CVE Vulnerability Catalog

The prescan() function in the address parser in Sendmail before version 8.12.9 does not properly handle conversions from char and int types, which can lead to a length check being disabled. This allows attackers to cause a denial of service and potentially execute arbitrary code via a buffer overflow attack.

A stack-based buffer overflow in the bsd_queue() function for lpq on Solaris 2.6 and 7 allows local users to gain root privilege.

Buffer overflow in the XML parser in wsabi.dll of Winamp 3 (1.0.0.488) allows remote attackers to execute arbitrary code via a skin file (.wal) with a long include file tag.

Buffer overflow in Apple QuickTime Player 5.x and 6.0 for Windows allows remote attackers to execute arbitrary code via a long QuickTime URL.

The HTTP proxy for Symantec Enterprise Firewall (SEF) 7.0 allows proxy users to bypass pattern matching for blocked URLs via requests that are URL-encoded with escapes, Unicode, or UTF-8.

Buffer overflow in the openlog function for PHP 4.3.1 on Windows operating system, and possibly other OSes, allows remote attackers to cause a crash and possibly execute arbitrary code via a long filename argument.

Heap-based buffer overflow in the NTLMSSP code for Ethereal 0.9.9 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code.

Unknown vulnerability in the bonsai Mozilla CVS query tool allows remote attackers to execute arbitrary commands as the www-data user.

Multiple buffer overflows in the IRC component of Trillian 0.73 and 0.74 allow remote malicious IRC servers to cause a denial of service and possibly execute arbitrary code. Attacks can be carried out through various long messages or responses from the server.

Integer signedness error in the emalloc() function for PHP before version 4.3.2 allows remote attackers to cause a denial of service (memory consumption) and possibly execute arbitrary code via negative arguments to functions such as socket_recv and socket_recvfrom.

Buffer overflow in PlanetDNS PlanetWeb 1.14 and earlier allows remote attackers to execute arbitrary code via (1) an HTTP GET request with a long URL or (2) a request with a long method name.

In versions 0.5.0 and earlier of the Null HTTP Server, a heap-based buffer overflow allows remote attackers to execute arbitrary code by providing a negative value in the Content-Length HTTP header.

Multiple off-by-one buffer overflows in the IMAP capability for Mutt 1.3.28 and earlier, and Balsa 1.2.4 and earlier, allow a remote malicious IMAP server to cause a denial of service (crash) and possibly execute arbitrary code via a specially crafted mail folder.

Buffer overflow in Automatic File Distributor (AFD) version 1.2.14 and earlier allows local users to gain privileges via a long MON_WORK_DIR environment variable or -w (workdir) argument.

Buffer overflow in the mrinfo, mtrace, and pppd programs in NetBSD versions 1.4.x through 1.6 allows local users to gain privileges by executing these programs after filling the file descriptor tables.

Buffer overflow in the COM Object Control Handler for Lotus Domino 6.0.1 and earlier allows remote attackers to execute arbitrary code. The attack can be carried out via multiple vectors, including the InitializeUsingNotesUserName method in the iNotes ActiveX control.

The CLI interface for WatchGuard Firebox Vclass 3.2 and earlier, and RSSA Appliance 3.0.2 does not properly close the SSH connection when a -N option is provided during authentication, allowing remote attackers to access CLI with administrator privileges.

Buffer overflow in Linuxconf before version 1.28r4 allows local users to execute arbitrary code via a long LINUXCONF_LANG environment variable, leading to an overflow of an error string.

CVE-2002-1519 describes a format string vulnerability in the CLI interface for WatchGuard Firebox Vclass 3.2 and earlier, and RSSA Appliance 3.0.2. This allows remote attackers to cause a denial of service and potentially execute arbitrary code via format string specifiers in the password parameter.

Multiple SQL injection vulnerabilities in FactoSystem CMS allow remote attackers to perform unauthorized database actions. These vulnerabilities affect the authornumber parameter in author.asp, discussblurbid in discuss.asp, and the name and email parameters in holdcomment.asp.