Buffer overflow in ntdll.dll on Microsoft Windows NT 4.0 Windows NT 4.0 Terminal Server Edition Windows 2000 and Windows XP allows remote attackers to execute arbitrary code as demonstrated via a WebDAV request to IIS 5.0.


Multiple stack-based buffer overflows in the error handling routines of the minires library as used in the NSUPDATE capability for ISC DHCPD 3.0 through 3.0.1RC10 allow remote attackers to execute arbitrary code via a DHCP message containing a long hostname.

buffer overflow
arbitrary code execution


Buffer overflow in search.cgi for mnoGoSearch 3.2.10 allows remote attackers to execute arbitrary code via a long tmplt parameter.


ProFTPD 1.2.7 through 1.2.9rc2 does not properly translate newline characters when transferring files in ASCII mode which allows remote attackers to execute arbitrary code via a buffer overflow using certain files.


Buffer overflow in Netris 0.52 and earlier and possibly other versions allows remote malicious Netris servers to execute arbitrary code on netris clients via a long server response.


Heap-based buffer overflow in smtp_in.c for Exim 3 (exim3) before 3.36 and Exim 4 (exim4) before 4.21 may allow remote attackers to execute arbitrary code via an invalid (1) HELO or (2) EHLO argument with a large number of spaces followed by a NULL character and a newline which is not properly trimmed before the \(no argument given)\ string is appended to the buffer.


Buffer overflow in unknown versions of Maelstrom allows local users to execute arbitrary code via a long -player command line argument.


Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed DCERPC DCOM object activation request packet with modified length fields a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0528.


Buffer overflow in iwconfig allows local users to execute arbitrary code via a long HOME environment variable.


Buffer overflow in omega-rpg 0.90 allows local users to execute arbitrary code via a long (1) command line or (2) environment variable.


Buffer overflow in FastTrack (FT) network code as used in Kazaa 2.0.2 and possibly other versions and products allows remote attackers to execute arbitrary code via a packet containing a large list of supernodes aka \Packet 0' death.\


Buffer overflow in zblast-svgalib of zblast 1.2.1 and earlier allows local users to execute arbitrary code via the high score file.


Buffer overflow in openlog function for PHP 4.3.1 on Windows operating system and possibly other OSes allows remote attackers to cause a crash and possibly execute arbitrary code via a long filename argument.


Buffer overflow in the H.323 filter of Microsoft Internet Security and Acceleration Server 2000 allows remote attackers to execute arbitrary code in the Microsoft Firewall Service via certain H.323 traffic as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol.


Buffer overflow in PINE before 4.58 allows remote attackers to execute arbitrary code via a malformed message/external-body MIME type.


The pop_msg function in qpopper 4.0.x before 4.0.5fc2 does not null terminate a message buffer after a call to Qvsnprintf which could allow authenticated users to execute arbitrary code via a buffer overflow in a mdef command with a long macro name.


Buffer overflow in search.cgi for mnoGoSearch 3.1.20 allows remote attackers to execute arbitrary code via a long ul parameter.


Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execute arbitrary code via a malformed RPC request with a long filename parameter a different vulnerability than CVE-2003-0352 (Blaster/Nachi) and CVE-2003-0715.


Buffer overflow in gbnserver for Gnome Batalla Naval 1.0.4 allows remote attackers to execute arbitrary code via a long connection string.


Buffer overflow in mah-jong 1.5.6 and earlier allows remote attackers to execute arbitrary code.


Buffer overflow in Firebird 1.0.2 and other versions before 1.5 and possibly other products that use the InterBase codebase allows local users to execute arbitrary code via a long INTERBASE environment variable when calling (1) gds_inet_server (2) gds_lock_mgr or (3) gds_drop.


Buffer overflow in WebAdmin.exe for WebAdmin allows remote attackers to execute arbitrary code via an HTTP request to WebAdmin.dll with a long USER argument.


Buffer overflow in Maelstrom 3.0.6 3.0.5 and earlier allows local users to execute arbitrary code via a long -server command line argument.


Buffer overflow in autorespond may allow remote attackers to execute arbitrary code as the autorespond user via qmail.


Stack-based buffer overflow in mod_gzip_printf for mod_gzip 1.3.26.1a and earlier and possibly later official versions when running in debug mode allows remote attackers to execute arbitrary code via a long filename in a GET request with an \Accept-Encoding: gzip\ header.


Buffer overflow in ORACLE.EXE for Oracle Database Server 9i 8i 8.1.7 and 8.0.6 allows remote attackers to execute arbitrary code via a long username that is provided during login as exploitable through client applications that perform their own authentication as demonstrated using LOADPSP.


Buffer overflow in catmail for ListProc 8.2.09 and earlier allows remote attackers to execute arbitrary code via a long ULISTPROC_UMASK value.


Buffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library as used in Microsoft Windows NT 4.0 SP6a 2000 SP2 through SP4 XP SP1 Server 2003 NetMeeting Windows 98 and Windows ME allows remote attackers to execute arbitrary code via PCT 1.0 handshake packets.


The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks as demonstrated using the parseaddr function in parseaddr.c.


Buffer overflow in CuteFTP 5.0 allows remote attackers to execute arbitrary code via a long response to a LIST command.


Buffer overflow in rwrite for HP-UX 11.0 could allow local users to execute arbitrary code via a long argument. NOTE: the vendor was unable to reproduce the problem on a system that had been patched for an lp vulnerability (CVE-2002-1473).


Buffer overflow in cmd.exe in Windows NT 4.0 may allow local users to execute arbitrary code via a long pathname argument to the cd command.


Buffer overflow in Opera 6.05 and 6.06 and possibly other versions allows remote attackers to execute arbitrary code via a URL with a long username.


Buffer overflow in cd9660.util in Apple Mac OS X 10.0 through 10.3.2 and Apple Mac OS X Server 10.0 through 10.3.2 may allow local users to execute arbitrary code via a long command line parameter.


Buffer overflow in pamverifier in Change Manager (CM) 1.0 for Sun Management Center (SunMC) 3.0 on Solaris 8 and 9 on the sparc platform allows remote attackers to execute arbitrary code via unspecified vectors.


Buffer overflow in AbsoluteTelnet before 2.12 RC10 allows remote attackers to execute arbitrary code via a long window title.


Buffer overflow in ISMail 1.4.3 and earlier allow remote attackers to execute arbitrary code via long domain names in (1) MAIL FROM or (2) RCPT TO fields.


Buffer overflow in TelCondex SimpleWebServer 2.12.30210 Build3285 allows remote attackers to execute arbitrary code via a long HTTP Referer header.


Buffer overflow in Symantec Norton AntiVirus 2002 allows remote attackers to execute arbitrary code via an e-mail attachment with a compressed ZIP file that contains a file with a long filename.


Multiple buffer overflows in SmartFTP 1.0.973 and other versions before 1.0.976 allow remote attackers to execute arbitrary code via (1) a long response to a PWD command which triggers a stack-based overflow and (2) a long line in a response to a file LIST command which triggers a heap-based overflow.


Buffer overflow in wall for HP-UX 10.20 through 11.11 may allow local users to execute arbitrary code by calling wall with a large file as an argument.


Buffer overflow in DameWare Mini Remote Control before 3.73 allows remote attackers to execute arbitrary code via a long pre-authentication request to TCP port 6129.


Multiple stack-based buffer overflows in Atrium MERCUR IMAPD in MERCUR Mailserver before 4.2.15.0 allow remote attackers to execute arbitrary code via a long (1) EXAMINE (2) DELETE (3) SUBSCRIBE (4) RENAME (5) UNSUBSCRIBE (6) LIST (7) LSUB (8) STATUS (9) LOGIN (10) CREATE or (11) SELECT command.


