Multiple vulnerabilities in the API subsystem of Cisco Integrated Management Controller (IMC) could allow an unauthenticated remote attacker to execute arbitrary code with root privileges. The vulnerabilities are due to improper boundary checks for certain user-supplied input. An attacker could exploit these vulnerabilities by sending a crafted HTTP request to the API subsystem of an affected system. When this request is processed an exploitable buffer overflow condition may occur. A successful exploit could allow the attacker to execute arbitrary code with root privileges on the underlying operating system (OS).


A vulnerability in the implementation of the Lua interpreter that is integrated in Cisco IOS XE Software could allow an authenticated local attacker to execute arbitrary code with root privileges on the underlying Linux operating system (OS) of an affected device. The vulnerability is due to insufficient restrictions on Lua function calls within the context of user-supplied Lua scripts. An attacker with valid administrative credentials could exploit this vulnerability by submitting a malicious Lua script. When this file is processed an exploitable buffer overflow condition could occur. A successful exploit could allow the attacker to execute arbitrary code with root privileges on the underlying Linux OS of the affected device.

buffer overflow
arbitrary code execution


A vulnerability in Cisco FXOS Software could allow an authenticated local attacker with administrative credentials to cause a buffer overflow condition. The vulnerability is due to incorrect bounds checking of values that are parsed from a specific file. An attacker could exploit this vulnerability by supplying a crafted file that when it is processed may cause a stack-based buffer overflow. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system with root privileges. An attacker would need to have valid administrative credentials to exploit this vulnerability.


WebAccess Node Version 8.4.4 and prior is vulnerable to a stack-based buffer overflow which may allow an attacker to remotely execute arbitrary code.


In Foxit Reader and PhantomPDF before 10.0.1 and PhantomPDF before 9.7.3 attackers can execute arbitrary code via a heap-based buffer overflow because dirty image-resource data is mishandled.


An issue was discovered on Samsung mobile devices with O(8.X) P(9.0) and Q(10.0) (Exynos chipsets) software. Attackers can bypass the Secure Bootloader protection mechanism via a heap-based buffer overflow to execute arbitrary code. The Samsung ID is SVE-2020-16712 (May 2020).


Morita Shogi 64 through 2020-05-02 for Nintendo 64 devices allows remote attackers to execute arbitrary code via crafted packet data to the built-in modem because 0x800b3e94 (aka the IF subcommand to top-level command 7) has a stack-based buffer overflow.


A buffer overflow vulnerability in the authd component of the PAN-OS management server allows authenticated administrators to disrupt system processes and potentially execute arbitrary code with root privileges. This issue affects: All versions of PAN-OS 7.1 and PAN-OS 8.0; PAN-OS 8.1 versions earlier than PAN-OS 8.1.13; PAN-OS 9.0 versions earlier than PAN-OS 9.0.7.


A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. If exploited this vulnerability allows attackers to execute arbitrary code. QNAP have already fixed this vulnerability in the following versions: Surveillance Station 5.1.5.4.3 (and later) for ARM CPU NAS (64bit OS) and x86 CPU NAS (64bit OS) Surveillance Station 5.1.5.3.3 (and later) for ARM CPU NAS (32bit OS) and x86 CPU NAS (32bit OS)


A stack-based buffer overflow vulnerability in the management server component of PAN-OS that allows an authenticated user to potentially execute arbitrary code with root privileges. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14.


A buffer overflow vulnerability in PAN-OS allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the Captive Portal or Multi-Factor Authentication interface. This issue impacts: All versions of PAN-OS 8.0; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 9.1 versions earlier than PAN-OS 9.1.3.


A buffer overflow vulnerability in the PAN-OS management server allows authenticated users to crash system processes or potentially execute arbitrary code with root privileges. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.7; PAN-OS 9.1 versions earlier than 9.1.1; All versions of PAN-OS 8.0.


A buffer overflow vulnerability in the PAN-OS management web interface allows authenticated administrators to disrupt system processes and potentially execute arbitrary code with root privileges. This issue impacts only PAN-OS 10.0 versions earlier than PAN-OS 10.0.1.


An issue was discovered in Moxa NPort 5110 versions prior to 2.6 NPort 5130/5150 Series versions prior to 3.6 NPort 5200 Series versions prior to 2.8 NPort 5400 Series versions prior to 3.11 NPort 5600 Series versions prior to 3.7 NPort 5100A Series & NPort P5150A versions prior to 1.3 NPort 5200A Series versions prior to 1.3 NPort 5150AI-M12 Series versions prior to 1.2 NPort 5250AI-M12 Series versions prior to 1.2 NPort 5450AI-M12 Series versions prior to 1.2 NPort 5600-8-DT Series versions prior to 2.4 NPort 5600-8-DTL Series versions prior to 2.4 NPort 6x50 Series versions prior to 1.13.11 NPort IA5450A versions prior to v1.4. Buffer overflow vulnerability may allow an unauthenticated attacker to remotely execute arbitrary code.


A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or potentially execute arbitrary code on the host with privileges of the QEMU process.


openjpeg: A heap-based buffer overflow flaw was found in the patch for CVE-2013-6045. A crafted j2k image could cause the application to crash or potentially execute arbitrary code.


Buffer overflow in Citrix Provisioning Services before 7.12 allows attackers to execute arbitrary code via unspecified vectors.


Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20 5.1.x before 5.1.13 6.0.x before 6.0.15 6.1.x before 6.1.15 7.0.x before 7.0.11 and 7.1.x before 7.1.6 allows remote attackers to execute arbitrary code via unspecified vectors.


Touch Panel (TP) driver in Huawei NEM phones with software Versions before NEM-AL10C00B130 Versions before NEM-UL10C17B160 Versions before NEM-UL10C00B160 Versions before NEM-TL00C01B160 allows attackers to get root privilege or crash the system or execute arbitrary code related to a buffer overflow.


The HIFI driver in Huawei Mate 8 phones with software versions before NXT-AL10C00B386 versions before NXT-CL00C92B386 versions before NXT-DL00C17B386 versions before NXT-TL00C01B386; Mate S phones with software Versions before CRR-CL00C92B368 Versions before CRR-CL20C92B368 Versions before CRR-TL00C01B368 Versions before CRR-UL00C00B368 Versions before CRR-UL20C00B368; P8 phones with software Versions before GRA-TL00C01B366 Versions before GRA-CL00C92B366 Versions before GRA-CL10C92B366 Versions before GRA-UL00C00B366 Versions before GRA-UL10C00B366; and P9 phones with software Versions before EVA-AL10C00B190 Versions before EVA-DL10C00B190 Versions before EVA-TL10C00B190 Versions before EVA-CL10C00B190 allows attackers to get root privilege or crash the system or execute arbitrary code related to a buffer overflow.


Heap buffer overflow (Out-of-Bounds write) vulnerability in Foxit Reader and PhantomPDF before 8.1 on Windows allows remote attackers to execute arbitrary code via a crafted JPEG2000 image embedded in a PDF document aka a \corrupted suffix pattern\ issue.


Multiple heap-based buffer overflows in VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows when Cortado ThinPrint virtual printing is enabled allow guest OS users to execute arbitrary code on the host OS via unspecified vectors.


Buffer overflow in BlueZ 5.41 and earlier allows an attacker to execute arbitrary code via the parse_line function used in some userland utilities.


partclone.restore in Partclone 0.2.87 is prone to a heap-based buffer overflow vulnerability due to insufficient validation of the partclone image header. An attacker may be able to execute arbitrary code in the context of the user running the affected application.


partclone.fat in Partclone before 0.2.88 is prone to a heap-based buffer overflow vulnerability due to insufficient validation of the FAT superblock related to the mark_reserved_sectors function. An attacker may be able to execute arbitrary code in the context of the user running the affected application.


Multiple

stack

buffer

overflow

vulnerabilities

in

Jensen

of

Scandinavia

AS

Air:Link

version

(Rev.

Air:Link

version

and

Air:Link

version

(Rev.

devices

allow

remote

attackers

to

execute

arbitrary

code

or

crash

the

web

service

via

the

ateFunc

ateGain

ateTxCount

ateChan

ateRate

ateMacID

ateTxFreqOffset

ateMode

ateBW

ateAntenna

and

parameters

of

the

endpoint.


A vulnerability in the Identity Firewall feature of Cisco ASA Software before 9.6(2.1) could allow an unauthenticated remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to a buffer overflow in the affected code area. An attacker could exploit this vulnerability by sending a crafted NetBIOS packet in response to a NetBIOS probe sent by the ASA software. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or cause a reload of the affected system. Note: Only traffic directed to the affected system can be used to exploit this vulnerability. This vulnerability affects systems configured in routed and transparent firewall mode and in single or multiple context mode. This vulnerability can be triggered by IPv4 traffic.


Buffer overflow in the Authentication Authorization and Accounting (AAA) module in Huawei USG2100 USG2200 USG5100 and USG5500 unified security gateways with software before V300R001C10SPC600 allows remote authenticated RADIUS servers to execute arbitrary code by sending a crafted EAP packet.


Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500 ASA 5500-X ASA Services Module ASA 1000V ASAv Firepower 9300 ASA Security Module PIX and FWSM devices allows remote authenticated users to execute arbitrary code via crafted IPv4 SNMP packets aka Bug ID CSCva92151 or EXTRABACON.


Heap-based buffer overflow in Adobe Reader and Acrobat before 11.0.18 Acrobat and Acrobat Reader DC Classic before 15.006.30243 and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-6939.


Heap-based buffer overflow in Adobe Reader and Acrobat before 11.0.18 Acrobat and Acrobat Reader DC Classic before 15.006.30243 and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-6994.


Stack-based buffer overflow in mchan.dll in the agent in HPE LoadRunner 11.52 through patch 3 12.00 through patch 1 12.01 through patch 3 12.02 through patch 2 and 12.50 through patch 3 and Performance Center 11.52 through patch 3 12.00 through patch 1 12.01 through patch 3 12.20 through patch 2 and 12.50 through patch 1 allows remote attackers to execute arbitrary code via a long -server_name value aka ZDI-CAN-3516.


Heap-based buffer overflow in Adobe Reader and Acrobat before 11.0.16 Acrobat and Acrobat Reader DC Classic before 15.006.30172 and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4091.


Heap-based buffer overflow in Adobe Reader and Acrobat before 11.0.17 Acrobat and Acrobat Reader DC Classic before 15.006.30198 and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.


Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses.


Heap-based buffer overflow in Adobe Reader and Acrobat before 11.0.16 Acrobat and Acrobat Reader DC Classic before 15.006.30172 and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4092.


Buffer overflow in Huawei VP9660 VP9650 and VP9630 multipoint control unit devices with software before V500R002C00SPC200 and RSE6500 videoconference devices with software before V500R002C00SPC100 when an unspecified service is enabled allows remote attackers to execute arbitrary code via a crafted packet aka HWPSIRT-2016-05054.


Stack-based buffer overflow in the PlayMacro function in ObjectXMacro.ObjectXMacro in WdMacCtl.ocx in Micro Focus Rumba 9.x before 9.3 HF 11997 and 9.4.x before 9.4 HF 12815 allows remote attackers to execute arbitrary code via a long MacroName argument. NOTE: some references mention CVE-2016-5226 but that is not a correct ID for any Rumba vulnerability.


Stack-based buffer overflow in the munge_other_line function in cachemgr.cgi in the squid package before 3.1.23-16.el6_8.6 in Red Hat Enterprise Linux 6 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-4051.


