CVE Vulnerability Catalog

The vulnerability in the changepassword.cgi script of ChangePassword 0.8, when installed setuid, allows local users to execute arbitrary code by modifying the PATH environment variable to point to a malicious 'make' program.

A buffer overflow in the handling of command line arguments in Skype 1.0.x.94 through 1.0.x.98 allows remote attackers to execute arbitrary code via a callto:// URL with a long non-existent username.

A vulnerability in rssh version 2.2.2 and earlier allows remote authenticated users to bypass intended access restrictions and execute arbitrary programs via rdist -P, rsync, or scp -S commands.

Buffer overflow vulnerability in the switch_voice function in parse.c of jcabc2ps 20040902 allows remote attackers to execute arbitrary code via a crafted ABC file.

Vulnerability in WinRAR 3.40 and earlier versions allows remote attackers to execute arbitrary code via a crafted ZIP file containing a file with a long filename. The issue stems from an integer overflow leading to a buffer overflow.

The gui_popup_view_fly function in gui_tview_popup.c in junkie 0.3.1 allows remote malicious FTP servers to execute arbitrary commands via shell metacharacters in a filename.

Buffer overflow in proxyd for Cyrus IMAP Server 2.2.9 and earlier, with the imapmagicplus option enabled, may allow remote attackers to execute arbitrary code. This is a different vulnerability than CVE-2004-1011.

The load_elf_binary function in the binfmt_elf loader in Linux kernel 2.4.x up to 2.4.27 and 2.6.x up to 2.6.8 does not properly check return values from calls to the kernel_read function, which may allow local users to modify sensitive memory in a setuid program and execute arbitrary code.

Buffer overflow in the open_aiff_file function in demux_aiff.c for xine-lib (libxine) 1-rc7 allows remote attackers to execute arbitrary code via a crafted AIFF file.

The vulnerability in the argument parser of the FETCH command in Cyrus IMAP Server 2.2.x through 2.2.8 allows remote authenticated users to execute arbitrary code via specially crafted commands such as "body[p", "binary[p", or "binary[p", which cause an index increment error leading to out-of-bounds memory corruption.

The argument parser of the PARTIAL command in Cyrus IMAP Server 2.2.6 and earlier allows remote authenticated users to execute arbitrary code via a certain command ("body[p") that is treated as a different command ("body.peek") and causes an index increment error that leads to an out-of-bounds memory corruption.

The id3tag_sort function in id3tag.c in YAMT 0.5 allows remote attackers to execute arbitrary commands via an MP3 file with double quotes in the Artist tag.

Multiple buffer overflows in the event_text and event_specific functions in abc2midi 2004.12.04 allow remote attackers to execute arbitrary code via crafted ABC files.

Integer overflow vulnerability in the Samba daemon (smbd) in Samba versions 2.x and 3.0.x through 3.0.9 allows remote authenticated users to cause a denial of service (application crash) and potentially execute arbitrary code via a Samba request with a large number of security descriptors, triggering a heap-based buffer overflow.

The init scripts in ChessBrain 20407 and earlier execute user-owned programs with root privileges, which allows local users to gain privileges by modifying the programs.

A format string vulnerability in Kreed 1.05 and earlier allows remote attackers to execute arbitrary code via format specifiers in a nickname or message text.

The vulnerability in Safari versions 1.x to 1.2.4 (and possibly others) allows inactive windows to display dialog boxes. A remote attacker can exploit this flaw to spoof dialog boxes from other websites, leading to a 'Dialog Box Spoofing' attack. This is a different vulnerability than CVE-2004-1314.

The binfmt_elf loader in Linux kernel 2.4.x up to 2.4.27 and 2.6.x up to 2.6.8 may create a non-NULL-terminated interpreter name string, leading to strings longer than PATH_MAX and buffer overflows. A local user can exploit this to cause a denial of service (hang) and potentially execute arbitrary code.

Multiple integer overflows in xzgv 0.8 and earlier allow remote attackers to execute arbitrary code via images with large width and height values, which trigger a heap-based buffer overflow, as demonstrated in the read_prf_file function in readprf.c.

Stack-based buffer overflow in Cyrus IMAP Server versions 2.2.4 through 2.2.8 with the imapmagicplus option enabled. A remote attacker can execute arbitrary code by sending a long PROXY or LOGIN command.