Buffer overflow in mIRC before 6.11 allows remote attackers to execute arbitrary code via a long irc:// URL.


Buffer overflow in Proxomitron Naoko 4.4 allows remote attackers to execute arbitrary code via a long request.


Buffer overflow in Musicqueue 1.2.0 allows local users to execute arbitrary code via a long language variable in the configuration file.


Buffer overflow in NIPrint 4.10 allows remote attackers to execute arbitrary code via a long string to TCP port 515.


Buffer overflow in the SockPrintf function in wu-ftpd 2.6.2 and earlier when compiled with MAIL_ADMIN option enabled on a system that supports very long pathnames might allow remote anonymous users to execute arbitrary code by uploading a file with a long pathname which triggers the overflow when wu-ftpd constructs a notification message to the administrator.


Multiple buffer overflows in Oracle 9i 9 before 9.2.0.3 allow local users to execute arbitrary code by (1) setting the TIME_ZONE session parameter to a long value or providing long parameters to the (2) NUMTOYMINTERVAL (3) NUMTODSINTERVAL or (4) FROM_TZ functions.


Buffer overflow in LTris 1.0.1 of FreeBSD Ports Collection 2003-02-25 and earlier allows local users to execute arbitrary code with gid \games\ permission via a long HOME environment variable.


Buffer overflow in disable of HP-UX 11.0 may allow local users to execute arbitrary code via a long argument to the (1) -r or (2)-c options.


Buffer overflow in zgv in svgalib 1.2.10 and earlier allows local users to execute arbitrary code via a long HOME environment variable.


Buffer overflow in nlps_server in Sun Solaris x86 2.4 2.5 and 2.5.1 allows remote attackers to execute arbitrary code as root via a long string beginning with \NLPS:002:002:\ to the listen (aka System V listener) port TCP port 2766.


A buffer overflow exists in the HELO command in Trend Micro Interscan VirusWall SMTP gateway 3.23/3.3 for NT which may allow an attacker to execute arbitrary code.


Buffer overflow in nslookup for AIX 4.3 allows local users to execute arbitrary code via a long hostname command line argument.


Computalynx CMail 2.4 and CMail 2.3 SP2 SMTP servers are vulnerable to a buffer overflow attack in the MAIL FROM command that may allow a remote attacker to execute arbitrary code on the server.


Buffer overflow in rwhod on AIX and other operating systems allows remote attackers to execute arbitrary code via a UDP packet with a long hostname.


Buffer overflow in lpr as used in BSD-based systems including Linux allows local users to execute arbitrary code as root via a long -C (classification) command line option.


Buffer overflow in YoungZSoft CCProxy 6.2 and earlier allows remote attackers to execute arbitrary code via a long address in a ping (p) command to the Telnet proxy service a different vector than CVE-2004-2416.


Buffer overflow in the IsValidFile function in the ADM ActiveX control for Altnet Download Manager 4.0.0.4 and earlier as used in Kazaa Media Desktop 1.3 through 2.6.4 and Grokkster 1.3 through 2.6 allows remote attackers to execute arbitrary code via a long bstrFilepath parameter.


Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.


Buffer overflow in Bochs before 2.1.1 if installed setuid allows local users to execute arbitrary code via a long HOME environment variable which is used if the .bochsrc bochsrc and bochsrc.txt cannot be found in a known path. NOTE: some external documents recommend that Bochs be installed setuid root so this should be treated as a vulnerability.


Buffer overflow in Omnicron OmniHTTPd 3.0a and earlier allows remote attackers to execute arbitrary code via an HTTP GET request with a long Range header.


Buffer overflow in XBoard 4.2.7 and earlier might allow local users to execute arbitrary code via a long -icshost command line argument. NOTE: since the program is not setuid and not normally called from remote programs there may not be a typical attack vector for the issue that crosses privilege boundaries. Therefore this may not be a vulnerability.


Buffer overflow in snmpd in ucd-snmp 4.2.6 and earlier when installed setuid root allows local users to execute arbitrary code via a long -p command line argument. NOTE: it is not clear whether there are any standard configurations in which snmpd is installed setuid or setgid. If not then this issue should not be included in CVE.


Buffer overflow in the IMAP service of MailEnable Professional Edition 1.52 and Enterprise Edition 1.01 allows remote attackers to execute arbitrary code via (1) a long command string or (2) a long string to the MEIMAP service and then terminating the connection.


Buffer overflow in Need for Speed Hot Pursuit 2.0 client (NFSHP2) version 242 and earlier allows remote attackers (servers) to execute arbitrary code via long (1) gamename (2) gamever (3) hostname (4) gametype (5) mapname or (6) gamemode commands.


Stack-based and heap-based buffer overflows in ProxyNow! 2.75 and earlier allow remote attackers to execute arbitrary code via a GET request with a long ftp:// URL.


Multiple buffer overflows in EnderUNIX isoqlog 2.1.1 allow remote attackers to execute arbitrary code via the (1) parseQmailFromBytesLine (2) parseQmailToRemoteLine (3) parseQmailToLocalLine (4) parseSendmailFromBytesLine (5) parseSendmailToLine (6) parseEximFromBytesLine and (7) parseEximToLine functions in Parser.c; allow local users to execute arbitrary code via the (8) lowercase and (9) check_syslog_date functions in Parser.c and (10) unspecified functions in Dir.c; and allow unspecified attackers to execute arbitrary code via the (11) loadconfig and (12) removespaces functions in loadconfig.c the (13) loadLang function in LangCfg.c and (14) unspecified functions in Html.c.


Buffer overflow in SoftCart.exe in Mercantec SoftCart 4.00b allows remote attackers to execute arbitrary code via a long parameter in an HTTP GET request.


Multiple stack-based and heap-based buffer overflows in EnderUNIX spamGuard before 1.7-BETA allow remote attackers to execute arbitrary code via the (1) qmail_parseline and (2) sendmail_parseline functions in parser.c (3) loadconfig and (4) removespaces functions in loadconfig.c and possibly (5) unspecified functions in functions.c.


Buffer overflow in SlimFTPd 3.15 and earlier allows local users to execute arbitrary code via a long command such as (1) CWD (2) STOR (3) MKD and (4) STAT.


Buffer overflow in Cscope 15.5 and possibly multiple overflows allows remote attackers to execute arbitrary code via a C file with a long #include line that is later browsed by the target.


Buffer overflow in Eudora for Windows 5.2.1 6.0.3 and 6.1 allows remote attackers to execute arbitrary code via an e-mail with (1) a link to a long URL to the C drive or (2) a long attachment name.


Buffer overflow in ShixxNote 6.net build 117 allows remote attackers to execute arbitrary code via a long font field.


Multiple buffer overflows in the PPPoE daemon (PPPoEd) in QNX RTP 6.1 allow remote attackers to execute arbitrary code via a long argument to the (1) -F (2) name (3) en (4) upscript (5) downscript (6) retries (7) timeout (8) scriptdetach (9) noscript (10) nodetach (11) remote_mac or (12) local_mac flags.


Heap-based buffer overflow in the DVD subpicture decoder in xine xine-lib 1-rc5 and earlier allows remote attackers to execute arbitrary code via a (1) DVD or (2) MPEG subpicture header where the second field reuses RLE data from the end of the first field.


Buffer overflow in proxyd for Cyrus IMAP Server 2.2.9 and earlier with the imapmagicplus option enabled may allow remote attackers to execute arbitrary code a different vulnerability than CVE-2004-1011.


Buffer overflow in PSNormalizer for Apple Mac OS X 10.3.6 allows remote attackers to execute arbitrary code via a crafted PostScript input file.


