Search
Total
25555 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2006-0151 | 2 Todd Miller, Ubuntu | 2 Sudo, Ubuntu Linux | 2018-10-03 | 7.2 HIGH | N/A |
| sudo 1.6.8 and other versions does not clear the PYTHONINSPECT environment variable, which allows limited local users to gain privileges via a Python script, a variant of CVE-2005-4158. | |||||
| CVE-2005-3632 | 1 Netpbm | 1 Netpbm | 2018-10-03 | 4.6 MEDIUM | N/A |
| Multiple buffer overflows in pnmtopng in netpbm 10.0 and earlier allow attackers to execute arbitrary code via a crafted PNM file. | |||||
| CVE-2005-3848 | 1 Linux | 1 Linux Kernel | 2018-10-03 | 7.8 HIGH | N/A |
| Memory leak in the icmp_push_reply function in Linux 2.6 before 2.6.12.6 and 2.6.13 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted packets that cause the ip_append_data function to fail, aka "DST leak in icmp_push_reply." | |||||
| CVE-2005-3858 | 1 Linux | 1 Linux Kernel | 2018-10-03 | 7.8 HIGH | N/A |
| Memory leak in the ip6_input_finish function in ip6_input.c in Linux kernel 2.6.12 and earlier might allow attackers to cause a denial of service via malformed IPv6 packets with unspecified parameter problems, which prevents the SKB from being freed. | |||||
| CVE-2005-3808 | 1 Linux | 1 Linux Kernel | 2018-10-03 | 4.9 MEDIUM | N/A |
| Integer overflow in the invalidate_inode_pages2_range function in mm/truncate.c in Linux kernel 2.6.11 to 2.6.14 allows local users to cause a denial of service (hang) via 64-bit mmap calls that are not properly handled on a 32-bit system. | |||||
| CVE-2005-3340 | 1 New Breed Software | 1 Tux Paint | 2018-10-03 | 7.2 HIGH | N/A |
| The tuxpaint-import.sh script in Tux Paint (tuxpaint) 0.9.14 and earlier creates temporary files insecurely, with unknown impact and attack vectors. | |||||
| CVE-2005-3532 | 1 Double Precision Incorporated | 1 Courier Mail Server | 2018-10-03 | 7.5 HIGH | N/A |
| authpam.c in courier-authdaemon for Courier Mail Server 0.37.3 through 0.52.1, when using pam_tally, does not call the pam_acct_mgmt function to verify that access should be granted, which allows attackers to authenticate to the server using accounts that have been disabled. | |||||
| CVE-2005-3323 | 2 Debian, Zope | 2 Debian Linux, Zope | 2018-10-03 | 7.5 HIGH | N/A |
| docutils in Zope 2.6, 2.7 before 2.7.8, and 2.8 before 2.8.2 allows remote attackers to include arbitrary files via include directives in RestructuredText functionality. | |||||
| CVE-2005-3359 | 1 Linux | 1 Linux Kernel | 2018-10-03 | 4.9 MEDIUM | N/A |
| The atm module in Linux kernel 2.6 before 2.6.14 allows local users to cause a denial of service (panic) via certain socket calls that produce inconsistent reference counts for loadable protocol modules. | |||||
| CVE-2005-3271 | 1 Linux | 1 Linux Kernel | 2018-10-03 | 2.1 LOW | N/A |
| Exec in Linux kernel 2.6 does not properly clear posix-timers in multi-threaded environments, which results in a resource leak and could allow a large number of multiple local users to cause a denial of service by using more posix-timers than specified by the quota for a single user. | |||||
| CVE-2005-2966 | 1 Dia | 1 Dia | 2018-10-03 | 5.1 MEDIUM | N/A |
| The Python SVG import plugin (diasvg_import.py) for DIA 0.94 and earlier allows user-assisted attackers to execute arbitrary commands via a crafted SVG file. | |||||
| CVE-2005-2978 | 1 Netpbm | 1 Netpbm | 2018-10-03 | 7.5 HIGH | N/A |
| pnmtopng in netpbm before 10.25, when using the -trans option, uses uninitialized size and index variables when converting Portable Anymap (PNM) images to Portable Network Graphics (PNG), which might allow attackers to execute arbitrary code by modifying the stack. | |||||
| CVE-2005-3272 | 1 Linux | 1 Linux Kernel | 2018-10-03 | 5.0 MEDIUM | N/A |