Heap-based buffer overflow in the opj_dwt_interleave_v function in dwt.c in OpenJPEG as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux allows remote attackers to execute arbitrary code via crafted coordinate values in JPEG 2000 data.


Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49.0 Firefox ESR 45.x before 45.4 and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via a crafted image data that is mishandled during the encoding of an image frame to an image.


Stack-based

buffer

overflow

in

dws/api/Login

on

D-Link

before

Ax

Bx

before

before

before

before

before

before

before

before

and

before

devices

allows

remote

attackers

to

execute

arbitrary

code

via

a

long

session

cookie.


The IBM Tivoli Storage Manager (IBM Spectrum Protect) AIX client is vulnerable to a buffer overflow when Journal-Based Backup is enabled. A local attacker could overflow a buffer and execute arbitrary code on the system or cause a system crash.


Buffer overflow in Rockwell Automation RSLogix Micro Starter Lite RSLogix Micro Developer RSLogix 500 Starter Edition RSLogix 500 Standard Edition and RSLogix 500 Professional Edition allows remote attackers to execute arbitrary code via a crafted RSS project file.


Buffer overflow in the redirection functionality in Cisco Wireless LAN Controller (WLC) Software 7.2 through 7.4 before 7.4.140.0(MD) and 7.5 through 8.0 before 8.0.115.0(ED) allows remote attackers to execute arbitrary code via a crafted HTTP request aka Bug ID CSCus25617.


Multiple stack-based buffer overflows in COM objects in Micro Focus Rumba 9.4.x before 9.4 HF 13960 allow remote attackers to execute arbitrary code via (1) the NetworkName property value to ObjectXSNAConfig.ObjectXSNAConfig in iconfig.dll (2) the CPName property value to ObjectXSNAConfig.ObjectXSNAConfig in iconfig.dll (3) the PrinterName property value to ProfileEditor.PrintPasteControl in ProfEdit.dll (4) the Data argument to the WriteRecords function in FTXBIFFLib.AS400FtxBIFF in FtxBIFF.dll (5) the Serialized property value to NMSECCOMPARAMSLib.SSL3 in NMSecComParams.dll (6) the UserName property value to NMSECCOMPARAMSLib.FirewallProxy in NMSecComParams.dll (7) the LUName property value to ProfileEditor.MFSNAControl in ProfEdit.dll (8) the newVal argument to the Load function in FTPSFTPLib.SFtpSession in FTPSFtp.dll or (9) a long Host field in the FTP Client.


Buffer overflow in IOAudioFamily in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context via a crafted app.


Heap-based buffer overflow in Mozilla Network Security Services (NSS) before 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1 as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code via crafted ASN.1 data in an X.509 certificate.


Heap-based buffer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux Adobe AIR before 21.0.0.176 Adobe AIR SDK before 21.0.0.176 and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors.


Heap-based buffer overflow in the KeyView PDF filter in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6 allows remote attackers to execute arbitrary code via a crafted PDF document a different vulnerability than CVE-2016-0278 CVE-2016-0279 and CVE-2016-0301.


Unspecified vulnerability in Oracle Java SE 6u105 7u91 and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality integrity and availability via vectors related to AWT. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a heap-based buffer overflow in the readImage function which allows remote attackers to execute arbitrary code via crafted image data.


Buffer

overflow

in

the

Java

Virtual

Machine

(JVM)

in

IBM

SDK

Java

Technology

Edition

before

before

before

before

and

before

allows

remote

attackers

to

execute

arbitrary

code

via

unspecified

vectors.


Heap-based buffer overflow in the KeyView PDF filter in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6 allows remote attackers to execute arbitrary code via a crafted PDF document a different vulnerability than CVE-2016-0277 CVE-2016-0279 and CVE-2016-0301.


Heap-based buffer overflow in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux Adobe AIR before 20.0.0.260 Adobe AIR SDK before 20.0.0.260 and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors.


Heap-based buffer overflow in the KeyView PDF filter in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6 allows remote attackers to execute arbitrary code via a crafted PDF document a different vulnerability than CVE-2016-0277 CVE-2016-0278 and CVE-2016-0279.


Buffer overflow in the PDF Library in Microsoft Windows 8.1 Windows Server 2012 Gold and R2 and Windows 10 allows remote attackers to execute arbitrary code via a crafted PDF document that triggers API calls aka \Microsoft PDF Library Buffer Overflow Vulnerability.\


Heap-based buffer overflow in the KeyView PDF filter in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6 allows remote attackers to execute arbitrary code via a crafted PDF document a different vulnerability than CVE-2016-0277 CVE-2016-0278 and CVE-2016-0301.


Heap-based

buffer

overflow

in

the

stagefright::SampleTable::parseSampleCencInfo

function

in

libstagefright

in

Mozilla

Firefox

before

Firefox

ESR

before

and

Firefox

ESR

before

allows

remote

attackers

to

execute

arbitrary

code

via

crafted

CENC

offsets

that

lead

to

mismanagement

of

the

sizes

table.


revision.c in git before 2.7.4 uses an incorrect integer data type which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees leading to a heap-based buffer overflow.


Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows remote attackers to execute arbitrary code via crafted MPLS packets as demonstrated by a long string in an ovs-appctl command.


Buffer overflow in Dec2LHA.dll in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection (SEP) before 12.1 RU6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1 RU6 MP5; Symantec Protection Engine (SPE) before 7.0.5 HF01 7.5.x before 7.5.3 HF03 7.5.4 before HF01 and 7.8.0 before HF01; Symantec Protection for SharePoint Servers (SPSS) 6.0.3 through 6.0.5 before 6.0.5 HF 1.5 and 6.0.6 before HF 1.6; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 7.0_3966002 HF1.1 and 7.5.x before 7.5_3966008 VHF1.2; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF1.1 and 8.1.x before 8.1.3 HF1.2; CSAPI before 10.0.4 HF01; Symantec Message Gateway (SMG) before 10.6.1-4; Symantec Message Gateway for Service Providers (SMG-SP) 10.5 before patch 254 and 10.6 before patch 253; Norton AntiVirus Norton Security Norton Internet Security and Norton 360 before NGC 22.7; Norton Security for Mac before 13.0.2; Norton Power Eraser (NPE) before 5.1; and Norton Bootable Removal Tool (NBRT) before 2016.1 allows remote attackers to execute arbitrary code via a crafted file.


Buffer overflow in Dec2SS.dll in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection (SEP) before 12.1 RU6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1 RU6 MP5; Symantec Protection Engine (SPE) before 7.0.5 HF01 7.5.x before 7.5.3 HF03 7.5.4 before HF01 and 7.8.0 before HF01; Symantec Protection for SharePoint Servers (SPSS) 6.0.3 through 6.0.5 before 6.0.5 HF 1.5 and 6.0.6 before HF 1.6; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 7.0_3966002 HF1.1 and 7.5.x before 7.5_3966008 VHF1.2; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF1.1 and 8.1.x before 8.1.3 HF1.2; CSAPI before 10.0.4 HF01; Symantec Message Gateway (SMG) before 10.6.1-4; Symantec Message Gateway for Service Providers (SMG-SP) 10.5 before patch 254 and 10.6 before patch 253; Norton AntiVirus Norton Security Norton Internet Security and Norton 360 before NGC 22.7; Norton Security for Mac before 13.0.2; Norton Power Eraser (NPE) before 5.1; and Norton Bootable Removal Tool (NBRT) before 2016.1 allows remote attackers to execute arbitrary code via a crafted file.


Buffer overflow in btif/src/btif_dm.c in Bluetooth in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-05-01 allows remote attackers to execute arbitrary code via a long PIN value aka internal bug 27411268.


Heap-based buffer overflow in the ClearKey Content Decryption Module (CDM) in the Encrypted Media Extensions (EME) API in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 might allow remote attackers to execute arbitrary code by providing a malformed video and leveraging a Gecko Media Plugin (GMP) sandbox bypass.


Multiple stack-based buffer overflows in the AVCC reassembly implementation in Utils.cpp in libstagefright in MediaMuxer in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 6.x before 2016-09-01 and 7.0 before 2016-09-01 allow remote attackers to execute arbitrary code via a crafted media file aka internal bug 29161888.


Heap-based buffer overflow in the CreateFXPDFConvertor function in ConvertToPdf_x86.dll in Foxit Reader 7.3.4.311 allows remote attackers to execute arbitrary code via a large SamplesPerPixel value in a crafted TIFF image that is mishandled during PDF conversion. This is fixed in 8.0.


Multiple stack-based buffer overflows in Sybase Adaptive Server Enterprise (ASE) 12.x before 12.5.3 ESD#1 allow remote authenticated users to execute arbitrary code via the (1) attrib_valid function (2) covert function (3) declare statement or (4) a crafted query plan or remote authenticated users with database owner or \sa\ role privileges to execute arbitrary code via (5) a crafted install java statement.


Buffer overflow in the PerlIO implementation in Perl 5.8.0 when installed with setuid support (sperl) allows local users to execute arbitrary code by setting the PERLIO_DEBUG variable and executing a Perl script whose full pathname contains a long directory tree.


Heap-based buffer overflow in the env_opt_add function in telnet.c for various BSD-based Telnet clients allows remote attackers to execute arbitrary code via responses that contain a large number of characters that require escaping which consumers more memory than allocated.


Buffer overflow in LTris before 1.0.10 allows local users to execute arbitrary code via a crafted highscores file.


Buffer overflow in Trillian 3.0 and Pro 3.0 allows remote attackers to execute arbitrary code via a crafted PNG image file.


Buffer overflow in Savant Web Server 3.1 allows remote attackers to execute arbitrary code via a long HTTP request.


Buffer overflow in digestmd5.c CVS release 1.170 (also referred to as digestmda5.c) as used in the DIGEST-MD5 SASL plugin for Cyrus-SASL but not in any official releases allows remote attackers to execute arbitrary code.


The Windows Animated Cursor (ANI) capability in Windows NT Windows 2000 through SP4 Windows XP through SP1 and Windows 2003 allows remote attackers to execute arbitrary code via the AnimationHeaderBlock length field which leads to a stack-based buffer overflow.


Buffer overflow in CVS before 1.11.20 allows remote attackers to execute arbitrary code.


Buffer overflow in the Telephony Application Programming Interface (TAPI) for Microsoft Windows 98 Windows 98 SE Windows ME Windows 2000 Windows XP and Windows Server 2003 allows attackers to elevate privileges or execute arbitrary code via a crafted message.


Buffer overflow in RaidenHTTPD 1.1.32 and possibly other versions before 1.1.34 allows remote attackers to execute arbitrary code via a long URL.


Buffer overflow in Golden FTP Server Pro (goldenftpd) 2.x allows remote attackers to execute arbitrary code via a long RNTO command.


Stack-based buffer overflow in the CSmil1Parser::testAttributeFailed function in smlparse.cpp for RealNetworks RealPlayer 10.5 (6.0.12.1056 and earlier) 10 8 and RealOne Player V2 and V1 allows remote attackers to execute arbitrary code via a .SMIL file with a large system-screen-size value.


Multiple stack-based buffer overflows in libcURL and cURL 7.12.1 and possibly other versions allow remote malicious web servers to execute arbitrary code via base64 encoded replies that exceed the intended buffer lengths when decoded which is not properly handled by (1) the Curl_input_ntlm function in http_ntlm.c during NTLM authentication or (2) the Curl_krb_kauth and krb4_auth functions in krb4.c during Kerberos authentication.