Integer underflow in winhlp32.exe in Windows NT Windows 2000 through SP4 Windows XP through SP2 and Windows 2003 allows remote attackers to execute arbitrary code via a malformed .hlp file which leads to a heap-based buffer overflow.


Buffer overflow in ascontrol.dll in Panda ActiveScan 5.0 allows remote attackers to execute arbitrary code via the Internacional property followed by a long string.


Buffer overflow in dxterm in Ultrix 4.5 allows local users to execute arbitrary code via a long -setup parameter.


Buffer overflow in Vypress Messenger 3.5.1 and earlier allows remote attackers to execute arbitrary code via a message with a long first field.


Buffer overflow in BlackJumboDog 3.x allows remote attackers to execute arbitrary code via long FTP commands such as (1) USER (2) PASS (3) RETR (4) CWD (5) XMKD and (6) XRMD.


Buffer overflow in Crystal FTP Client 2.8 allows remote malicious servers to execute arbitrary code via a response to a LIST command that contains a file name with a long extension.


Buffer overflow in Privateer's Bounty: Age of Sail II allows remote attackers to execute arbitrary code via a long nickname.


The add_to_history function in svr_principal.c in libkadm5srv for MIT Kerberos 5 (krb5) up to 1.3.5 when performing a password change does not properly track the password policy's history count and the maximum number of keys which can cause an array index out-of-bounds error and may allow authenticated users to execute arbitrary code via a heap-based buffer overflow.


Buffer overflow in Open Dc Hub 0.7.14 allows remote attackers with administrator privileges to execute arbitrary code via a long RedirectAll command.


Buffer overflow in MailCarrier 2.51 allows remote attackers to execute arbitrary code via a long (1) EHLO and possibly (2) HELO command.


Buffer overflow in Info-Zip 2.3 and possibly earlier versions when using recursive folder compression allows remote attackers to execute arbitrary code via a ZIP file containing a long pathname.


Buffer overflow in Icecast 2.0.1 and earlier allows remote attackers to execute arbitrary code via an HTTP request with a large number of headers.


Stack-based buffer overflow in the client for Citrix Program Neighborhood Agent for Win32 8.00.24737 and earlier and Citrix MetaFrame Presentation Server client for WinCE before 8.33 allows remote attackers to execute arbitrary code via a long cached icon filename in the InName XML element.


Buffer overflow in British National Corpus SARA (sarad) allows remote attackers to execute arbitrary code by calling the client with a long string.


Buffer overflow in the WodFtpDLX.ocx (WeOnlyDo!) ActiveX component before 2.3.2.97 as used by CoffeeCup Direct FTP 6.2.0.62 and CoffeeCup Free FTP 3.0.0.10 and possibly other applications allows remote attackers to execute arbitrary code via a long filename.


Buffer overflow in blaxxun 3D 7.0 allows remote attackers to execute arbitrary code via a long URL property inside an object tag.


Buffer overflow in Ability Server 2.34 and possibly other versions allows remote attackers to execute arbitrary code via a long STOR command.


Buffer overflow in Ability Server 2.25 2.32 2.34 and possibly other versions allows remote attackers to execute arbitrary code via a long APPE command.


Buffer overflow in paginit in AIX 5.1 through 5.3 allows local users to execute arbitrary code via a long username.


Buffer overflow in extproc in Oracle 10g allows remote attackers to execute arbitrary code via environment variables in the library name which are expanded after the length check is performed.


Heap-based buffer overflow in Internet Explorer 6 allows remote attackers to execute arbitrary code via long (1) SRC or (2) NAME attributes in IFRAME FRAME and EMBED elements as originally discovered using the mangleme utility aka \the IFRAME vulnerability\ or the \HTML Elements Vulnerability.\


Buffer overflow in Kinesphere eXchange POP3 allows remote attackers to execute arbitrary code via a long MAIL FROM field.


Multiple buffer overflows in Ipswitch WS_FTP Server 4.0.2 (1) allow remote authenticated users to execute arbitrary code by causing a large error string to be generated by the ALLO handler or (2) may allow remote FTP administrators to execute arbitrary code by causing a long hostname or username to be inserted into a reply to a STAT command while a file is being transferred.


Buffer overflow in CMailCOM.dll in CMailServer 5.2 allows remote attackers to execute arbitrary code via an attachment with a long filename.


Buffer overflow in InnerMedia DynaZip DUNZIP32.dll file version 5.00.03 and earlier allows remote attackers to execute arbitrary code via a ZIP file containing a file with a long filename as demonstrated using (1) a .rjs (skin) file in RealPlayer 10 through RealPlayer 10.5 (6.0.12.1053) RealOne Player 1 and 2 (2) the Restore Backup function in CheckMark Software Payroll 2004/2005 3.9.6 and earlier (3) CheckMark MultiLedger before 7.0.2 (4) dtSearch 6.x and 7.x (5) mcupdmgr.exe and mghtml.exe in McAfee VirusScan 10 Build 10.0.21 and earlier (6) IBM Lotus Notes before 6.5.5 and other products. NOTE: it is unclear whether this is the same vulnerability as CVE-2004-0575 although the data manipulations are the same.


Multiple buffer overflows in LCDProc 0.4.1 and possibly other 0.4.x versions up to 0.4.4 allows remote attackers to execute arbitrary code via (1) a long invalid command to parse_all_client_messages function or (2) long argv command to test_func_func function.


Buffer overflow in unarj before 2.63a-r2 allows remote attackers to execute arbitrary code via an arj archive that contains long filenames.


Buffer overflow in Entrust LibKmp ISAKMP library as used by Symantec Enterprise Firewall 7.0 through 8.0 Gateway Security 5300 1.0 Gateway Security 5400 2.0 and VelociRaptor 1.5 allows remote attackers to execute arbitrary code via a crafted ISAKMP payload.


HyperTerminal application for Windows NT 4.0 Windows 2000 Windows XP and Windows Server 2003 does not properly validate the length of a value that is saved in a session file which allows remote attackers to execute arbitrary code via a malicious HyperTerminal session file (.ht) web site or Telnet URL contained in an e-mail message triggering a buffer overflow.


The Network News Transfer Protocol (NNTP) component of Microsoft Windows NT Server 4.0 Windows 2000 Server Windows Server 2003 Exchange 2000 Server and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns possibly related to improper length validation and an \unchecked buffer \ leading to off-by-one and heap-based buffer overflows.


Buffer overflow in the uudecoding feature for Adobe Acrobat Reader 5.0.5 and 5.0.6 for Unix and Linux and possibly other versions including those before 5.0.9 allows remote attackers to execute arbitrary code via a long filename for the PDF file that is provided to the uudecode command.


Multiple buffer overflows in Overkill (0verkill) 0.15pre3 might allow local users to execute arbitrary code in the client via a long HOME environment variable in the (1) load_cfg and (2) save_cfg functions; possibly allow remote attackers to execute arbitrary code via long strings to (3) the send_message function; and in the server via (4) the parse_command_line function.


Multiple stack-based buffer overflows in the get_header function in header.c for LHA 1.14 as used in products such as Barracuda Spam Firewall allow remote attackers or local users to execute arbitrary code via long directory or file names in an LHA archive which triggers the overflow when testing or extracting the archive.


Buffer overflow in (1) queue.c and (2) queued.c in queue before 1.30.1 may allow remote attackers to execute arbitrary code.


Buffer overflow in fsp before 2.81.b18 allows remote users to execute arbitrary code.


Buffer overflow in Real Networks RealPlayer 10 allows remote attackers to execute arbitrary code via a URL with a large number of \.\ (period) characters.


k5admind (kadmind) for Heimdal allows remote attackers to execute arbitrary code via a Kerberos 4 compatibility administration request whose framing length is less than 2 which leads to a heap-based buffer overflow.