| Linux kernel before 2.6.12 allows remote attackers to poison the bridge forwarding table using frames that have already been dropped by filtering, which can cause the bridge to forward spoofed packets. | |||||
| CVE-2005-2550 | 1 Gnome | 1 Evolution | 2018-10-03 | 7.5 HIGH | N/A |
| Format string vulnerability in Evolution 1.4 through 2.3.6.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the calendar entries such as task lists, which are not properly handled when the user selects the Calendars tab. | |||||
| CVE-2005-3256 | 1 Enigmail | 1 Enigmail | 2018-10-03 | 5.0 MEDIUM | N/A |
| The key selection dialogue in Enigmail before 0.92.1 can incorrectly select a key with a user ID that does not have additional information, which allows parties with that key to decrypt the message. | |||||
| CVE-2005-2971 | 1 Kde | 1 Koffice | 2018-10-03 | 7.5 HIGH | N/A |
| Heap-based buffer overflow in the KWord RTF importer for KOffice 1.2.0 through 1.4.1 allows remote attackers to execute arbitrary code via a crafted RTF file. | |||||
| CVE-2005-3054 | 1 Php | 1 Php | 2018-10-03 | 2.1 LOW | N/A |
| fopen_wrappers.c in PHP 4.4.0, and possibly other versions, does not properly restrict access to other directories when the open_basedir directive includes a trailing slash, which allows PHP scripts in one directory to access files in other directories whose names are substrings of the original directory. | |||||
| CVE-2005-2672 | 1 Lm Sensors | 1 Lm Sensors | 2018-10-03 | 2.1 LOW | N/A |
| pwmconfig in LM_sensors before 2.9.1 creates temporary files insecurely, which allows local users to overwrite arbitrary files via a symlink attack on the fancontrol temporary file. | |||||
| CVE-2005-2958 | 1 Gnome | 1 Libgda2 | 2018-10-03 | 7.5 HIGH | N/A |
| Multiple format string vulnerabilities in the GNOME Data Access library for GNOME2 (libgda2) 1.2.1 and earlier allow attackers to execute arbitrary code. | |||||
| CVE-2005-2353 | 1 Mozilla | 1 Thunderbird | 2018-10-03 | 2.1 LOW | N/A |
| run-mozilla.sh in Thunderbird, with debugging enabled, allows local users to create or overwrite arbitrary files via a symlink attack on temporary files. | |||||
| CVE-2005-2549 | 1 Gnome | 1 Evolution | 2018-10-03 | 7.5 HIGH | N/A |
| Multiple format string vulnerabilities in Evolution 1.5 through 2.3.6.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) full vCard data, (2) contact data from remote LDAP servers, or (3) task list data from remote servers. | |||||
| CVE-2005-1686 | 1 Gnome | 1 Gedit | 2018-10-03 | 2.6 LOW | N/A |
| Format string vulnerability in gedit 2.10.2 may allow attackers to cause a denial of service (application crash) via a bin file with format string specifiers in the filename. NOTE: while this issue is triggered on the command line by the gedit user, it has been reported that web browsers and email clients could be configured to provide a file name as an argument to gedit, so there is a valid attack that crosses security boundaries. | |||||
| CVE-2005-1739 | 2 Graphicsmagick, Imagemagick | 2 Graphicsmagick, Imagemagick | 2018-10-03 | 5.0 MEDIUM | N/A |
| The XWD Decoder in ImageMagick before 6.2.2.3, and GraphicsMagick before 1.1.6-r1, allows remote attackers to cause a denial of service (infinite loop) via an image with a zero color mask. | |||||
| CVE-2005-1765 | 1 Linux | 1 Linux Kernel | 2018-10-03 | 2.1 LOW | N/A |
| syscall in the Linux kernel 2.6.8.1 and 2.6.10 for the AMD64 platform, when running in 32-bit compatibility mode, allows local users to cause a denial of service (kernel hang) via crafted arguments. | |||||
| CVE-2005-0990 | 1 Gnu | 1 Sharutils | 2018-10-03 | 2.1 LOW | N/A |