Buffer overflow in McAfee Scan Engine 4320 with DAT version before 4436 allows remote attackers to execute arbitrary code via a malformed LHA file with a type 2 header file name field a variant of CVE-2005-0643.


Buffer overflow in Bontago 1.1 and earlier allows remote attackers to execute arbitrary code via a long nickname.


Buffer overflow in smail 3.2.0.120 allows remote attackers or local users to execute arbitrary code via a long string in the MAIL FROM command and possibly other SMTP commands.


Multiple buffer overflows in the web tool for MySQL MaxDB before 7.5.00.26 allows remote attackers to execute arbitrary code via (1) an HTTP GET request with a long file parameter after a percent (\%\) sign or (2) a long Lock-Token string to the WebDAV functionality which is not properly handled by the getLockTokenHeader function in WDVHandler_CommonUtils.c.


Buffer overflow in pcdsvgaview in xpcd 2.08 allows local users to execute arbitrary code.


Stack-based buffer overflow in VERITAS Backup Exec Remote Agent 9.0 through 10.0 for Windows and 9.0.4019 through 9.1.307 for Netware allows remote attackers to execute arbitrary code via a CONNECT_CLIENT_AUTH request with authentication method type 3 (Windows credentials) and a long password argument.


Multiple buffer overflows in Cyrus IMAPd before 2.2.11 may allow attackers to execute arbitrary code via (1) an off-by-one error in the imapd annotate extension (2) an off-by-one error in \cached header handling \ (3) a stack-based buffer overflow in fetchnews or (4) a stack-based buffer overflow in imapd.


Buffer overflow in Computer Associates (CA) License Client 0.1.0.15 allows remote attackers to execute arbitrary code via a long filename in a PUTOLF request.


Stack-based buffer overflow in the get_internal_addresses function in the pluto application for Openswan 1.x before 1.0.9 and Openswan 2.x before 2.3.0 when compiled with XAUTH and PAM enabled allows remote authenticated attackers to execute arbitrary code.


Buffer overflow in gram.y for PostgreSQL 8.0.0 and earlier may allow attackers to execute arbitrary code via a large number of arguments to a refcursor function (gram.y) which leads to a heap-based buffer overflow a different vulnerability than CVE-2005-0247.


Buffer overflow in Midnight Commander (mc) 4.5.55 and earlier may allow attackers to execute arbitrary code.


Multiple buffer overflows in Exim before 4.43 may allow attackers to execute arbitrary code via (1) an IPv6 address with more than 8 components as demonstrated using the -be command line option which triggers an overflow in the host_aton function or (2) the -bh command line option or dnsdb PTR lookup which triggers an overflow in the dns_build_reverse function.


Buffer overflow in ipl_varyon on AIX 5.1 5.2 and 5.3 allows local users to execute arbitrary code via a long -d argument.


Buffer overflow in ncplogin in ncpfs before 2.2.6 allows remote malicious NetWare servers to execute arbitrary code on the NetWare client.


Buffer overflow in (1) termsh (2) atcronsh and (3) auditsh in SCO OpenServer 5.0.6 and 5.0.7 might allow local users to execute arbitrary code via a long HOME environment variable.


Buffer overflow in luxman before 0.41 if used with certain insecure svgalib libraries allows local users to execute arbitrary code via a long -f command line argument.


Heap-based buffer overflow in GIF2.cpp in Firefox before 1.0.2 Mozilla before to 1.7.6 and Thunderbird before 1.0.2 and possibly other applications that use the same library allows remote attackers to execute arbitrary code via a GIF image with a crafted Netscape extension 2 block and buffer size.


Buffer overflow in Sylpheed before 1.0.3 and other versions before 1.9.5 allows remote attackers to execute arbitrary code via an e-mail message with certain headers containing non-ASCII characters that are not properly handled when the user replies to the message.


Buffer overflow in Golden FTP Server 1.92 allows remote attackers to execute arbitrary code via a long USER command.


Multiple buffer overflows in gram.y for PostgreSQL 8.0.1 and earlier may allow attackers to execute arbitrary code via (1) a large number of variables in a SQL statement being handled by the read_sql_construct function (2) a large number of INTO variables in a SELECT statement being handled by the make_select_stmt function (3) a large number of arbitrary variables in a SELECT statement being handled by the make_select_stmt function and (4) a large number of INTO variables in a FETCH statement being handled by the make_fetch_stmt function a different set of vulnerabilities than CVE-2005-0245.


Buffer overflow in ArGoSoft FTP Server 1.4.2.8 allows remote authenticated users to execute arbitrary code via a long DELE command. NOTE: this issue was later reported to also affect 1.4.3.5.


The Hyperlink Object Library for Windows 98 2000 XP and Server 2003 allows remote attackers to execute arbitrary code via a crafted link that triggers an \unchecked buffer\ in the library possibly due to a buffer overflow.


scan.c for LibXPM may allow attackers to execute arbitrary code via a negative bitmap_unit value that leads to a buffer overflow.


Buffer overflow in command.C for rxvt-unicode before 5.3 allows remote attackers to execute arbitrary code via a crafted file containing long escape sequences.


Multiple buffer overflows in Computer Associates (CA) License Client and Server 0.1.0.15 allow remote attackers to execute arbitrary code via (1) certain long fields in the Checksum item in a GCR request (2) a long IP address hostname or netmask values in a GCR request (3) a long last parameter in a GETCONFIG packet or (4) long values in a request with an invalid format.


Buffer overflow in Foxmail Server 2.0 allows remote attackers to execute arbitrary code via a long USER command.


Multiple vulnerabilities in fliccd when installed setuid root as part of the kdeedu Kstars support for Instrument Neutral Distributed Interface (INDI) in KDE 3.3 to 3.3.2 allow local users and remote attackers to execute arbitrary code via stack-based buffer overflows.


Buffer overflow in nwprint in SCO OpenServer 5.0.7 allows local users to execute arbitrary code via a long command line argument.


Buffer overflow in McAfee Scan Engine 4320 with DAT version before 4357 allows remote attackers to execute arbitrary code via crafted LHA files.


Buffer overflow in ext.dll in BadBlue 2.55 allows remote attackers to execute arbitrary code via a long mfcisapicommand parameter.


Buffer overflow in playmidi before 2.4 allows local users to execute arbitrary code.


Buffer overflow in netpmon on AIX 5.1 5.2 and 5.3 allows local users to execute arbitrary code via a long -O argument.


Buffer overflow in XShisen before 1.36 allows local users to execute arbitrary code via a long GECOS field.


Buffer overflow in queue.c in a support script for sympa 3.3.3 when running setuid allows local users to execute arbitrary code.


Buffer overflow in PeID allows attackers to execute arbitrary code via a PE file with an Import Address Table containing a long import library name.


Heap-based buffer overflow in Trend Micro AntiVirus Library VSAPI before 7.510 as used in multiple Trend Micro products allows remote attackers to execute arbitrary code via a crafted ARJ file with long header file names that modify pointers within a structure.


The elf_core_dump function in binfmt_elf.c for Linux kernel 2.x.x to 2.2.27-rc2 2.4.x to 2.4.31-pre1 and 2.6.x to 2.6.12-rc4 allows local users to execute arbitrary code via an ELF binary that in certain conditions involving the create_elf_tables function causes a negative length argument to pass a signed integer comparison leading to a buffer overflow.


Multiple buffer overflows in BakBone NetVault 6.x and 7.x allow (1) remote attackers to execute arbitrary code via a modified computer name and length that leads to a heap-based buffer overflow or (2) local users to execute arbitrary code via a long Name entry in the configure.cfg file.


Multiple heap-based buffer overflows in (1) isaNVWRequest.dll and (2) relay.dll in Trend Micro ServerProtect Management Console 5.58 and earlier as used in Control Manager 2.5 and 3.0 and Damage Cleanup Server 1.1 allow remote attackers to execute arbitrary code via \wrapped\ length values in Chunked transfer requests. NOTE: the original report suggests that the relay.dll issue is related to a problem in which a Microsoft Foundation Classes (MFC) static library returns invalid values under heavy load. As such this might not be a vulnerability in Trend Micro's product.


Heap-based buffer overflow in the BERDecBitString function in Microsoft ASN.1 library (MSASN1.DLL) allows remote attackers to execute arbitrary code via nested constructed bit strings which leads to a realloc of a non-null pointer and causes the function to overwrite previously freed memory as demonstrated using a SPNEGO token with a constructed bit string during HTTP authentication and a different vulnerability than CVE-2003-0818. NOTE: the researcher has claimed that MS:MS04-007 fixes this issue.


Buffer overflow in MailEnable Imapd (MEIMAP.exe) allows remote attackers to execute arbitrary code via a long LOGIN command.


Buffer overflow in HTTPMail in MailEnable Enterprise 1.04 and earlier and Professional 1.54 and earlier allows remote attackers to execute arbitrary code via a long HTTP Authorization header.


Stack-based buffer overflow in the IMAP daemon (IMAPD32.EXE) in IMail 8.13 in Ipswitch Collaboration Suite (ICS) and other versions before IMail Server 8.2 Hotfix 2 allows remote authenticated users to execute arbitrary code via a STATUS command with a long mailbox name.


Stack-based buffer overflow in the Plug and Play (PnP) service for Microsoft Windows 2000 and Windows XP Service Pack 1 allows remote attackers to execute arbitrary code via a crafted packet and local users to gain privileges via a malicious application as exploited by the Zotob (aka Mytob) worm.


Multiple heap-based buffer overflows in the code used to handle (1) MMS over TCP (MMST) streams or (2) RealMedia RTSP streams in xine-lib before 1.0 and other products that use xine-lib such as MPlayer 1.0pre6 and earlier allow remote malicious servers to execute arbitrary code.


Buffer overflow in NetFtpd for NetTerm 5.1.1 and earlier allows remote attackers to execute arbitrary code via a long USER command.


Buffer overflow in GlobalSCAPE Secure FTP Server 3.0.2 allows remote authenticated users to execute arbitrary code via a long FTP command.


Buffer overflow in Convert-UUlib (Convert::UUlib) before 1.051 allows remote attackers to execute arbitrary code via a malformed parameter to a read operation.


Multiple buffer overflows in Crob FTP 3.6.1 and possibly earlier versions allow remote attackers to execute arbitrary code via (1) an FTP command with a large string followed by the RMD command with a long string or (2) a globbing (\*\) character followed by a long string.


Heap-based buffer overflow in WinHex 12.05 SR-14 and possibly other versions may allow attackers to execute arbitrary code via a long file name argument. NOTE: since this overflow is in the command line of an unprivileged program it is highly likely that this is not a vulnerability.


Multiple stack-based buffer overflows in the IMAP server in IMail 8.12 and 8.13 in Ipswitch Collaboration Suite (ICS) and other versions before IMail Server 8.2 Hotfix 2 allow remote attackers to execute arbitrary code via a LOGIN command with (1) a long username argument or (2) a long username argument that begins with a special character.


Buffer overflow in Sun Java System Web Proxy Server (aka Sun ONE Proxy Server) 3.6 SP6 allows remote attackers to execute arbitrary code via unknown vectors.


Buffer overflow in PMSoftware Simple Web Server 1.0 allows remote attackers to execute arbitrary code via a long GET request.


