort before 2.3.0, when printing TCP/IP options using FAST output or verbose mode, allows remote attackers to cause a denial of service (crash) via packets with invalid TCP/IP options, which trigger a null dereference.


definition_id: oval:org.debian:def:17781116628862400863192068743885217424
title: CVE-2004-2654 squid
description:
The clientAbortBody function in client_side.c in Squid Web Proxy Cache before 2.6 STABLE6 allows remote attackers to cause a denial of service (segmentation fault) via unspecified vectors that trigger a null dereference.  NOTE: in a followup advisory, a researcher claimed that the issue was a buffer overflow that was not fixed in STABLE6. However, the vendor's bug report clearly shows that the researcher later retracted this claim, because the tested product was actually STABLE5.


definition_id: oval:org.debian:def:153279721405009519068463009426898124378
title: CVE-2004-2655 xscreensaver
description:
rdesktop 1.3.1 with xscreensaver 4.14, and possibly other versions, when running on Fedora and possibly other platforms, does not release the keyboard focus when xscreensaver starts, which causes the password to be entered into the active window when the user unlocks the screen.


definition_id: oval:org.debian:def:124342971467162901492418450811443223424
title: CVE-2004-2664 phppgadmin
description:
John Lim ADOdb Library for PHP before 4.23 allows remote attackers to obtain sensitive information via direct requests to certain scripts that result in an undefined value of ADODB_DIR, which reveals the installation path in an error message.


definition_id: oval:org.debian:def:5919475744922219036298860467936127683
title: CVE-2004-2680 libapache2-mod-python
description:
mod_python (libapache2-mod-python) 3.1.4 and earlier does not properly handle when output filters process more than 16384 bytes, which can cause filter.read to return portions of previously freed memory.


definition_id: oval:org.debian:def:219324223350667196550881014630606775639
title: CVE-2004-2687 distcc
description:
distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs, which are executed by the server without authorization checks.


definition_id: oval:org.debian:def:138195964458914697517586850457969475818
title: CVE-2004-2698 imwheel
description:
Race condition in IMWheel 1.0.0pre11 and earlier, when running with the -k option, allows local users to cause a denial of service (IMWheel crash) and possibly modify arbitrary files via a symlink attack on the imwheel.pid file.


definition_id: oval:org.debian:def:261310009853912873351673129322320831468
title: CVE-2004-2705 pvpgn
description:
Unspecified vulnerability in Player vs. Player Gaming Network (PvPGN) before 1.6.4 allows remote attackers to obtain attributes of arbitrary accounts, including the password hash, via certain statsreq packets.


definition_id: oval:org.debian:def:66993195002127202962747072525870204919
title: CVE-2004-2714 wmaker
description:
Unspecified vulnerability in Window Maker 0.80.2 and earlier allows attackers to perform unknown actions via format string specifiers in a font specification in WMGLOBAL, probably a format string vulnerability.


definition_id: oval:org.debian:def:229958388742138651117548864716729742026
title: CVE-2004-2760 openssh
description:
sshd in OpenSSH 3.5p1, when PermitRootLogin is disabled, immediately closes the TCP connection after a root login attempt with the correct password, but leaves the connection open after an attempt with an incorrect password, which makes it easier for remote attackers to guess the password by observing the connection state, a different vulnerability than CVE-2003-0190.  NOTE: it could be argued that in most environments, this does not cross privilege boundaries without requiring leverage of a separate vulnerability.


definition_id: oval:org.debian:def:2403066373950513452012741775391749926
title: CVE-2004-2768 dpkg
description:
dpkg 1.9.21 does not properly reset the metadata of a file during replacement of the file in a package upgrade, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid file, (2) setgid file, or (3) device, a related issue to CVE-2010-2059.


definition_id: oval:org.debian:def:97951152139227501016109348654573514566
title: CVE-2004-2771 bsd-mailx
description:
A flaw was found in the way mailx handled the parsing of email addresses. A syntactically valid email address could allow a local attacker to cause mailx to execute arbitrary shell commands through shell meta-characters (CVE-2004-2771) and the direct command execution functionality (CVE-2014-7844).


definition_id: oval:org.debian:def:19835172515505734191814314668179292745
title: CVE-2004-2779 libid3tag
description:
id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until an OOM condition is reached, leading to denial-of-service (DoS).


definition_id: oval:org.debian:def:179456051582429375612023184672886245130
title: CVE-2005-0005 imagemagick
description:
Heap-based buffer overflow in psd.c for ImageMagick 6.1.0, 6.1.7, and possibly earlier versions allows remote attackers to execute arbitrary code via a .PSD image file with a large number of layers.


definition_id: oval:org.debian:def:99187661898300089566662326240937039209
title: CVE-2005-0012 dillo
description:
Format string vulnerability in the a_Interface_msg function in Dillo before 0.8.3-r4 allows remote attackers to execute arbitrary code via format string specifiers in a web page.


definition_id: oval:org.debian:def:65481521307945735370187302191719360909
title: CVE-2005-0015 sword
description:
diatheke.pl in Sword 1.5.7a allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.


definition_id: oval:org.debian:def:85247108331869652509551796446625771347
title: CVE-2005-0016 gatos
description:
Buffer overflow in the exported_display function in xatitv in gatos before 0.0.5 allows local users to execute arbitrary code.


definition_id: oval:org.debian:def:223066872894229312012931281553580811318
title: CVE-2005-0017 f2c
description:
The f2c translator in the f2c package 3.1 allows local users to read arbitrary files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:177002146439027354951246548790754198568
title: CVE-2005-0018 f2c
description:
The f2 shell script in the f2c package 3.1 allows local users to read arbitrary files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:266355089293744553395583987159149586000
title: CVE-2005-0021 exim4
description:
Multiple buffer overflows in Exim before 4.43 may allow attackers to execute arbitrary code via (1) an IPv6 address with more than 8 components, as demonstrated using the -be command line option, which triggers an overflow in the host_aton function, or (2) the -bh command line option or dnsdb PTR lookup, which triggers an overflow in the dns_build_reverse function.


definition_id: oval:org.debian:def:42948862332503708341173672948575928250
title: CVE-2005-0022 exim4
description:
Buffer overflow in the spa_base64_to_bits function in Exim before 4.43, as originally obtained from Samba code, and as called by the auth_spa_client function, may allow attackers to execute arbitrary code during SPA authentication.


definition_id: oval:org.debian:def:249668288721459367981581490173026916367
title: CVE-2005-0034 bind9
description:
An "incorrect assumption" in the authvalidated validator function in BIND 9.3.0, when DNSSEC is enabled, allows remote attackers to cause a denial of service (named server exit) via crafted DNS packets that cause an internal consistency test (self-check) to fail.


definition_id: oval:org.debian:def:107378672148774810056754975087620329975
title: CVE-2005-0038 pdns
description:
The DNS implementation of PowerDNS 2.9.16 and earlier allows remote attackers to cause a denial of service via a compressed DNS packet with a label length byte with an incorrect offset, which could trigger an infinite loop.


definition_id: oval:org.debian:def:34792561519578505006654529278708405156
title: CVE-2005-0064 cups
description:
Buffer overflow in the Decrypt::makeFileKey2 function in Decrypt.cc for xpdf 3.00 and earlier allows remote attackers to execute arbitrary code via a PDF file with a large /Encrypt /Length keyLength value.


definition_id: oval:org.debian:def:279776037160907061321824399586981946772
title: CVE-2005-0069 vim
description:
The (1) tcltags or (2) vimspell.sh scripts in vim 6.3 allow local users to overwrite or create arbitrary files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:11220247628437685226291714463699403124
title: CVE-2005-0071 vdr
description:
vdr before 1.2.6 does not securely create files, which allows attackers to overwrite arbitrary files.


definition_id: oval:org.debian:def:279807622420173232053316355163705677228
title: CVE-2005-0072 zhcon
description:
zhcon before 0.2 does not drop privileges before reading a user configuration file, which allows local users to read arbitrary files.


definition_id: oval:org.debian:def:198783878192155815710489339316536895244
title: CVE-2005-0073 sympa
description:
Buffer overflow in queue.c in a support script for sympa 3.3.3, when running setuid, allows local users to execute arbitrary code.


definition_id: oval:org.debian:def:132154784812106638377365353050982724545
title: CVE-2005-0077 libdbi-perl
description:
The DBI library (libdbi-perl) for Perl allows local users to overwrite arbitrary files via a symlink attack on a temporary PID file.


definition_id: oval:org.debian:def:328897265129315442220779369793833771689
title: CVE-2005-0079 xtrlock
description:
Buffer overflow in xtrlock 2.0 allows local users to cause a denial of service (application crash) and hijack the desktop session.


definition_id: oval:org.debian:def:113419374823098478975174710454069267309
title: CVE-2005-0080 mailman
description:
The 55_options_traceback.dpatch patch for mailman 2.1.5 in Ubuntu 4.10 displays a different error message depending on whether the e-mail address is subscribed to a private list, which allows remote attackers to determine the list membership for a given e-mail address.


definition_id: oval:org.debian:def:1142486495127184721308774625737533919
title: CVE-2005-0085 htdig
description:
Cross-site scripting (XSS) vulnerability in ht://dig (htdig) before 3.1.6-r7 allows remote attackers to execute arbitrary web script or HTML via the config parameter, which is not properly sanitized before it is displayed in an error message.


definition_id: oval:org.debian:def:213481916271583432150535013388884539172
title: CVE-2005-0087 alsa-lib
description:
The alsa-lib package in Red Hat Linux 4 disables stack protection for the libasound.so library, which makes it easier for attackers to execute arbitrary code if there are other vulnerabilities in the library.


definition_id: oval:org.debian:def:42534035770967106623620900089504412021
title: CVE-2005-0088 libapache2-mod-python
description:
The publisher handler for mod_python 2.7.8 and earlier allows remote attackers to obtain access to restricted objects via a crafted URL.


definition_id: oval:org.debian:def:304919008598039099603478934795069362513
title: CVE-2005-0094 squid
description:
Buffer overflow in the gopherToHTML function in the Gopher reply parser for Squid 2.5.STABLE7 and earlier allows remote malicious Gopher servers to cause a denial of service (crash) via crafted responses.


definition_id: oval:org.debian:def:166322521514581043337320630161882706389
title: CVE-2005-0095 squid
description:
The WCCP message parsing code in Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service (crash) via malformed WCCP messages with source addresses that are spoofed to reference Squid's home router and invalid WCCP_I_SEE_YOU cache numbers.


definition_id: oval:org.debian:def:221946877020269853695227957136143997375
title: CVE-2005-0096 squid
description:
Memory leak in the NTLM fakeauth_auth helper for Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service (memory consumption).


definition_id: oval:org.debian:def:308753718873062977200374353467291424356
title: CVE-2005-0097 squid
description:
The NTLM component in Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service (crash) via a malformed NTLM type 3 message that triggers a NULL dereference.


definition_id: oval:org.debian:def:166096836938219798142571063092305528311
title: CVE-2005-0100 xemacs21
description:
Format string vulnerability in the movemail utility in (1) Emacs 20.x, 21.3, and possibly other versions, and (2) XEmacs 21.4 and earlier, allows remote malicious POP3 servers to execute arbitrary code via crafted packets.


definition_id: oval:org.debian:def:47063013792503539319399322216091774973
title: CVE-2005-0102 evolution
description:
Integer overflow in camel-lock-helper in Evolution 2.0.2 and earlier allows local users or remote malicious POP3 servers to execute arbitrary code via a length value of -1, which leads to a zero byte memory allocation and a buffer overflow.


definition_id: oval:org.debian:def:313307013937992552542798307378780735898
title: CVE-2005-0106 libnet-ssleay-perl
description:
SSLeay.pm in libnet-ssleay-perl before 1.25 uses the /tmp/entropy file for entropy if a source is not set in the EGD_PATH variable, which allows local users to reduce the cryptographic strength of certain operations by modifying the file.


definition_id: oval:org.debian:def:64234143606502557238793160822778354192
title: CVE-2005-0108 libapache-mod-auth-radius
description:
Apache mod_auth_radius 1.5.4 and libpam-radius-auth allow remote malicious RADIUS servers to cause a denial of service (crash) via a RADIUS_REPLY_MESSAGE with a RADIUS attribute length of 1, which leads to a memcpy operation with a -1 length argument.


definition_id: oval:org.debian:def:98481010633073982630191430429831187793
title: CVE-2005-0116 awstats
description:
AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary commands via shell metacharacters in the configdir parameter to aswtats.pl.


definition_id: oval:org.debian:def:165473352515897265951372728368177577134
title: CVE-2005-0117 xshisen
description:
Buffer overflow in XShisen before 1.36 allows local users to execute arbitrary code via a long GECOS field.


definition_id: oval:org.debian:def:22372241732328412865312438820532617364
title: CVE-2005-0129 konversation
description:
The Quick Buttons feature in Konversation 0.15 allows remote attackers to execute certain IRC commands via a channel name containing "%" variables, which are recursively expanded by the Server::parseWildcards function when the Part Button is selected.


definition_id: oval:org.debian:def:183614649466466251386709642015360587052
title: CVE-2005-0130 konversation
description:
Certain Perl scripts in Konversation 0.15 allow remote attackers to execute arbitrary commands via shell metacharacters in (1) channel names or (2) song names that are not properly quoted when the user runs IRC scripts.


definition_id: oval:org.debian:def:23606876243470168406969178836437797899
title: CVE-2005-0131 konversation
description:
The Quick Connection dialog in Konversation 0.15 inadvertently uses the user-provided password as the nickname instead of the user-provided nickname when connecting to the IRC server, which could leak the password to other users.


definition_id: oval:org.debian:def:222957473888998318652160330530251158564
title: CVE-2005-0133 clamav
description:
ClamAV 0.80 and earlier allows remote attackers to cause a denial of service (clamd daemon crash) via a ZIP file with malformed headers.


definition_id: oval:org.debian:def:269084003686778403249825915164871944538
title: CVE-2005-0155 perl
description:
The PerlIO implementation in Perl 5.8.0, when installed with setuid support (sperl), allows local users to create arbitrary files via the PERLIO_DEBUG variable.


definition_id: oval:org.debian:def:326127264537798673925035033483532675992
title: CVE-2005-0156 perl
description:
Buffer overflow in the PerlIO implementation in Perl 5.8.0, when installed with setuid support (sperl), allows local users to execute arbitrary code by setting the PERLIO_DEBUG variable and executing a Perl script whose full pathname contains a long directory tree.


definition_id: oval:org.debian:def:187354394041854551192763005809561149610
title: CVE-2005-0157 smartlist
description:
The confirm add-on in SmartList 3.15 and earlier allows attackers to subscribe arbitrary e-mail addresses by using a valid cookie that specifies an address other than the address for which the cookie was assigned.


definition_id: oval:org.debian:def:104501038696029356447446949856893267937
title: CVE-2005-0160 unace
description:
Multiple buffer overflows in unace 1.2b allow attackers to execute arbitrary code via (1) 2 overflows in ACE archives, (2) a long command line argument, or (3) certain "Ready for next volume" messages.


definition_id: oval:org.debian:def:323874357360387235147353488760856478693
title: CVE-2005-0161 unace
description:
Multiple directory traversal vulnerabilities in unace 1.2b allow attackers to overwrite arbitrary files via an ACE archive containing (1) ../ sequences or (2) absolute pathnames.


definition_id: oval:org.debian:def:152447259463978644705624411732057012413
title: CVE-2005-0173 squid
description:
squid_ldap_auth in Squid 2.5 and earlier allows remote authenticated users to bypass username-based Access Control Lists (ACLs) via a username with a space at the beginning or end, which is ignored by the LDAP server.


definition_id: oval:org.debian:def:44031211297751074452799992696112662865
title: CVE-2005-0174 squid
description:
Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP specification, including (1) multiple Content-Length headers, (2) carriage return (CR) characters that are not part of a CRLF pair, and (3) header names containing whitespace characters.


definition_id: oval:org.debian:def:178688404016140697528691903758595070694
title: CVE-2005-0175 squid
description:
Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache via an HTTP response splitting attack.


definition_id: oval:org.debian:def:210271546402584500486694227212406271849
title: CVE-2005-0194 squid
description:
Squid 2.5, when processing the configuration file, parses empty Access Control Lists (ACLs), including proxy_auth ACLs without defined auth schemes, in a way that effectively removes arguments, which could allow remote attackers to bypass intended ACLs if the administrator ignores the parser warnings.


definition_id: oval:org.debian:def:243127140228958762721958259218083575857
title: CVE-2005-0198 uw-imap
description:
A logic error in the CRAM-MD5 code for the University of Washington IMAP (UW-IMAP) server, when Challenge-Response Authentication Mechanism with MD5 (CRAM-MD5) is enabled, does not properly enforce all the required conditions for successful authentication, which allows remote attackers to authenticate as arbitrary users.


definition_id: oval:org.debian:def:16697008614835831804773809595199439853
title: CVE-2005-0201 dbus
description:
D-BUS (dbus) before 0.22 does not properly restrict access to a socket, if the socket address is known, which allows local users to listen or send arbitrary messages on another user's per-user session bus via that socket.


definition_id: oval:org.debian:def:294350081155823083174932687945238115123
title: CVE-2005-0202 mailman
description:
Directory traversal vulnerability in the true_path function in private.py for Mailman 2.1.5 and earlier allows remote attackers to read arbitrary files via ".../....///" sequences, which are not properly cleansed by regular expressions that are intended to remove "../" and "./" sequences.


definition_id: oval:org.debian:def:175414312494687003353367873894075151766
title: CVE-2005-0206 cups
description:
The patch for integer overflow vulnerabilities in Xpdf 2.0 and 3.0 (CVE-2004-0888) is incomplete for 64-bit architectures on certain Linux distributions such as Red Hat, which could leave Xpdf users exposed to the original vulnerabilities.


definition_id: oval:org.debian:def:77896844983264027269168652140736216412
title: CVE-2005-0211 squid
description:
Buffer overflow in wccp.c in Squid 2.5 before 2.5.STABLE7 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long WCCP packet, which is processed by a recvfrom function call that uses an incorrect length parameter.


definition_id: oval:org.debian:def:50277662266555009151732079866927733163
title: CVE-2005-0218 clamav
description:
ClamAV 0.80 and earlier allows remote attackers to bypass virus scanning via a base64 encoded image in a data: (RFC 2397) URL.


definition_id: oval:org.debian:def:291304571202205718688731716616481145104
title: CVE-2005-0225 firehol
description:
firehol.sh in FireHOL before 1.224 creates temporary files with predictable file names, which could allow local users to overwrite arbitrary files via a symlink attack.


definition_id: oval:org.debian:def:315177698289042296138810837461893813864
title: CVE-2005-0238 epiphany-browser
description:
The International Domain Name (IDN) support in Epiphany allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.


definition_id: oval:org.debian:def:151849978456966017268369101302088304571
title: CVE-2005-0241 squid
description:
The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is handling "oversized" HTTP reply headers, which might allow remote attackers to poison the cache or bypass access controls based on header size.


definition_id: oval:org.debian:def:151256612562984105708349599501843522176
title: CVE-2005-0337 postfix
description:
Postfix 2.1.3, when /proc/net/if_inet6 is not available and permit_mx_backup is enabled in smtpd_recipient_restrictions, allows remote attackers to bypass e-mail restrictions and perform mail relaying by sending mail to an IPv6 hostname.


definition_id: oval:org.debian:def:282174101651895471969832378912141422265
title: CVE-2005-0362 awstats
description:
awstats.pl in AWStats 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) "pluginmode", (2) "loadplugin", or (3) "noloadplugin" parameters.


definition_id: oval:org.debian:def:114740125221754604301474046578734563774
title: CVE-2005-0363 awstats
description:
awstats.pl in AWStats 4.0 and 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the config parameter.


definition_id: oval:org.debian:def:17246943570267878180269286489028365603
title: CVE-2005-0372 gftp
description:
Directory traversal vulnerability in gftp before 2.0.18 for GTK+ allows remote malicious FTP servers to read arbitrary files via .. (dot dot) sequences in filenames returned from a LIST command.


definition_id: oval:org.debian:def:60314235230554837188622860917240370675
title: CVE-2005-0373 cyrus-sasl2
description:
Buffer overflow in digestmd5.c CVS release 1.170 (also referred to as digestmda5.c), as used in the DIGEST-MD5 SASL plugin for Cyrus-SASL but not in any official releases, allows remote attackers to execute arbitrary code.