Buffer overflow in the extract_one function from lhext.c in LHA may allow attackers to execute arbitrary code via a long w (working directory) command line option a different issue than CVE-2004-0769. NOTE: this issue may be REJECTED if there are not any cases in which LHA is setuid or is otherwise used across security boundaries.


Buffer overflow in the WriteToLog function for JRun 3.0 through 4.0 web server connectors such as (1) mod_jrun and (2) mod_jrun20 for Apache with verbose logging enabled allows remote attackers to execute arbitrary code via a long HTTP header Content-Type field or other fields.


Buffer overflow in LHA allows remote attackers to execute arbitrary code via long pathnames in LHarc format 2 headers for a .LHZ archive as originally demonstrated using the \x\ option but also exploitable through \l\ and \v\ and fixed in header.c a different issue than CVE-2004-0771.


Multiple stack-based buffer overflows in the word-list-compress functionality in compress.c for Aspell allow local users to execute arbitrary code via a long entry in the wordlist that is not properly handled when using the (1) \c\ compress option or (2) \d\ decompress option.


Buffer overflow in uustat in Sun Solaris 8 and 9 allows local users to execute arbitrary code via a long -S command line argument.


Stack-based buffer overflow in AppleFileServer for Mac OS X 10.3.3 and earlier allows remote attackers to execute arbitrary code via a LoginExt packet for a Cleartext Password User Authentication Method (UAM) request with a PathName argument that includes an AFPName type string that is longer than the associated length field.


Buffer overflow in WIDCOMM Bluetooth Connectivity Software as used in products such as BTStackServer 1.3.2.7 and 1.4.2.10 Windows XP and Windows 98 with MSI Bluetooth Dongles and HP IPAQ 5450 running WinCE 3.0 allows remote attackers to execute arbitrary code via certain service requests.


Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component GDIPlus.dll allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.


Buffer overflow in ReadFontAlias from dirfile.c of XFree86 4.1.0 through 4.3.0 allows local users and remote attackers to execute arbitrary code via a font alias file (font.alias) with a long token a different vulnerability than CVE-2004-0084 and CVE-2004-0106.


Buffer overflow in the KSDWRTB function in the dbms_system package (dbms_system.ksdwrt) for Oracle 9i Database Server Release 2 9.2.0.3 and 9.2.0.4 9i Release 1 9.0.1.4 and 9.0.1.5 and 8i Release 1 8.1.7.4 allows remote authorized users to execute arbitrary code via a long second argument.


Buffer overflow in The Core Foundation framework (CoreFoundation.framework) in Mac OS X 10.2.8 10.3.4 and 10.3.5 allows local users to execute arbitrary code via a certain environment variable.


rquotad in nfs-utils (rquota_server.c) before 1.0.6-r6 on 64-bit architectures does not properly perform an integer conversion which leads to a stack-based buffer overflow and allows remote attackers to execute arbitrary code via a crafted NFS request.


Heap-based buffer overflow in Oracle 9i Application Server Web Cache 9.0.4.0.0 9.0.3.1.0 9.0.2.3.0 and 9.0.0.4.0 allows remote attackers to execute arbitrary code via a long HTTP request method header to the Web Cache listener. NOTE: due to the vagueness of the Oracle advisory it is not clear whether there are additional issues besides this overflow although the advisory alludes to multiple \vulnerabilities.\


The POSIX component of Microsoft Windows NT and Windows 2000 allows local users to execute arbitrary code via certain parameters possibly by modifying message length values and causing a buffer overflow.


Buffer overflow in Red Faction client 1.20 and earlier allows remote servers to execute arbitrary code via a long server name.


Heap-based buffer overflow in the search_for_command function of ltrace 0.3.10 if it is installed setuid could allow local users to execute arbitrary code via a long filename. NOTE: It is unclear whether there are any packages that install ltrace as a setuid program so this candidate might be REJECTed.


Buffer overflow in htget 0.93 allows remote attackers to execute arbitrary code via a crafted URL.


Network Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98 Windows NT 4.0 Windows 2000 Windows XP and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an \unchecked buffer \ possibly a buffer overflow.


Multiple stack-based buffer overflows in the ICQ parsing routines of the ISS Protocol Analysis Module (PAM) component as used in various RealSecure Proventia and BlackICE products allow remote attackers to execute arbitrary code via a SRV_MULTI response containing a SRV_USER_ONLINE response packet and a SRV_META_USER response packet with long (1) nickname (2) firstname (3) lastname or (4) email address fields as exploited by the Witty worm.


Buffer overflow in layer2.c in mpg123 0.59r and possibly mpg123 0.59s allows remote attackers to execute arbitrary code via a certain (1) mp3 or (2) mp2 file.


Stack-based buffer overflow in the writeGroup function in nsVCardObj.cpp for Mozilla Firefox before the Preview Release Mozilla before 1.7.3 and Thunderbird before 0.8 allows remote attackers to execute arbitrary code via malformed VCard attachments that are not properly handled when previewing a message.


Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl when mod_ssl is configured to trust the issuing CA may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.


Stack-based buffer overflows in SL Mail Pro 2.0.9 allow remote attackers to execute arbitrary code via (1) user.dll (2) loadpageadmin.dll or (3) loadpageuser.dll.


Heap-based buffer overflow in the ISS Protocol Analysis Module (PAM) as used in certain versions of RealSecure Network 7.0 and Server Sensor 7.0 Proventia A G and M Series RealSecure Desktop 7.0 and 3.6 RealSecure Guard 3.6 RealSecure Sentry 3.6 BlackICE PC Protection 3.6 and BlackICE Server Protection 3.6 allows remote attackers to execute arbitrary code via an SMB packet containing an authentication request with a long username.


Adobe Reader 6.0 does not properly handle null characters when splitting a filename path into components which allows remote attackers to execute arbitrary code via a file with a long extension that is not normally handled by Reader triggering a buffer overflow.


Buffer overflow in the ISAKMP functionality for Check Point VPN-1 and FireWall-1 NG products before VPN-1/FireWall-1 R55 HFA-03 R54 HFA-410 and NG FP3 HFA-325 or VPN-1 SecuRemote/SecureClient R56 may allow remote attackers to execute arbitrary code during VPN tunnel negotiation.


Stack-based buffer overflow in the Task Scheduler for Windows 2000 and XP and Internet Explorer 6 on Windows NT 4.0 allows local or remote attackers to execute arbitrary code via a .job file containing long parameters as demonstrated using Internet Explorer and accessing a .job file on an anonymous share.


Buffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension which is not properly handled when the shell capability launches grpconv.exe.


Stack-based buffer overflow in the SMTP service support in vsmon.exe in Zone Labs ZoneAlarm before 4.5.538.001 ZoneLabs Integrity client 4.0 before 4.0.146.046 and 4.5 before 4.5.085 allows remote attackers to execute arbitrary code via a long RCPT TO argument.


Multiple stack-based buffer overflows in (1) the encode_mime function (2) the encode_uuencode function (3) or the decode_uuencode function for emil 2.1.0 and earlier allow remote attackers to execute arbitrary code via e-mail messages containing attachments with filenames.


Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and earlier may allow remote attackers to execute arbitrary code via malformed image files that trigger the overflows due to improper calls to the gdMalloc function a different set of vulnerabilities than CVE-2004-0990.


Buffer overflow in write_packet in control.c for l2tpd may allow remote attackers to execute arbitrary code.


