CVE Vulnerability Catalog

Heap-based buffer overflow in the DCOM interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed RPC request with a long filename parameter.

Multiple heap-based buffer overflows in FTP Desktop client 3.5, and possibly earlier versions, allow remote malicious servers to execute arbitrary code via (1) a long FTP banner, (2) a long response to a USER command, or (3) a long response to a PASS command.

The IN_MIDI.DLL plugin version 3.01 and earlier, used in Winamp 2.91, allows remote attackers to execute arbitrary code via a MIDI file with a large 'Track data size' value.

Buffer overflow in mah-jong 1.5.6 and earlier allows remote attackers to execute arbitrary code.

Buffer overflow in foxweb.dll and foxweb.exe of Foxweb 2.5 allows remote attackers to execute arbitrary code via a long URL (PATH_INFO value).

KisMAC before 0.05d trusts user-supplied variables to load arbitrary kernels or kernel modules, allowing local users to gain privileges via the $DRIVER_KEXT environment variable.

Heap-based buffer overflow in the DCOM interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed DCERPC DCOM object activation request packet with modified length fields.

Buffer overflow in PINE before 4.58 allows remote attackers to execute arbitrary code via a malformed message/external-body MIME type.

Buffer overflow in RogerWilco graphical server 1.4.1.6 and earlier, and dedicated server 0.32a and earlier for Windows, and 0.27 and earlier for Linux and BSD, allows remote attackers to cause a denial of service and execute arbitrary code via a client request with a large length value.

Buffer overflow in the get_msg_text function in chan_sip.c in the SIP protocol implementation for Asterisk releases before August 15, 2003, allows remote attackers to execute arbitrary code via certain MESSAGE or INFO requests.

KisMAC before version 0.05d trusts user-supplied variables when changing file or directory ownership, allowing local users to gain privileges via the $DRIVER_KEXT environment variable.

Aspppls for Solaris 8 allows local users to overwrite arbitrary files via a symlink attack on the .asppp.fifo temporary file.

The C-Media PCI sound driver in Linux before version 2.4.21 does not use the get_user function to access userspace, which crosses security boundaries and may facilitate the exploitation of vulnerabilities.

Buffer overflow in a component of SQL-DMO for Microsoft Data Access Components (MDAC) 2.5 through 2.7 allows remote attackers to execute arbitrary code via a long response to a broadcast request to UDP port 1434.

CVE-2003-0575 involves a heap-based buffer overflow in the name services daemon (nsd) in SGI IRIX 6.5.x through 6.5.21f, allowing attackers to gain root privileges via the AUTH_UNIX gid list.

Buffer overflow in WiTango Application Server and Tango 2000 allows remote attackers to execute arbitrary code via a long cookie to Witango_UserReference.

Unknown vulnerability in the Virtual File System (VFS) capability for phpGroupWare version 0.9.16preRC and earlier, related to the VFS path being under the web document root.

Novell iChain 2.2 before Support Pack 1 does not properly verify that URL redirects match the DNS name of an accelerator, allowing attackers to redirect URLs to malicious web sites.

Windows Media Player (WMP) 7 and 8, running on Internet Explorer and possibly other Microsoft products that process HTML, allows remote attackers to bypass zone restrictions and access or execute arbitrary files via an IFRAME tag pointing to an ASF file whose Content-location contains a File:// URL.

The RPC DCOM interface in Windows 2000 SP3 and SP4 allows remote attackers to cause a denial of service (crash), and local attackers to use the DoS to hijack the epmapper pipe to gain privileges, via certain messages to the __RemoteGetClassObject interface that cause a NULL pointer to be passed to the PerformScmStage function.