Multiple stack-based buffer overflows in the nvd_exec function in HP Radia Notify Daemon 3.1.2.0 (formerly by Novadigm) and other versions including 2.x 3.x and 4.x allows remote attackers to execute arbitrary code via a command with crafted parameters to a RADEXECD process.


Heap-based buffer overflow in rtffplin.cpp in RealPlayer 10.5 6.0.12.1056 on Windows and 10 10.0.1.436 and other versions before 10.0.5 on Linux allows remote attackers to execute arbitrary code via a RealMedia file with a long RealText string such as an SMIL file.


Multiple stack-based and heap-based buffer overflows in Remote Management authentication (zenrem32.exe) on Novell ZENworks 6.5 Desktop and Server Management ZENworks for Desktops 4.x ZENworks for Servers 3.x and Remote Management allows remote attackers to execute arbitrary code via (1) unspecified vectors (2) type 1 authentication requests and (3) type 2 authentication requests.


Buffer overflow in the JBIG2Bitmap::JBIG2Bitmap function in JBIG2Stream.cc in Xpdf as used in products such as gpdf kpdf pdftohtml poppler teTeX CUPS libextractor and others allows attackers to modify memory and possibly execute arbitrary code via unknown attack vectors.


Buffer overflow in vxFtpSrv 0.9.7 allows remote attackers to execute arbitrary code via a long USER name.


Buffer overflow in blenderplay in Blender Player 2.37a allows attackers to execute arbitrary code via a long command line argument.


Buffer overflow in petris before 1.0.1 allows remote attackers to execute arbitrary code via unspecified attack vectors.


Buffer overflow in xloadimage 4.1 and earlier and xli might allow user-assisted attackers to execute arbitrary code via a long title name in a NIFF file which triggers the overflow during (1) zoom (2) reduce or (3) rotate operations.


Buffer overflow in phgrafx in QNX 6.2.1 and 6.3.0 allows local users to execute arbitrary code via a long command line argument.


Stack-based buffer overflow in the ntlm_output function in http-ntlm.c for (1) wget 1.10 (2) curl 7.13.2 and (3) libcurl 7.13.2 and other products that use libcurl when NTLM authentication is enabled allows remote servers to execute arbitrary code via a long NTLM username.


Buffer overflow in RealNetworks RealPlayer 10 and 10.5 allows remote attackers to execute arbitrary code via a crafted image in a RealPlayer Skin (RJS) file. NOTE: due to the lack of details it is unclear how this is different than CVE-2005-2629 and CVE-2005-2630 but the vendor advisory implies that it is different.


Stack-based buffer overflow in (1) CxUux60.dll and (2) CxUux60u.dll as used in SpeedProject products including (a) Squeez 5.0 Build 4285 and (b) SpeedCommander 11.0 Build 4430 and 10.51 Build 4430 allows user-assisted attackers to execute arbitrary code via a ZIP archive containing a long filename.


Buffer overflow in OSH before 1.7-15 allows local users to execute arbitrary code via a long current working directory and filename.


Heap-based buffer overflow in the iGateway service for various Computer Associates (CA) iTechnology products in iTechnology iGateway before 4.0.051230 allows remote attackers to execute arbitrary code via an HTTP request with a negative Content-Length field.


Buffer overflow in GO-Global for Windows 3.1.0.3270 and earlier allows remote attackers to execute arbitrary code via a data block that is longer than the specified data block size.


Multiple stack-based buffer overflows in ZipGenius 5.5.1.468 and 6.0.2.1041 and other versions before 6.0.2.1050 allow remote attackers to execute arbitrary code via (1) a ZIP archive that contains a file with a long filename which is not properly handled by (a) zipgenius.exe (b) zg.exe (c) zgtips.dll and (d) contmenu.dll; (2) a long original name in a (a) UUE (b) XXE or (c) MIM file which is not properly handled by zipgenius.exe; or (3) an ACE archive with a file with a long filename which is not properly handled by unacev2.dll.


Buffer overflow in Nullsoft Winamp 5.094 allows remote attackers to execute arbitrary code via (1) an m3u file containing a long line ending in .wma or (2) a pls file containing a long File1 value ending in .wma a different vulnerability than CVE-2006-0476.


Multiple buffer overflows in Scorched 3D 39.1 (bf) and earlier allow remote attackers to execute arbitrary code via various (1) GLConsole::addLine (2) ServerCommon::sendString (3) ServerCommon::serverLog functions (4) a long command that is not properly handled in ComsMessageHandler.cpp when generating an error message (5) a long UniqueID value in Logger.cpp and possibly other unspecified vectors.


Buffer overflow in Computer Associates (CA) iGateway 3.0 and 4.0 before 4.0.050623 when running in debug mode allows remote attackers to execute arbitrary code via HTTP GET requests.


Buffer overflow in KETM 0.0.6 allows local users to execute arbitrary code via unknown vectors.


Buffer overflow in liby2util in Yet another Setup Tool (YaST) for SuSE Linux 9.3 allows local users to execute arbitrary code via a long Loc entry.


Buffer overflow in swcons in IBM AIX 5.2 when debug malloc is enabled allows remote attackers to cause a core dump and possibly execute arbitrary code.


Buffer overflow in Asus Video Security 3.5.0.0 and earlier when using authorization allows remote attackers to execute arbitrary code via a long username/password string.


Buffer overflow in various ha commands of VERITAS Cluster Server for UNIX before 4.0MP2 allows local users to execute arbitrary code via a long VCSI18N_LANG environment variable to (1) haagent (2) haalert (3) haattr (4) hacli (5) hacli_runcmd (6) haclus (7) haconf (8) hadebug (9) hagrp (10) hahb (11) halog (12) hareg (13) hares (14) hastatus (15) hasys (16) hatype (17) hauser and (18) tststew.


Buffer overflow in Mirabilis ICQ 2003a allows user-assisted attackers to execute arbitrary code by convincing a user to enter long strings into the First Name and Last Name fields.


Buffer overflow in unalz before 0.53 allows remote attackers to execute arbitrary code via long file names in ALZ archives.


Buffer overflow in Skype for Windows 1.1.x.0 through 1.4.x.83 allows remote attackers to execute arbitrary code via (1) callto:// and (2) skype:// links or (3) a non-standard VCARD possibly due to an underlying error in the SysUtils.WideFmtStr Delphi routine.


Buffer overflow in the HTTP management interface for GFI MailSecurity 8.1 allows remote attackers to execute arbitrary code via long headers such as (1) Host and (2) Accept in HTTP requests. NOTE: the vendor suggests that this issues is \in an underlying Microsoft technology\ which if true could mean that the overflow affects other products as well.


Stack-based buffer overflow in (1) CxZIP60.dll and (2) CxZIP60u.dll as used in SpeedProject products including (a) ZipStar 5.0 Build 4285 (b) Squeez 5.0 Build 4285 and (c) SpeedCommander 11.0 Build 4430 and 10.51 Build 4430 allows user-assisted attackers to execute arbitrary code via a ZIP archive containing a long filename.


Cisco IOS 12.0 to 12.4 might allow remote attackers to execute arbitrary code via a heap-based buffer overflow in system timers. NOTE: this issue does not correspond to a specific vulnerability rather a general weakness that only increases the feasibility of exploitation of any vulnerabilities that might exist. Such design-level weaknesses normally are not included in CVE so perhaps this issue should be REJECTed.


Multiple buffer overflows in AhnLab V3 AntiVirus V3Pro 2004 before 6.0.0.488 V3Net for Windows Server 6.0 before 6.0.0.488 and MyV3 with compressed file scanning enabled allow remote attackers to execute arbitrary code via crafted (1) ALZ (2) UUE or (3) XXE archives.


Heap-based buffer overflow in Kaspersky Anti-Virus Engine as used in Kaspersky Personal 5.0.227 Anti-Virus On-Demand Scanner for Linux 5.0.5 and F-Secure Anti-Virus for Linux 4.50 allows remote attackers to execute arbitrary code via a crafted CHM file.


Heap-based buffer overflow in the StreamPredictor function in Xpdf 3.01 as used in products such as (1) Poppler (2) teTeX (3) KDE kpdf and (4) pdftohtml (5) KOffice KWord (6) CUPS and (7) libextractor allows remote attackers to execute arbitrary code via a PDF file with an out-of-range numComps (number of components) field.


Buffer overflow in Glider Collect'n kill 1.0.0.0 allows remote attackers to execute arbitrary code via a gl_playerEnter command with a long player name.


Buffer overflow in getconf in IBM AIX 5.2 to 5.3 allows local users to execute arbitrary code via unknown vectors.


Stack-based buffer overflow in the IMAP service (meimaps.exe) of MailEnable Professional 1.6 and earlier and Enterprise 1.1 and earlier allows remote attackers to execute arbitrary code via a long mailbox name in the (1) select (2) create (3) delete (4) rename (5) subscribe or (6) unsubscribe commands.


Buffer overflow in Virtools Web Player 3.0.0.100 and earlier allows remote attackers to execute arbitrary code via a long filename.


Buffer overflow in uidadmin in SCO Unixware 7.1.3 and 7.1.4 allows local users to execute arbitrary code via a -S (scheme) argument that specifies a large file a different vulnerability than CVE-2001-1063.


Buffer overflow in the Network Block Device (nbd) server 2.7.5 and earlier and 2.8.0 through 2.8.2 allows remote attackers to execute arbitrary code via a large request which is written past the end of the buffer because nbd does not account for memory taken by the reply header.


Stack-based buffer overflow in kkstrtext.h in ktools library 0.3 and earlier as used in products such as (1) centericq (2) orpheus (3) motor and (4) groan allows local users or remote attackers to execute arbitrary code via a long parameter to the VGETSTRING macro.


Stack-based buffer overflow in the Plug and Play (PnP) service (UMPNPMGR.DLL) in Microsoft Windows 2000 SP4 and XP SP1 and SP2 allows remote or local authenticated attackers to execute arbitrary code via a large number of \\\\ (backslash) characters in a registry key name which triggers the overflow in a wsprintfW function call.


Buffer overflow in servermgrd in Mac OS X 10.3.9 and 10.4.2 allows remote attackers to execute arbitrary code during authentication.


Multiple stack-based buffer overflows in University of Minnesota gopher client 3.0.9 allow remote malicious servers to execute arbitrary code via (1) a long \+VIEWS:\ reply which is not properly handled in the VIfromLine function and (2) certain arguments when launching third party programs such as a web browser from a web link which is not properly handled in the FIOgetargv function.


Multiple integer underflows in Kismet before 2005-08-R1 allow remote attackers to execute arbitrary code via (1) kernel headers in a pcap file or (2) data frame dissection which leads to heap-based buffer overflows.


Buffer overflow in Bluetooth FTP client (BTFTP) in Nokia Affix 2.1.2 and 3.2.0 allows remote attackers to execute arbitrary code via a long filename in an OBEX file share.


Unspecified vulnerability in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4 XP SP1 and SP2 and Server 2003 SP1 related to \An unchecked buffer\ and possibly buffer overflows allows remote attackers to execute arbitrary code via a crafted Windows Metafile (WMF) format image aka \Windows Metafile Vulnerability.\


Buffer overflow in invscout in IBM AIX 5.1.0 through 5.3.0 might allow local users to execute arbitrary code via a long command line argument.