Buffer overflow in Medal of Honor (1) Allied Assault 1.11v9 and earlier (2) Breakthrough 2.40b and earlier and (3) Spearhead 2.15 and earlier when playing on a Local Area Network (LAN) allows remote attackers to execute arbitrary code via vectors such as (1) the getinfo query (2) the connect packet and other unknown vectors.


Buffer overflow in Zinf 2.2.1 on Windows and other older versions for Linux allows remote attackers or local users to execute arbitrary code via certain values in a .pls file.


Buffer overflow in Serv-U ftp before 5.0.0.4 allows remote authenticated users to execute arbitrary code via a long time zone argument to the MDTM command.


Stack-based buffer overflow in xpm_extract_color (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier and gdk-pixbuf before 0.22 may allow remote attackers to execute arbitrary code via a certain color string. NOTE: this identifier is ONLY for gtk+. It was incorrectly referenced in an advisory for a different issue (CVE-2004-0688).


Stack-based buffer overflow in the SymSpamHelper ActiveX component (symspam.dll) in Norton AntiSpam 2004 as used in Norton Internet Security 2004 allows remote attackers to execute arbitrary code via a long parameter to the LaunchCustomRuleWizard method.


Buffer overflow in the ReadFontAlias function in XFree86 4.1.0 to 4.3.0 when using the CopyISOLatin1Lowered function allows local or remote authenticated users to execute arbitrary code via a malformed entry in the font alias (font.alias) file a different vulnerability than CVE-2004-0083 and CVE-2004-0106.


Buffer overflow in cgi.c in www-sql before 0.5.7 allows local users to execute arbitrary code via a web page that is processed by www-sql.


Buffer overflow in xpcd-svga in xpcd before 2.08 and possibly other versions may allow local users to execute arbitrary code.


The Indexing Service for Microsoft Windows XP and Server 2003 does not properly validate the length of a message which allows remote attackers to execute arbitrary code via a buffer overflow attack.


Multiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2) and possibly other versions may allow remote attackers to execute arbitrary code via (1) a long FTP URL that is not properly handled by the xmlNanoFTPScanURL function (2) a long proxy URL containing FTP data that is not properly handled by the xmlNanoFTPScanProxy function and other overflows related to manipulation of DNS length values including (3) xmlNanoFTPConnect (4) xmlNanoHTTPConnectHost and (5) xmlNanoHTTPConnectHost.


Buffer overflow in TranslateFilename for common.c in MPlayer 1.0pre4 allows remote attackers to execute arbitrary code via a long file name.


Multiple buffer overflows in libpng 1.2.5 and earlier as used in multiple products allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.


Heap-based buffer overflow in ASN.1 decoding library in Check Point VPN-1 products when Aggressive Mode IKE is implemented allows remote attackers to execute arbitrary code by initiating an IKE negotiation and then sending an IKE packet with malformed ASN.1 data.


Heap-based buffer overflow in the Hrtbeat.ocx (Heartbeat) ActiveX control for Internet Explorer 5.01 through 6 when users who visit online gaming sites that are associated with MSN allows remote attackers to execute arbitrary code via the SetupData parameter.


Buffer overflow in Purge Jihad 2.0.1 and earlier allows remote game servers to execute arbitrary code via an information packet that contains large (1) battle type and (2) map name fields.


Buffer overflow in mpg123 before 0.59s-r9 allows remote attackers to execute arbitrary code via frame headers in MP2 or MP3 files.


IBM DB2 for Linux UNIX and Windows 9.2 10.1 10.5 and 11.1 (includes DB2 Connect Server) is vulnerable to a stack-based buffer overflow caused by improper bounds checking which could allow a local attacker to execute arbitrary code. IBM X-Force ID: 125159.


Stack

buffer

overflow

in

httpd

in

Asuswrt-Merlin

firmware

and

earlier

for

ASUS

devices

and

ASUS

firmware

for

ASUS

and

devices

allows

remote

attackers

to

execute

arbitrary

code

on

the

router

by

sending

a

crafted

http

GET

request

packet

that

includes

a

long

parameter

in

the

url.


A Buffer Overflow vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (.arf) files could allow an attacker to execute arbitrary code on a system. An attacker could exploit this vulnerability by providing a user with a malicious .arf file via email or URL and convincing the user to launch the file. Exploitation of this vulnerability could allow arbitrary code execution on the system of the targeted user. This vulnerability affects Cisco WebEx Business Suite meeting sites Cisco WebEx Meetings sites Cisco WebEx Meetings Server and Cisco WebEx ARF players. Cisco Bug IDs: CSCve10729 CSCve10771 CSCve10779 CSCve11521 CSCve11543.


A stack-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Researchers have identified multiple vulnerabilities where there is a lack of proper validation of the length of user-supplied data prior to copying it to a which could allow an attacker to execute arbitrary code under the context of the process.


A heap-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Researchers have identified multiple vulnerabilities where there is a lack of proper validation of the length of user-supplied data prior to copying it to the heap-based buffer which could allow an attacker to execute arbitrary code under the context of the process.


A Heap-Based Buffer Overflow issue was discovered in Advantech WebOP. A maliciously crafted project file may be able to trigger a heap-based buffer overflow which may crash the process and allow an attacker to execute arbitrary code.


Multiple stack-based buffer overflows in TP-Link WR940N WiFi routers with hardware version 4 allow remote authenticated users to execute arbitrary code via the (1) ping_addr parameter to PingIframeRpm.htm or (2) dnsserver2 parameter to WanStaticIpV6CfgRpm.htm.


A buffer overflow in Smart Card authentication code in gpkcsp.dll in Microsoft Windows XP through SP3 and Server 2003 through SP2 allows a remote attacker to execute arbitrary code on the target computer provided that the computer is joined in a Windows domain and has Remote Desktop Protocol connectivity (or Terminal Services) enabled.


Heap-based buffer overflow in Actian Pervasive PSQL v12.10 and Zen v13 allows remote attackers to execute arbitrary code via crafted traffic to TCP port 1583. The overflow occurs after Server-Client encryption-key exchange. The issue results from an integer underflow that leads to a zero-byte allocation. The _srvLnaConnectMP1 function is affected.


Global buffer overflow in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS firmware for ASUS RT-AC5300 RT_AC1900P RT-AC68U RT-AC68P RT-AC88U RT-AC66U RT-AC66U_B1 RT-AC58U RT-AC56U RT-AC55U RT-AC52U RT-AC51U RT-N18U RT-N66U RT-N56U RT-AC3200 RT-AC3100 RT_AC1200GU RT_AC1200G RT-AC1200 RT-AC53 RT-N12HP RT-N12HP_B1 RT-N12D1 RT-N12+ RT_N12+_PRO RT-N16 and RT-N300 devices allows remote attackers to write shellcode at any address in the heap; this can be used to execute arbitrary code on the router by hosting a crafted device description XML document at a URL specified within a Location header in an SSDP response.


Stack

buffer

overflow

in

networkmap

in

Asuswrt-Merlin

firmware

for

ASUS

devices

and

ASUS

firmware

for

ASUS

and

devices

allows

remote

attackers

to

execute

arbitrary

code

on

the

router

by

hosting

a

crafted

device

description

XML

document

(that

includes

a

serviceType

element)

at

a

URL

specified

within

a

Location

header

in

an

SSDP

response.


Stack-based

buffer

overflow

in

in

networkmap

in

Asuswrt-Merlin

firmware

for

ASUS

devices

and

ASUS

firmware

for

ASUS

and

devices

allows

remote

attackers

to

execute

arbitrary

code

via

long

device

information

that

is

mishandled

during

a

strcat

to

a

device

list.


An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the \Kernel\ component. A buffer overflow allows attackers to execute arbitrary code in a privileged context via a crafted app.