definition_id: oval:org.debian:def:4585597908056243797058357592871705216
title: CVE-2005-0390 axel
description:
Buffer overflow in the HTTP redirection capability in conn.c for Axel before 1.0b may allow remote attackers to execute arbitrary code.


definition_id: oval:org.debian:def:123829922826270209820660298666433646784
title: CVE-2005-0391 geneweb
description:
geneweb 4.10 and earlier does not properly check file permissions and content during conversion, which allows attackers to modify arbitrary files.


definition_id: oval:org.debian:def:85310689166629581159708377850675280667
title: CVE-2005-0393 crip
description:
The helper scripts for crip 3.5 do not properly use temporary files, which allows local users to have an unknown impact with unknown attack vectors.


definition_id: oval:org.debian:def:322060035795152983944737442001880379335
title: CVE-2005-0397 graphicsmagick
description:
Format string vulnerability in the SetImageInfo function in image.c for ImageMagick before 6.0.2.5 may allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a filename argument to convert, which may be called by other web applications.


definition_id: oval:org.debian:def:95038119813578391800447653221999062171
title: CVE-2005-0428 pdns
description:
The DNSPacket::expand method in dnspacket.cc in PowerDNS before 2.9.17 allows remote attackers to cause a denial of service by sending a random stream of bytes.


definition_id: oval:org.debian:def:2943479102156397163805184528759499168
title: CVE-2005-0435 awstats
description:
awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to read server web logs by setting the loadplugin and pluginmode parameters to rawlog.


definition_id: oval:org.debian:def:55514095075436754380760556511374719205
title: CVE-2005-0436 awstats
description:
Direct code injection vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to execute portions of Perl code via the PluginMode parameter.


definition_id: oval:org.debian:def:109778490144708090156414353563960964119
title: CVE-2005-0437 awstats
description:
Directory traversal vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to include arbitrary Perl modules via .. (dot dot) sequences in the loadplugin parameter.


definition_id: oval:org.debian:def:59948672656715829320139445951882950882
title: CVE-2005-0438 awstats
description:
awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to obtain sensitive information by setting the debug parameter.


definition_id: oval:org.debian:def:286310593829495382134337738021333779910
title: CVE-2005-0446 squid
description:
Squid 2.5.STABLE8 and earlier allows remote attackers to cause a denial of service (crash) via certain DNS responses regarding (1) Fully Qualified Domain Names (FQDN) in fqdncache.c or (2) IP addresses in ipcache.c, which trigger an assertion failure.


definition_id: oval:org.debian:def:90651983281407439476340766617036992617
title: CVE-2005-0448 perl
description:
Race condition in the rmtree function in File::Path.pm in Perl before 5.8.4 allows local users to create arbitrary setuid binaries in the tree being deleted, a different vulnerability than CVE-2004-0452.


definition_id: oval:org.debian:def:280732585241724437380143389955266702121
title: CVE-2005-0467 putty
description:
Multiple integer overflows in the (1) sftp_pkt_getstring and (2) fxp_readdir_recv functions in the PSFTP and PSCP clients for PuTTY 0.56, and possibly earlier versions, allow remote malicious web sites to execute arbitrary code via SFTP responses that corrupt the heap after insufficient memory has been allocated.


definition_id: oval:org.debian:def:10038068934461601913668202134711067759
title: CVE-2005-0468 krb5
description:
Heap-based buffer overflow in the env_opt_add function in telnet.c for various BSD-based Telnet clients allows remote attackers to execute arbitrary code via responses that contain a large number of characters that require escaping, which consumers more memory than allocated.


definition_id: oval:org.debian:def:111186859790116389020290164820641772876
title: CVE-2005-0469 heimdal
description:
Buffer overflow in the slc_add_reply function in various BSD-based Telnet clients, when handling LINEMODE suboptions, allows remote attackers to execute arbitrary code via a reply with a large number of Set Local Character (SLC) commands.


definition_id: oval:org.debian:def:97150040947764431198101358156809667765
title: CVE-2005-0488 krb5
description:
Certain BSD-based Telnet clients, including those used on Solaris and SuSE Linux, allow remote malicious Telnet servers to read sensitive environment variables via the NEW-ENVIRON option with a SEND ENV_USERVAR command.


definition_id: oval:org.debian:def:294812900838478122097255486584643061913
title: CVE-2005-0490 curl
description:
Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to execute arbitrary code via base64 encoded replies that exceed the intended buffer lengths when decoded, which is not properly handled by (1) the Curl_input_ntlm function in http_ntlm.c during NTLM authentication or (2) the Curl_krb_kauth and krb4_auth functions in krb4.c during Kerberos authentication.


definition_id: oval:org.debian:def:131565431286051502887074733269060894760
title: CVE-2005-0503 uim
description:
uim before 0.4.5.1 trusts certain environment variables when libUIM is used in setuid or setgid applications, which allows local users to gain privileges.


definition_id: oval:org.debian:def:191383946891871989132546265973628130452
title: CVE-2005-0508 batik
description:
Unknown vulnerability in Squiggle for Batik before 1.5.1 allows attackers to bypass certain access controls via certain features of the Rhino scripting engine due to a "script security issue."


definition_id: oval:org.debian:def:173984782970268865644401441292788679691
title: CVE-2005-0509 mono
description:
Multiple cross-site scripting (XSS) vulnerabilities in the Mono 1.0.5 implementation of ASP.NET (.Net) allow remote attackers to inject arbitrary HTML or web script via Unicode representations for ASCII fullwidth characters that are converted to normal ASCII characters, including ">" and "<".


definition_id: oval:org.debian:def:236477033594421821772843518733050147854
title: CVE-2005-0534 mediawiki
description:
Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki 1.3.x before 1.3.11 and 1.4 beta before 1.4 rc1 allow remote attackers to inject arbitrary web script.


definition_id: oval:org.debian:def:338302919589461920414502139888010542927
title: CVE-2005-0535 mediawiki
description:
Cross-site request forgery (CSRF) vulnerability in MediaWiki 1.3.x before 1.3.11 and 1.4 beta before 1.4 rc1 allows remote attackers to perform unauthorized actions as authenticated MediaWiki users.


definition_id: oval:org.debian:def:98203839065469892800457678833557422537
title: CVE-2005-0536 mediawiki
description:
Directory traversal vulnerability in MediaWiki 1.3.x before 1.3.11 and 1.4 beta before 1.4 rc1 allows remote attackers to delete arbitrary files or determine file existence via a parameter related to image deletion.


definition_id: oval:org.debian:def:229731941844890990183915195097984095790
title: CVE-2005-0602 unzip
description:
Unzip 5.51 and earlier does not properly warn the user when extracting setuid or setgid files, which may allow local users to gain privileges.


definition_id: oval:org.debian:def:5605730311066842549354208929277301496
title: CVE-2005-0624 reportbug
description:
reportbug before 2.62 creates the .reportbugrc configuration file with world-readable permissions, which allows local users to obtain email smarthost passwords.


definition_id: oval:org.debian:def:145561674574298032139738174076753503026
title: CVE-2005-0625 reportbug
description:
reportbug 3.2 includes settings from .reportbugrc in bug reports, which exposes sensitive information such as smtpuser and smtppasswd.


definition_id: oval:org.debian:def:214527159453987979474798668003839971663
title: CVE-2005-0626 squid
description:
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.


definition_id: oval:org.debian:def:111708070857601070787316029318737649131
title: CVE-2005-0638 xli
description:
xloadimage before 4.1-r2, and xli before 1.17, allows attackers to execute arbitrary commands via shell metacharacters in filenames for compressed images, which are not properly quoted when calling the gunzip command.


definition_id: oval:org.debian:def:276199484430709987963264809031594732157
title: CVE-2005-0639 xli
description:
Multiple vulnerabilities in xli before 1.17 may allow remote attackers to execute arbitrary code via "buffer management errors" from certain image properties, some of which may be related to integer overflows in PPM files.


definition_id: oval:org.debian:def:200201574666568441549593287526644819441
title: CVE-2005-0664 libexif
description:
Buffer overflow in the EXIF library (libexif) 0.6.9 does not properly validate the structure of the EXIF tags, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a JPEG image with a crafted EXIF tag.


definition_id: oval:org.debian:def:8284808434233228974505913678858882080
title: CVE-2005-0667 sylpheed
description:
Buffer overflow in Sylpheed before 1.0.3 and other versions before 1.9.5 allows remote attackers to execute arbitrary code via an e-mail message with certain headers containing non-ASCII characters that are not properly handled when the user replies to the message.


definition_id: oval:org.debian:def:88800320174816757536087770508353927568
title: CVE-2005-0686 mlterm
description:
Integer overflow in mlterm 2.5.0 through 2.9.1, with gdk-pixbuf support enabled, allows remote attackers to execute arbitrary code via a large image file that is used as a background.


definition_id: oval:org.debian:def:79219942110600586694945886660515456393
title: CVE-2005-0687 hashcash
description:
Format string vulnerability in Hashcash 1.16 allows remote attackers to cause a denial of service (memory consumption) and possibly execute arbitrary code via format string specifiers in a reply address, which is not properly handled when printing the header.


definition_id: oval:org.debian:def:261608609380556231986223805709364224369
title: CVE-2005-0706 grip
description:
Buffer overflow in discdb.c for grip 3.1.2 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code by causing the cddb lookup to return more matches than expected.


definition_id: oval:org.debian:def:6656342892089302556800233388896981987
title: CVE-2005-0718 squid
description:
Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service (segmentation fault) by aborting the connection during a (1) PUT or (2) POST request, which causes Squid to access previously freed memory.


definition_id: oval:org.debian:def:317065470378833718937003195399717136216
title: CVE-2005-0758 bzip2
description:
zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script.


definition_id: oval:org.debian:def:118666072610439681030548554130965058948
title: CVE-2005-0759 imagemagick
description:
ImageMagick before 6.0 allows remote attackers to cause a denial of service (application crash) via a TIFF image with an invalid tag.


definition_id: oval:org.debian:def:316902931966289397795373842776540830428
title: CVE-2005-0760 imagemagick
description:
The TIFF decoder in ImageMagick before 6.0 allows remote attackers to cause a denial of service (crash) via a crafted TIFF file.


definition_id: oval:org.debian:def:139554982207976677497707339299131395371
title: CVE-2005-0761 imagemagick
description:
Unknown vulnerability in ImageMagick before 6.1.8 allows remote attackers to cause a denial of service (application crash) via a crafted PSD file.


definition_id: oval:org.debian:def:108831854297244928826996770873085583945
title: CVE-2005-0762 imagemagick
description:
Heap-based buffer overflow in the SGI parser in ImageMagick before 6.0 allows remote attackers to execute arbitrary code via a crafted SGI image file.


definition_id: oval:org.debian:def:241099447470500859373401562299512640896
title: CVE-2005-0763 mc
description:
Buffer overflow in Midnight Commander (mc) 4.5.55 and earlier may allow attackers to execute arbitrary code.


definition_id: oval:org.debian:def:169304422664884864595941567017161352523
title: CVE-2005-0764 rxvt-unicode
description:
Buffer overflow in command.C for rxvt-unicode before 5.3 allows remote attackers to execute arbitrary code via a crafted file containing long escape sequences.


definition_id: oval:org.debian:def:324052069500808366210114561118785109876
title: CVE-2005-0787 wine
description:
Wine 20050211 and earlier creates temp files with world readable permissions and predictable file names, which allows local users to obtain sensitive information, such as passwords.


definition_id: oval:org.debian:def:4137237083786564086979072511448240058
title: CVE-2005-0806 evolution
description:
Evolution 2.0.3 allows remote attackers to cause a denial of service (application crash or hang) via crafted messages, possibly involving charsets in attachment filenames.


definition_id: oval:org.debian:def:68075673975562829507072088866632924488
title: CVE-2005-0814 lsh-utils
description:
Unknown vulnerability in lshd in Lysator LSH 1.x and 2.x before 2.0.1 allows remote attackers to cause a denial of service via unknown vectors.


definition_id: oval:org.debian:def:159092862629552496600936992106107717935
title: CVE-2005-0825 ltris
description:
Buffer overflow in LTris before 1.0.10 allows local users to execute arbitrary code via a crafted highscores file.


definition_id: oval:org.debian:def:235426422742802443214477675760456875295
title: CVE-2005-0876 dnsmasq
description:
Off-by-one buffer overflow in Dnsmasq before 2.21 may allow attackers to execute arbitrary code via the DHCP lease file.


definition_id: oval:org.debian:def:62552095488259968032609568653353793796
title: CVE-2005-0877 dnsmasq
description:
Dnsmasq before 2.21 allows remote attackers to poison the DNS cache via answers to queries that were not made by Dnsmasq.


definition_id: oval:org.debian:def:215832566400543017950067892054630455084
title: CVE-2005-0891 gdk-pixbuf
description:
Double free vulnerability in gtk 2 (gtk2) before 2.2.4 allows remote attackers to cause a denial of service (crash) via a crafted BMP image.


definition_id: oval:org.debian:def:235909351491517623466945270042942478422
title: CVE-2005-0926 sylpheed
description:
Buffer overflow in Sylpheed before 1.0.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attachments with MIME-encoded file names.


definition_id: oval:org.debian:def:9162010746534648399043819906385587533
title: CVE-2005-0953 bzip2
description:
Race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by bzip2 after the decompression is complete.


definition_id: oval:org.debian:def:190954506445319861600426379117139443017
title: CVE-2005-0988 gzip
description:
Race condition in gzip 1.2.4, 1.3.3, and earlier, when decompressing a gzipped file, allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by gzip after the decompression is complete.


definition_id: oval:org.debian:def:23383692965511071815205190657060892795
title: CVE-2005-0990 sharutils
description:
unshar (unshar.c) in sharutils 4.2.1 allows local users to overwrite arbitrary files via a symlink attack on the unsh.X temporary file.


definition_id: oval:org.debian:def:288341216086041075538863082577248841412
title: CVE-2005-1039 coreutils
description:
Race condition in Core Utilities (coreutils) 5.2.1, when (1) mkdir, (2) mknod, or (3) mkfifo is running with the -m switch, allows local users to modify permissions of other files.


definition_id: oval:org.debian:def:97469284193317332192901211436592967355
title: CVE-2005-1061 logwatch
description:
The secure script in LogWatch before 2.6-2 allows attackers to prevent LogWatch from detecting malicious activity via certain strings in the secure file that are later used as part of a regular expression, which causes the parser to crash, aka "logwatch log processing regular expression DoS."


definition_id: oval:org.debian:def:283996670424259251760608071651901552975
title: CVE-2005-1064 rsnapshot
description:
The copy_symlink function in rsnapshot 1.2.0 and 1.1.x before 1.1.7 changes the ownership of files that a symlink points to rather than the symlink itself, which allows local users to obtain access to arbitrary files.


definition_id: oval:org.debian:def:133786066366385712516291330857252163919
title: CVE-2005-1099 postfix-gld
description:
Multiple buffer overflows in the HandleChild function in server.c in Greylisting daemon (GLD) 1.3 and 1.4, when GLD is listening on a network interface, allow remote attackers to execute arbitrary code.


definition_id: oval:org.debian:def:94209696610726865082312587390501401315
title: CVE-2005-1100 postfix-gld
description:
Format string vulnerability in the ErrorLog function in cnf.c in Greylisting daemon (GLD) 1.3 and 1.4 allows remote attackers to execute arbitrary code via format string specifiers in data that is passed directly to syslog.


definition_id: oval:org.debian:def:277090689578880729960904359561315818747
title: CVE-2005-1111 cpio
description:
Race condition in cpio 2.6 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by cpio after the decompression is complete.


definition_id: oval:org.debian:def:318114415159494048184084573626915534807
title: CVE-2005-1127 libnet-server-perl
description:
Format string vulnerability in the log function in Net::Server 0.87 and earlier, as used in Postfix Greylisting Policy Server (Postgrey) 1.18 and earlier, and possibly other products, allows remote attackers to cause a denial of service (crash) via format string specifiers that are not properly handled before being sent to syslog, as demonstrated using sender addresses to Postgrey.


definition_id: oval:org.debian:def:59906078433429770949925025264404473668
title: CVE-2005-1141 gocr
description:
Integer overflow in the readpgm function in pnm.c for GOCR 0.40, when using the netpbm library, allows remote attackers to execute arbitrary code via a PNM file with large width and height values, which leads to a heap-based buffer overflow.


definition_id: oval:org.debian:def:63945858363307236369047948355004881678
title: CVE-2005-1142 gocr
description:
Heap-based buffer overflow in the readpgm function in pnm.c for GOCR 0.40, when it is not using netpbm, allows remote attackers to execute arbitrary code via a P3 format PNM file with more data than implied by its width and height values.


definition_id: oval:org.debian:def:11734155482896590252453030603428239681
title: CVE-2005-1174 krb5
description:
MIT Kerberos 5 (krb5) 1.3 through 1.4.1 Key Distribution Center (KDC) allows remote attackers to cause a denial of service (application crash) via a certain valid TCP connection that causes a free of unallocated memory.


definition_id: oval:org.debian:def:151939237473687685805194418856368685316
title: CVE-2005-1175 krb5
description:
Heap-based buffer overflow in the Key Distribution Center (KDC) in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a certain valid TCP or UDP request.


definition_id: oval:org.debian:def:260045637053117872163268576676070499749
title: CVE-2005-1194 nasm
description:
Stack-based buffer overflow in the ieee_putascii function for nasm 0.98 and earlier allows attackers to execute arbitrary code via a crafted asm file, a different vulnerability than CVE-2004-1287.


definition_id: oval:org.debian:def:146490532417177913978202435619323516771
title: CVE-2005-1228 gzip
description:
Directory traversal vulnerability in gunzip -N in gzip 1.2.4 through 1.3.5 allows remote attackers to write to arbitrary directories via a .. (dot dot) in the original filename within a compressed file.


definition_id: oval:org.debian:def:179349865055454643886315564408408381372
title: CVE-2005-1229 cpio
description:
Directory traversal vulnerability in cpio 2.6 and earlier allows remote attackers to write to arbitrary directories via a .. (dot dot) in a cpio file.


definition_id: oval:org.debian:def:130949546803615640515113011012181821881
title: CVE-2005-1245 mediawiki
description:
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.4.2, when using HTML Tidy ($wgUseTidy), allows remote attackers to inject arbitrary web script or HTML via unknown vectors.


definition_id: oval:org.debian:def:74288505936192478041585450998032510784
title: CVE-2005-1260 bzip2
description:
bzip2 allows remote attackers to cause a denial of service (hard drive consumption) via a crafted bzip2 file that causes an infinite loop (a.k.a "decompression bomb").


definition_id: oval:org.debian:def:272026518091880313412235981577154479340
title: CVE-2005-1266 spamassassin
description:
Apache SpamAssassin 3.0.1, 3.0.2, and 3.0.3 allows remote attackers to cause a denial of service (CPU consumption and slowdown) via a message with a long Content-Type header without any boundaries.


definition_id: oval:org.debian:def:283720650229657378366488434279223996023
title: CVE-2005-1267 tcpdump
description:
The bgp_update_print function in tcpdump 3.x does not properly handle a -1 return value from the decode_prefix4 function, which allows remote attackers to cause a denial of service (infinite loop) via a crafted BGP packet.


definition_id: oval:org.debian:def:113326537888775999084211666630394834983
title: CVE-2005-1268 apache2
description:
Off-by-one error in the mod_ssl Certificate Revocation List (CRL) verification callback in Apache, when configured to use a CRL, allows remote attackers to cause a denial of service (child process crash) via a CRL that causes a buffer overflow of one null byte.


definition_id: oval:org.debian:def:130857595518466289847485559355003873199
title: CVE-2005-1270 rkhunter
description:
The (1) check_update.sh and (2) rkhunter script in Rootkit Hunter before 1.2.3-r1 create temporary files with predictable file names, which allows local users to overwrite arbitrary files via a symlink attack.


definition_id: oval:org.debian:def:332622113986245220923445333497802923283
title: CVE-2005-1275 imagemagick
description:
Heap-based buffer overflow in the ReadPNMImage function in pnm.c for ImageMagick 6.2.1 and earlier allows remote attackers to cause a denial of service (application crash) via a PNM file with a small colors value.