Buffer overflow in the mail_valid_net_parse_work function in mail.c for Washington's IMAP Server (UW-IMAP) before imap-2004g allows remote attackers to execute arbitrary code via a mailbox name containing a single double-quote (\) character without a closing quote which causes bytes after the double-quote to be copied into a buffer indefinitely.


Buffer overflow in ad_pcm.c in MPlayer 1.0pre7 and earlier allows remote attackers to execute arbitrary code via crafted PCM audio data as demonstrated using a video file with an audio header containing a large value in a stream format (strf) chunk.


The aupair service (aupair.exe) in Cisco CallManager (CCM) 3.2 and earlier 3.3 before 3.3(5) 4.0 before 4.0(2a)SR2b and 4.1 4.1 before 4.1(3)SR1 allows remote attackers to execute arbitrary code or corrupt memory via crafted packets that trigger a memory allocation failure and lead to a buffer overflow.


Buffer overflow in SlimFTPd 3.15 and 3.16 allows remote authenticated users to execute arbitrary code via a long directory name to (1) LIST (2) DELE or (3) RNFR commands.


Buffer overflow in traceroute in Mac OS X 10.3.9 allows local users to execute arbitrary code via unknown vectors.


Buffer overflow in Domain Name Relay Daemon (DNRD) before 2.19.1 allows remote attackers to execute arbitrary code via a large number of large DNS packets with the Z and QR flags cleared.


Buffer overflow in ping in Mac OS X 10.3.9 allows local users to execute arbitrary code.


Buffer overflow in Winamp 5.03a 5.09 and 5.091 and other versions before 5.094 allows remote attackers to execute arbitrary code via an MP3 file with a long ID3v2 tag such as (1) ARTIST or (2) TITLE.


Buffer overflow in WinAce 2.6.0.5 and possibly earlier versions allows remote attackers to execute arbitrary code via a temporary (.tmp) file that contains an entry with a long file name.


Buffer overflow in dwrcs.exe in DameWare Mini Remote Control before 4.9.0 allows remote attackers to execute arbitrary code via the username.


Multiple stack-based buffer overflows in GoodTech SMTP server 5.16 allow remote attackers to execute arbitrary code via (1) a RCPT TO command with a long DNS name or (2) a large number of RCPT TO commands with a long e-mail name arugment in the last command.


Buffer overflow in Sysinternals Process Explorer 9.23 and other versions before 9.25 allows local users to execute arbitrary code via a long CompanyName field in the VersionInfo information in a running process.


Buffer overflow in LeapFTP allows remote attackers to execute arbitrary code via a long Host string in a Site Queue (.lsq) file.


Stack-based buffer overflow in the ACE archive decompression library (vrAZace.dll) in HAURI Anti-Virus products including ViRobot Expert 4.0 Advanced Server Linux Server 2.0 and LiveCall when compressed file scanning is enabled allows remote attackers to execute arbitrary code via an ACE archive that contains a file with a long filename.


Buffer overflow in AppKit for Mac OS X 10.3.9 and 10.4.2 allows external user-assisted attackers to execute arbitrary code via a crafted Rich Text Format (RTF) file.


Buffer overflow in addschup in HAURI ViRobot 2.0 and possibly other products allows remote attackers to execute arbitrary code via a long ViRobot_ID cookie (HTTP_COOKIE).


Buffer overflow in utility.cpp in Turquoise SuperStat (turqstat) 2.2.4 and earlier might allow remote NNTP servers to execute arbitrary code via a date with a long month.


Buffer overflow in multiple \p\ commands in IBM AIX 5.1 5.2 and 5.3 might allow local users to execute arbitrary code via long command line arguments to (1) penable or other hard-linked files including (2) pdisable (3) pstart (4) phold (5) pdelay or (6) pshare.


Buffer overflow in CoreFoundation in Mac OS X 10.3.9 allows attackers to execute arbitrary code via command line arguments to an application that uses CoreFoundation.


Stack-based

buffer

overflow

in

the

WinACE

third-party

compression

utility

before

as

used

in

multiple

products

including

ALZip

through

Servant

Salamander

and

Beta

WinHKI

and

ExtractNow

Total

Commander

Anti-Trojan

PowerArchiver

before

UltimateZip

and

Where

Is

It

(WhereIsIt)

FilZip

IZArc

Eazel

Rising

Antivirus

and

earlier

AutoMate

BitZipper

ZipTV

and

other

products

allows

user-assisted

attackers

to

execute

arbitrary

code

via

a

long

filename

in

an

ACE

archive.


Stack-based buffer overflow in the init_syms function in MySQL 4.0 before 4.0.25 4.1 before 4.1.13 and 5.0 before 5.0.7-beta allows remote authenticated users who can create user-defined functions to execute arbitrary code via a long function_name field.


Buffer overflow in libclamav/upx.c in Clam AntiVirus (ClamAV) before 0.87 allows remote attackers to execute arbitrary code via a crafted UPX packed executable.


Multiple heap-based and stack-based buffer overflows in certain DCOM server components in VERITAS Storage Exec Storage Exec 5.3 before Hotfix 9 and StorageCentral 5.2 before Hot Fix 2 allow remote attackers to execute arbitrary code via certain ActiveX controls.


Buffer overflow in QuickDraw Manager for Apple OS X 10.3.9 and 10.4.2 as used by applications such as Safari Mail and Finder allows remote attackers to execute arbitrary code via a crafted PICT file.


Buffer overflow in Directory Services in Mac OS X 10.3.9 and 10.4.2 allows remote attackers to execute arbitrary code during authentication.


Stack-based buffer overflow in the _chm_find_in_PMGL function in chm_lib.c for chmlib before 0.36 as used in products such as KchmViewer allows user-assisted attackers to execute arbitrary code via a CHM file containing a long element a different vulnerability than CVE-2005-3318.


Buffer overflow in apply.cgi in Linksys WRT54G 3.01.03 3.03.6 and possibly other versions before 4.20.7 allows remote attackers to execute arbitrary code via a long HTTP POST request.


Buffer overflow in AppKit for Mac OS X 10.3.9 and 10.4.2 as used in applications such as TextEdit allows external user-assisted attackers to execute arbitrary code via a crafted Microsoft Word file.


Buffer overflow in KillProcess 2.20 and earlier allows user-assisted attackers to execute arbitrary code via an exe file with a long FileDescription in the version resource.


Multiple stack-based buffer overflows in the RTF import feature in AbiWord before 2.2.11 allow user-assisted attackers to execute arbitrary code via an RTF file with long identifiers which are not properly handled in the (1) ParseLevelText (2) getCharsInsideBrace (3) HandleLists (4) or (5) HandleAbiLists functions in ie_imp_RTF.cpp a different vulnerability than CVE-2005-2964.


Heap-based buffer overflow in vidplin.dll in RealPlayer 10 and 10.5 (6.0.12.1040 through 1069) RealOne Player v1 and v2 RealPlayer 8 and RealPlayer Enterprise allows remote attackers to execute arbitrary code via an .avi file with a modified strf structure value.


Multiple stack-based buffer overflows in Autonomy (formerly Verity) KeyView SDK before 9.2.0 as used in Lotus Notes 6.5.4 and 7.0 allow remote attackers to execute arbitrary code via (1) a UUE file containing an encoded file with a long filename handled by uudrdr.dll (2) a compressed ZIP file with a long filename handled by kvarcve.dll (3) a TAR archive with a long filename that is extracted to a directory with a long path handled by the TAR reader (tarrdr.dll) (4) an email that contains a long HTTP FTP or // link handled by the HTML speed reader (htmsr.dll) or (5) an email containing a crafted long link handled by the HTML speed reader (htmsr.dll).


Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program there are not many scenarios under which it poses a vulnerability unless unzip is passed long arguments when it is invoked from other programs.


Buffer overflow in Dropbear server before 0.47 allows authenticated users to execute arbitrary code via unspecified inputs that cause insufficient memory to be allocated due to an incorrect expression that does not enforce the proper order of operations.


Heap-based buffer overflow in Dec2Rar.dll 3.2.14.3 as distributed in the Symantec Antivirus Library and used by various Symantec products allows remote attackers to execute arbitrary code via RAR archives with sub-block headers that contain incorrect values in the length field.


Buffer overflow in Mercury Mail Transport System 4.01b allows remote attackers to execute arbitrary code via a long request to TCP port 105.


Buffer overflow in Appfluent Technology Database IDS 2.0 allows local users to execute arbitrary code via a long APPFLUENT_HOME environment variable.


Buffer overflow in WinRAR 3.50 and earlier allows local users to execute arbitrary code via a long command-line argument. NOTE: because this program executes with the privileges of the invoking user and because remote programs do not normally have the ability to specify a command-line argument for this program there may not be a typical attack vector for the issue that crosses privilege boundaries. Therefore this may not be a vulnerability.


Stack-based buffer overflow in Qualcomm WorldMail 3.0 allows remote attackers to execute arbitrary code via a long IMAP command that ends with a \}\ character as demonstrated using long (1) LIST (2) LSUB (3) SEARCH TEXT (4) STATUS INBOX (5) AUTHENTICATE (6) FETCH (7) SELECT and (8) COPY commands.


Stack-based buffer overflows in the (1) xmlvarcharfromfile (2) xmlclobfromfile (3) xmlfilefromvarchar and (4) xmlfilefromclob function calls in IBM DB2 8.1 allow remote attackers to execute arbitrary code via a 94-byte second argument which causes the return address to be overwritten with a pointer to the argument.


Buffer overflow in Electric Sheep 2.6.3 client allows local users to execute arbitrary code via a long window-id parameter. NOTE: because the program is not setuid and not normally called from remote programs there may not be a typical attack vector for the issue that crosses privilege boundaries. Therefore this may not be a vulnerability.


Buffer overflow in MTink in the printer-filters-utils package allows local users to execute arbitrary code via a long HOME environment variable.


Buffer overflow in Golden FTP Server 1.92 allows remote attackers to execute arbitrary code via a long APPE command. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Buffer overflow in MailEnable Professional 1.71 and earlier and Enterprise 1.1 and earlier allows remote authenticated users to execute arbitrary code via a long IMAP EXAMINE command.


** DISPUTED ** Buffer overflow in mIRC 5.91 6.03 6.12 and 6.16 allows local users to execute arbitrary code via a long string that is entered after reaching the DCC Get Folder Dialog. NOTE: this issue has been disputed by the vendor saying \as far as I can tell this is neither an exploit nor a vulnerability. The above report describes a local bug in mIRC.\ It could be that this is only exploitable by the user of the application and thus would not cross privilege boundaries unless under an otherwise restrictive environment such as a kiosk.


Heap-based buffer overflow in the NAT networking components vmnat.exe and vmnet-natd in VMWare Workstation 5.5 GSX Server 3.2 ACE 1.0.1 and Player 1.0 allows remote authenticated attackers including guests to execute arbitrary code via crafted (1) EPRT and (2) PORT FTP commands.


Buffer overflow in multiple Multi-Tech Systems MultiVOIP devices with firmware before x.08 allows remote attackers to execute arbitrary code via a long INVITE field in a Session Initiation Protocol (SIP) packet.


Multiple stack-based buffer overflows in the phpcups PHP module for CUPS 1.1.23rc1 might allow context-dependent attackers to execute arbitrary code via vectors that result in long function parameters as demonstrated by the cups_get_dest_options function in phpcups.c.