Buffer overflow in Hoozin Viewer 2 3 4.1.5.15 and earlier 5.1.2.13 and earlier and 6.0.3.09 and earlier allows remote attackers to execute arbitrary code via specially crafted webpage.


Buffer overflow in HOME SPOT CUBE2 firmware V101 and earlier allows an attacker to execute arbitrary code via WebUI.


An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the \Keyboards\ component. A buffer overflow allows attackers to execute arbitrary code in a privileged context via a crafted app.


Buffer overflow in NTT DOCOMO Wi-Fi STATION L-02F Software version L02F-MDM9625-V10h-JUN-23-2017-DCM-JP and earlier allows an attacker to execute arbitrary code via unspecified vectors.


Buffer overflow in Corega CG-WGR1200 firmware 2.20 and earlier allows an attacker to execute arbitrary code via unspecified vectors.


Buffer overflow in CG-WLR300NM Firmware version 1.90 and earlier allows an attacker to execute arbitrary code via unspecified vectors.


Stack-based buffer overflows in CyberLink LabelPrint 2.5 allow remote attackers to execute arbitrary code via the (1) author (inside the INFORMATION tag) (2) name (inside the INFORMATION tag) (3) artist (inside the TRACK tag) or (4) default (inside the TEXT tag) parameter in an lpp project file.


Certain D-Link products are affected by: Buffer Overflow. This affects DIR-880L 1.08B04 and DIR-895 L/R 1.13b03. The impact is: execute arbitrary code (remote). The component is: htdocs/fileaccess.cgi. The attack vector is: A crafted HTTP request handled by fileacces.cgi could allow an attacker to mount a ROP attack: if the HTTP header field CONTENT_TYPE starts with ''boundary=' followed by more than 256 characters a buffer overflow would be triggered potentially causing code execution.


A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. The application lacks proper validation of the length of user-supplied data prior to copying it to a stack-based buffer which could allow an attacker to execute arbitrary code under the context of the process.


A buffer overflow flaw was found in the way minicom before version 2.7.1 handled VT100 escape sequences. A malicious terminal device could potentially use this flaw to crash minicom or execute arbitrary code in the context of the minicom process.


Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with \If: <http://\ in a PROPFIND request as exploited in the wild in July or August 2016.


An issue was discovered in certain Apple products. Xcode before 9.2 is affected. The issue involves the \ld64\ component. A buffer overflow allows remote attackers to execute arbitrary code via crafted source code.


Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.


A buffer overflow vulnerability in Import Command in SyncBreeze before 10.6 DiskSorter before 10.6 DiskBoss before 8.9 DiskPulse before 10.6 DiskSavvy before 10.6 DupScout before 10.6 and VX Search before 10.6 allows attackers to execute arbitrary code via a crafted XML file containing a long name attribute of a classify element.


Stack-based buffer overflow in the firmware in Broadcom Wi-Fi HardMAC SoC chips when the firmware supports CCKM Fast and Secure Roaming and the feature is enabled in RAM allows remote attackers to execute arbitrary code via a crafted reassociation response frame with a Cisco IE (156).


Buffer overflow in APNGDis 2.8 and below allows a remote attacker to execute arbitrary code via a crafted filename.


Buffer

overflows

in

networkmap

on

ASUS

and

routers

with

firmware

before

routers

with

firmware

before

and

and

Pro

routers

with

firmware

before

and

Asuswrt-Merlin

firmware

before

allow

remote

attackers

to

execute

arbitrary

code

on

the

router

via

a

long

host

or

port

in

crafted

multicast

messages.


Flexense VX Search Enterprise 10.1.12 is vulnerable to a buffer overflow via an empty POST request to a long URI beginning with a /../ substring. This allows remote attackers to execute arbitrary code.


The remote management interface on the Claymore Dual GPU miner 10.1 allows an unauthenticated remote attacker to execute arbitrary code due to a stack-based buffer overflow in the request handler. This can be exploited via a long API request that is mishandled during logging.


A Stack-based Buffer Overflow issue was discovered in Delta Electronics Delta Industrial Automation Screen Editor Version 2.00.23.00 or prior. Stack-based buffer overflow vulnerabilities caused by processing specially crafted .dpb files may allow an attacker to remotely execute arbitrary code.


Buffer

overflow

in

Active

Management

Technology

(AMT)

in

Intel

Manageability

Engine

Firmware

8.x/9.x/10.x/11.0/11.5/11.6/11.7/11.10/11.20

allows

attacker

with

remote

Admin

access

to

the

system

to

execute

arbitrary

code

with

AMT

execution

privilege.


HPE LoadRunner before 12.53 Patch 4 and HPE Performance Center before 12.53 Patch 4 allow remote attackers to execute arbitrary code via unspecified vectors. At least in LoadRunner this is a libxdrutil.dll mxdr_string heap-based buffer overflow.


Stack-based buffer overflows in php_Easycom5_3_0.dll in EasyCom for PHP 4.0.0.29 allows remote attackers to execute arbitrary code via the server argument to the (1) i5_connect (2) i5_pconnect or (3) i5_private_connect API function.


Stack-based buffer overflow in Quick Heal Internet Security 10.1.0.316 and earlier Total Security 10.1.0.316 and earlier and AntiVirus Pro 10.1.0.316 and earlier on OS X allows remote attackers to execute arbitrary code via a crafted LC_UNIXTHREAD.cmdsize field in a Mach-O file that is mishandled during a Security Scan (aka Custom Scan) operation.


Buffer Overflow in the FTP client in LabF nfsAxe 3.7 allows remote FTP servers to execute arbitrary code via a long reply.


Buffer overflow on Dasan GPON ONT WiFi Router H640X 12.02-01121 2.77p1-1124 and 3.03p2-1146 devices allows remote attackers to execute arbitrary code via a long POST request to the login_action function in /cgi-bin/login_action.cgi (aka cgipage.cgi).


A Stack-Based Buffer Overflow issue was discovered in Schneider Electric Wonderware ArchestrA Logger versions 2017.426.2307.1 and prior. The stack-based buffer overflow vulnerability has been identified which may allow a remote attacker to execute arbitrary code in the context of a highly privileged account.


There is a remote stack-based buffer overflow (SEH) in register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1. By sending an overly long username string to registresult.htm for registering the user an attacker may be able to execute arbitrary code.


Buffer overflow in MediaCoder 0.8.48.5888 allows remote attackers to execute arbitrary code via a crafted .m3u file.


Buffer overflow in AudioCoder 0.8.46 allows remote attackers to execute arbitrary code via a crafted .m3u file.


Buffer overflow in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux Adobe AIR before 19.0.0.190 Adobe AIR SDK before 19.0.0.190 and Adobe AIR SDK & Compiler before 19.0.0.190 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-6676.


Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0 8.5.1 and 8.5.2 allows local users to affect availability via unknown vectors related to Outside In Filters a different vulnerability than CVE-2015-4808 CVE-2015-6014 CVE-2015-6015 and CVE-2016-0432. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this issue is a stack-based buffer overflow in Oracle Outside In 8.5.2 and earlier which allows remote attackers to execute arbitrary code via a crafted WK4 file.


Heap-based buffer overflow in the AcroForm implementation in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13 Acrobat and Acrobat Reader DC Classic before 2015.006.30094 and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-6696.


Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0 8.5.1 and 8.5.2 allows local users to affect availability via unknown vectors related to Outside In Filters a different vulnerability than CVE-2015-4808 CVE-2015-6013 CVE-2015-6015 and CVE-2016-0432. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this issue is a stack-based buffer overflow in Oracle Outside In 8.5.2 and earlier which allows remote attackers to execute arbitrary code via a crafted DOC file.


Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13 Acrobat and Acrobat Reader DC Classic before 2015.006.30094 and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-6698.


Multiple stack-based buffer overflows in the Reprise License Manager service in Borland AccuRev allow remote attackers to execute arbitrary code via the (1) akey or (2) actserver parameter to the activate_doit function or (3) licfile parameter to the service_startup_doit functionality.


Buffer overflow in Ricoh DL FTP Server 1.1.0.6 and earlier allows remote attackers to execute arbitrary code via a long USER command.


Heap-based buffer overflow in Windows Journal in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted Journal (.jnt) file aka \Windows Journal Heap Overflow Vulnerability.\


Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0 8.5.1 and 8.5.2 allows local users to affect availability via unknown vectors related to Outside In Filters a different vulnerability than CVE-2015-4808 CVE-2015-6013 CVE-2015-6014 and CVE-2016-0432. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this issue is a stack-based buffer overflow in Oracle Outside In 8.5.2 and earlier which allows remote attackers to execute arbitrary code via a crafted Paradox DB file.


Buffer overflow in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux Adobe AIR before 19.0.0.190 Adobe AIR SDK before 19.0.0.190 and Adobe AIR SDK & Compiler before 19.0.0.190 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-6678.


Buffer overflow in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux Adobe AIR before 19.0.0.213 Adobe AIR SDK before 19.0.0.213 and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via a Loader object with a crafted loaderBytes property.


Multiple buffer overflows in the F1BookView ActiveX control in F1 Bookview in Schneider Electric ProClima before 6.2 allow remote attackers to execute arbitrary code via the (1) Attach (2) DefinedName (3) DefinedNameLocal (4) ODBCPrepareEx (5) ObjCreatePolygon (6) SetTabbedTextEx or (7) SetValidationRule method a different vulnerability than CVE-2015-8561.


Buffer overflow in libc in Apple iOS before 9.2 OS X before 10.11.2 tvOS before 9.1 and watchOS before 2.1 allows remote attackers to execute arbitrary code via a crafted package a different vulnerability than CVE-2015-7039.


Stack-based buffer overflow in the agent in Persistent Accelerite Radia Client Automation (formerly HP Client Automation) possibly before 9.1 allows remote attackers to execute arbitrary code by sending a large amount of data in an environment that lacks relationship-based firewalling.


Buffer overflow in Konica Minolta FTP Utility 1.0 allows remote attackers to execute arbitrary code via a long CWD command.


Buffer overflow in libc in Apple iOS before 9.2 OS X before 10.11.2 tvOS before 9.1 and watchOS before 2.1 allows remote attackers to execute arbitrary code via a crafted package a different vulnerability than CVE-2015-7038.


MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A buffer overflow vulnerability was reported (fixed and publicly disclosed in 2015) in the Lenovo Service Engine (LSE) affecting various versions of BIOS for Lenovo Notebooks that could allow a remote user to execute arbitrary code on the system.


Stack-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12 Acrobat and Acrobat Reader DC Classic before 2015.006.30060 and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.


Buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux Adobe AIR before 18.0.0.199 Adobe AIR SDK before 18.0.0.199 and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-5132 and CVE-2015-5133.


Heap-based buffer overflow in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux Adobe AIR before 18.0.0.180 Adobe AIR SDK before 18.0.0.180 and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-3135 and CVE-2015-4432.


Heap-based buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux Adobe AIR before 18.0.0.199 Adobe AIR SDK before 18.0.0.199 and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-5541.


Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12 Acrobat and Acrobat Reader DC Classic before 2015.006.30060 and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-5096 and CVE-2015-5098.


Stack-based buffer overflow in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux Adobe AIR before 19.0.0.190 Adobe AIR SDK before 19.0.0.190 and Adobe AIR SDK & Compiler before 19.0.0.190 allows attackers to execute arbitrary code via unspecified vectors.


Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12 Acrobat and Acrobat Reader DC Classic before 2015.006.30060 and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-5096 and CVE-2015-5105.


Heap-based buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux Adobe AIR before 18.0.0.199 Adobe AIR SDK before 18.0.0.199 and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-5129.


Buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux Adobe AIR before 18.0.0.199 Adobe AIR SDK before 18.0.0.199 and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-5131 and CVE-2015-5133.


Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12 Acrobat and Acrobat Reader DC Classic before 2015.006.30060 and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-5098 and CVE-2015-5105.


Buffer overflow in Canary Labs Trend Web Server before 9.5.2 allows remote attackers to execute arbitrary code via a crafted TCP packet.


Buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux Adobe AIR before 18.0.0.199 Adobe AIR SDK before 18.0.0.199 and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-5131 and CVE-2015-5132.


Buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12 Acrobat and Acrobat Reader DC Classic before 2015.006.30060 and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.


Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier CENTUM CS 3000 R3.09.50 and earlier CENTUM CS 3000 Entry R3.09.50 and earlier CENTUM VP R5.04.20 and earlier CENTUM VP Entry R5.04.20 and earlier ProSafe-RS R3.02.10 and earlier Exaopc R3.72.00 and earlier Exaquantum R2.85.00 and earlier Exaquantum/Batch R2.50.30 and earlier Exapilot R3.96.10 and earlier Exaplog R3.40.00 and earlier Exasmoc R4.03.20 and earlier Exarqe R4.03.20 and earlier Field Wireless Device OPC Server R2.01.02 and earlier PRM R3.12.00 and earlier STARDOM VDS R7.30.01 and earlier STARDOM OPC Server for Windows R3.40 and earlier FAST/TOOLS R10.01 and earlier B/M9000CS R5.05.01 and earlier B/M9000 VP R7.03.04 and earlier and FieldMate R1.01 or R1.02 allows remote attackers to execute arbitrary code via a crafted packet.


Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet a different vulnerability than CVE-2015-4931 CVE-2015-4932 CVE-2015-4933 and CVE-2015-4935.


Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet a different vulnerability than CVE-2015-4931 CVE-2015-4932 CVE-2015-4933 and CVE-2015-4934.


Heap-based buffer overflow in the stagefright::ESDS::parseESDescriptor function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via an invalid size field in an esds chunk in MPEG-4 video data a related issue to CVE-2015-1539.


Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet a different vulnerability than CVE-2015-4932 CVE-2015-4933 CVE-2015-4934 and CVE-2015-4935.


Stack-based buffer overflow in the Administration Server in IBM HTTP Server 6.1.0.x through 6.1.0.47 7.0.0.x before 7.0.0.39 8.0.0.x before 8.0.0.12 and 8.5.x before 8.5.5.7 as used in WebSphere Application Server and other products allows remote authenticated users to execute arbitrary code via unspecified vectors.


Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet a different vulnerability than CVE-2015-4931 CVE-2015-4932 CVE-2015-4934 and CVE-2015-4935.


Heap-based buffer overflow in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux Adobe AIR before 18.0.0.180 Adobe AIR SDK before 18.0.0.180 and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-3135 and CVE-2015-5118.


Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet a different vulnerability than CVE-2015-4931 CVE-2015-4933 CVE-2015-4934 and CVE-2015-4935.


Buffer overflow in Lhaplus before 1.70 allows remote attackers to execute arbitrary code via a crafted archive.


Heap-based buffer overflow in Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android Adobe AIR SDK before 16.0.0.272 and Adobe AIR SDK & Compiler before 16.0.0.272 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-0309.


Buffer overflow in Saitoh Kikaku Maruo Editor 8.51 and earlier allows remote attackers to execute arbitrary code via a crafted .hmbook file.


Buffer overflow in libstagefright in Mozilla Firefox before 36.0 allows remote attackers to execute arbitrary code via a crafted MP4 video that is improperly handled during playback.