definition_id: oval:org.debian:def:160619383436248888020640703915489023228
title: CVE-2005-1278 tcpdump
description:
The isis_print function, as called by isoclns_print, in tcpdump 3.9.1 and earlier allows remote attackers to cause a denial of service (infinite loop) via a zero length, as demonstrated using a GRE packet.


definition_id: oval:org.debian:def:109574666398985752030183573965246286317
title: CVE-2005-1279 tcpdump
description:
tcpdump 3.8.3 and earlier allows remote attackers to cause a denial of service (infinite loop) via a crafted (1) BGP packet, which is not properly handled by RT_ROUTING_INFO, or (2) LDP packet, which is not properly handled by the ldp_print function.


definition_id: oval:org.debian:def:126348793521714353810642157253350423170
title: CVE-2005-1280 tcpdump
description:
The rsvp_print function in tcpdump 3.9.1 and earlier allows remote attackers to cause a denial of service (infinite loop) via a crafted RSVP packet of length 4.


definition_id: oval:org.debian:def:6725146105916097722062345244020638755
title: CVE-2005-1344 apache2
description:
Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument.  NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program.  Therefore this may not be a vulnerability.


definition_id: oval:org.debian:def:167831780682739606269575907411693080105
title: CVE-2005-1345 squid
description:
Squid 2.5.STABLE9 and earlier does not trigger a fatal error when it identifies missing or invalid ACLs in the http_access configuration, which could lead to less restrictive ACLs than intended by the administrator.


definition_id: oval:org.debian:def:163524957856431194722449149125244917370
title: CVE-2005-1349 libconvert-uulib-perl
description:
Buffer overflow in Convert-UUlib (Convert::UUlib) before 1.051 allows remote attackers to execute arbitrary code via a malformed parameter to a read operation.


definition_id: oval:org.debian:def:278813240082566534285521481331580857753
title: CVE-2005-1453 leafnode
description:
fetchnews in leafnode 1.9.48 to 1.11.1 allows remote NNTP servers to cause a denial of service (crash) by closing the connection while fetchnews is reading (1) an article header or (2) an article body, which also prevents fetchnews from querying other servers.


definition_id: oval:org.debian:def:105578874633824324086063649430666227228
title: CVE-2005-1454 freeradius
description:
SQL injection vulnerability in the radius_xlat function in the SQL module for FreeRADIUS 1.0.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via (1) group_membership_query, (2) simul_count_query, or (3) simul_verify_query configuration entries.


definition_id: oval:org.debian:def:96002068245999578890529794694161398938
title: CVE-2005-1455 freeradius
description:
Buffer overflow in the sql_escape_func function in the SQL module for FreeRADIUS 1.0.2 and earlier allows remote attackers to cause a denial of service (crash).


definition_id: oval:org.debian:def:301531616026842522463262135760304801308
title: CVE-2005-1519 squid
description:
Squid 2.5 STABLE9 and earlier, when the DNS client port is unfiltered and the environment does not prevent IP spoofing, allows remote attackers to spoof DNS lookups.


definition_id: oval:org.debian:def:252351416754822100453676506834630050020
title: CVE-2005-1520 mailutils
description:
Buffer overflow in the header_get_field_name function in header.c for GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows remote attackers to execute arbitrary code via a crafted e-mail.


definition_id: oval:org.debian:def:22250977620453396529412066221142362576
title: CVE-2005-1521 mailutils
description:
Integer overflow in the fetch_io function of the imap4d server in GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows remote attackers to execute arbitrary code via a partial message request with a large value in the END parameter, which leads to a heap-based buffer overflow.


definition_id: oval:org.debian:def:74420280331007919995267464865246548997
title: CVE-2005-1522 mailutils
description:
The imap4d server for GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows authenticated remote users to cause a denial of service (CPU consumption) via a large range value in the FETCH command.


definition_id: oval:org.debian:def:114147312571392321119170660351320582879
title: CVE-2005-1523 mailutils
description:
Format string vulnerability in imap4d server in GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows remote attackers to execute arbitrary code via format string specifiers in the command tag for IMAP commands.


definition_id: oval:org.debian:def:126864895033357451245017947067785529538
title: CVE-2005-1524 cacti
description:
PHP file inclusion vulnerability in top_graph_header.php in Cacti 0.8.6d and possibly earlier versions allows remote attackers to execute arbitrary PHP code via the config[library_path] parameter.


definition_id: oval:org.debian:def:33304174725126412654920577572260074590
title: CVE-2005-1525 cacti
description:
SQL injection vulnerability in config_settings.php for Cacti before 0.8.6e allows remote attackers to execute arbitrary SQL commands via the id parameter.


definition_id: oval:org.debian:def:203536228690250163984169017779130755076
title: CVE-2005-1526 cacti
description:
PHP remote file inclusion vulnerability in config_settings.php in Cacti before 0.8.6e allows remote attackers to execute arbitrary PHP code via the config[include_path] parameter.


definition_id: oval:org.debian:def:204807054486901753416116641835109931637
title: CVE-2005-1527 awstats
description:
Eval injection vulnerability in awstats.pl in AWStats 6.4 and earlier, when a URLPlugin is enabled, allows remote attackers to execute arbitrary Perl code via the HTTP Referrer, which is used in a $url parameter that is inserted into an eval function call.


definition_id: oval:org.debian:def:154708127990906964749375578717832782225
title: CVE-2005-1544 tiff
description:
Stack-based buffer overflow in libTIFF before 3.7.2 allows remote attackers to execute arbitrary code via a TIFF file with a malformed BitsPerSample tag.


definition_id: oval:org.debian:def:217445013373466467446025641775295347922
title: CVE-2005-1545 ht
description:
Integer overflow in the ELF parser in HT Editor before 0.8.0 allows remote attackers to execute arbitrary code via a crafted ELF file, which leads to a heap-based buffer overflow.


definition_id: oval:org.debian:def:29142139168940649962677402695830519679
title: CVE-2005-1546 ht
description:
Buffer overflow in the PE parser in HT Editor before 0.8.0 allows remote attackers to execute arbitrary code via a crafted PE file.


definition_id: oval:org.debian:def:177540148413792544666855875145370773997
title: CVE-2005-1632 cheetah
description:
Cheetah 0.9.15 and 0.9.16 searches the /tmp directory for modules before using the paths in the PYTHONPATH variable, which allows local users to execute arbitrary code via a malicious module in /tmp/.


definition_id: oval:org.debian:def:181970209665969873353006639608138025299
title: CVE-2005-1686 gedit
description:
Format string vulnerability in gedit 2.10.2 may allow attackers to cause a denial of service (application crash) via a bin file with format string specifiers in the filename.  NOTE: while this issue is triggered on the command line by the gedit user, it has been reported that web browsers and email clients could be configured to provide a file name as an argument to gedit, so there is a valid attack that crosses security boundaries.


definition_id: oval:org.debian:def:274360572654456545819644911842536011113
title: CVE-2005-1687 wordpress
description:
SQL injection vulnerability in wp-trackback.php in Wordpress 1.5 and earlier allows remote attackers to execute arbitrary SQL commands via the tb_id parameter.


definition_id: oval:org.debian:def:91528105588051633368552801964020602719
title: CVE-2005-1688 wordpress
description:
Wordpress 1.5 and earlier allows remote attackers to obtain sensitive information via a direct request to files in (1) wp-content/themes/, (2) wp-includes/, or (3) wp-admin/, which reveal the path in an error message.


definition_id: oval:org.debian:def:112344080522265265879550163284692672762
title: CVE-2005-1689 krb5
description:
Double free vulnerability in the krb5_recvauth function in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to execute arbitrary code via certain error conditions.


definition_id: oval:org.debian:def:282632619099924240145286374802810537503
title: CVE-2005-1704 gdb
description:
Integer overflow in the Binary File Descriptor (BFD) library for gdb before 6.3, binutils, elfutils, and possibly other packages, allows user-assisted attackers to execute arbitrary code via a crafted object file that specifies a large number of section headers, leading to a heap-based buffer overflow.


definition_id: oval:org.debian:def:162932621511397636836185681844015081512
title: CVE-2005-1705 gdb
description:
gdb before 6.3 searches the current working directory to load the .gdbinit configuration file, which allows local users to execute arbitrary commands as the user running gdb.


definition_id: oval:org.debian:def:326884737998487094857776811430021605729
title: CVE-2005-1739 imagemagick
description:
The XWD Decoder in ImageMagick before 6.2.2.3, and GraphicsMagick before 1.1.6-r1, allows remote attackers to cause a denial of service (infinite loop) via an image with a zero color mask.


definition_id: oval:org.debian:def:75161843695658619040040265832942504137
title: CVE-2005-1751 mysql-ocaml
description:
Race condition in shtool 2.0.1 and earlier allows local users to create or modify arbitrary files via a symlink attack on the .shtool.$$ temporary file, a different vulnerability than CVE-2005-1759.


definition_id: oval:org.debian:def:197210477298576859568819356516508048966
title: CVE-2005-1759 mysql-ocaml
description:
Race condition in shtool 2.0.1 and earlier allows local users to modify or create arbitrary files via a symlink attack on temporary files after they have been created, a different vulnerability than CVE-2005-1751.


definition_id: oval:org.debian:def:188956395942968506101188142773728207235
title: CVE-2005-1774 davfs2
description:
WEB-DAV Linux File System (davfs2) 0.2.3 does not properly enforce Unix permissions, which allows local users to write arbitrary files on a davfs2 mounted filesystem.


definition_id: oval:org.debian:def:332105351420074775319708335633657545468
title: CVE-2005-1796 ettercap
description:
Format string vulnerability in the curses_msg function in the Ncurses interface (ec_curses.c) for Ettercap before 0.7.3 allows remote attackers to execute arbitrary code.


definition_id: oval:org.debian:def:215843583571662860374856002824166061027
title: CVE-2005-1807 libphp-phpmailer
description:
The Data function in class.smtp.php in PHPMailer 1.7.2 and earlier allows remote attackers to cause a denial of service (infinite loop leading to memory and CPU consumption) via a long header field.


definition_id: oval:org.debian:def:308390674205618639919454210160677036843
title: CVE-2005-1810 wordpress
description:
SQL injection vulnerability in template-functions-category.php in WordPress 1.5.1 allows remote attackers to execute arbitrary SQL commands via the $cat_ID variable, as demonstrated using the cat parameter to index.php.


definition_id: oval:org.debian:def:21625818097167625898674592159974735052
title: CVE-2005-1824 mailutils
description:
The sql_escape_string function in auth/sql.c for the mailutils SQL authentication module does not properly quote the "\" (backslash) character, which is used as an escape character and makes the module vulnerable to SQL injection attacks.


definition_id: oval:org.debian:def:180770672864184272484039286975558895233
title: CVE-2005-1849 sash
description:
inftrees.h in zlib 1.2.2 allows remote attackers to cause a denial of service (application crash) via an invalid file that causes a large dynamic tree to be produced.


definition_id: oval:org.debian:def:249757173148260642755965920474019319480
title: CVE-2005-1853 gopher
description:
gopher.c in the Gopher client 3.0.5 does not properly create temporary files, which allows local users to gain privileges.


definition_id: oval:org.debian:def:256267933587003539053932910005999369006
title: CVE-2005-1854 apt-cacher
description:
Unknown vulnerability in apt-cacher in Debian 3.1, related to "missing input sanitising," allows remote attackers to execute arbitrary commands on the caching server.


definition_id: oval:org.debian:def:55857952232836815676030934918036287441
title: CVE-2005-1855 backup-manager
description:
Backup Manager (backup-manager) before 0.5.8 creates backup files with world-readable default permissions, which allows local users to obtain sensitive information.


definition_id: oval:org.debian:def:316639549792992121515165495217802791155
title: CVE-2005-1856 backup-manager
description:
The CD-burning feature in backup-manager 0.5.8 and earlier uses a fixed filename in a world-writable directory for logging, which allows local users to overwrite files via a symlink attack.


definition_id: oval:org.debian:def:301858060567333712741434497590374665201
title: CVE-2005-1857 simpleproxy
description:
Format string vulnerability in simpleproxy before 3.4 allows remote malicious HTTP proxies to execute arbitrary code via format string specifiers in a reply.


definition_id: oval:org.debian:def:157010911268545381084965255950869543037
title: CVE-2005-1858 fuse
description:
FUSE 2.x before 2.3.0 does not properly clear previously used memory from unfilled pages when the filesystem returns a short byte count to a read request, which may allow local users to obtain sensitive information.


definition_id: oval:org.debian:def:220764679337244649276092036326462465141
title: CVE-2005-1888 mediawiki
description:
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.4.5 allows remote attackers to inject arbitrary web script via HTML attributes in page templates.


definition_id: oval:org.debian:def:78620991051181446074840620549541090083
title: CVE-2005-1911 leafnode
description:
The fetchnews NNTP client in leafnode 1.11.2 and earlier can hang while waiting for input that never arrives, which allows remote NNTP servers to cause a denial of service (news loss).


definition_id: oval:org.debian:def:78457788733794261823970779242838547057
title: CVE-2005-1918 tar
description:
The original patch for a GNU tar directory traversal vulnerability (CVE-2002-0399) in Red Hat Enterprise Linux 3 and 2.1 uses an "incorrect optimization" that allows user-assisted attackers to overwrite arbitrary files via a crafted tar file, probably involving "/../" sequences with a leading "/".


definition_id: oval:org.debian:def:230587819030315086659833880707223513083
title: CVE-2005-1922 clamav
description:
The MS-Expand file handling in Clam AntiVirus (ClamAV) before 0.86 allows remote attackers to cause a denial of service (file descriptor and memory consumption) via a crafted file that causes repeated errors in the cli_msexpand function.


definition_id: oval:org.debian:def:219585791528021838230681964189256863515
title: CVE-2005-1923 clamav
description:
The ENSURE_BITS macro in mszipd.c for Clam AntiVirus (ClamAV) 0.83, and other versions vefore 0.86, allows remote attackers to cause a denial of service (CPU consumption by infinite loop) via a cabinet (CAB) file with the cffile_FolderOffset field set to 0xff, which causes a zero-length read.


definition_id: oval:org.debian:def:167329317581516898905070429178131096230
title: CVE-2005-1993 sudo
description:
Race condition in sudo 1.3.1 up to 1.6.8p8, when the ALL pseudo-command is used after a user entry in the sudoers file, allows local users to gain privileges via a symlink attack.


definition_id: oval:org.debian:def:337112678504199077203779037902342484089
title: CVE-2005-2007 trac
description:
Directory traversal vulnerability in Edgewall Trac 0.8.3 and earlier allows remote attackers to read or write arbitrary files via a .. (dot dot) in the id parameter to the (1) upload or (2) attachment scripts.


definition_id: oval:org.debian:def:319690579305792482880065531746222750897
title: CVE-2005-2008 yaws
description:
Yaws Webserver 1.55 and earlier allows remote attackers to obtain the source code for yaws scripts via a request to a yaw script with a trailing %00 (null).


definition_id: oval:org.debian:def:184475136760542858323163934387428961892
title: CVE-2005-2023 gnupg2
description:
The send_pinentry_environment function in asshelp.c in gpg2 on SUSE Linux 9.3 does not properly handle certain options, which can prevent pinentry from being found and causes S/MIME signing to fail.


definition_id: oval:org.debian:def:205342249269544748136781865723456273781
title: CVE-2005-2024 razor
description:
Vipul Razor Agents (razor-agents) before 2.70 allows remote attackers to cause a denial of service via (1) certain "unusual HTML messages" or (2) "certain malformed headers" such as Content-Type.


definition_id: oval:org.debian:def:7043570428136017918845608872420926065
title: CVE-2005-2040 heimdal
description:
Multiple buffer overflows in the getterminaltype function in telnetd for Heimdal before 0.6.5 may allow remote attackers to execute arbitrary code, a different vulnerability than CVE-2005-0468 and CVE-2005-0469.


definition_id: oval:org.debian:def:127292169250807900930058849781987981588
title: CVE-2005-2050 tor
description:
Unknown vulnerability in Tor before 0.1.0.10 allows remote attackers to read arbitrary memory and possibly key information from the exit server's process space.


definition_id: oval:org.debian:def:85440829188304241176373600535040202994
title: CVE-2005-2056 clamav
description:
The Quantum archive decompressor in Clam AntiVirus (ClamAV) before 0.86.1 allows remote attackers to cause a denial of service (application crash) via a crafted Quantum archive.


definition_id: oval:org.debian:def:99251119095470402125917086538883413275
title: CVE-2005-2069 libnss-ldap
description:
pam_ldap and nss_ldap, when used with OpenLDAP and connecting to a slave using TLS, does not use TLS for the subsequent connection if the client is referred to a master, which may cause a password to be sent in cleartext and allows remote attackers to sniff the password.


definition_id: oval:org.debian:def:22127122261939331036583633018505531997
title: CVE-2005-2070 clamav
description:
The ClamAV Mail fILTER (clamav-milter) 0.84 through 0.85d, when used in Sendmail using long timeouts, allows remote attackers to cause a denial of service by keeping an open connection, which prevents ClamAV from reloading.


definition_id: oval:org.debian:def:216914500591589599791711303209646753965
title: CVE-2005-2081 asterisk
description:
Stack-based buffer overflow in the function that parses commands in Asterisk 1.0.7, when the 'write = command' option is enabled, allows remote attackers to execute arbitrary code via a command that has two double quotes followed by a tab character.


definition_id: oval:org.debian:def:269155695927509393648756599336980368417
title: CVE-2005-2088 apache2
description:
The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."


definition_id: oval:org.debian:def:86549448536659953467481079172674905471
title: CVE-2005-2096 aide
description:
zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file.


definition_id: oval:org.debian:def:292591089885638263308942880557132931367
title: CVE-2005-2097 cups
description:
xpdf and kpdf do not properly validate the "loca" table in PDF files, which allows local users to cause a denial of service (disk consumption and hang) via a PDF file with a "broken" loca table, which causes a large temporary file to be created when xpdf attempts to reconstruct the information.


definition_id: oval:org.debian:def:229982453375696116521926531269221871823
title: CVE-2005-2107 wordpress
description:
Multiple cross-site scripting (XSS) vulnerabilities in post.php in WordPress 1.5.1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) p or (2) comment parameter.


definition_id: oval:org.debian:def:285283868098693827023239624784574803646
title: CVE-2005-2108 wordpress
description:
SQL injection vulnerability in XMLRPC server in WordPress 1.5.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via input that is not filtered in the HTTP_RAW_POST_DATA variable, which stores the data in an XML file.


definition_id: oval:org.debian:def:26833038763336786947384490360518008322
title: CVE-2005-2109 wordpress
description:
wp-login.php in WordPress 1.5.1.2 and earlier allows remote attackers to change the content of the forgotten password e-mail message via the message variable, which is not initialized before use.


definition_id: oval:org.debian:def:245901471344646635470844691608257590245
title: CVE-2005-2110 wordpress
description:
WordPress 1.5.1.2 and earlier allows remote attackers to obtain sensitive information via (1) a direct request to menu-header.php or a "1" value in the feed parameter to (2) wp-atom.php, (3) wp-rss.php, or (4) wp-rss2.php, which reveal the path in an error message.  NOTE: vector [1] was later reported to also affect WordPress 2.0.1.


definition_id: oval:org.debian:def:191044558088588462676490964016324317439
title: CVE-2005-2147 trac
description:
Trac before 0.8.4 allows remote attackers to read or upload arbitrary files via a full pathname in the id parameter to the (1) upload or (2) attachment viewer scripts.


definition_id: oval:org.debian:def:185488575026595657750768353097825612851
title: CVE-2005-2148 cacti
description:
Cacti 0.8.6e and earlier does not perform proper input validation to protect against common attacks, which allows remote attackers to execute arbitrary commands or SQL by sending a legitimate value in a POST request or cookie, then specifying the attack string in the URL, which causes the get_request_var function to return the wrong value in the $_REQUEST variable, which is cleansed while the original malicious $_GET value remains unmodified, as demonstrated in (1) graph_image.php and (2) graph.php.


definition_id: oval:org.debian:def:319618543789524469889327126593195061229
title: CVE-2005-2149 cacti
description:
config.php in Cacti 0.8.6e and earlier allows remote attackers to set the no_http_headers switch, then modify session information to gain privileges and disable the use of addslashes to conduct SQL injection attacks.


definition_id: oval:org.debian:def:50711302616654353793444578808083973487
title: CVE-2005-2151 courier
description:
spf.c in Courier Mail Server does not properly handle DNS failures when looking up Sender Policy Framework (SPF) records, which could allow attackers to cause memory corruption.