Buffer overflow in Watchfire AppScan QA 5.0.609 and 5.0.134 allows remote web servers to execute arbitrary code via an HTTP 401 response with a WWW-Authenticate header containing a long Realm field.


Buffer overflow in BlueCoat (a) WinProxy before 6.1a and (b) the web console access functionality in ProxyAV before 2.4.2.3 allows remote attackers to execute arbitrary code via a long Host: header.


Buffer overflow in the archive decompression library (vrAZMain.dll 5.8.22.137) as used in HAURI anti-virus products including (1) ViRobot Expert 4.0 (2) ViRobot Advanced Server and (3) HAURI LiveCall allows user-assisted attackers to execute arbitrary code via an ALZ archive containing a file with a long filename.


Buffer overflow in Seunghyun Seo's MSN666 MSN Sniffer 1.0 and 1.0.1 allows remote attackers to execute arbitrary code via a long MSN packet.


Buffer overflow in ssldump 0.9b2 and earlier when running in decryption mode allows remote attackers to execute arbitrary code via a long RSA PreMasterSecret.


Buffer overflow in BrowseFTP 1.62 client allows remote FTP servers to execute arbitrary code via a long FTP \220\ message reply.


Buffer overflow in Advanced TFTP (atftp) 0.5 and 0.6 if installed setuid or setgid may allow local users to execute arbitrary code via a long argument to the -g option.


Buffer overflow in axspawn.c in Axspawn-pam before 0.2.1a allows remote attackers to execute arbitrary code via large packets.


Buffer overflow in Enceladus Server Suite 3.9 allows remote attackers to execute arbitrary code via a long CD (CWD) command.


Buffer overflow in the sun.awt.windows.WDefaultFontCharset Java class implementation in Netscape 4.0 allows remote attackers to execute arbitrary code via an applet that calls the WDefaultFontCharset constructor with a long string and invokes the canConvert method.


Buffer overflow in tftpd of TFTP32 2.21 and earlier allows remote attackers to execute arbitrary code via a long filename argument.


Samba before 2.2.5 does not properly terminate the enum_csc_policy data structure which may allow remote attackers to execute arbitrary code via a buffer overflow attack.


Buffer overflow in PFinger 0.7.8 client allows remote attackers to execute arbitrary code via a long query value passed to the (1) finger program (2) -l (3) -d and (4) -t options. NOTE: if PFinger is not setuid or setgid then this issue would not cross privilege boundaries and would not be considered a vulnerability.


Buffer overflow in Trillian 0.73 allows remote IRC servers to execute arbitrary code via a long PING response.


Buffer overflow in rcp in Solaris 9.0 allows local users to execute arbitrary code via a long command line argument.


Buffer overflow in Links 2.0 pre4 allows remote attackers to crash client browsers and possibly execute arbitrary code via gamma tables in large 16-bit PNG images.


Buffer overflow in Webster HTTP Server allows remote attackers to execute arbitrary code via a long URL.


Buffer overflow in libc in Compaq Tru64 4.0F 5.0 5.1 and 5.1A allows attackers to execute arbitrary code via long (1) LANG and (2) LOCPATH environment variables.


Buffer overflow in the GNU DataDisplay Debugger (DDD) 3.3.1 allows local users to execute arbitrary code and possibly gain privileges via a long HOME environment variable. NOTE: since DDD is not installed setuid or setgid perhaps this issue should not be included in CVE.


Buffer overflow in badmin.c in BannerWheel 1.0 allows remote attackers to execute arbitrary code via a long rcmd command.


Buffer overflow in Borland InterBase 6.0 allows local users to execute arbitrary code via a long INTERBASE environment variable when calling (1) gds_drop (2) gds_lock_mgr or (3) gds_inet_server.


Multiple buffer overflows in Cyrus Sieve / libSieve 2.1.2 and earlier allow remote attackers to execute arbitrary code via (1) a long header name (2) a long IMAP flag or (3) a script that generates a large number of errors that overflow the resulting error string.


Buffer overflow in Webresolve 0.1.0 and earlier allows remote attackers to execute arbitrary code by connecting to the server from an IP address that resolves to a long hostname.


Buffer overflow in ZMailer before 2.99.51_1 allows remote attackers to execute arbitrary code during HELO processing from an IPv6 address possibly using an address that resolves to a long hostname.


Buffer overflow in Talentsoft Web+ 5.0 allows remote attackers to execute arbitrary code via an HTTP request with a long cookie.


Buffer overflow in efax 0.9 and earlier when installed setuid root allows local users to execute arbitrary code via a long -x argument.


Buffer overflow in VMware Authorization Service for VMware GSX Server 2.0.0 build-2050 allows remote authenticated users to execute arbitrary code via a long GLOBAL argument.


Buffer overflow in AuthFilter ISAPI filter on Microsoft Commerce Server 2000 allows remote attackers to execute arbitrary code via long authentication data.


Buffer overflow in ndcfg command for UnixWare 7.1.1 and Open UNIX 8.0.0 allows local users to execute arbitrary code via a long command line.


Buffer overflow in CodeBlue 4 and earlier and possibly other versions allows remote attackers to execute arbitrary code via a long string in an SMTP reply.


Buffer overflow in Low BandWidth X proxy (lbxproxy) in Solaris 8 allows local users to execute arbitrary code via a long display command line option.


Buffer overflow in Real Networks RealPlayer 8.0 and earlier allows remote attackers to execute arbitrary code via a header length value that exceeds the actual length of the header.


Buffer overflow in SNMP daemon (snmpd) on SGI IRIX 6.5 through 6.5.15m allows remote attackers to execute arbitrary code via an SNMP request.


Buffer overflow in webpsvc.exe for Talentsoft Web+ 5.0 and earlier allows remote attackers to execute arbitrary code via a long argument to webplus.exe program which triggers the overflow in webpsvc.exe.


Buffer overflow in index.cgi administration interface for Boozt! Standard 0.9.8 allows local users to execute arbitrary code via a long name field when creating a new banner.


Buffer overflow in AuthFilter ISAPI filter on Microsoft Commerce Server 2000 and 2002 allows remote attackers to execute arbitrary code via long authentication data aka \New Variant of the ISAPI Filter Buffer Overrun\.


Buffer overflows in icecast 1.3.11 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request from an MP3 client.


Buffer overflow in Netwin WebNews CGI program 1.1 Webnews.exe allows remote attackers to execute arbitrary code via a long group argument.


Buffer overflow in bulk insert procedure of Microsoft SQL Server 2000 including Microsoft SQL Server Desktop Engine (MSDE) 2000 allows attackers with database administration privileges to execute arbitrary code via a long filename in the BULK INSERT query.


Buffer overflow in the implementation of an HTML directive in mshtml.dll in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code via a web page that specifies embedded ActiveX controls in a way that causes 2 Unicode strings to be concatenated.


Buffer overflow in DNS resolver functions that perform lookup of network names and addresses as used in BIND 4.9.8 and ported to glibc 2.2.5 and earlier allows remote malicious DNS servers to execute arbitrary code through a subroutine used by functions such as getnetbyname and getnetbyaddr.


Buffer overflow in TNS Listener for Oracle 9i Database Server on Windows systems and Oracle 8 on VM allows local users to execute arbitrary code via a long SERVICE_NAME parameter which is not properly handled when writing an error message to a log file.


Buffer overflow in SHOUTcast 1.8.9 and other versions before 1.8.12 allows a remote authenticated DJ to execute arbitrary code on the server via a long value in a header whose name begins with \icy-\.


Buffer overflow in Eterm of Enlightenment Imlib2 1.0.4 and earlier allows local users to execute arbitrary code via a long HOME environment variable.


Buffer overflow in several Database Consistency Checkers (DBCCs) for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows members of the db_owner and db_ddladmin roles to execute arbitrary code.


Buffer overflow in InstantServers MiniPortal 1.1.5 and earlier allows remote attackers to execute arbitrary code via a long login name which is not properly handled by the logging utility.


Buffer overflow in ClanLib library 0.5 may allow local users to execute arbitrary code in games that use the library such as (1) Super Methane Brothers (2) Star War (3) Kwirk (4) Clankanoid and others via a long HOME environment variable.


Buffer overflow in Windows Shell (used as the Windows Desktop) allows local and possibly remote attackers to execute arbitrary code via a custom URL handler that has not been removed for an application that has been improperly uninstalled.


Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt).


Buffer overflows in (1) php_mime_split in PHP 4.1.0 4.1.1 and 4.0.6 and earlier and (2) php3_mime_split in PHP 3.0.x allows remote attackers to execute arbitrary code via a multipart/form-data HTTP POST request when file_uploads is enabled.


Buffer overflow in Remote Access Service (RAS) phonebook for Windows NT 4.0 2000 XP and Routing and Remote Access Server (RRAS) allows local users to execute arbitrary code by modifying the rasphone.pbk file to use a long dial-up entry.


Buffer overflow in Talentsoft Web+ 5.0 and earlier allows remote attackers to execute arbitrary code via a long Web Markup Language (wml) file name to (1) webplus.dll or (2) webplus.exe.


Buffer overflow in Internet Mail Connector (IMC) for Microsoft Exchange Server 5.5 allows remote attackers to execute arbitrary code via an EHLO request from a system with a long name as obtained through a reverse DNS lookup which triggers the overflow in IMC's hello response.


Buffer overflow in (1) gv 3.5.8 and earlier (2) gvv 1.0.2 and earlier (3) ggv 1.99.90 and earlier (4) gnome-gv and (5) kghostview in kdegraphics 2.2.2 and earlier allows attackers to execute arbitrary code via a malformed (a) PDF or (b) PostScript file which is processed by an unsafe call to sscanf.


Buffer overflow in Common Desktop Environment (CDE) ToolTalk RPC database server (rpc.ttdbserverd) allows remote attackers to execute arbitrary code via an argument to the _TT_CREATE_FILE procedure.


Buffer overflow in gxnsapi6.dll NSAPI plugin of the Connector Module for Sun ONE Application Server before 6.5 allows remote attackers to execute arbitrary code via a long HTTP request URL.


Buffer overflow in MySQL daemon (mysqld) before 3.23.50 and 4.0 beta before 4.02 on the Win32 platform allows local users to execute arbitrary code via a long \datadir\ parameter in the my.ini initialization file whose permissions on Windows allow Full Control to the Everyone group.


Buffer overflow in the password encryption function of Microsoft SQL Server 2000 including Microsoft SQL Server Desktop Engine (MSDE) 2000 allows remote attackers to gain control of the database and execute arbitrary code via SQL Server Authentication aka \Unchecked Buffer in Password Encryption Procedure.\


Buffer overflow in Sun AnswerBook2 1.4 through 1.4.3 allows remote attackers to execute arbitrary code via a long filename argument to the gettransbitmap CGI program.


Buffer overflow in GNU Chess (gnuchess) 5.02 and earlier if modified or used in a networked capacity contrary to its own design as a single-user application may allow local or remote attackers to execute arbitrary code via a long command.


Buffer overflows in Ecartis (formerly Listar) 1.0.0 before snapshot 20020125 allows remote attackers to execute arbitrary code via (1) address_match() of mystring.c or (2) other functions in tolist.c.


Buffer overflow in PGP Corporate Desktop 7.1.1 allows remote attackers to execute arbitrary code via an encrypted document that has a long filename when it is decrypted.


Buffer overflow in mIRC 5.91 and earlier allows a remote server to execute arbitrary code on the client via a long nickname.