| unshar (unshar.c) in sharutils 4.2.1 allows local users to overwrite arbitrary files via a symlink attack on the unsh.X temporary file. | |||||
| CVE-2005-0866 | 1 Cdrtools | 1 Cdrecord | 2018-10-03 | 2.1 LOW | N/A |
| cdrecord before 4:2.0, when DEBUG is enabled, allows local users to overwrite arbitrary files via a symlink attack on temporary files. | |||||
| CVE-2005-1527 | 2 Awstats, Ubuntu | 2 Awstats, Ubuntu Linux | 2018-10-03 | 5.0 MEDIUM | N/A |
| Eval injection vulnerability in awstats.pl in AWStats 6.4 and earlier, when a URLPlugin is enabled, allows remote attackers to execute arbitrary Perl code via the HTTP Referrer, which is used in a $url parameter that is inserted into an eval function call. | |||||
| CVE-2005-2452 | 1 Libtiff | 1 Libtiff | 2018-10-03 | 5.0 MEDIUM | N/A |
| libtiff up to 3.7.0 allows remote attackers to cause a denial of service (application crash) via a TIFF image header with a zero "YCbCr subsampling" value, which causes a divide-by-zero error in (1) tif_strip.c and (2) tif_tile.c, a different vulnerability than CVE-2004-0804. | |||||
| CVE-2004-1058 | 2 Linux, Ubuntu | 2 Linux Kernel, Ubuntu Linux | 2018-10-03 | 1.2 LOW | N/A |
| Race condition in Linux kernel 2.6 allows local users to read the environment variables of another process that is still spawning via /proc/.../cmdline. | |||||
| CVE-2004-2014 | 1 Gnu | 1 Wget | 2018-10-03 | 2.6 LOW | N/A |
| Wget 1.9 and 1.9.1 allows local users to overwrite arbitrary files via a symlink attack on the name of the file being downloaded. | |||||
| CVE-2004-1333 | 2 Linux, Redhat | 3 Linux Kernel, Fedora Core, Linux | 2018-10-03 | 2.1 LOW | N/A |
| Integer overflow in the vc_resize function in the Linux kernel 2.4 and 2.6 before 2.6.10 allows local users to cause a denial of service (kernel crash) via a short new screen value, which leads to a buffer overflow. | |||||
| CVE-2004-1387 | 1 Apache | 1 Http Server | 2018-10-03 | 2.1 LOW | N/A |
| The check_forensic script in apache-utils package 1.3.31 allows local users to overwrite or create arbitrary files via a symlink attack on temporary files. | |||||
| CVE-2004-2655 | 1 Xscreensaver | 1 Xscreensaver | 2018-10-03 | 5.4 MEDIUM | N/A |
| rdesktop 1.3.1 with xscreensaver 4.14, and possibly other versions, when running on Fedora and possibly other platforms, does not release the keyboard focus when xscreensaver starts, which causes the password to be entered into the active window when the user unlocks the screen. | |||||
| CVE-2004-1268 | 2 Easy Software Products, Redhat | 2 Cups, Fedora Core | 2018-10-03 | 2.1 LOW | N/A |
| lppasswd in CUPS 1.1.22 ignores write errors when modifying the CUPS passwd file, which allows local users to corrupt the file by filling the associated file system and triggering the write errors. | |||||
| CVE-2005-0605 | 8 Altlinux, Lesstif, Mandrakesoft and 5 more | 11 Alt Linux, Lesstif, Mandrake Linux and 8 more | 2018-10-03 | 7.5 HIGH | N/A |
| scan.c for LibXPM may allow attackers to execute arbitrary code via a negative bitmap_unit value that leads to a buffer overflow. | |||||
| CVE-2005-0626 | 1 Squid | 1 Squid | 2018-10-03 | 2.6 LOW | N/A |
| Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies. | |||||
| CVE-2005-0448 | 1 Larry Wall | 1 Perl | 2018-10-03 | 1.2 LOW | N/A |
| Race condition in the rmtree function in File::Path.pm in Perl before 5.8.4 allows local users to create arbitrary setuid binaries in the tree being deleted, a different vulnerability than CVE-2004-0452. | |||||
| CVE-2005-0106 | 1 Ubuntu | 1 Ubuntu Linux | 2018-10-03 | 4.6 MEDIUM | N/A |
| SSLeay.pm in libnet-ssleay-perl before 1.25 uses the /tmp/entropy file for entropy if a source is not set in the EGD_PATH variable, which allows local users to reduce the cryptographic strength of certain operations by modifying the file. | |||||