definition_id: oval:org.debian:def:265695412516893113849204034564979666838
title: CVE-2005-2177 net-snmp
description:
Net-SNMP 5.0.x before 5.0.10.2, 5.2.x before 5.2.1.2, and 5.1.3, when net-snmp is using stream sockets such as TCP, allows remote attackers to cause a denial of service (daemon hang and CPU consumption) via a TCP packet of length 1, which triggers an infinite loop.


definition_id: oval:org.debian:def:333372523857552084821857235123022966759
title: CVE-2005-2215 mediawiki
description:
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.4.x before 1.4.6 and 1.5 before 1.5beta3 allows remote attackers to inject arbitrary web script or HTML via a parameter in the page move template, a different vulnerability than CVE-2005-1888.


definition_id: oval:org.debian:def:190376861262044087927761076627875838056
title: CVE-2005-2231 heartbeat
description:
High Availability Linux Project Heartbeat 1.2.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:134781686561214275317416960277998699374
title: CVE-2005-2256 phppgadmin
description:
Encoded directory traversal vulnerability in phpPgAdmin 3.1 to 3.5.3 allows remote attackers to access arbitrary files via "%2e%2e%2f" (encoded dot dot) sequences in the formLanguage parameter.


definition_id: oval:org.debian:def:2645343330779673843388697485609245697
title: CVE-2005-2295 netpanzer
description:
NetPanzer 0.8 and earlier allows remote attackers to cause a denial of service (infinite loop) via a packet with a zero datablock size.


definition_id: oval:org.debian:def:316271046538684816636787963160309434634
title: CVE-2005-2301 pdns
description:
PowerDNS before 2.9.18, when running with an LDAP backend, does not properly escape LDAP queries, which allows remote attackers to cause a denial of service (failure to answer ldap questions) and possibly conduct an LDAP injection attack.


definition_id: oval:org.debian:def:190322318980766602087196749624123596642
title: CVE-2005-2302 pdns
description:
PowerDNS before 2.9.18, when allowing recursion to a restricted range of IP addresses, does not properly handle questions from clients that are denied recursion, which could cause a "blank out" of answers to those clients that are allowed to use recursion.


definition_id: oval:org.debian:def:2934838969086685027504585204615729030
title: CVE-2005-2317 shorewall
description:
Shorewall 2.4.x before 2.4.1, 2.2.x before 2.2.5, and 2.0.x before 2.0.17, when MACLIST_TTL is greater than 0 or MACLIST_DISPOSITION is set to ACCEPT, allows remote attackers with an accepted MAC address to bypass other firewall rules or policies.


definition_id: oval:org.debian:def:277861773341161275938648045834153364078
title: CVE-2005-2335 fetchmail
description:
Buffer overflow in the POP3 client in Fetchmail before 6.2.5.2 allows remote POP3 servers to cause a denial of service and possibly execute arbitrary code via long UIDL responses.  NOTE: a typo in an advisory accidentally used the wrong CVE identifier for the Fetchmail issue. This is the correct identifier.


definition_id: oval:org.debian:def:263398530681346764610070387423235224864
title: CVE-2005-2336 hiki
description:
Cross-site scripting (XSS) vulnerability in Hiki 0.8.0 to 0.8.2 allows remote attackers to inject arbitrary web script or HTML via "missing pages" in which the page name is not properly escaped, a different vulnerability than CVE-2005-2803.


definition_id: oval:org.debian:def:3381674227043789912224716087728095605
title: CVE-2005-2351 mutt
description:
Mutt before 1.5.20 patch 7 allows an attacker to cause a denial of service via a series of requests to mutt temporary files.


definition_id: oval:org.debian:def:44897287692745421122226147118986180727
title: CVE-2005-2353 thunderbird
description:
run-mozilla.sh in Thunderbird, with debugging enabled, allows local users to create or overwrite arbitrary files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:138999788643744708154462004882748812412
title: CVE-2005-2368 vim
description:
vim 6.3 before 6.3.082, with modelines enabled, allows external user-assisted attackers to execute arbitrary commands via shell metacharacters in the (1) glob or (2) expand commands of a foldexpr expression for calculating fold levels.


definition_id: oval:org.debian:def:123745165683701778203775525948331419513
title: CVE-2005-2396 mediawiki
description:
Cross-site scripting (XSS) vulnerability in MediaWiki 1.4.6 and earlier allows remote attackers to inject arbitrary web script or HTML via a parameter to the page move template.


definition_id: oval:org.debian:def:214741046409811661801946721789157031670
title: CVE-2005-2411 tdiary
description:
Cross-Site Request Forgery (CSRF) vulnerability in tDiary 2.1.1, and tDiary 2.0.1 and earlier, allows remote attackers to conduct actions as another user, and execute commands on the server, via a URL that is activated by the user.


definition_id: oval:org.debian:def:200779509119478263605206166798688661809
title: CVE-2005-2450 clamav
description:
Multiple integer overflows in the (1) TNEF, (2) CHM, or (3) FSG file format processors in libclamav for Clam AntiVirus (ClamAV) 0.86.1 and earlier allow remote attackers to gain privileges via a crafted e-mail message.


definition_id: oval:org.debian:def:5808541276980139461504547327290757413
title: CVE-2005-2452 tiff
description:
libtiff up to 3.7.0 allows remote attackers to cause a denial of service (application crash) via a TIFF image header with a zero "YCbCr subsampling" value, which causes a divide-by-zero error in (1) tif_strip.c and (2) tif_tile.c, a different vulnerability than CVE-2004-0804.


definition_id: oval:org.debian:def:136393487012898474191114989039776095080
title: CVE-2005-2471 netpbm-free
description:
pstopnm in netpbm does not properly use the "-dSAFER" option when calling Ghostscript to convert a PostScript file into a (1) PBM, (2) PGM, or (3) PNM file, which allows external user-assisted attackers to execute arbitrary commands.


definition_id: oval:org.debian:def:101137954892776369704714899955531875588
title: CVE-2005-2475 unzip
description:
Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.


definition_id: oval:org.debian:def:266134176124207726223322999544942501321
title: CVE-2005-2491 gnumeric
description:
Integer overflow in pcre_compile.c in Perl Compatible Regular Expressions (PCRE) before 6.2, as used in multiple products such as Python, Ethereal, and PHP, allows attackers to execute arbitrary code via quantifier values in regular expressions, which leads to a heap-based buffer overflow.


definition_id: oval:org.debian:def:169564816565549926418938659377491982177
title: CVE-2005-2496 ntp
description:
The xntpd ntp (ntpd) daemon before 4.2.0b, when run with the -u option and using a string to specify the group, uses the group ID of the user instead of the group, which causes xntpd to run with different privileges than intended.


definition_id: oval:org.debian:def:212079584535140484223187583651964829819
title: CVE-2005-2531 openvpn
description:
OpenVPN before 2.0.1, when running with "verb 0" and without TLS authentication, does not properly flush the OpenSSL error queue when a client fails certificate authentication to the server and causes the error to be processed by the wrong client, which allows remote attackers to cause a denial of service (client disconnection) via a large number of failed authentication attempts.


definition_id: oval:org.debian:def:126333022837996724437290945352446923881
title: CVE-2005-2532 openvpn
description:
OpenVPN before 2.0.1 does not properly flush the OpenSSL error queue when a packet can not be decrypted by the server, which allows remote authenticated attackers to cause a denial of service (client disconnection) via a large number of packets that can not be decrypted.


definition_id: oval:org.debian:def:83913166894765474731862559296002213733
title: CVE-2005-2533 openvpn
description:
OpenVPN before 2.0.1, when running in "dev tap" Ethernet bridging mode, allows remote authenticated clients to cause a denial of service (memory exhaustion) via a flood of packets with a large number of spoofed MAC addresses.


definition_id: oval:org.debian:def:325044128042064036910616730453955333140
title: CVE-2005-2534 openvpn
description:
Race condition in OpenVPN before 2.0.1, when --duplicate-cn is not enabled, allows remote attackers to cause a denial of service (server crash) via simultaneous TCP connections from multiple clients that use the same client certificate.


definition_id: oval:org.debian:def:38515921529945161938730356908339150034
title: CVE-2005-2549 evolution
description:
Multiple format string vulnerabilities in Evolution 1.5 through 2.3.6.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) full vCard data, (2) contact data from remote LDAP servers, or (3) task list data from remote servers.


definition_id: oval:org.debian:def:47424172332131854768308987158515270559
title: CVE-2005-2550 evolution
description:
Format string vulnerability in Evolution 1.4 through 2.3.6.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the calendar entries such as task lists, which are not properly handled when the user selects the Calendars tab.


definition_id: oval:org.debian:def:222939608753620671225787523271116392592
title: CVE-2005-2612 wordpress
description:
Direct code injection vulnerability in WordPress 1.5.1.3 and earlier allows remote attackers to execute arbitrary PHP code via the cache_lastpostdate[server] cookie.


definition_id: oval:org.debian:def:207812959025797516394696519328968599987
title: CVE-2005-2626 kismet
description:
Unspecified vulnerability in Kismet before 2005-08-R1 allows remote attackers to have an unknown impact via unprintable characters in the SSID.


definition_id: oval:org.debian:def:264624821510929978603714868604634063477
title: CVE-2005-2627 kismet
description:
Multiple integer underflows in Kismet before 2005-08-R1 allow remote attackers to execute arbitrary code via (1) kernel headers in a pcap file or (2) data frame dissection, which leads to heap-based buffer overflows.


definition_id: oval:org.debian:def:287657368174302826055277435309428379165
title: CVE-2005-2641 libpam-ldap
description:
Unknown vulnerability in pam_ldap before 180 does not properly handle a new password policy control, which could allow attackers to gain privileges.  NOTE: CVE-2005-2497 had also been assigned to this issue, but CVE-2005-2641 is the correct candidate.


definition_id: oval:org.debian:def:199006350234140559352976202165714690425
title: CVE-2005-2643 tor
description:
Tor 0.1.0.13 and earlier, and experimental versions 0.1.1.4-alpha and earlier, does not reject certain weak keys when using ephemeral Diffie-Hellman (DH) handshakes, which allows malicious Tor servers to obtain the keys that a client uses for other systems in the circuit.


definition_id: oval:org.debian:def:12867370518534678653404869833439958912
title: CVE-2005-2655 maildrop
description:
lockmail in maildrop before 1.5.3 does not drop privileges before executing commands, which allows local users to gain privileges via command line arguments.


definition_id: oval:org.debian:def:230422069189164673936719731668352533326
title: CVE-2005-2656 polygen
description:
Polygen before 1.0.6 generates precompiled grammar objects with world-writable permissions, which allows local users to cause a denial of service (disk consumption) and possibly perform other unauthorized activities.


definition_id: oval:org.debian:def:151114554996313341519325599441985497452
title: CVE-2005-2659 chmlib
description:
Buffer overflow in the LZX decompression in CHM Lib (chmlib) 0.35, as used in products such as KchmViewer, has unknown impact and attack vectors.


definition_id: oval:org.debian:def:121549394250540147847636193825224119825
title: CVE-2005-2660 apachetop
description:
apachetop 0.12.5 and earlier, when running in debug mode, allows local users to create or append to arbitrary files via a symlink attack on atop.debug.


definition_id: oval:org.debian:def:290398557722365588146407446352577643963
title: CVE-2005-2661 up-imapproxy
description:
Format string vulnerability in the ParseBannerAndCapability function in main.c for up-imapproxy 1.2.3 and 1.2.4 allows remote IMAP servers to execute arbitrary code via format string specifiers in a banner or capability line.


definition_id: oval:org.debian:def:244267636943473289614934843154030677041
title: CVE-2005-2666 openssh
description:
SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames, IP addresses, and keys in plaintext in the known_hosts file, which makes it easier for an attacker that has compromised an SSH user's account to generate a list of additional targets that are more likely to have the same password or key.


definition_id: oval:org.debian:def:113712281138712434263006985997772643308
title: CVE-2005-2672 lm-sensors
description:
pwmconfig in LM_sensors before 2.9.1 creates temporary files insecurely, which allows local users to overwrite arbitrary files via a symlink attack on the fancontrol temporary file.


definition_id: oval:org.debian:def:289811074400538216017375337547423609350
title: CVE-2005-2693 cvs
description:
cvsbug in CVS 1.12.12 and earlier creates temporary files insecurely, which allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack.


definition_id: oval:org.debian:def:332690000429109469285865736758639193017
title: CVE-2005-2700 apache2
description:
ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.


definition_id: oval:org.debian:def:236320735339188140247043400948129209101
title: CVE-2005-2724 courier
description:
Cross-site scripting (XSS) vulnerability in SqWebMail 5.0.4 allows remote attackers to inject arbitrary web script or HTML via a file attachment that is processed by the Display feature.  NOTE: the severity of this issue has been disputed by the developer.


definition_id: oval:org.debian:def:58320194031645046972324588998998438167
title: CVE-2005-2728 apache2
description:
The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Range field.


definition_id: oval:org.debian:def:113886555973666334324594426052275814511
title: CVE-2005-2769 courier
description:
Cross-site scripting (XSS) vulnerability in SqWebMail 5.0.4 and possibly other versions allows remote attackers to inject arbitrary web script or HTML via an HTML e-mail containing tags with strings that contain ">" or other special characters, which is not properly sanitized by SqWebMail.


definition_id: oval:org.debian:def:44258994185169330685156048007860211721
title: CVE-2005-2772 gopher
description:
Multiple stack-based buffer overflows in University of Minnesota gopher client 3.0.9 allow remote malicious servers to execute arbitrary code via (1) a long "+VIEWS:" reply, which is not properly handled in the VIfromLine function, and (2) certain arguments when launching third party programs such as a web browser from a web link, which is not properly handled in the FIOgetargv function.


definition_id: oval:org.debian:def:207920038151061766894479754975305004422
title: CVE-2005-2794 squid
description:
store.c in Squid 2.5.STABLE10 and earlier allows remote attackers to cause a denial of service (crash) via certain aborted requests that trigger an assert error related to STORE_PENDING.


definition_id: oval:org.debian:def:218634887857669664020437896664235365000
title: CVE-2005-2796 squid
description:
The sslConnectTimeout function in ssl.c for Squid 2.5.STABLE10 and earlier allows remote attackers to cause a denial of service (segmentation fault) via certain crafted requests.


definition_id: oval:org.debian:def:197223270022562730471392858830923042303
title: CVE-2005-2797 openssh
description:
OpenSSH 4.0, and other versions before 4.2, does not properly handle dynamic port forwarding ("-D" option) when a listen address is not provided, which may cause OpenSSH to enable the GatewayPorts functionality.


definition_id: oval:org.debian:def:201330577514315324770222860273449527930
title: CVE-2005-2798 openssh
description:
sshd in OpenSSH before 4.2, when GSSAPIDelegateCredentials is enabled, allows GSSAPI credentials to be delegated to clients who log in using non-GSSAPI methods, which could cause those credentials to be exposed to untrusted users or hosts.


definition_id: oval:org.debian:def:160565180259027466609272037407756895590
title: CVE-2005-2803 hiki
description:
Cross-site scripting (XSS) vulnerability in Hiki 0.8.1 to 0.8.2 allows remote attackers to inject arbitrary web script or HTML via a page name in a Login link, a different vulnerability than CVE-2005-2336.


definition_id: oval:org.debian:def:205644916698120243168366622243849095915
title: CVE-2005-2820 courier
description:
Cross-site scripting (XSS) vulnerability in SqWebMail 5.0.4 allows remote attackers to inject arbitrary web script or HTML via an e-mail message containing Internet Explorer "Conditional Comments" such as "[if]" and "[endif]".


definition_id: oval:org.debian:def:126830749564443530130281743587115009057
title: CVE-2005-2851 smb4k
description:
smb4k 0.4 and other versions before 0.6.3 allows local users to read sensitive files via a symlink attack on the (1) smb4k.tmp or (2) sudoers temporary files.


definition_id: oval:org.debian:def:160047756391546681307371127597668028694
title: CVE-2005-2860 nikto
description:
Cross-site scripting (XSS) vulnerability in Nikto 1.35 and earlier allows remote attackers to inject arbitrary web script or HTML via the Server field in an HTTP response header, which is directly injected into an HTML report.


definition_id: oval:org.debian:def:275230216020498609046675847447993295369
title: CVE-2005-2874 cups
description:
The is_path_absolute function in scheduler/client.c for the daemon in CUPS before 1.1.23 allows remote attackers to cause a denial of service (CPU consumption by tight loop) via a "..\.." URL in an HTTP request.


definition_id: oval:org.debian:def:338305442350830495868966702063986788758
title: CVE-2005-2876 util-linux
description:
umount in util-linux 2.8 to 2.12q, 2.13-pre1, and 2.13-pre2, and other packages such as loop-aes-utils, allows local users with unmount permissions to gain privileges via the -r (remount) option, which causes the file system to be remounted with just the read-only flag, which effectively clears the nosuid, nodev, and other flags.


definition_id: oval:org.debian:def:61327410854566030307422869650551811188
title: CVE-2005-2878 mailutils
description:
Format string vulnerability in search.c in the imap4d server in GNU Mailutils 0.6 allows remote authenticated users to execute arbitrary code via format string specifiers in the SEARCH command.


definition_id: oval:org.debian:def:99542725872287122034236182026542699010
title: CVE-2005-2917 squid
description:
Squid 2.5.STABLE10 and earlier, while performing NTLM authentication, does not properly handle certain request sequences, which allows attackers to cause a denial of service (daemon restart).


definition_id: oval:org.debian:def:249919102791826690865948059368860460747
title: CVE-2005-2919 clamav
description:
libclamav/fsg.c in Clam AntiVirus (ClamAV) before 0.87 allows remote attackers to cause a denial of service (infinite loop) via a crafted FSG packed executable.


definition_id: oval:org.debian:def:331796914500217626273762943480688512198
title: CVE-2005-2920 clamav
description:
Buffer overflow in libclamav/upx.c in Clam AntiVirus (ClamAV) before 0.87 allows remote attackers to execute arbitrary code via a crafted UPX packed executable.


definition_id: oval:org.debian:def:109755809694878999578952094226517693034
title: CVE-2005-2930 chmlib
description:
Stack-based buffer overflow in the _chm_find_in_PMGL function in chm_lib.c for chmlib before 0.36, as used in products such as KchmViewer, allows user-assisted attackers to execute arbitrary code via a CHM file containing a long element, a different vulnerability than CVE-2005-3318.


definition_id: oval:org.debian:def:232351948726172684253011093855215787504
title: CVE-2005-2933 uw-imap
description:
Buffer overflow in the mail_valid_net_parse_work function in mail.c for Washington's IMAP Server (UW-IMAP) before imap-2004g allows remote attackers to execute arbitrary code via a mailbox name containing a single double-quote (") character without a closing quote, which causes bytes after the double-quote to be copied into a buffer indefinitely.


definition_id: oval:org.debian:def:36071082783355146818424636309199681657
title: CVE-2005-2945 arc
description:
arc 5.21j and earlier create temporary files with world-readable permissions, which allows local users to read sensitive information from files created by (1) arc (arc.c) or (2) marc (marc.c).


definition_id: oval:org.debian:def:191582961686495472432120406556543564931
title: CVE-2005-2946 openssl
description:
The default configuration on OpenSSL before 0.9.8 uses MD5 for creating message digests instead of a more cryptographically strong algorithm, which makes it easier for remote attackers to forge certificates with a valid certificate authority signature.


definition_id: oval:org.debian:def:167129229907725819970037371986126880783
title: CVE-2005-2959 sudo
description:
Incomplete blacklist vulnerability in sudo 1.6.8 and earlier allows local users to gain privileges via the (1) SHELLOPTS and (2) PS4 environment variables before executing a bash script on behalf of another user, which are not cleared even though other variables are.


definition_id: oval:org.debian:def:164937121443837685883086439660628724300
title: CVE-2005-2962 ntlmaps
description:
The post-installation script for ntlmaps before 0.9.9 sets world-readable permissions for the configuration file, which allows local users to obtain the username and password.


definition_id: oval:org.debian:def:128790697923298928184067094342177193045
title: CVE-2005-2964 abiword
description:
Stack-based buffer overflow in AbiWord before 2.2.10 allows attackers to execute arbitrary code via the RTF import mechanism.