Multiple buffer overflows in Advanced Maryland Automatic Network Disk Archiver (AMANDA) 2.3.0.4 allow (1) remote attackers to execute arbitrary code via long commands to the amindexd daemon or certain local users to execute arbitrary code via long command line arguments to the programs (2) amcheck (3) amgetidx (4) amtrmidx (5) createindex-dump or (6) createindex-gnutar.


Buffer overflow in various decoders in Ettercap 0.6.3.1 and earlier when running on networks with an MTU greater than 2000 allows remote attackers to execute arbitrary code via large packets.


Buffer overflow in Flash OCX for Macromedia Flash 6 revision 23 (6 0 23 0) allows remote attackers to execute arbitrary code via a long movie parameter.


Buffer overflows in OpenSSL 0.9.6d and earlier and 0.9.7-beta2 and earlier allow remote attackers to execute arbitrary code via (1) a large client master key in SSL2 or (2) a large session ID in SSL3.


Buffer overflows in mpg321 before 0.2.9 allows local and possibly remote attackers to execute arbitrary code via a long URL to (1) a command line option (2) an HTTP request or (3) an FTP request.


Buffer overflow in hanterm 3.3.1 and earlier allows local users to execute arbitrary code via a long string in the (1) -fn (2) -hfb or (3) -hfn argument.


Multiple buffer overflows in mnews 1.22 and earlier allow (1) a remote NNTP server to execute arbitrary code via long responses or local users can gain privileges via long command line arguments (2) -f (3) -n (4) -D (5) -M or (6) -P or via long environment variables (7) JNAMES or (8) MAILSERVER.


Buffer overflows in Lugiment Log Explorer before 3.02 allow attackers with database permissions to execute arbitrary code via long arguments to the extended stored procedures (1) xp_logattach_StartProf (2) xp_logattach_setport or (3) xp_logattach.


Buffer overflow in WS_FTP FTP Server 3.1.1 allows remote authenticated users to execute arbitrary code via a long SITE CPWD command.


Buffer overflows in the DNS stub resolver library in ISC BIND 4.9.2 through 4.9.10 and other derived libraries such as BSD libc and GNU glibc allow remote attackers to execute arbitrary code via DNS server responses that trigger the overflow in the (1) getnetbyname or (2) getnetbyaddr functions aka \LIBRESOLV: buffer overrun\ and a different vulnerability than CVE-2002-0684.


Buffer overflow in ipcs for HP Tru64 UNIX 4.0f through 5.1a may allow attackers to execute arbitrary code a different vulnerability than CVE-2001-0423.


Buffer overflows in Yahoo! Messenger 5 0 0 1064 and earlier allows remote attackers to execute arbitrary code via a ymsgr URI with long arguments to (1) call (2) sendim (3) getimv (4) chat (5) addview or (6) addfriend.


Buffer overflow in rwcgi60 CGI program for Oracle Reports Server 6.0.8.18.0 and earlier as used in Oracle9iAS and other products allows remote attackers to execute arbitrary code via a long database name parameter.


Buffer overflow in Winhlp32.exe allows remote attackers to execute arbitrary code via an HTML document that calls the HTML Help ActiveX control (HHCtrl.ocx) with a long pathname in the Item parameter.


Buffer overflow in xpilot-server for XPilot 4.5.0 and earlier allows remote attackers to execute arbitrary code.


Buffer overflow in SQL Server 7.0 and 2000 allows remote attackers to execute arbitrary code via a long OLE DB provider name to (1) OpenDataSource or (2) OpenRowset in an ad hoc connection.


Buffer overflow in Chinput 3.0 allows local users to execute arbitrary code via a long HOME environment variable.


Buffer overflow in search.cgi in mnoGoSearch 3.1.19 and earlier allows remote attackers to execute arbitrary code via a long query (q) parameter.


Buffer overflow in gopher client for Microsoft Internet Explorer 5.1 through 6.0 Proxy Server 2.0 or ISA Server 2000 allows remote attackers to execute arbitrary code via a gopher:// URL that redirects the user to a real or simulated gopher server that sends a long response.


Buffer overflow in OpenSSL 0.9.7 before 0.9.7-beta3 with Kerberos enabled allows attackers to execute arbitrary code via a long master key.


Buffer overflow in CWMail.exe in NetWin before 2.8a allows remote authenticated users to execute arbitrary code via a long item parameter.


Buffer overflow in ICQ before 2001B Beta v5.18 Build #3659 allows remote attackers to execute arbitrary code via a Voice Video & Games request.


Buffer overflow in Jabber plug-in for Gaim client before 0.58 allows remote attackers to execute arbitrary code.


Buffer overflow in ippRead function of CUPS before 1.1.14 may allow attackers to execute arbitrary code via long attribute names or language values.


Buffer overflow in Sun ONE / iPlanet Web Server 4.1 and 6.0 allows remote attackers to execute arbitrary code via an HTTP request using chunked transfer encoding.


Off-by-one buffer overflow in the ssl_compat_directive function as called by the rewrite_command hook for mod_ssl Apache module 2.8.9 and earlier allows local users to execute arbitrary code as the Apache server user via .htaccess files with long entries.


Buffer overflows in netstd 3.07-17 package allows remote DNS servers to execute arbitrary code via a long FQDN reply as observed in the utilities (1) linux-ftpd (2) pcnfsd (3) tftp (4) traceroute or (5) from/to.


Buffer overflows in xtell (xtelld) 1.91.1 and earlier and 2.x before 2.7 allows remote attackers to execute arbitrary code via (1) a long DNS hostname that is determined using reverse DNS lookups (2) a long AUTH string or (3) certain data in the xtell request.


Buffer overflow in University of Washington imap server (uw-imapd) imap-2001 (imapd 2001.315) and imap-2001a (imapd 2001.315) with legacy RFC 1730 support and imapd 2000.287 and earlier allows remote authenticated users to execute arbitrary code via a long BODY request.


Buffer overflow in Eudora 5.1.1 and 5.0-J for Windows and possibly other versions allows remote attackers to execute arbitrary code via a multi-part message with a long boundary string.


Buffer overflow in YoungZSoft CMailServer 3.30 allows remote attackers to execute arbitrary code via a long USER argument.


Buffer overflow in Webalizer 2.01-06 when configured to use reverse DNS lookups allows remote attackers to execute arbitrary code by connecting to the monitored web server from an IP address that resolves to a long hostname.


Buffer overflow in plDaniels ripMime 1.2.6 and earlier as used in other programs such as xamime and inflex allows remote attackers to execute arbitrary code via an attachment in a long filename.


Buffer overflow in lukemftp FTP client in SuSE 6.4 through 8.0 and possibly other operating systems allows a malicious FTP server to execute arbitrary code via a long PASV command.


Buffer overflow in BlackMoon FTP Server 1.0 through 1.5 allows remote attackers to execute arbitrary code via a long argument to (1) USER (2) PASS or (3) CWD.


Buffer overflow in EasyBoard 2000 1.27 (aka EZboard) allows remote attackers to execute arbitrary code via a long boundary value in a multipart Content-Type header to (1) ezboard.cgi (2) ezman.cgi or (3) ezadmin.cgi.


Buffer overflow in (1) sastcpd in SAS/Base 8.0 and 8.1 or (2) objspawn in SAS/Integration Technologies 8.0 and 8.1 allows local users to execute arbitrary code via large command line argument.


Buffer overflow in Matu FTP client 1.74 allows remote FTP servers to execute arbitrary code via a long \220\ banner.


Buffer overflow in telnet server in Windows 2000 and Interix 2.2 allows remote attackers to execute arbitrary code via malformed protocol options.


The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23 and Apache-SSL before 1.3.22+1.46 does not properly initialize memory using the i2d_SSL_SESSION function which allows remote attackers to use a buffer overflow to execute arbitrary code via a large client certificate that is signed by a trusted Certificate Authority (CA) which produces a large serialized session.


Buffer overflow in WTRS_UI.EXE (WTX_REMOTE.DLL) for WebTrends Reporting Center 4.0d allows remote attackers to execute arbitrary code via a long HTTP GET request to the /reports/ directory.


Buffer overflow in Oracle iSQL*Plus web application of the Oracle 9 database server allows remote attackers to execute arbitrary code via a long USERID parameter in the isqlplus URL.


Multiple buffer overflows in HP Tru64 UNIX 5.x allow local users to execute arbitrary code via (1) a long -contextDir argument to dtaction (2) a long -p argument to dtprintinfo (3) a long -customization argument to dxterm or (4) a long DISPLAY environment variable to dtterm.


Buffer overflow in Winamp 2.81 allows remote attackers to execute arbitrary code via a long Artist ID3v2 tag in an MP3 file.


Buffer overflow in Van Dyke SecureCRT SSH client before 3.4.6 and 4.x before 4.0 beta 3 allows an SSH server to execute arbitrary code via a long SSH1 protocol version string.


Buffer overflow in log2mail before 0.2.5.1 allows remote attackers to execute arbitrary code via a long log message.


Buffer overflow in certain RPC routines in IBM AIX 4.3 may allow attackers to execute arbitrary code related to a \variable data type.\


Buffer overflow in Alsaplayer 0.99.71 when installed setuid root allows local users to execute arbitrary code via a long (1) -f or (2) -o command line argument.


Buffer overflow in dxterm allows local users to execute arbitrary code via a long -xrm argument.


Buffer overflow in Fake Identd 0.9 through 1.4 allows remote attackers to execute arbitrary code as root via a long request that is split into multiple packets.


Buffer overflow in ypmatch in HP Tru64 UNIX 5.1a 5.1 5.0a 4.0g and 4.0f allows local users to execute arbitrary code.


Multiple buffer overflows in RealOne and RealPlayer allow remote attackers to execute arbitrary code via (1) a Synchronized Multimedia Integration Language (SMIL) file with a long parameter (2) a long long filename in a rtsp:// request e.g. from a .m3u file or (3) certain \Now Playing\ options on a downloaded file with a long filename.


Buffer overflow in XML parser in wsabi.dll of Winamp 3 (1.0.0.488) allows remote attackers to execute arbitrary code via a skin file (.wal) with a long include file tag.


Buffer overflow in Volume Manager daemon (vold) of Sun Solaris 2.5.1 through 8 allows local users to execute arbitrary code via unknown attack vectors.


Buffer overflow in John Franks WN Server 1.18.2 through 2.0.0 allows remote attackers to execute arbitrary code via a long GET request.


Buffer overflow in tnslsnr of Oracle 8i Database Server 8.1.5 for Linux allows local users to execute arbitrary code as the oracle user via a long command line argument.


Buffer overflow in inc mail utility for Compaq Tru64/OSF1 3.x allows local users to execute arbitrary code via a long MH environment variable.


Buffer overflow in sqllib/security/db2ckpw for IBM DB2 Universal Database 6.0 and 7.0 allows local users to execute arbitrary code via a long username that is read from a file descriptor argument.


Multiple buffer overflows in Tomahawk SteelArrow before 4.5 allow remote attackers to execute arbitrary code via (1) the Steelarrow Service (Steelarrow.exe) using a long UserIdent Cookie header (2) DLLHOST.EXE (Steelarrow.dll) via a request for a long .aro file or (3) DLLHOST.EXE via a Chunked Transfer-Encoding request.


Buffer overflow in MyWebServer 1.02 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.