| CVE-2004-1010 | 1 Info-zip | 1 Zip | 2018-10-03 | 10.0 HIGH | N/A |
| Buffer overflow in Info-Zip 2.3 and possibly earlier versions, when using recursive folder compression, allows remote attackers to execute arbitrary code via a ZIP file containing a long pathname. | |||||
| CVE-2004-1270 | 2 Easy Software Products, Redhat | 2 Cups, Fedora Core | 2018-10-03 | 2.1 LOW | N/A |
| lppasswd in CUPS 1.1.22, when run in environments that do not ensure that file descriptors 0, 1, and 2 are open when lppasswd is called, does not verify that the passwd.new file is different from STDERR, which allows local users to control output to passwd.new via certain user input that triggers an error message. | |||||
| CVE-2004-1269 | 2 Easy Software Products, Redhat | 2 Cups, Fedora Core | 2018-10-03 | 5.0 MEDIUM | N/A |
| lppasswd in CUPS 1.1.22 does not remove the passwd.new file if it encounters a file-size resource limit while writing to passwd.new, which causes subsequent invocations of lppasswd to fail. | |||||
| CVE-2005-0400 | 1 Linux | 1 Linux Kernel | 2018-10-03 | 2.1 LOW | N/A |
| The ext2_make_empty function call in the Linux kernel before 2.6.11.6 does not properly initialize memory when creating a block for a new directory entry, which allows local users to obtain potentially sensitive information by reading the block. | |||||
| CVE-2005-0102 | 1 Ximian | 1 Evolution | 2018-10-03 | 7.2 HIGH | N/A |
| Integer overflow in camel-lock-helper in Evolution 2.0.2 and earlier allows local users or remote malicious POP3 servers to execute arbitrary code via a length value of -1, which leads to a zero byte memory allocation and a buffer overflow. | |||||
| CVE-2005-0201 | 1 D-bus | 1 D-bus | 2018-10-03 | 2.1 LOW | N/A |
| D-BUS (dbus) before 0.22 does not properly restrict access to a socket, if the socket address is known, which allows local users to listen or send arbitrary messages on another user's per-user session bus via that socket. | |||||
| CVE-2004-1487 | 1 Gnu | 1 Wget | 2018-10-03 | 5.0 MEDIUM | N/A |
| wget 1.8.x and 1.9.x allows a remote malicious web server to overwrite certain files via a redirection URL containing a ".." that resolves to the IP address of the malicious server, which bypasses wget's filtering for ".." sequences. | |||||
| CVE-2005-0384 | 4 Redhat, Suse, Trustix and 1 more | 4 Enterprise Linux, Suse Linux, Secure Linux and 1 more | 2018-10-03 | 5.0 MEDIUM | N/A |
| Unknown vulnerability in the PPP driver for the Linux kernel 2.6.8.1 allows remote attackers to cause a denial of service (kernel crash) via a pppd client. | |||||
| CVE-2004-1488 | 1 Gnu | 1 Wget | 2018-10-03 | 5.0 MEDIUM | N/A |
| wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP responses to the terminal, which may allow remote malicious web servers to inject terminal escape sequences and execute arbitrary code. | |||||
| CVE-2004-0983 | 4 Gentoo, Mandrakesoft, Ubuntu and 1 more | 5 Linux, Mandrake Linux, Mandrake Linux Corporate Server and 2 more | 2018-10-03 | 5.0 MEDIUM | N/A |
| The CGI module in Ruby 1.6 before 1.6.8, and 1.8 before 1.8.2, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a certain HTTP request. | |||||
| CVE-2005-0767 | 1 Linux | 1 Linux Kernel | 2018-10-03 | 6.9 MEDIUM | N/A |
| Race condition in the Radeon DRI driver for Linux kernel 2.6.8.1 allows local users with DRI privileges to execute arbitrary code as root. | |||||
| CVE-2005-0749 | 1 Linux | 1 Linux Kernel | 2018-10-03 | 7.2 HIGH | N/A |
| The load_elf_library in the Linux kernel before 2.6.11.6 allows local users to cause a denial of service (kernel crash) via a crafted ELF library or executable, which causes a free of an invalid pointer. | |||||