definition_id: oval:org.debian:def:67943639840504126059908992832814347876
title: CVE-2005-2966 dia
description:
The Python SVG import plugin (diasvg_import.py) for DIA 0.94 and earlier allows user-assisted attackers to execute arbitrary commands via a crafted SVG file.


definition_id: oval:org.debian:def:84390604744297168791801727304168983388
title: CVE-2005-2969 openssl
description:
The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSL_OP_MSIE_SSLV2_RSA_PADDING option, disables a verification step that is required for preventing protocol version rollback attacks, which allows remote attackers to force a client and server to use a weaker protocol than needed via a man-in-the-middle attack.


definition_id: oval:org.debian:def:172572728760632241858285788857375577164
title: CVE-2005-2970 apache2
description:
Memory leak in the worker MPM (worker.c) for Apache 2, in certain circumstances, allows remote attackers to cause a denial of service (memory consumption) via aborted connections, which prevents the memory for the transaction pool from being reused for other connections.


definition_id: oval:org.debian:def:170572296582013132249138812843038517323
title: CVE-2005-2972 abiword
description:
Multiple stack-based buffer overflows in the RTF import feature in AbiWord before 2.2.11 allow user-assisted attackers to execute arbitrary code via an RTF file with long identifiers, which are not properly handled in the (1) ParseLevelText, (2) getCharsInsideBrace, (3) HandleLists, (4) or (5) HandleAbiLists functions in ie_imp_RTF.cpp, a different vulnerability than CVE-2005-2964.


definition_id: oval:org.debian:def:154752211865181246202020752679192004727
title: CVE-2005-2975 gdk-pixbuf
description:
io-xpm.c in the gdk-pixbuf XPM image rendering library in GTK+ before 2.8.7 allows attackers to cause a denial of service (infinite loop) via a crafted XPM image with a large number of colors.


definition_id: oval:org.debian:def:108691491358228739064477623494198425439
title: CVE-2005-2976 gdk-pixbuf
description:
Integer overflow in io-xpm.c in gdk-pixbuf 0.22.0 in GTK+ before 2.8.7 allows attackers to cause a denial of service (crash) or execute arbitrary code via an XPM file with large height, width, and colour values, a different vulnerability than CVE-2005-3186.


definition_id: oval:org.debian:def:280493987832935238828445640594025895676
title: CVE-2005-2977 pam
description:
The SELinux version of PAM before 0.78 r3 allows local users to perform brute force password guessing attacks via unix_chkpwd, which does not log failed guesses or delay its responses.


definition_id: oval:org.debian:def:138389315521405106455103144157065711124
title: CVE-2005-2978 netpbm-free
description:
pnmtopng in netpbm before 10.25, when using the -trans option, uses uninitialized size and index variables when converting Portable Anymap (PNM) images to Portable Network Graphics (PNG), which might allow attackers to execute arbitrary code by modifying the stack.


definition_id: oval:org.debian:def:158587143797709864747294644899892835523
title: CVE-2005-2992 arc
description:
arc 5.21j and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files, a different type of vulnerability than CVE-2005-2945.


definition_id: oval:org.debian:def:178337290163162504797367205667418871646
title: CVE-2005-2995 bacula
description:
bacula 1.36.3 and earlier allows local users to modify or read sensitive files via symlink attacks on (1) the temporary file used by autoconf/randpass when openssl is not available, or (2) the mtx.[PID] temporary file in mtx-changer.in.


definition_id: oval:org.debian:def:235257731797866903193270250052444859822
title: CVE-2005-3011 texinfo
description:
The sort_offline function for texindex in texinfo 4.8 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:20880259753617398667675180597981551694
title: CVE-2005-3068 eric
description:
Unspecified vulnerability in Eric Integrated Development Environment (eric3) before 3.7.2 has unknown impact and attack vectors related to a "potential security exploit."


definition_id: oval:org.debian:def:211761631999639343105417376382926142591
title: CVE-2005-3069 hylafax
description:
xferfaxstats in HylaFax 4.2.1 and earlier allows local users to overwrite arbitrary files via a symlink attack on the xferfax$$ temporary file.


definition_id: oval:org.debian:def:116474382984068460805339558514101895514
title: CVE-2005-3070 hylafax
description:
HylaFax 4.2.1 and earlier does not create or verify ownership of the UNIX domain socket, which might allow local users to read faxes and cause a denial of service by creating the socket using the hyla.unix temporary file.


definition_id: oval:org.debian:def:89378709102937778218404146835512049628
title: CVE-2005-3088 fetchmail
description:
fetchmailconf before 1.49 in fetchmail 6.2.0, 6.2.5 and 6.2.5.2 creates configuration files with insecure world-readable permissions, which allows local users to obtain sensitive information such as passwords.


definition_id: oval:org.debian:def:12709531815378507177558604404577772775
title: CVE-2005-3111 backupninja
description:
The handler code for backupninja 0.8 and earlier creates temporary files with predictable filenames, which allows local users to modify arbitrary files via a symlink attack.


definition_id: oval:org.debian:def:110590043196428252443451810470070871431
title: CVE-2005-3118 mason
description:
Mason before 1.0.0 does not install the init script after the user uses Mason to configure a firewall, which causes the system to run without a firewall after a reboot.


definition_id: oval:org.debian:def:316946340087276972496872048642028404602
title: CVE-2005-3120 lynx
description:
Stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP servers to execute arbitrary code via certain article headers containing Asian characters that cause Lynx to add extra escape (ESC) characters.


definition_id: oval:org.debian:def:151708947650652891009525495381158247460
title: CVE-2005-3121 module-assistant
description:
A rule file in module-assistant before 0.9.10 causes a temporary file to be created insecurely, which allows local users to conduct unauthorized operations.


definition_id: oval:org.debian:def:246717455336192309026564765072299134347
title: CVE-2005-3126 antiword
description:
The (1) kantiword (kantiword.sh) and (2) gantiword (gantiword.sh) scripts in antiword 0.35 and earlier allow local users to overwrite arbitrary files via a symlink attack on temporary (a) output and (b) error files.


definition_id: oval:org.debian:def:281784179684705650861435340211795706369
title: CVE-2005-3146 storebackup
description:
StoreBackup before 1.19 allows local users to perform unauthorized operations on arbitrary files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:88359922929574750497826580906800119169
title: CVE-2005-3147 storebackup
description:
StoreBackup before 1.19 creates the backup root with world-readable permissions, which allows local users to obtain sensitive information.


definition_id: oval:org.debian:def:224047396584619728451729275529489077874
title: CVE-2005-3148 storebackup
description:
StoreBackup before 1.19 does not properly set the uid and guid for symbolic links (1) that are backed up by storeBackup.pl, or (2) recovered by storeBackupRecover.pl, which could cause files to be restored with incorrect ownership.


definition_id: oval:org.debian:def:132394739999914204811409362691094992609
title: CVE-2005-3149 uim
description:
Uim 0.4.x before 0.4.9.1 and 0.5.0 and earlier does not properly handle the LIBUIM_VANILLA environment variable when a suid or sgid application is linked to libuim, such as immodule for Qt, which allows local users to gain privileges.


definition_id: oval:org.debian:def:334666751004015521838284283823831238667
title: CVE-2005-3150 weex
description:
Format string vulnerability in the Log_Flush function in Weex 2.6.1.5, 2.6.1, and possibly other versions allows remote FTP servers to execute arbitrary code via format strings in filenames.


definition_id: oval:org.debian:def:300279509817673969457779309047117810191
title: CVE-2005-3163 polipo
description:
Unspecified vulnerability in Polipo 0.9.8 and earlier allows attackers to read files outside of the web root.


definition_id: oval:org.debian:def:46960142166041863967893723875259389746
title: CVE-2005-3165 mediawiki
description:
Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.4.9 allow remote attackers to inject arbitrary web script or HTML via (1) <math> tags or (2) Extension or <nowiki> sections that "bypass HTML style attribute restrictions" that are intended to protect against XSS vulnerabilities in Internet Explorer clients.


definition_id: oval:org.debian:def:26403824939895978501966128664123281198
title: CVE-2005-3166 mediawiki
description:
Unspecified vulnerability in "edit submission handling" for MediaWiki 1.4.x before 1.4.10 and 1.3.x before 1.3.16 allows remote attackers to cause a denial of service (corruption of the previous submission) via a crafted URL.


definition_id: oval:org.debian:def:2070638681971419408356329782538911042
title: CVE-2005-3167 mediawiki
description:
Incomplete blacklist vulnerability in MediaWiki before 1.4.11 does not properly remove certain CSS inputs (HTML inline style attributes) that are processed as active content by Internet Explorer, which allows remote attackers to conduct cross-site scripting (XSS) attacks.


definition_id: oval:org.debian:def:336420039017745632816177485327906706221
title: CVE-2005-3178 xli
description:
Buffer overflow in xloadimage 4.1 and earlier, and xli, might allow user-assisted attackers to execute arbitrary code via a long title name in a NIFF file, which triggers the overflow during (1) zoom, (2) reduce, or (3) rotate operations.


definition_id: oval:org.debian:def:126251673281282234409421425487312869694
title: CVE-2005-3185 curl
description:
Stack-based buffer overflow in the ntlm_output function in http-ntlm.c for (1) wget 1.10, (2) curl 7.13.2, and (3) libcurl 7.13.2, and other products that use libcurl, when NTLM authentication is enabled, allows remote servers to execute arbitrary code via a long NTLM username.


definition_id: oval:org.debian:def:310406045799199948805432096623040692227
title: CVE-2005-3186 gdk-pixbuf
description:
Integer overflow in the GTK+ gdk-pixbuf XPM image rendering library in GTK+ 2.4.0 allows attackers to execute arbitrary code via an XPM file with a number of colors that causes insufficient memory to be allocated, which leads to a heap-based buffer overflow.


definition_id: oval:org.debian:def:311059173510238043085661990335707170857
title: CVE-2005-3191 cups
description:
Multiple heap-based buffer overflows in the (1) DCTStream::readProgressiveSOF and (2) DCTStream::readBaselineSOF functions in the DCT stream parsing code (Stream.cc) in xpdf 3.01 and earlier, as used in products such as (a) Poppler, (b) teTeX, (c) KDE kpdf, (d) pdftohtml, (e) KOffice KWord, (f) CUPS, and (g) libextractor allow user-assisted attackers to cause a denial of service (heap corruption) and possibly execute arbitrary code via a crafted PDF file with an out-of-range number of components (numComps), which is used as an array index.


definition_id: oval:org.debian:def:7109422271764451822853063946579656354
title: CVE-2005-3192 cups
description:
Heap-based buffer overflow in the StreamPredictor function in Xpdf 3.01, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, and (4) pdftohtml, (5) KOffice KWord, (6) CUPS, and (7) libextractor allows remote attackers to execute arbitrary code via a PDF file with an out-of-range numComps (number of components) field.


definition_id: oval:org.debian:def:264567871639404622132661269647695609431
title: CVE-2005-3193 cups
description:
Heap-based buffer overflow in the JPXStream::readCodestream function in the JPX stream parsing code (JPXStream.c) for xpdf 3.01 and earlier, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, (4) CUPS, and (5) libextractor allows user-assisted attackers to cause a denial of service (heap corruption) and possibly execute arbitrary code via a crafted PDF file with large size values that cause insufficient memory to be allocated.


definition_id: oval:org.debian:def:15681755394164856348398034396890047574
title: CVE-2005-3239 clamav
description:
The OLE2 unpacker in clamd in Clam AntiVirus (ClamAV) 0.87-1 allows remote attackers to cause a denial of service (segmentation fault) via a DOC file with an invalid property tree, which triggers an infinite recursion in the ole2_walk_property_tree function.


definition_id: oval:org.debian:def:169129565597889915981045231679168111981
title: CVE-2005-3256 enigmail
description:
The key selection dialogue in Enigmail before 0.92.1 can incorrectly select a key with a user ID that does not have additional information, which allows parties with that key to decrypt the message.


definition_id: oval:org.debian:def:267413642600603782147164798083589293187
title: CVE-2005-3302 blender
description:
Eval injection vulnerability in bvh_import.py in Blender 2.36 allows attackers to execute arbitrary Python code via a hierarchy element in a .bvh file, which is supplied to an eval function call.


definition_id: oval:org.debian:def:56663424870524675380830857445226050082
title: CVE-2005-3303 clamav
description:
The FSG unpacker (fsg.c) in Clam AntiVirus (ClamAV) 0.80 through 0.87 allows remote attackers to cause "memory corruption" and execute arbitrary code via a crafted FSG 1.33 file.


definition_id: oval:org.debian:def:257405461617261379135824874553644722454
title: CVE-2005-3318 chmlib
description:
Buffer overflow in the _chm_decompress_block function in CHM lib (chmlib) before 0.37, as used in products such as KchmViewer, allows attackers to execute arbitrary code, a different vulnerability than CVE-2005-2930.


definition_id: oval:org.debian:def:12759049896773977293703538451500548395
title: CVE-2005-3331 mgdiff
description:
viewpatch in mgdiff 1.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files.


definition_id: oval:org.debian:def:17977883743294214793407239770399837867
title: CVE-2005-3340 tuxpaint
description:
The tuxpaint-import.sh script in Tux Paint (tuxpaint) 0.9.14 and earlier creates temporary files insecurely, with unknown impact and attack vectors.


definition_id: oval:org.debian:def:90616970243800801227314442690655180217
title: CVE-2005-3341 dhis-tools-dns
description:
DHIS tools DNS package (dhis-tools-dns) before 5.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files created by (1) register-q.sh and (2) register-p.sh.


definition_id: oval:org.debian:def:304462670648421846915315273875381243978
title: CVE-2005-3342 noweb
description:
noweb 2.10c and earlier allows local users to overwrite arbitrary files via symlink attacks on temporary files in (1) lib/toascii.nw and (2) shell/roff.mm.


definition_id: oval:org.debian:def:164926016023918490091098802066898379673
title: CVE-2005-3350 giflib
description:
libungif library before 4.1.0 allows attackers to corrupt memory and possibly execute arbitrary code via a crafted GIF file that leads to an out-of-bounds write.


definition_id: oval:org.debian:def:173697419704608881771870642312002194857
title: CVE-2005-3351 spamassassin
description:
SpamAssassin 3.0.4 allows attackers to bypass spam detection via an e-mail with a large number of recipients ("To" addresses), which triggers a bus error in Perl.


definition_id: oval:org.debian:def:89951174772453344003401095791178806860
title: CVE-2005-3352 apache2
description:
Cross-site scripting (XSS) vulnerability in the mod_imap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps.


definition_id: oval:org.debian:def:151088155225213884239746130799194168753
title: CVE-2005-3354 sylpheed
description:
Stack-based buffer overflow in the ldif_get_line function in ldif.c of Sylpheed before 2.1.6 allows user-assisted attackers to execute arbitrary code by having local users import LDIF files with long lines.


definition_id: oval:org.debian:def:281824662280583148874327090014532453937
title: CVE-2005-3357 apache2
description:
mod_ssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with access control and a custom error 400 error page, allows remote attackers to cause a denial of service (application crash) via a non-SSL request to an SSL port, which triggers a NULL pointer dereference.


definition_id: oval:org.debian:def:35298846362045598883807854791796285609
title: CVE-2005-3393 openvpn
description:
Format string vulnerability in the foreign_option function in options.c for OpenVPN 2.0.x allows remote clients to execute arbitrary code via format string specifiers in a push of the dhcp-option command option.


definition_id: oval:org.debian:def:173821837580501483910203893739270769810
title: CVE-2005-3409 openvpn
description:
OpenVPN 2.x before 2.0.4, when running in TCP mode, allows remote attackers to cause a denial of service (segmentation fault) by forcing the accept function call to return an error status, which leads to a null dereference in an exception handler.


definition_id: oval:org.debian:def:127880283624460831099994774078515967547
title: CVE-2005-3486 scorched3d
description:
Multiple format string vulnerabilities in Scorched 3D 39.1 (bf) and earlier allow remote attackers to execute arbitrary code via various (1) GLConsole::addLine, (2) ServerCommon::sendString, (3) ServerCommon::serverLog functions, and possibly other unspecified vectors.


definition_id: oval:org.debian:def:8266259174426850036355426705239745337
title: CVE-2005-3487 scorched3d
description:
Multiple buffer overflows in Scorched 3D 39.1 (bf) and earlier allow remote attackers to execute arbitrary code via various (1) GLConsole::addLine, (2) ServerCommon::sendString, (3) ServerCommon::serverLog functions, (4) a long command that is not properly handled in ComsMessageHandler.cpp when generating an error message, (5) a long UniqueID value in Logger.cpp, and possibly other unspecified vectors.


definition_id: oval:org.debian:def:269057845889871002743836624524985902065
title: CVE-2005-3488 scorched3d
description:
Scorched 3D 39.1 (bf) and earlier allows remote attackers to cause a denial of service (long loop and server hang) via a negative numplayers value that bypasses a signed check in ServerConnectHandler.cpp.


definition_id: oval:org.debian:def:197158027779359983973509182482461541895
title: CVE-2005-3500 clamav
description:
The tnef_attachment function in tnef.c for Clam AntiVirus (ClamAV) before 0.87.1 allows remote attackers to cause a denial of service (infinite loop and memory exhaustion) via a crafted value in a CAB file that causes ClamAV to repeatedly scan the same block.


definition_id: oval:org.debian:def:120113729199276408673790167494333301441
title: CVE-2005-3501 clamav
description:
The cabd_find function in cabd.c of the libmspack library (mspack) for Clam AntiVirus (ClamAV) before 0.87.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted CAB file that causes cabd_find to be called with a zero length.


definition_id: oval:org.debian:def:40259820727465576165578013449112461658
title: CVE-2005-3531 fuse
description:
fusermount in FUSE before 2.4.1, if installed setuid root, allows local users to corrupt /etc/mtab and possibly modify mount options by performing a mount over a directory whose name contains certain special characters.


definition_id: oval:org.debian:def:163625288571964577010714530147482067252
title: CVE-2005-3532 courier
description:
authpam.c in courier-authdaemon for Courier Mail Server 0.37.3 through 0.52.1, when using pam_tally, does not call the pam_acct_mgmt function to verify that access should be granted, which allows attackers to authenticate to the server using accounts that have been disabled.


definition_id: oval:org.debian:def:288972312171693502915829040343220913612
title: CVE-2005-3534 nbd
description:
Buffer overflow in the Network Block Device (nbd) server 2.7.5 and earlier, and 2.8.0 through 2.8.2, allows remote attackers to execute arbitrary code via a large request, which is written past the end of the buffer because nbd does not account for memory taken by the reply header.


definition_id: oval:org.debian:def:91503430851969144075287344443523203216
title: CVE-2005-3538 hylafax
description:
hfaxd in HylaFAX 4.2.3, when PAM support is disabled, accepts arbitrary passwords, which allows remote attackers to gain privileges.


definition_id: oval:org.debian:def:120425676586587889162245030176299236815
title: CVE-2005-3539 hylafax
description:
Multiple eval injection vulnerabilities in HylaFAX 4.2.3 and earlier allow remote attackers to execute arbitrary commands via (1) the notify script in HylaFAX 4.2.0 to 4.2.3 and (2) crafted CallID parameters to the faxrcvd script in HylaFAX 4.2.2 and 4.2.3.


definition_id: oval:org.debian:def:170602400907070841581497701261161950512
title: CVE-2005-3540 petris
description:
Buffer overflow in petris before 1.0.1 allows remote attackers to execute arbitrary code via unspecified attack vectors.


definition_id: oval:org.debian:def:266844217036553546105916386498027896312
title: CVE-2005-3559 asterisk
description:
Directory traversal vulnerability in vmail.cgi in Asterisk 1.0.9 through 1.2.0-beta1 allows remote attackers to access WAV files via a .. (dot dot) in the folder parameter.


definition_id: oval:org.debian:def:239479403134616054078220530331508445348
title: CVE-2005-3573 mailman
description:
Scrubber.py in Mailman 2.1.5-8 does not properly handle UTF8 character encodings in filenames of e-mail attachments, which allows remote attackers to cause a denial of service (application crash).


definition_id: oval:org.debian:def:47734025270650574256242851145693254205
title: CVE-2005-3587 clamav
description:
Improper boundary checks in petite.c in Clam AntiVirus (ClamAV) before 0.87.1 allows attackers to perform unknown attacks via unknown vectors.