Multiple

buffer

overflows

in

QNX

may

allow

local

users

to

execute

arbitrary

code

via

long

command

line

arguments

to

sample

ex

du

find

lex

mkdir

rm

serserv

tcpserv

termdef

time

unzip

use

wcc

wd

wdisasm

which

wlib

wlink

wpp

wprof

write

or

wstrip.


Buffer overflow in traceroute-nanog (aka traceroute-ng) may allow local users to execute arbitrary code via a long hostname argument.


Buffer overflow in errpt in AIX 4.3.3 allows local users to execute arbitrary code as root.


Buffer overflow in efstools in Bonobo when installed setuid allows local users to execute arbitrary code via long command line arguments.


Buffer overflow in Composer in Netscape 4.77 allows local users to overwrite process memory and execute arbitrary code via a font tag with a long face attribute.


Buffer overflow in Savant Web Server 3.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.


Buffer overflow in uux in eoe.sw.uucp package of SGI IRIX 6.5 through 6.5.17 allows local users to execute arbitrary code via unknown attack vectors.


Buffer overflow in PlanetDNS PlanetWeb 1.14 and earlier allows remote attackers to execute arbitrary code via (1) an HTTP GET request with a long URL or (2) a request with a long method name.


Buffer overflow in GoAhead WebServer 2.1 allows remote attackers to execute arbitrary code via a long HTTP GET request with a large number of subdirectories.


Buffer overflow in setlocale in libc on NetBSD 1.4.x through 1.6 and possibly other operating systems when called with the LC_ALL category allows local attackers to execute arbitrary code via a user-controlled locale string that has more than 6 elements which exceeds the boundaries of the new_categories category array as exploitable through programs such as xterm and zsh.


Buffer overflow in Window Maker (wmaker) 0.80.0 and earlier may allow remote attackers to execute arbitrary code via a certain image file that is not properly handled when Window Maker uses width and height information to allocate a buffer.


Multiple buffer overflows in HP Tru64 UNIX allow local and possibly remote attackers to execute arbitrary code via a long NLSPATH environment variable to (1) csh (2) dtsession (3) dxsysinfo (4) imapd (5) inc (6) uucp (7) uux (8) rdist or (9) deliver.


Buffer overflow in gdam123 0.933 and 0.942 allows local users to execute arbitrary code via a long filename parameter.


Buffer overflow in the S/MIME Parsing capability in Microsoft Outlook Express 5.5 and 6.0 allows remote attackers to execute arbitrary code via a digitally signed email with a long \From\ address which triggers the overflow when the user views or previews the message.


Heap-based buffer overflow in snmpnetstat for ucd-snmp 4.2.3 and earlier and net-snmp allows remote attackers to execute arbitrary code via multiple getnextrequest PDU messages with conflicting ifindex variables which cause snmpnetstat to write variable data past the end of an array.


jobs.c in Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly use the strncat function call when processing the options string which allows remote attackers to execute arbitrary code via a buffer overflow attack.


Buffer overflow in talkd on NetBSD 1.6 and earlier and possibly other operating systems may allow remote attackers to execute arbitrary code via a long inbound message.


Buffer overflow in Light HTTPd (lhttpd) 0.1 allows remote attackers to execute arbitrary code via a long HTTP GET request.


Buffer overflow in IRCIT 0.3.1 IRC client allows remote attackers to execute arbitrary code via a long invite request.


Heap-based buffer overflow in Fetchmail 6.1.3 and earlier does not account for the \@\ character when determining buffer lengths for local addresses which allows remote attackers to execute arbitrary code via a header with a large number of local addresses.


Multiple buffer overflows in RealNetworks Helix Universal Server 9.0 (9.0.2.768) allow remote attackers to execute arbitrary code via (1) a long Transport field in a SETUP RTSP request (2) a DESCRIBE RTSP request with a long URL argument or (3) two simultaneous HTTP GET requests with long arguments.


Buffer overflow in traceroute in HP Tru64 UNIX 5.1a 5.1 5.0a 4.0g and 4.0f allows local users to execute arbitrary code.


Buffer overflow in Linuxconf before 1.28r4 allows local users to execute arbitrary code via a long LINUXCONF_LANG environment variable which overflows an error string that is generated.


Buffer overflow in named in BIND 4 versions 4.9.10 and earlier and 8 versions 8.3.3 and earlier allows remote attackers to execute arbitrary code via a certain DNS server response containing SIG resource records (RR).


The kadm_ser_in function in (1) the Kerberos v4compatibility administration daemon (kadmind4) in the MIT Kerberos 5 (krb5) krb5-1.2.6 and earlier (2) kadmind in KTH Kerberos 4 (eBones) before 1.2.1 and (3) kadmind in KTH Kerberos 5 (Heimdal) before 0.5.1 when compiled with Kerberos 4 support does not properly verify the length field of a request which allows remote attackers to execute arbitrary code via a buffer overflow attack.


Buffer overflow in RealJukebox 2 1.0.2.340 and 1.0.2.379 and RealOne Player Gold 6.0.10.505 allows remote attackers to execute arbitrary code via an RFS skin file whose skin.ini contains a long value in a CONTROLnImage argument such as CONTROL1Image.


Buffer overflow in mIRC 6.0.2 and earlier allows remote attackers to execute arbitrary code via a long $asctime value.


Buffer overflow in pop3trap.exe for PC-cillin 2000 2002 and 2003 allows local users to execute arbitrary code via a long input string to TCP port 110 (POP3).


Buffer overflow in WorldClient.cgi in WorldClient in Alt-N Technologies MDaemon 5.0.5.0 and earlier allows local users to execute arbitrary code via a long folder name (NewFolder parameter).


Multiple buffer overflows in OpenLDAP2 (OpenLDAP 2) 2.2.0 and earlier allow remote attackers to execute arbitrary code via (1) long -t or -r parameters to slurpd (2) a malicious ldapfilter.conf file that is not properly handled by getfilter functions (3) a malicious ldaptemplates.conf that causes an overflow in libldap (4) a certain access control list that causes an overflow in slapd or (5) a long generated filename for logging rejected replication requests.


Buffer overflow in AN HTTPd 1.38 through 1.4.1c allows remote attackers to execute arbitrary code via a SOCKS4 request with a long username.


Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields related to sender and recipient header comments as processed by the crackaddr function of headers.c.


Buffer overflow in uucp in Compaq Tru64/OSF1 3.x allows local users to execute arbitrary code via a long source (-s) command line parameter.


Multiple buffer overflows in LISa on KDE 2.x for 2.1 and later and KDE 3.x before 3.0.4 allow (1) local and possibly remote attackers to execute arbitrary code via the \lisa\ daemon and (2) remote attackers to execute arbitrary code via a certain \lan://\ URL.


Buffer overflow in SmartMax MailMax POP3 daemon (popmax) 4.8 allows remote attackers to execute arbitrary code via a long USER command.


Buffer overflows in Computer Associates MLink (CA-MLink) 6.5 and earlier may allow local users to execute arbitrary code via long command line arguments to (1) mlclear or (2) mllock.


Buffer overflow in KON kon2 0.3.9b and earlier allows local users to execute arbitrary code via a long -Coding command line argument.


Buffer overflow in backup utility of Microsoft Windows 95 allows attackers to execute arbitrary code by causing a filename with a long extension to be placed in a folder to be backed up.


Buffer overflow in the Database Console Command (DBCC) that handles user inputs in Microsoft SQL Server 7.0 and 2000 including Microsoft Data Engine (MSDE) 1.0 and Microsoft Desktop Engine (MSDE) 2000 allows attackers to execute arbitrary code via a long SourceDB argument in a \non-SQL OLEDB data source\ such as FoxPro a variant of CAN-2002-0644.


Stack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow user-assisted attackers to execute arbitrary code via an an invalid RealText (rt) subtitle file related to the ParseRealText function in modules/demux/subtitle.c. NOTE: this issue was SPLIT from CVE-2008-5032 on 20081110.


Buffer overflow in Foxmail 6.5 allows remote attackers to execute arbitrary code via a long mailto URI in the HREF attribute of an A element.


Stack-based buffer overflow in VideoLAN VLC media player 0.5.0 through 0.9.5 might allow user-assisted attackers to execute arbitrary code via the header of an invalid CUE image file related to modules/access/vcd/cdrom.c. NOTE: this identifier originally included an issue related to RealText but that issue has been assigned a separate identifier CVE-2008-5036.


Multiple heap-based buffer overflows in xine-lib 1.1.12 and other 1.1.15 and earlier versions allow remote attackers to execute arbitrary code via vectors related to (1) a crafted EBML element length processed by the parse_block_group function in demux_matroska.c; (2) a certain combination of sps w and h values processed by the real_parse_audio_specific_data and demux_real_send_chunk functions in demux_real.c; and (3) an unspecified combination of three values processed by the open_ra_file function in demux_realaudio.c. NOTE: vector 2 reportedly exists because of an incomplete fix in 1.1.15.


Heap-based

buffer

overflow

in

in

the

mbstring

extension

in

PHP

through

allows

context-dependent

attackers

to

execute

arbitrary

code

via

a

crafted

string

containing

an

HTML

entity

which

is

not

properly

handled

during

Unicode

conversion

related

to

the

and

functions.


Heap-based buffer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier might allow remote attackers to execute arbitrary code via a crafted TrueType font file.


Buffer overflow in the CallHTMLHelp method in the Microsoft Windows Media Services ActiveX control in nskey.dll 4.1.00.3917 in Windows Media Services on Microsoft Windows NT and 2000 and Avaya Media and Message Application servers allows remote attackers to execute arbitrary code via a long argument. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


The Local ZIM Server (zcs.exe) in Zilab Chat and Instant Messaging (ZIM) Server 2.1 and earlier allow remote attackers to execute arbitrary code via (1) heap-based buffer overflows involving multiple vectors including a long room name and a long source account and (2) a stack-based buffer overflow with a long username in an information request. NOTE: some of these details are obtained from third party information.


Multiple buffer overflows in Opera before 9.63 might allow (1) remote attackers to execute arbitrary code via a crafted text area or allow (2) user-assisted remote attackers to execute arbitrary code via a long host name in a file: URL. NOTE: this might overlap CVE-2008-5178.


Multiple buffer overflows in Client Software WinCom LPD Total 3.0.2.623 and earlier allow remote attackers to execute arbitrary code via (1) a long 0x02 command to the remote administration service on TCP port 13500 or (2) a long invalid control filename to LPDService.exe on TCP port 515.


Multiple buffer overflows in the (1) recognize_eps_file function (src/psgen.c) and (2) tilde_subst function (src/util.c) in GNU enscript 1.6.1 and possibly earlier might allow remote attackers to execute arbitrary code via an epsf escape sequence with a long filename.


Heap-based buffer overflow in the demux_real_send_chunk function in src/demuxers/demux_real.c in xine-lib before 1.1.15 allows remote attackers to execute arbitrary code via a crafted Real Media file. NOTE: some of these details are obtained from third party information.


Buffer overflow in No-IP DUC 2.1.7 and earlier allows remote HTTP servers to execute arbitrary code via a crafted response to a DNS update request related to a missing length check in the GetNextLine function.


Heap-based buffer overflow in the PDFVIEW.PdfviewCtrl.1 ActiveX control in pdfview.ocx 2.0.0.1 in VeryDOC PDF Viewer OCX Control allows remote attackers to execute arbitrary code via a long first argument to the OpenPDF method. NOTE: some of these details are obtained from third party information.