CVE Vulnerability Catalog

Multiple buffer overflows in the sys32_ni_syscall and sys32_vm86_warning functions in sys_ia32.c for Linux 2.6.x may allow local attackers to modify kernel memory and gain privileges.

Buffer overflow in CMailCOM.dll in CMailServer 5.2 allows remote attackers to execute arbitrary code via an attachment with a long filename.

A buffer overflow in Open Dc Hub 0.7.14 in the RedirectAll command allows a remote attacker with administrator privileges to execute arbitrary code.

Buffer overflow in the Gfx::doImage function in Gfx.cc for xpdf 3.00, and other products that share code such as tetex-bin and kpdf in KDE 3.2.x to 3.2.3 and 3.3.x to 3.3.2, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted PDF file that causes the boundaries of a maskColors array to be exceeded.

The vulnerability in Safari versions 1.x to 1.2.4 (and possibly others) allows inactive windows to display dialog boxes. A remote attacker can exploit this flaw to spoof dialog boxes from other websites, leading to a 'Dialog Box Spoofing' attack. This is a different vulnerability than CVE-2004-1314.

The init scripts in ChessBrain 20407 and earlier execute user-owned programs with root privileges, which allows local users to gain privileges by modifying the programs.

A buffer overflow in the handling of command line arguments in Skype 1.0.x.94 through 1.0.x.98 allows remote attackers to execute arbitrary code via a callto:// URL with a long non-existent username.

SQL injection vulnerability in SQLgrey Postfix greylisting service before version 1.2.0 allows remote attackers to execute arbitrary SQL commands via the sender or recipient email addresses.

Vulnerability in MIMEDefang in MIME-tools 5.414 allows remote attackers to bypass virus scanning by sending an email attachment with a virus that contains an empty boundary string in the Content-Type header.

Format string vulnerability in the cherokee_logger_ncsa_write_string function in Cherokee 0.4.17 and earlier, when authenticating via auth_pam, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via format string specifiers in the URL.

Buffer overflow in InnerMedia DynaZip DUNZIP32.dll file version 5.00.03 and earlier allows remote attackers to execute arbitrary code via a ZIP file containing a file with a long filename. This affects multiple products including RealPlayer, CheckMark Software, dtSearch, McAfee VirusScan, and IBM Lotus Notes.

The WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 contains a vulnerability that allows a remote attacker to write to arbitrary memory locations and potentially execute arbitrary code by sending a modified memory pointer in a WINS replication packet to TCP port 42. This vulnerability is known as the 'Association Context Vulnerability'.

Buffer overflow in ncplogin and ncpmap in ncpfs 2.2.4 (and possibly other versions) allows local users to gain privileges via a long -T option.

The binfmt_elf loader in Linux kernel 2.4.x up to 2.4.27 and 2.6.x up to 2.6.8 may create a non-NULL-terminated interpreter name string, leading to strings longer than PATH_MAX and buffer overflows. A local user can exploit this to cause a denial of service (hang) and potentially execute arbitrary code.

The load_elf_binary function in the binfmt_elf loader in Linux kernel 2.4.x up to 2.4.27 and 2.6.x up to 2.6.8 does not properly check return values from calls to the kernel_read function, which may allow local users to modify sensitive memory in a setuid program and execute arbitrary code.

An off-by-one error in the mysasl_canon_user function in Cyrus IMAP Server 2.2.9 and earlier leads to a buffer overflow, which may allow remote attackers to execute arbitrary code via the username.

Buffer overflow in the exif_read_data function in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to execute arbitrary code via a long section name in an image file.

In PHP versions 4.x to 4.3.9 and 5.x to 5.0.2, the safe mode checks truncate the file path before passing data to the realpath function, which could allow attackers to bypass safe mode restrictions.

The HyperTerminal application in Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value saved in a session file, allowing remote attackers to execute arbitrary code via a malicious .ht session file, website, or Telnet URL in an email, triggering a buffer overflow.

Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CVE-2004-0901.