definition_id: oval:org.debian:def:167342599825097643046824500363792387448
title: CVE-2005-3590 glibc
description:
The getgrouplist function in the GNU C library (glibc) before version 2.3.5, when invoked with a zero argument, writes to the passed pointer even if the specified array size is zero, leading to a buffer overflow and potentially allowing attackers to corrupt memory.


definition_id: oval:org.debian:def:15283543661343377724223198599481354563
title: CVE-2005-3624 cups
description:
The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to corrupt the heap via negative or large integers in a CCITTFaxDecode stream, which lead to integer overflows and integer underflows.


definition_id: oval:org.debian:def:277635818775926825037040248719531308329
title: CVE-2005-3625 cups
description:
Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (infinite loop) via streams that end prematurely, as demonstrated using the (1) CCITTFaxDecode and (2) DCTDecode streams, aka "Infinite CPU spins."


definition_id: oval:org.debian:def:22504414929513032904157681423499416382
title: CVE-2005-3626 cups
description:
Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (crash) via a crafted FlateDecode stream that triggers a null dereference.


definition_id: oval:org.debian:def:65637405786523894073420966206943875970
title: CVE-2005-3627 cups
description:
Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to modify memory and possibly execute arbitrary code via a DCTDecode stream with (1) a large "number of components" value that is not checked by DCTStream::readBaselineSOF or DCTStream::readProgressiveSOF, (2) a large "Huffman table index" value that is not checked by DCTStream::readHuffmanTables, and (3) certain uses of the scanInfo.numComps value by DCTStream::readScanInfo.


definition_id: oval:org.debian:def:289221108066422027980680930762997665756
title: CVE-2005-3628 cups
description:
Buffer overflow in the JBIG2Bitmap::JBIG2Bitmap function in JBIG2Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to modify memory and possibly execute arbitrary code via unknown attack vectors.


definition_id: oval:org.debian:def:236258364516638301121634287628310380400
title: CVE-2005-3632 netpbm-free
description:
Multiple buffer overflows in pnmtopng in netpbm 10.0 and earlier allow attackers to execute arbitrary code via a crafted PNM file.


definition_id: oval:org.debian:def:202441824100605763112902748048397679316
title: CVE-2005-3656 libapache2-mod-auth-pgsql
description:
Multiple format string vulnerabilities in logging functions in mod_auth_pgsql before 2.0.3, when used for user authentication against a PostgreSQL database, allows remote unauthenticated attackers to execute arbitrary code, as demonstrated via the username.


definition_id: oval:org.debian:def:177427728825187474010721790579661586355
title: CVE-2005-3662 netpbm-free
description:
Off-by-one buffer overflow in pnmtopng before 2.39, when using the -alpha command line option (Alphas_Of_Color), allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PNM file with exactly 256 colors.


definition_id: oval:org.debian:def:164745311125808336779371381248122906635
title: CVE-2005-3737 inkscape
description:
Buffer overflow in the SVG importer (style.cpp) of inkscape 0.41 through 0.42.2 might allow remote attackers to execute arbitrary code via a SVG file with long CSS style property values.


definition_id: oval:org.debian:def:59514535789891047263265446276135283830
title: CVE-2005-3856 krusader
description:
The Popular URL capability (popularurls.cpp) in Krusader 1.60.0 and 1.70.0-beta1 saves passwords in cleartext in the krusaderrc file when the user enters URLs containing passwords in the panel URL field, which might allow attackers to access other sites.


definition_id: oval:org.debian:def:256070817003248956909629335819743787341
title: CVE-2005-3862 unalz
description:
Buffer overflow in unalz before 0.53 allows remote attackers to execute arbitrary code via long file names in ALZ archives.


definition_id: oval:org.debian:def:327118361702574374717358000831485103454
title: CVE-2005-3885 inkscape
description:
The ps2epsi extension shell script (ps2epsi.sh) in Inkscape before 0.41 allows local users to overwrite arbitrary files via a symlink attack on the tmpepsifile.epsi temporary file.


definition_id: oval:org.debian:def:75744659726990582969884610301691687975
title: CVE-2005-3962 perl
description:
Integer overflow in the format string functionality (Perl_sv_vcatpvfn) in Perl 5.9.2 and 5.8.6 Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via format string specifiers with large values, which causes an integer wrap and leads to a buffer overflow, as demonstrated using format string vulnerabilities in Perl applications.


definition_id: oval:org.debian:def:132858853053632572746909112304027318582
title: CVE-2005-3980 trac
description:
SQL injection vulnerability in the ticket query module in Edgewall Trac 0.9 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the group parameter.


definition_id: oval:org.debian:def:281002855582129498879647787078816755820
title: CVE-2005-4048 ffmpeg
description:
Heap-based buffer overflow in the avcodec_default_get_buffer function (utils.c) in FFmpeg libavcodec 0.4.9-pre1 and earlier, as used in products such as (1) mplayer, (2) xine-lib, (3) Xmovie, and (4) GStreamer, allows remote attackers to execute arbitrary commands via small PNG images with palettes.


definition_id: oval:org.debian:def:307105905181174525941408720433100117706
title: CVE-2005-4065 trac
description:
SQL injection vulnerability in the search module in Edgewall Trac before 0.9.2 allows remote attackers to execute arbitrary SQL commands via unknown vectors.


definition_id: oval:org.debian:def:316091454720803056932540539280247620203
title: CVE-2005-4077 curl
description:
Multiple off-by-one errors in the cURL library (libcurl) 7.11.2 through 7.15.0 allow local users to trigger a buffer overflow and cause a denial of service or bypass PHP security restrictions via certain URLs that (1) are malformed in a way that prevents a terminating null byte from being added to either a hostname or path buffer, or (2) contain a "?"  separator in the hostname portion, which causes a "/" to be prepended to the resulting string.


definition_id: oval:org.debian:def:239708672060985225340315539337047958847
title: CVE-2005-4153 mailman
description:
Mailman 2.1.4 through 2.1.6 allows remote attackers to cause a denial of service via a message that causes the server to "fail with an Overflow on bad date data in a processed message," a different vulnerability than CVE-2005-3573.


definition_id: oval:org.debian:def:13980325520240655790858201929941687523
title: CVE-2005-4158 sudo
description:
Sudo before 1.6.8 p12, when the Perl taint flag is off, does not clear the (1) PERLLIB, (2) PERL5LIB, and (3) PERL5OPT environment variables, which allows limited local users to cause a Perl script to include and execute arbitrary library files that have the same name as library files that are included by the script.


definition_id: oval:org.debian:def:20574060125728672537733643694149221518
title: CVE-2005-4178 dropbear
description:
Buffer overflow in Dropbear server before 0.47 allows authenticated users to execute arbitrary code via unspecified inputs that cause insufficient memory to be allocated due to an incorrect expression that does not enforce the proper order of operations.


definition_id: oval:org.debian:def:194423631407818353968990803305527081273
title: CVE-2005-4268 cpio
description:
Buffer overflow in cpio 2.6-8.FC4 on 64-bit platforms, when creating a cpio archive, allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a file whose size is represented by more than 8 digits.


definition_id: oval:org.debian:def:288833363529521683092187760906013029692
title: CVE-2005-4305 trac
description:
Cross-site scripting (XSS) vulnerability in Edgewall Trac 0.9, 0.9.1, and 0.9.2 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly sanitized before it is returned in an error page.


definition_id: oval:org.debian:def:54410980568412955646267112041468750245
title: CVE-2005-4347 util-vserver
description:
The Linux 2.4 kernel patch in kernel-patch-vserver before 1.9.5.5 and 2.x before 2.3 for Debian GNU/Linux does not correctly set the "chroot barrier" with util-vserver, which allows attackers to access files on the host system that are outside of the vserver.


definition_id: oval:org.debian:def:2719528463187111494025563089604304581
title: CVE-2005-4348 fetchmail
description:
fetchmail before 6.3.1 and before 6.2.5.5, when configured for multidrop mode, allows remote attackers to cause a denial of service (application crash) by sending messages without headers from upstream mail servers.


definition_id: oval:org.debian:def:7535968627288836936146037130298625568
title: CVE-2005-4418 util-vserver
description:
util-vserver before 0.30.208-1 with kernel-patch-vserver before 1.9.5.5 and 2.x before 2.3 for Debian GNU/Linux sets a default policy that trusts unknown capabilities, which could allow local users to conduct unauthorized activities.


definition_id: oval:org.debian:def:176095474886755270794723792292399350346
title: CVE-2005-4463 wordpress
description:
WordPress before 1.5.2 allows remote attackers to obtain sensitive information via a direct request to (1) wp-includes/vars.php, (2) wp-content/plugins/hello.php, (3) wp-admin/upgrade-functions.php, (4) wp-admin/edit-form.php, (5) wp-settings.php, and (6) wp-admin/edit-form-comment.php, which leaks the path in an error message related to undefined functions or failed includes.  NOTE: the wp-admin/menu-header.php vector is already covered by CVE-2005-2110. NOTE: the vars.php, edit-form.php, wp-settings.php, and edit-form-comment.php vectors were also reported to affect WordPress 2.0.1.


definition_id: oval:org.debian:def:316910918611705611642290322077490194251
title: CVE-2005-4470 blender
description:
Heap-based buffer overflow in the get_bhead function in readfile.c in Blender BlenLoader 2.0 through 2.40pre allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a .blend file with a negative bhead.len value, which causes less memory to be allocated than expected, possibly due to an integer overflow.


definition_id: oval:org.debian:def:183953912607779846818885439778703698116
title: CVE-2005-4494 spip
description:
Cross-site scripting (XSS) vulnerability in SPIP 1.8.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) spip_login.php3 and (2) spip_pass.php3.


definition_id: oval:org.debian:def:327075616344795508216296200519181236815
title: CVE-2005-4501 mediawiki
description:
MediaWiki before 1.5.4 uses a hard-coded "internal placeholder string", which allows remote attackers to bypass protection against cross-site scripting (XSS) attacks and execute Javascript using inline style attributes, which are processed by Internet Explorer.


definition_id: oval:org.debian:def:92837100041772142433340184757035708717
title: CVE-2005-4584 bzflag
description:
BZFlag server 2.0.4 and earlier allows remote attackers to cause a denial of service (application crash) via a callsign that is not followed by a NULL (\0) character.


definition_id: oval:org.debian:def:261263749232526122180554761988048555890
title: CVE-2005-4591 bogofilter
description:
Heap-based buffer overflow in bogofilter 0.96.2, 0.95.2, 0.94.14, 0.94.12, and other versions from 0.93.5 to 0.96.2, when using Unicode databases, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via "invalid input sequences" that lead to heap corruption when bogofilter or bogolexer converts character sets.


definition_id: oval:org.debian:def:157889736181760665724920710152686747646
title: CVE-2005-4592 bogofilter
description:
Heap-based buffer overflow in bogofilter and bogolexer 0.96.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via words that are longer than the input buffer used by flex.


definition_id: oval:org.debian:def:159457186863158331731235012085832213861
title: CVE-2005-4600 wordpress
description:
Directory traversal vulnerability in tiny_mce_gzip.php in TinyMCE Compressor PHP before 1.06 allows remote attackers to read or include arbitrary files via a trailing null byte (%00) in the (1) theme, (2) language, (3) plugins, or (4) lang parameter.


definition_id: oval:org.debian:def:154396678835811215113314848116385793085
title: CVE-2005-4601 graphicsmagick
description:
The delegate code in ImageMagick 6.2.4.5-0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in a filename that is processed by the display command.


definition_id: oval:org.debian:def:7889807877839997071902830462025099167
title: CVE-2005-4644 trac
description:
Cross-site scripting (XSS) vulnerability in the HTML WikiProcessor in Edgewall Trac 0.9.2 allows remote attackers to inject arbitrary web script or HTML via javascript in the SRC attribute of an IMG tag.


definition_id: oval:org.debian:def:142351468353277899628823934517836006827
title: CVE-2005-4667 unzip
description:
Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument.  NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.


definition_id: oval:org.debian:def:269029656171637089114616197170505794278
title: CVE-2005-4676 exiv2
description:
Buffer overflow in Andreas Huggel Exiv2 before 0.9 does not null terminate strings before calling the sscanf function, which allows remote attackers to cause a denial of service (application crash) via images with crafted IPTC metadata.


definition_id: oval:org.debian:def:14407295582504932134180131782642848789
title: CVE-2005-4683 migrationtools
description:
PADL MigrationTools 46, when a failure occurs, stores contents of /etc/shadow in a world-readable /tmp/nis.$$.ldif file, and possibly other sensitive information in other temporary files, which are not properly managed by (1) migrate_all_online.sh, (2) migrate_all_offline.sh, (3) migrate_all_netinfo_online.sh, (4) migrate_all_netinfo_offline.sh, (5) migrate_all_nis_online.sh, (6) migrate_all_nis_offline.sh, (7) migrate_all_nisplus_online.sh, and (8) migrate_all_nisplus_offline.sh.


definition_id: oval:org.debian:def:127919637379012162291968964870077721673
title: CVE-2005-4713 pam-mysql
description:
Unspecified vulnerability in the SQL logging facility in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3 allows remote attackers to cause a denial of service (segmentation fault) via unspecified vectors, probably involving the pam_mysql_sql_log function when being used in vsftpd, which does not include the IP address argument to an sprintf call.


definition_id: oval:org.debian:def:119536180227313682718122655516879622609
title: CVE-2005-4744 freeradius
description:
Off-by-one error in the sql_error function in sql_unixodbc.c in FreeRADIUS 1.0.2.5-5, and possibly other versions including 1.0.4, might allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by causing the external database query to fail.  NOTE: this single issue is part of a larger-scale disclosure, originally by SUSE, which reported multiple issues that were disputed by FreeRADIUS.  Disputed issues included file descriptor leaks, memory disclosure, LDAP injection, and other issues.  Without additional information, the most recent FreeRADIUS report is being regarded as the authoritative source for this CVE identifier.


definition_id: oval:org.debian:def:339282782081832769086953300972013218535
title: CVE-2005-4745 freeradius
description:
SQL injection vulnerability in the rlm_sqlcounter module in FreeRADIUS 1.0.3 and 1.0.4 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.


definition_id: oval:org.debian:def:12974712261182863056743547372288250219
title: CVE-2005-4746 freeradius
description:
Multiple buffer overflows in FreeRADIUS 1.0.3 and 1.0.4 allow remote attackers to cause denial of service (crash) via (1) the rlm_sqlcounter module or (2) unknown vectors "while expanding %t".


definition_id: oval:org.debian:def:63824813783653186759386259450048533687
title: CVE-2005-4791 beagle
description:
Multiple untrusted search path vulnerabilities in SUSE Linux 10.0 cause the working directory to be added to LD_LIBRARY_PATH, which might allow local users to execute arbitrary code via (1) liferea or (2) banshee.


definition_id: oval:org.debian:def:216440133470985897972844651078905330416
title: CVE-2005-4802 flexbackup
description:
Flexbackup 1.2.1 and earlier allows local users to overwrite files and execute code via a symlink attack on temporary files.  NOTE: the raw source referenced an incorrect candidate number; this is the correct number to use.


definition_id: oval:org.debian:def:256853001907559392227133902031109237794
title: CVE-2005-4803 graphviz
description:
graphviz before 2.2.1 allows local users to overwrite arbitrary files via a symlink attack on temporary files.  NOTE: this issue was originally associated with a different CVE identifier, CVE-2005-2965, which had been used for multiple different issues.  This is the correct identifier.


definition_id: oval:org.debian:def:286981543975159055058456096459768438981
title: CVE-2005-4807 binutils
description:
Stack-based buffer overflow in the as_bad function in messages.c in the GNU as (gas) assembler in Free Software Foundation GNU Binutils before 20050721 allows attackers to execute arbitrary code via a .c file with crafted inline assembly code.


definition_id: oval:org.debian:def:187290522215274714544715382196827299094
title: CVE-2005-4808 binutils
description:
Buffer overflow in reset_vars in config/tc-crx.c in the GNU as (gas) assembler in Free Software Foundation GNU Binutils before 20050714 allows user-assisted attackers to have an unknown impact via a crafted .s file.


definition_id: oval:org.debian:def:156989091174348292496850377838293668258
title: CVE-2005-4816 proftpd-dfsg
description:
Buffer overflow in mod_radius in ProFTPD before 1.3.0rc2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long password.


definition_id: oval:org.debian:def:131434888311231902826521166821477339933
title: CVE-2005-4830 viewvc
description:
CRLF injection vulnerability in viewcvs in ViewCVS 0.9.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the content-type parameter.


definition_id: oval:org.debian:def:148232472074836822457978414263148101812
title: CVE-2005-4831 viewvc
description:
viewcvs in ViewCVS 0.9.2 allows remote attackers to set the Content-Type header to arbitrary values via the content-type parameter, which can be leveraged for cross-site scripting (XSS) and other attacks, as demonstrated using (1) "text/html", or (2) "image/jpeg" with an image that is rendered as HTML by Internet Explorer, a different vulnerability than CVE-2004-1062.  NOTE: it was later reported that 0.9.4 is also affected.


definition_id: oval:org.debian:def:20879680417167075391553191189645374901
title: CVE-2005-4837 net-snmp
description:
snmp_api.c in snmpd in Net-SNMP 5.2.x before 5.2.2, 5.1.x before 5.1.3, and 5.0.x before 5.0.10.2, when running in master agentx mode, allows remote attackers to cause a denial of service (crash) by causing a particular TCP disconnect, which triggers a free of an incorrect variable, a different vulnerability than CVE-2005-2177.


definition_id: oval:org.debian:def:27249493110690361298719598326659987827
title: CVE-2005-4872 pcre3
description:
Perl-Compatible Regular Expression (PCRE) library before 6.2 does not properly count the number of named capturing subpatterns, which allows context-dependent attackers to cause a denial of service (crash) via a regular expression with a large number of named subpatterns, which triggers a buffer overflow.  NOTE: this issue was originally subsumed by CVE-2006-7224, but that CVE has been REJECTED and split.


definition_id: oval:org.debian:def:42441536465364458384241168739159017533
title: CVE-2005-4873 cups
description:
Multiple stack-based buffer overflows in the phpcups PHP module for CUPS 1.1.23rc1 might allow context-dependent attackers to execute arbitrary code via vectors that result in long function parameters, as demonstrated by the cups_get_dest_options function in phpcups.c.


definition_id: oval:org.debian:def:274308776005229795993487488772765217530
title: CVE-2005-4889 rpm
description:
lib/fsm.c in RPM before 4.4.3 does not properly reset the metadata of an executable file during deletion of the file in an RPM package removal, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid or (2) setgid file, a related issue to CVE-2010-2059.


definition_id: oval:org.debian:def:17618377065616543690557752096376393131
title: CVE-2005-4890 shadow
description:
There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process.


definition_id: oval:org.debian:def:336077625328893495153678214147263371719
title: CVE-2005-4895 google-perftools
description:
Multiple integer overflows in TCMalloc (tcmalloc.cc) in gperftools before 0.4 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.


definition_id: oval:org.debian:def:326057585204673047325064084828494149774
title: CVE-2006-0040 evolution
description:
GNOME Evolution 2.4.2.1 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a text e-mail with a large number of URLs, possibly due to unknown problems in gtkhtml.


definition_id: oval:org.debian:def:127768706810415530497137297496239202508
title: CVE-2006-0042 libapreq2
description:
Unspecified vulnerability in (1) apreq_parse_headers and (2) apreq_parse_urlencoded functions in Apache2::Request (Libapreq2) before 2.07 allows remote attackers to cause a denial of service (CPU consumption) via unknown attack vectors that result in quadratic computational complexity.


definition_id: oval:org.debian:def:226396379293906327969366219246317520038
title: CVE-2006-0045 crawl
description:
crawl before 4.0.0 does not securely call programs when saving and loading games, which allows local users to gain privileges.


definition_id: oval:org.debian:def:107392994909913997902948136822613764829
title: CVE-2006-0047 freeciv
description:
packets.c in Freeciv 2.0 before 2.0.8 allows remote attackers to cause a denial of service (server crash) via crafted packets with negative compressed size values.


definition_id: oval:org.debian:def:11922025270579112497974619441610437033
title: CVE-2006-0048 tcpick
description:
Francesco Stablum tcpick 0.2.1 allows remote attackers to cause a denial of service (segmentation fault) via certain fragmented packets, possibly involving invalid headers and an attacker-controlled payload length.  NOTE: this issue might be a buffer overflow or overread.


definition_id: oval:org.debian:def:312281812855618466878781663767574858437
title: CVE-2006-0050 snmptrapfmt
description:
snmptrapfmt in Debian 3.0 allows local users to overwrite arbitrary files via a symlink attack on a temporary log file.


definition_id: oval:org.debian:def:65240373090984653892681298934617979479
title: CVE-2006-0051 kaffeine
description:
Buffer overflow in playlistimport.cpp in Kaffeine Player 0.4.2 through 0.7.1 allows user-assisted attackers to execute arbitrary code via long HTTP request headers when Kaffeine is "fetching remote playlists", which triggers the overflow in the http_peek function.


definition_id: oval:org.debian:def:76438549568733142057887248119025136129
title: CVE-2006-0052 mailman
description:
The attachment scrubber (Scrubber.py) in Mailman 2.1.5 and earlier, when using Python's library email module 2.5, allows remote attackers to cause a denial of service (mailing list delivery failure) via a multipart MIME message with a single part that has two blank lines between the first boundary and the end boundary.


definition_id: oval:org.debian:def:54658912662128103457525921405651313102
title: CVE-2006-0053 libimager-perl
description:
Imager (libimager-perl) before 0.50 allows user-assisted attackers to cause a denial of service (segmentation fault) by writing a 2- or 4-channel JPEG image (or a 2-channel TGA image) to a scalar, which triggers a NULL pointer dereference.


definition_id: oval:org.debian:def:124223437369364908823783149100918725387
title: CVE-2006-0056 pam-mysql
description:
Double free vulnerability in the authentication and authentication token alteration code in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted passwords, which lead to a double free of a pointer that was created by the pam_get_item function.  NOTE: this issue only occurs in certain configurations in which there are multiple PAM modules, PAM-MySQL is not evaluated first, and there are no requisite modules before PAM-MySQL.


definition_id: oval:org.debian:def:263781434239346999865657161778117621555
title: CVE-2006-0058 sendmail
description:
Signal handler race condition in Sendmail 8.13.x before 8.13.6 allows remote attackers to execute arbitrary code by triggering timeouts in a way that causes the setjmp and longjmp function calls to be interrupted and modify unexpected memory locations.


definition_id: oval:org.debian:def:169077097266146982996644799831131902636
title: CVE-2006-0082 imagemagick
description:
Format string vulnerability in the SetImageInfo function in image.c for ImageMagick 6.2.3 and other versions, and GraphicsMagick, allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a numeric format string specifier such as %d in the file name, a variant of CVE-2005-0397, and as demonstrated using the convert program.


definition_id: oval:org.debian:def:238193715920654648345108761413854886440
title: CVE-2006-0083 smstools
description:
Format string vulnerability in the logging code of SMS Server Tools (smstools) 1.14.8 and earlier allows local users to execute arbitrary code via unspecified attack vectors.


definition_id: oval:org.debian:def:294630005402583994664179107001271451804
title: CVE-2006-0106 wine
description:
gdi/driver.c and gdi/printdrv.c in Wine 20050930, and other versions, implement the SETABORTPROC GDI Escape function call for Windows Metafile (WMF) files, which allows attackers to execute arbitrary code, the same vulnerability as CVE-2005-4560 but in a different codebase.


definition_id: oval:org.debian:def:179692027133164882807539545345156866789
title: CVE-2006-0126 rxvt-unicode
description:
rxvt-unicode before 6.3, on certain platforms that use openpty and non-Unix pty devices such as Linux and most BSD platforms, does not maintain the intended permissions of tty devices, which allows local users to gain read and write access to the devices.


definition_id: oval:org.debian:def:259342576432809801207356971031811572652
title: CVE-2006-0146 cacti
description:
The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter.


definition_id: oval:org.debian:def:310281641646315170316986769389837064079
title: CVE-2006-0147 cacti
description:
Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PhpOpenChat, possibly (7) MAXdev MD-Pro, and (8) Simplog, allows remote attackers to execute arbitrary PHP functions via the do parameter, which is saved in a variable that is then executed as a function, as demonstrated using phpinfo.


definition_id: oval:org.debian:def:29075203360261647158909238823320163139
title: CVE-2006-0151 sudo
description:
sudo 1.6.8 and other versions does not clear the PYTHONINSPECT environment variable, which allows limited local users to gain privileges via a Python script, a variant of CVE-2005-4158.


definition_id: oval:org.debian:def:198725223811500799872181913131449357561
title: CVE-2006-0162 clamav
description:
Heap-based buffer overflow in libclamav/upx.c in Clam Antivirus (ClamAV) before 0.88 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted UPX files.


definition_id: oval:org.debian:def:317151803921955765942892441221070031638
title: CVE-2006-0224 libast
description:
Buffer overflow in Library of Assorted Spiffy Things (LibAST) 0.6.1 and earlier, as used in Eterm and possibly other software, allows local users to execute arbitrary code as the utmp user via a long -X command line argument (alternative configuration file name).


definition_id: oval:org.debian:def:172075533707604507363781690857882582097
title: CVE-2006-0225 dropbear
description:
scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice.


definition_id: oval:org.debian:def:214683479452568364613132043257255790731
title: CVE-2006-0292 thunderbird
description:
The Javascript interpreter (jsinterp.c) in Mozilla and Firefox before 1.5.1 does not properly dereference objects, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via unknown attack vectors related to garbage collection.


definition_id: oval:org.debian:def:317485013772251557263082942123027826247
title: CVE-2006-0294 thunderbird
description:
Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 allow remote attackers to execute arbitrary code by changing an element's style from position:relative to position:static, which causes Gecko to operate on freed memory.


definition_id: oval:org.debian:def:183060374564569154194378526710584147091
title: CVE-2006-0295 thunderbird
description:
Mozilla Firefox 1.5, Thunderbird 1.5 if Javascript is enabled in mail, and SeaMonkey before 1.0 might allow remote attackers to execute arbitrary code via the QueryInterface method of the built-in Location and Navigator objects, which leads to memory corruption.


definition_id: oval:org.debian:def:176613707196283938589657216225598669066
title: CVE-2006-0296 thunderbird
description:
The XULDocument.persist function in Mozilla, Firefox before 1.5.0.1, and SeaMonkey before 1.0 does not validate the attribute name, which allows remote attackers to execute arbitrary Javascript by injecting RDF data into the user's localstore.rdf file.


definition_id: oval:org.debian:def:198868949133482884239580739778671528098
title: CVE-2006-0297 thunderbird
description:
Multiple integer overflows in Mozilla Firefox 1.5, Thunderbird 1.5 if Javascript is enabled in mail, and SeaMonkey before 1.0 might allow remote attackers to execute arbitrary code via the (1) EscapeAttributeValue in jsxml.c for E4X, (2) nsSVGCairoSurface::Init in SVG, and (3) nsCanvasRenderingContext2D.cpp in Canvas.


definition_id: oval:org.debian:def:209223084843021754499314604398667161853
title: CVE-2006-0298 thunderbird
description:
The XML parser in Mozilla Firefox before 1.5.0.1 and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly read sensitive data via unknown attack vectors that trigger an out-of-bounds read.


definition_id: oval:org.debian:def:11155847838988815303464170370640876442
title: CVE-2006-0299 thunderbird
description:
The E4X implementation in Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 exposes the internal "AnyName" object to external interfaces, which allows multiple cooperating domains to exchange information in violation of the same origin restrictions.


definition_id: oval:org.debian:def:140063263083991179645253675019157786344
title: CVE-2006-0300 tar
description:
Buffer overflow in tar 1.14 through 1.15.90 allows user-assisted attackers to cause a denial of service (application crash) and possibly execute code via unspecified vectors involving PAX extended headers.


definition_id: oval:org.debian:def:222670697612805265393156457550745760668
title: CVE-2006-0301 libextractor
description:
Heap-based buffer overflow in Splash.cc in xpdf, as used in other products such as (1) poppler, (2) kdegraphics, (3) gpdf, (4) pdfkit.framework, and others, allows attackers to cause a denial of service and possibly execute arbitrary code via crafted splash images that produce certain values that exceed the width or height of the associated bitmap.


definition_id: oval:org.debian:def:236416195634561927862757211954147187289
title: CVE-2006-0321 fetchmail
description:
fetchmail 6.3.0 and other versions before 6.3.2 allows remote attackers to cause a denial of service (crash) via crafted e-mail messages that cause a free of an invalid pointer when fetchmail bounces the message to the originator or local postmaster.


definition_id: oval:org.debian:def:208282793214383785689084400284142509690
title: CVE-2006-0322 mediawiki
description:
Unspecified vulnerability the edit comment formatting functionality in MediaWiki 1.5.x before 1.5.6 and 1.4.x before 1.4.14 allows attackers to cause a denial of service (infinite loop) via "certain malformed links."


definition_id: oval:org.debian:def:260176755055664306842441763696609560395
title: CVE-2006-0353 lsh-utils
description:
unix_random.c in lshd for lsh 2.0.1 leaks file descriptors related to the randomness generator, which allows local users to cause a denial of service by truncating the seed file, which prevents the server from starting, or obtain sensitive seed information that could be used to crack keys.


definition_id: oval:org.debian:def:153061194622522129809880792467905005880
title: CVE-2006-0402 zoph
description:
SQL injection vulnerability in Zoph before 0.5pre1 allows remote attackers to execute arbitrary SQL commands.


definition_id: oval:org.debian:def:70530398775992492766090070699033792825
title: CVE-2006-0405 tiff
description:
The TIFFFetchShortPair function in tif_dirread.c in libtiff 3.8.0 allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image that triggers a NULL pointer dereference, possibly due to changes in type declarations and/or the TIFFVSetField function.


definition_id: oval:org.debian:def:1714257377820874167278470757313695374
title: CVE-2006-0410 cacti
description:
SQL injection vulnerability in ADOdb before 4.71, when using PostgreSQL, allows remote attackers to execute arbitrary SQL commands via unspecified attack vectors involving binary strings.


definition_id: oval:org.debian:def:27072365891862206697462564264355017294
title: CVE-2006-0414 tor
description:
Tor before 0.1.1.20 allows remote attackers to identify hidden services via a malicious Tor server that attempts a large number of accesses of the hidden service, which eventually causes a circuit to be built through the malicious server.


definition_id: oval:org.debian:def:45140719644215601327389164627700596746
title: CVE-2006-0459 flex
description:
flex.skl in Will Estes and John Millaway Fast Lexical Analyzer Generator (flex) before 2.5.33 does not allocate enough memory for grammars containing (1) REJECT statements or (2) trailing context rules, which causes flex to generate code that contains a buffer overflow that might allow context-dependent attackers to execute arbitrary code.


definition_id: oval:org.debian:def:38565379950317855946836301733324313643
title: CVE-2006-0460 bomberclone
description:
Multiple buffer overflows in BomberClone before 0.11.6.2 allow remote attackers to execute arbitrary code via long error messages.


definition_id: oval:org.debian:def:49303460616501810130443873943292517230
title: CVE-2006-0467 pioneers
description:
Unspecified vulnerability in Pioneers (formerly gnocatan) before 0.9.49 allows remote attackers to cause a denial of service (application crash) via long chat messages.


definition_id: oval:org.debian:def:141964285295613953114895391705991723685
title: CVE-2006-0512 migrationtools
description:
PADL MigrationTools 46 creates temporary files insecurely, which allows local users to overwrite arbitrary files via a symlink attack on the temporary files, which are not properly created by (1) migrate_all_online.sh, (2) migrate_all_offline.sh, (3) migrate_all_netinfo_online.sh, (4) migrate_all_netinfo_offline.sh, (5) migrate_all_nis_online.sh, (6) migrate_all_nis_offline.sh, (7) migrate_all_nisplus_online.sh, and (8) migrate_all_nisplus_offline.sh.


definition_id: oval:org.debian:def:316607862362313178816918534550006643868
title: CVE-2006-0517 spip
description:
Multiple SQL injection vulnerabilities in formulaires/inc-formulaire_forum.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id_forum, (2) id_article, or (3) id_breve parameters to forum.php3; (4) unspecified vectors related to "session handling"; and (5) when posting "petitions".


definition_id: oval:org.debian:def:264515415277190057874689446019343584321
title: CVE-2006-0518 spip
description:
Cross-site scripting (XSS) vulnerability in index.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allows remote attackers to inject arbitrary web script or HTML via the lang parameter.


definition_id: oval:org.debian:def:122857158482879333192907060659594129693
title: CVE-2006-0519 spip
description:
SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allows remote attackers to obtain sensitive information via a direct request to inc-messforum.php3, which reveals the path in an error message.


definition_id: oval:org.debian:def:212408625950390993902334565745932066947
title: CVE-2006-0528 evolution
description:
The cairo library (libcairo), as used in GNOME Evolution and possibly other products, allows remote attackers to cause a denial of service (persistent client crash) via an attached text file that contains "Content-Disposition: inline" in the header, and a very long line in the body, which causes the client to repeatedly crash until the e-mail message is manually removed, possibly due to a buffer overflow, as demonstrated using an XML attachment.


definition_id: oval:org.debian:def:237390215703567957188561675244870375979
title: CVE-2006-0582 heimdal
description:
Unspecified vulnerability in rshd in Heimdal 0.6.x before 0.6.6 and 0.7.x before 0.7.2, when storing forwarded credentials, allows attackers to overwrite arbitrary files and change file ownership via unknown vectors.


definition_id: oval:org.debian:def:329856106109151837513189472589041636709
title: CVE-2006-0625 spip
description:
Directory traversal vulnerability in Spip_RSS.PHP in SPIP 1.8.2g and earlier allows remote attackers to read or include arbitrary files via ".."  sequences in the GLOBALS[type_urls] parameter, which could then be used to execute arbitrary code via resultant direct static code injection in the file parameter to spip_acces_doc.php3.


definition_id: oval:org.debian:def:186995559924084594472420435238271155929
title: CVE-2006-0626 spip
description:
SQL injection vulnerability in spip_acces_doc.php3 in SPIP 1.8.2g and earlier allows remote attackers to execute arbitrary SQL commands via the file parameter.


definition_id: oval:org.debian:def:13697515420241679625317333863025180698
title: CVE-2006-0635 tcc
description:
Tiny C Compiler (TCC) 0.9.23 (aka TinyCC) evaluates the "i>sizeof(int)" expression to false when i equals -1, which might introduce integer overflow vulnerabilities into applications that could be exploited by context-dependent attackers.


definition_id: oval:org.debian:def:17626288171905726505793854507854076663
title: CVE-2006-0658 moin
description:
Incomplete blacklist vulnerability in connector.php in FCKeditor 2.0 and 2.2, as used in products such as RunCMS, allows remote attackers to upload and execute arbitrary script files by giving the files specific extensions that are not listed in the Config[DeniedExtensions][File], such as .php.txt.


definition_id: oval:org.debian:def:76307055818176118926963686801590159615
title: CVE-2006-0677 heimdal
description:
telnetd in Heimdal 0.6.x before 0.6.6 and 0.7.x before 0.7.2 allows remote unauthenticated attackers to cause a denial of service (server crash) via unknown vectors that trigger a null dereference.


definition_id: oval:org.debian:def:61214263195553193619816814764289170200
title: CVE-2006-0707 pyblosxom
description:
PyBlosxom before 1.3.2, when running on certain webservers, allows remote attackers to read arbitrary files via an HTTP request with multiple leading / (slash) characters, which is accessed using the PATH_INFO variable.


definition_id: oval:org.debian:def:273078057560515564328530090324556034917
title: CVE-2006-0730 dovecot
description:
Multiple unspecified vulnerabilities in Dovecot before 1.0beta3 allow remote attackers to cause a denial of service (application crash or hang) via unspecified vectors involving (1) "potential hangs" in the APPEND command and "potential crashes" in (2) dovecot-auth and (3) imap/pop3-login.  NOTE: vector 2 might be related to a double free vulnerability.


definition_id: oval:org.debian:def:156010418844690512897165498033537922985
title: CVE-2006-0745 xorg-server
description:
X.Org server (xorg-server) 1.0.0 and later, X11R6.9.0, and X11R7.0 inadvertently treats the address of the geteuid function as if it is the return value of a call to geteuid, which allows local users to bypass intended restrictions and (1) execute arbitrary code via the -modulepath command line option or (2) overwrite arbitrary files via -logfile.


definition_id: oval:org.debian:def:129718418129375087647133641582283883424
title: CVE-2006-0747 freetype
description:
Integer underflow in Freetype before 2.2 allows remote attackers to cause a denial of service (crash) via a font file with an odd number of blue values, which causes the underflow when decrementing by 2 in a context that assumes an even number of values.


definition_id: oval:org.debian:def:337757690318544566536978110156521599784
title: CVE-2006-0748 thunderbird
description:
Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via "an invalid and non-sensical ordering of table-related tags" that results in a negative array index.


definition_id: oval:org.debian:def:100641306738132623014021462635247551564
title: CVE-2006-0749 thunderbird
description:
nsHTMLContentSink.cpp in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors involving a "particular sequence of HTML tags" that leads to memory corruption.


definition_id: oval:org.debian:def:69321448524096079381564269682363978731
title: CVE-2006-0804 tin
description:
Off-by-one error in TIN 1.8.0 and earlier might allow attackers to execute arbitrary code via unknown vectors that trigger a buffer overflow.


definition_id: oval:org.debian:def:105098005729530257390494130862204565059
title: CVE-2006-0806 cacti
description:
Multiple cross-site scripting (XSS) vulnerabilities in ADOdb 4.71, as used in multiple packages such as phpESP, allow remote attackers to inject arbitrary web script or HTML via (1) the next_page parameter in adodb-pager.inc.php and (2) other unspecified vectors related to PHP_SELF.


definition_id: oval:org.debian:def:114976382776296774247955538463930202967
title: CVE-2006-0847 python-cherrypy
description:
Directory traversal vulnerability in the staticfilter component in CherryPy before 2.1.1 allows remote attackers to read arbitrary files via ".." sequences in unspecified vectors.


definition_id: oval:org.debian:def:50822029195811692955209621955337824421
title: CVE-2006-0883 openssh
description:
OpenSSH on FreeBSD 5.3 and 5.4, when used with OpenPAM, does not properly handle when a forked child process terminates during PAM authentication, which allows remote attackers to cause a denial of service (client connection refusal) by connecting multiple times to the SSH server, waiting for the password prompt, then disconnecting.


definition_id: oval:org.debian:def:54643460765139961058758348507562040698
title: CVE-2006-0884 thunderbird
description:
The WYSIWYG rendering engine ("rich mail" editor) in Mozilla Thunderbird 1.0.7 and earlier allows user-assisted attackers to bypass javascript security settings and obtain sensitive information or cause a crash via an e-mail containing a javascript URI in the SRC attribute of an IFRAME tag, which is executed when the user edits the e-mail.


definition_id: oval:org.debian:def:145470385864053221888265533421167977050
title: CVE-2006-0898 libcrypt-cbc-perl
description:
Crypt::CBC Perl module 2.16 and earlier, when running in RandomIV mode, uses an initialization vector (IV) of 8 bytes, which results in weaker encryption when used with a cipher that requires a larger block size than 8 bytes, such as Rijndael.


definition_id: oval:org.debian:def:194374299289202825041496242959359495172
title: CVE-2006-0950 unalz
description:
unalz 0.53 allows user-assisted attackers to overwrite arbitrary files via an ALZ archive with ".." (dot dot) sequences in a filename.


definition_id: oval:org.debian:def:222229587393893071183265825916046822102
title: CVE-2006-0985 wordpress
description:
Multiple cross-site scripting (XSS) vulnerabilities in the "post comment" functionality of WordPress 2.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) website, and (3) comment parameters.


definition_id: oval:org.debian:def:340124878908502854055349848794404453944
title: CVE-2006-0986 wordpress
description:
WordPress 2.0.1 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) default-filters.php, (2) template-loader.php, (3) rss-functions.php, (4) locale.php, (5) wp-db.php, and (6) kses.php in the wp-includes/ directory; and (7) edit-form-advanced.php, (8) admin-functions.php, (9) edit-link-form.php, (10) edit-page-form.php, (11) admin-footer.php, and (12) menu.php in the wp-admin directory; and possibly (13) list directory contents of the wp-includes directory.  NOTE: the vars.php, edit-form.php, wp-settings.php, and edit-form-comment.php vectors are already covered by CVE-2005-4463.  The menu-header.php vector is already covered by CVE-2005-2110.  Other vectors might be covered by CVE-2005-1688.  NOTE: if the typical installation of WordPress does not list any site-specific files to wp-includes, then vector [13] is not an exposure.


definition_id: oval:org.debian:def:316496156866025417007376639525204246500
title: CVE-2006-0987 bind9
description:
The default configuration of ISC BIND before 9.4.1-P1, when configured as a caching name server, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers to cause a denial of service (traffic amplification) via DNS queries with spoofed source IP addresses.


definition_id: oval:org.debian:def:39672874484231412433968740792423509932
title: CVE-2006-1010 crossfire
description:
Buffer overflow in socket/request.c in CrossFire before 1.9.0, when oldsocketmode is enabled, allows remote attackers to cause a denial of service (segmentation fault) and possibly execute code by sending the server a large request.


definition_id: oval:org.debian:def:30586162015038659108962885563374434274
title: CVE-2006-1012 wordpress
description:
SQL injection vulnerability in WordPress 1.5.2, and possibly other versions before 2.0, allows remote attackers to execute arbitrary SQL commands via the User-Agent field in an HTTP header for a comment.


definition_id: oval:org.debian:def:279474566922555184180440153749278078090
title: CVE-2006-1045 thunderbird
description:
The HTML rendering engine in Mozilla Thunderbird 1.5, when "Block loading of remote images in mail messages" is enabled, does not properly block external images from inline HTML attachments, which could allow remote attackers to obtain sensitive information, such as application version or IP address, when the user reads the email and the external image is accessed.


definition_id: oval:org.debian:def:93445883478765008574237850750657844724
title: CVE-2006-1046 monopd
description:
server.cpp in Monopd 0.9.3 allows remote attackers to cause a denial of service (CPU and memory consumption) via a string containing a large number of characters that are escaped when Monopd produces XML output.


definition_id: oval:org.debian:def:149835197332060924571007806705901878921
title: CVE-2006-1058 busybox
description:
BusyBox 1.1.1 does not use a salt when generating passwords, which makes it easier for local users to guess passwords from a stolen password file using techniques such as rainbow tables.


definition_id: oval:org.debian:def:302968001115322650751947766071746300494
title: CVE-2006-1059 samba
description:
The winbindd daemon in Samba 3.0.21 to 3.0.21c writes the machine trust account password in cleartext in log files, which allows local users to obtain the password and spoof the server in the domain.


definition_id: oval:org.debian:def:209889293747905496415796732055031002628
title: CVE-2006-1060 xzgv
description:
Heap-based buffer overflow in zgv before 5.8 and xzgv before 0.8 might allow user-assisted attackers to execute arbitrary code via a JPEG image with more than 3 output components, such as a CMYK or YCCK color space, which causes less memory to be allocated than required.


definition_id: oval:org.debian:def:319930725979731156952481165022209144326
title: CVE-2006-1061 curl
description:
Heap-based buffer overflow in cURL and libcURL 7.15.0 through 7.15.2 allows remote attackers to execute arbitrary commands via a TFTP URL (tftp://) with a valid hostname and a long path.


definition_id: oval:org.debian:def:63391526968204916762677085039573417833
title: CVE-2006-1062 lurker
description:
Unspecified vulnerability in lurker.cgi for Lurker 2.0 and earlier allows attackers to read arbitrary files via unknown vectors.


definition_id: oval:org.debian:def:161166881816655474557846797259286493833
title: CVE-2006-1063 lurker
description:
Unspecified vulnerability in Lurker 2.0 and earlier allows remote attackers to create or overwrite files in any writable directory that is named "mbox".


definition_id: oval:org.debian:def:99997274624130773436244196790727545751
title: CVE-2006-1064 lurker
description:
Multiple cross-site scripting (XSS) vulnerabilities in Lurker 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.


definition_id: oval:org.debian:def:321884446639676537754594152118151698775
title: CVE-2006-1150 teg
description:
Buffer overflow in Tenes Empanadas Graciela (TEG) 0.11.1, automatically appends an _ (underscore) to the end of duplicate nicknames, which allows remote attackers to cause a denial of service (application crash) by creating multiple users with long, identical nicknames, which triggers an off-by-one error.


definition_id: oval:org.debian:def:207068401805388588588961864831926519158
title: CVE-2006-1165 dokuwiki
description:
Cross-site scripting (XSS) vulnerability in the mediamanager module in DokuWiki before 2006-03-05 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors relating to "handling EXIF data."


definition_id: oval:org.debian:def:35526332347175949842519540293624595080
title: CVE-2006-1168 ncompress
description:
The decompress function in compress42.c in (1) ncompress 4.2.4 and (2) liblzw allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code, via crafted data that leads to a buffer underflow.


definition_id: oval:org.debian:def:283439801456210133077019516474665849066
title: CVE-2006-1173 sendmail
description:
Sendmail before 8.13.7 allows remote attackers to cause a denial of service via deeply nested, malformed multipart MIME messages that exhaust the stack during the recursive mime8to7 function for performing 8-bit to 7-bit conversion, which prevents Sendmail from delivering queued messages and might lead to disk consumption by core dump files.


definition_id: oval:org.debian:def:303166756454367752069060165306839831621
title: CVE-2006-1174 shadow
description:
useradd in shadow-utils before 4.0.3, and possibly other versions before 4.0.8, does not provide a required argument to the open function when creating a new user mailbox, which causes the mailbox to be created with unpredictable permissions and possibly allows attackers to read or modify the mailbox.


definition_id: oval:org.debian:def:196117712542660519176169392351056615847
title: CVE-2006-1206 dropbear
description:
Matt Johnston Dropbear SSH server 0.47 and earlier, as used in embedded Linux devices and on general-purpose operating systems, allows remote attackers to cause a denial of service (connection slot exhaustion) via a large number of connection attempts that exceeds the MAX_UNAUTH_CLIENTS defined value of 30.


definition_id: oval:org.debian:def:81383524869564002180157557857956486970
title: CVE-2006-1236 crossfire
description:
Buffer overflow in the SetUp function in socket/request.c in CrossFire 1.9.0 allows remote attackers to execute arbitrary code via a long setup sound command, a different vulnerability than CVE-2006-1010.


definition_id: oval:org.debian:def:166004114234709394207095274693856473420
title: CVE-2006-1251 sa-exim
description:
Argument injection vulnerability in greylistclean.cron in sa-exim 4.2 allows remote attackers to delete arbitrary files via an email with a To field that contains a filename separated by whitespace, which is not quoted when greylistclean.cron provides the argument to the rm command.


definition_id: oval:org.debian:def:247790607420860228803154066257997942048
title: CVE-2006-1263 wordpress
description:
Multiple "unannounced" cross-site scripting (XSS) vulnerabilities in WordPress before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.


definition_id: oval:org.debian:def:100939658850442117026399942942528590393
title: CVE-2006-1279 libcgi-session-perl
description:
CGI::Session 4.03-1 allows local users to overwrite arbitrary files via a symlink attack on temporary files used by (1) Driver::File, (2) Driver::db_file, and possibly (3) Driver::sqlite.


definition_id: oval:org.debian:def:38584412042014111216620940280872954211
title: CVE-2006-1280 libcgi-session-perl
description:
CGI::Session 4.03-1 does not set proper permissions on temporary files created in (1) Driver::File and (2) Driver::db_file, which allows local users to obtain privileged information, such as session keys, by viewing the files.


definition_id: oval:org.debian:def:161009444766528880723201588130148391084
title: CVE-2006-1295 spip
description:
Cross-site scripting (XSS) vulnerability in recherche.php3 in SPIP 1.8.2-g allows remote attackers to inject arbitrary web script or HTML via the recherche parameter.


definition_id: oval:org.debian:def:273716940021557061762049706490873498518
title: CVE-2006-1296 beagle
description:
Untrusted search path vulnerability in Beagle 0.2.2.1 might allow local users to gain privileges via a malicious beagle-info program in the current working directory, or possibly directories specified in the PATH.


definition_id: oval:org.debian:def:41028870656256376065301539766420950399
title: CVE-2006-1319 runit
description:
chpst in runit 1.3.3-1 for Debian GNU/Linux, when compiled on little endian i386 machines against dietlibc, does not properly handle when multiple groups are specified in the -u option, which causes chpst to assign permissions for the root group due to inconsistent bit sizes for the gid_t type.


definition_id: oval:org.debian:def:147350187768079356461682361664604647588
title: CVE-2006-1321 webcheck
description:
Cross-site scripting (XSS) vulnerability in webcheck before 1.9.6 allows remote attackers to inject arbitrary web script or HTML via the (1) url, (2) title, or (3) author name in a crawled page, which is not properly sanitized in the tooltips of a report.


definition_id: oval:org.debian:def:86312113191426960214745930935277981787
title: CVE-2006-1329 jabberd2
description:
The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to cause a denial of service ("c2s segfault") by sending a "response stanza before an auth stanza".


definition_id: oval:org.debian:def:312442181494064612079464111601125327668
title: CVE-2006-1335 gnome-screensaver
description:
gnome screensaver before 2.14, when running on an X server with AllowDeactivateGrabs and AllowClosedownGrabs enabled, allows attackers with physical access to cause the screensaver to crash and access the session via the Ctl+Alt+Keypad-Multiply keyboard sequence, which removes the grab from gnome.


definition_id: oval:org.debian:def:154565466349472037280796263322438507538
title: CVE-2006-1354 freeradius
description:
Unspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass authentication or cause a denial of service (server crash) via "Insufficient input validation" in the EAP-MSCHAPv2 state machine module.


definition_id: oval:org.debian:def:268481289211698257808232483002286709926
title: CVE-2006-1356 libvc
description:
Stack-based buffer overflow in the count_vcards function in LibVC 3, as used in Rolo, allows user-assisted attackers to execute arbitrary code via a vCard file (e.g. contacts.vcf) containing a long line.


definition_id: oval:org.debian:def:167173364703740358671106441610951073115
title: CVE-2006-1376 shadow
description:
The installation of Debian GNU/Linux 3.1r1 from the network install CD creates /var/log/debian-installer/cdebconf with world writable permissions, which allows local users to cause a denial of service (disk consumption).


definition_id: oval:org.debian:def:76934191897549231226345076280590543720
title: CVE-2006-1498 mediawiki
description:
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.5.8 and 1.4.15 allows remote attackers to inject arbitrary web script or HTML via crafted encoded links.


definition_id: oval:org.debian:def:32146134395553084546970593847553915073
title: CVE-2006-1514 abcmidi
description:
Multiple buffer overflows in the abcmidi-yaps translator in abcmidi 20050101, and other versions, allow remote attackers to execute arbitrary code via crafted ABC music files that trigger the overflows during translation into PostScript.


definition_id: oval:org.debian:def:193205255533045910394061574895602614029
title: CVE-2006-1515 typespeed
description:
Buffer overflow in the addnewword function in typespeed 0.4.4 and earlier might allow remote attackers to execute arbitrary code via unknown vectors.


definition_id: oval:org.debian:def:180444779511588832494068293508868511602
title: CVE-2006-1526 xorg-server
description:
Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows attackers to cause a denial of service (crash), as demonstrated by the (1) XRenderCompositeTriStrip and (2) XRenderCompositeTriFan requests in the rendertest from XCB xcb/xcb-demo, which leads to an incorrect memory allocation due to a typo in an expression that uses a "&" instead of a "*" operator. NOTE: the subject line of the original announcement used an incorrect CVE number for this issue.


definition_id: oval:org.debian:def:129125784420407555538602898833917962517
title: CVE-2006-1529 thunderbird
description:
Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML.  NOTE: due to the lack of sufficient public details from the vendor as of 20060413, it is unclear how CVE-2006-1529, CVE-2006-1530, CVE-2006-1531, and CVE-2006-1723 are different.


definition_id: oval:org.debian:def:204376147468836899461507203269140625817
title: CVE-2006-1539 bsdgames
description:
Multiple buffer overflows in the checkscores function in scores.c in tetris-bsd in bsd-games before 2.17-r1 in Gentoo Linux might allow local users with games group membership to gain privileges by modifying tetris-bsd.scores to contain crafted executable content, which is executed when another user launches tetris-bsd.


definition_id: oval:org.debian:def:49441913514760481728147661439713493983
title: CVE-2006-1550 dia
description:
Multiple buffer overflows in the xfig import code (xfig-import.c) in Dia 0.87 and later before 0.95-pre6 allow user-assisted attackers to have an unknown impact via a crafted xfig file, possibly involving an invalid (1) color index, (2) number of points, or (3) depth.


definition_id: oval:org.debian:def:157378408686163222919936518900162773747
title: CVE-2006-1564 subversion
description:
Untrusted search path vulnerability in libapache2-svn 1.3.0-4 for Subversion in Debian GNU/Linux includes RPATH values under the /tmp/svn directory for the (1) mod_authz_svn.so and (2) mod_dav_svn.so modules, which might allow local users to gain privileges by installing malicious libraries in that directory.


definition_id: oval:org.debian:def:262535127246056624917968808426793124729
title: CVE-2006-1614 clamav
description:
Integer overflow in the cli_scanpe function in the PE header parser (libclamav/pe.c) in Clam AntiVirus (ClamAV) before 0.88.1, when ArchiveMaxFileSize is disabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code.


definition_id: oval:org.debian:def:307142103876129620101219410103211362807
title: CVE-2006-1615 clamav
description:
Multiple format string vulnerabilities in the logging code in Clam AntiVirus (ClamAV) before 0.88.1 might allow remote attackers to execute arbitrary code.  NOTE: as of 20060410, it is unclear whether this is a vulnerability, as there is some evidence that the arguments are actually being sanitized properly.


definition_id: oval:org.debian:def:120806025539118679300947163684105886557
title: CVE-2006-1629 openvpn
description:
OpenVPN 2.0 through 2.0.5 allows remote malicious servers to execute arbitrary code on the client by using setenv with the LD_PRELOAD environment variable.


definition_id: oval:org.debian:def:151401964659545394998722867505757562193
title: CVE-2006-1630 clamav
description:
The cli_bitset_set function in libclamav/others.c in Clam AntiVirus (ClamAV) before 0.88.1 allows remote attackers to cause a denial of service via unspecified vectors that trigger an "invalid memory access."


definition_id: oval:org.debian:def:255280851817227542817984458243361475228
title: CVE-2006-1655 mpg123
description:
Multiple buffer overflows in mpg123 0.59r allow user-assisted attackers to trigger a segmentation fault and possibly have other impacts via a certain MP3 file, as demonstrated by mpg1DoS3.  NOTE: this issue might be related to CVE-2004-0991, but it is not clear.


definition_id: oval:org.debian:def:188405999013745685404703971030823690378
title: CVE-2006-1656 util-vserver
description:
vserver in util-vserver 0.30.209 executes a command as root when the suexec userid parameter is invalid and non-numeric, which might cause local users to inadvertently execute dangerous commands as root.


definition_id: oval:org.debian:def:23662856165354845996351379396694593003
title: CVE-2006-1695 fbi
description:
The fbgs script in the fbi package 2.01-1.4, when the TMPDIR environment variable is not defined, allows local users to overwrite arbitrary files via a symlink attack on temporary files in /var/tmp/fbps-[PID].


definition_id: oval:org.debian:def:296800813714971616077902808811949228639
title: CVE-2006-1702 spip
description:
PHP remote file inclusion vulnerability in spip_login.php3 in SPIP 1.8.3 allows remote attackers to execute arbitrary PHP code via a URL in the url parameter.


definition_id: oval:org.debian:def:258593578467628246018291135600297184415
title: CVE-2006-1712 mailman
description:
Cross-site scripting (XSS) vulnerability in the private archive script (private.py) in GNU Mailman 2.1.7 allows remote attackers to inject arbitrary web script or HTML via the action argument.


definition_id: oval:org.debian:def:295594340449645341226791999340288655958
title: CVE-2006-1721 cyrus-sasl2
description:
digestmd5.c in the CMU Cyrus Simple Authentication and Security Layer (SASL) library 2.1.18, and possibly other versions before 2.1.21, allows remote unauthenticated attackers to cause a denial of service (segmentation fault) via malformed inputs in DIGEST-MD5 negotiation.


definition_id: oval:org.debian:def:156105954091452662629212280907397658160
title: CVE-2006-1724 thunderbird
description:
Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attack vectors related to DHTML.


definition_id: oval:org.debian:def:259386831815569630531414691659592670346
title: CVE-2006-1726 thunderbird
description:
Unspecified vulnerability in Firefox and Thunderbird 1.5 before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to bypass the js_ValueToFunctionObject check and execute arbitrary code via unknown vectors involving setTimeout and Firefox' ForEach method.


definition_id: oval:org.debian:def:267861927730753998002979600879309803964
title: CVE-2006-1727 thunderbird
description:
Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to gain chrome privileges via multiple attack vectors related to the use of XBL scripts with "Print Preview".


definition_id: oval:org.debian:def:14235947466240826558817774606855619777
title: CVE-2006-1728 thunderbird
description:
Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via unknown vectors related to the crypto.generateCRMFRequest method.


definition_id: oval:org.debian:def:49536967867944744032554830934375237831
title: CVE-2006-1730 thunderbird
description:
Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via a large number in the CSS letter-spacing property that leads to a heap-based buffer overflow.


definition_id: oval:org.debian:def:59350198577895934571430550788290446810
title: CVE-2006-1731 thunderbird
description:
Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 returns the Object class prototype instead of the global window object when (1) .valueOf.call or (2) .valueOf.apply are called without any arguments, which allows remote attackers to conduct cross-site scripting (XSS) attacks.


definition_id: oval:org.debian:def:259779777455986601361574504828211232389
title: CVE-2006-1732 thunderbird
description:
Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to bypass same-origin protections and conduct cross-site scripting (XSS) attacks via unspecified vectors involving the window.controllers array.


definition_id: oval:org.debian:def:83611554553132921690660091146516490636
title: CVE-2006-1733 thunderbird
description:
Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 does not properly protect the compilation scope of privileged built-in XBL bindings, which allows remote attackers to execute arbitrary code via the (1) valueOf.call or (2) valueOf.apply methods of an XBL binding, or (3) "by inserting an XBL method into the DOM's document.body prototype chain."


definition_id: oval:org.debian:def:195946177527837655649637060535483931771
title: CVE-2006-1734 thunderbird
description:
Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to execute arbitrary code by using the Object.watch method to access the "clone parent" internal function.


definition_id: oval:org.debian:def:78777476535714987548977408212131396981
title: CVE-2006-1735 thunderbird
description:
Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to execute arbitrary code by using an eval in an XBL method binding (XBL.method.eval) to create Javascript functions that are compiled with extra privileges.


definition_id: oval:org.debian:def:34514230053313224621993726496123867555
title: CVE-2006-1737 thunderbird
description:
Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary bytecode via JavaScript with a large regular expression.


definition_id: oval:org.debian:def:140315506306869403469266040698890236018
title: CVE-2006-1738 thunderbird
description:
Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) by changing the (1) -moz-grid and (2) -moz-grid-group display styles.


definition_id: oval:org.debian:def:99065633364403568880589134631623700771
title: CVE-2006-1739 thunderbird
description:
The CSS border-rendering code in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain Cascading Style Sheets (CSS) that causes an out-of-bounds array write and buffer overflow.


definition_id: oval:org.debian:def:225202173046623693658931830264169489526
title: CVE-2006-1740 thunderbird
description:
Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to spoof secure site indicators such as the locked icon by opening the trusted site in a popup window, then changing the location to a malicious site.


definition_id: oval:org.debian:def:111836210727615294290124914654619227746
title: CVE-2006-1741 thunderbird
description:
Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to inject arbitrary Javascript into other sites by (1) "using a modal alert to suspend an event handler while a new page is being loaded", (2) using eval(), and using certain variants involving (3) "new Script;" and (4) using window.__proto__ to extend eval, aka "cross-site JavaScript injection".


definition_id: oval:org.debian:def:9265732369297253871184406486073202784
title: CVE-2006-1742 thunderbird
description:
The JavaScript engine in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 does not properly handle temporary variables that are not garbage collected, which might allow remote attackers to trigger operations on freed memory and cause memory corruption.


definition_id: oval:org.debian:def:135575372117883408981798260178027697649
title: CVE-2006-1744 bsdgames
description:
Buffer overflow in pl_main.c in sail in BSDgames before 2.17-7 allows local users to execute arbitrary code via a long player name that is used in a scanf function call.