Heap-based buffer overflow in Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android Adobe AIR SDK before 16.0.0.272 and Adobe AIR SDK & Compiler before 16.0.0.272 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-0304.


Off-by-one error in the extracthalf function in dpkg-deb/extract.c in the dpkg-deb component in Debian dpkg 1.16.x before 1.16.17 and 1.17.x before 1.17.26 allows remote attackers to execute arbitrary code via the archive magic version number in an \old-style\ Debian binary package which triggers a stack-based buffer overflow.


Buffer overflow in the XnsSdkDeviceIpInstaller.ocx ActiveX control in Samsung iPOLiS Device Manager 1.12.2 allows remote attackers to execute arbitrary code via a long string in the first argument to the (1) ReadConfigValue or (2) WriteConfigValue function.


Multiple stack-based buffer overflows in the SafeShellExecute method in the NetIQExecObject.NetIQExec.1 ActiveX control in NetIQExec.dll in NetIQ Security Solutions for iSeries 8.1 allow remote attackers to execute arbitrary code via long arguments aka ZDI-CAN-2699.


Heap-based buffer overflow in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-0327.


Buffer overflow in CREAR AL-Mail32 before 1.13d allows remote attackers to execute arbitrary code via a long filename of an attachment.


Heap-based buffer overflow in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-0323.


Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2 and other 2.x versions before 2.18 allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function aka \GHOST.\


Buffer overflow in the Telnet service in Microsoft Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted packets aka \Windows Telnet Service Buffer Overflow Vulnerability.\


Heap-based buffer overflow in closefs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code by causing a crafted block group descriptor to be marked as dirty. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0247.


Buffer overflow in the integrated web server on Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35 WIN52xx devices with firmware before SS4.4.4624.35 WIN70xx devices with firmware before BS4.4.4621.32 and WIN72xx devices with firmware before BS4.4.4621.32 allows remote attackers to execute arbitrary code via unspecified vectors.


Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors as exploited in the wild in June 2015.


Heap-based

buffer

overflow

in

PCRE

through

and

allows

remote

attackers

to

execute

arbitrary

code

via

a

crafted

regular

expression

as

demonstrated

by

/^(?P=B)((?P=B)(?J:(?P<B>c)(?P<B>a(?P=B)))>WGXCREDITS)/

a

different

vulnerability

than


Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40 5.5.x before 5.5.24 and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary code via a crafted length value in a (1) tar (2) phar or (3) ZIP archive.


Heap-based buffer overflow in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux Adobe AIR before 18.0.0.180 Adobe AIR SDK before 18.0.0.180 and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-4432 and CVE-2015-5118.


Stack-based buffer overflow in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors.


Heap-based buffer overflow in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux Adobe AIR before 17.0.0.172 Adobe AIR SDK before 17.0.0.172 and Adobe AIR SDK & Compiler before 17.0.0.172 allows attackers to execute arbitrary code via unspecified vectors.


Stack-based buffer overflow in the run_init_sbus function in the KCodes NetUSB module for the Linux kernel as used in certain NETGEAR products TP-LINK products and other products allows remote attackers to execute arbitrary code by providing a long computer name in a session on TCP port 20005.


Buffer

overflow

in

the

readAt

function

in

BpMediaHTTPConnection

in

in

the

mediaserver

service

in

Android

before

allows

attackers

to

execute

arbitrary

code

via

a

crafted

application

aka

internal

bug


Stack-based buffer overflow in the WESPPlayback.WESPPlaybackCtrl.1 control in WebGate WinRDS allows remote attackers to execute arbitrary code via unspecified vectors to the (1) PrintSiteImage (2) PlaySiteAllChannel (3) StopSiteAllChannel or (4) SaveSiteImage function.


Buffer overflow in the Adobe Type Manager Library in Microsoft Windows Vista SP2 Windows Server 2008 SP2 Office 2007 SP3 Office 2010 SP2 Lync 2010 Lync 2010 Attendee Lync 2013 SP1 Lync Basic 2013 SP1 and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted OpenType font aka \Graphics Component Buffer Overflow Vulnerability.\


Stack-based buffer overflow in AirTies Air 6372 5760 5750 5650TT 5453 5444TT 5443 5442 5343 5342 5341 and 5021 DSL modems with firmware 1.0.2.0 and earlier allows remote attackers to execute arbitrary code via a long string in the redirect parameter to cgi-bin/login.


Buffer overflow in das_watchdog 0.9.0 allows local users to execute arbitrary code with root privileges via a large string in the XAUTHORITY environment variable.


Heap-based buffer overflow in the SVGTextFrame class in Mozilla Firefox before 38.0 Firefox ESR 31.x before 31.7 and Thunderbird before 31.7 allows remote attackers to execute arbitrary code via crafted SVG graphics data in conjunction with a crafted Cascading Style Sheets (CSS) token sequence.


Multiple stack-based buffer overflows in WebGate eDVR Manager allow remote attackers to execute arbitrary code via unspecified vectors to the (1) Connect (2) ConnectEx or (3) ConnectEx2 function in the WESPEvent.WESPEventCtrl.1 control; (4) AudioOnlySiteChannel function in the WESPPlayback.WESPPlaybackCtrl.1 control; (5) Connect or (6) ConnectEx function in the WESPPTZ.WESPPTZCtrl.1 control; (7) SiteChannel property in the WESPPlayback.WESPPlaybackCtrl.1 control; (8) SiteName property in the WESPPlayback.WESPPlaybackCtrl.1 control; or (9) OpenDVrSSite function in the WESPPTZ.WESPPTZCtrl.1 control.


Buffer overflow in NScripter before 3.00 allows remote attackers to execute arbitrary code via crafted save data.


Multiple buffer overflows in WebGate Control Center allow remote attackers to execute arbitrary code via unspecified vectors to the (1) GetRecFileInfo function in the FileConverter.FileConverterCtrl.1 control (2) Login function in the LoginContoller.LoginControllerCtrl.1 control or (3) GetThumbnail function in the WESPPlayback.WESPPlaybackCtrl.1 control.


Multiple stack-based buffer overflows in Medicomp MEDCIN Engine 2.22.20142.166 might allow remote attackers to execute arbitrary code via a crafted packet on port 8190 related to (1) the GetProperty info_getproperty function and (2) the GetProperty UdfCodeList function.


Multiple buffer overflows in WebGate Embedded Standard Protocol (WESP) SDK allow remote attackers to execute arbitrary code via unspecified vectors to the (1) LoadImage or (2) LoadImageEx function in the WESPMonitor.WESPMonitorCtrl.1 control (3) ChangePassword function in the WESPCONFIGLib.UserItem control Connect function in the (4) WESPSerialPort.WESPSerialPortCtrl.1 or (5) WESPPLAYBACKLib.WESPPlaybackCtrl control or (6) AddID function in the WESPCONFIGLib.IDList control or a (7) long string to the second argument to the ConnectEx3 function in the WESPPLAYBACKLib.WESPPlaybackCtrl control.


Multiple stack-based buffer overflows in Medicomp MEDCIN Engine before 2.22.20153.226 might allow remote attackers to execute arbitrary code via a crafted packet on port 8190 related to (1) the SetGroupSequenceEx na_setgroupsequenceex function (2) the FormatDate julptostr function and (3) the UserFindingCodes addtocl function.


Buffer overflow in the XML parser in Mozilla Firefox before 38.0 Firefox ESR 31.x before 31.7 and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data a related issue to CVE-2015-1283.


Heap-based buffer overflow in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux Adobe AIR before 20.0.0.204 Adobe AIR SDK before 20.0.0.204 and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a crafted XML object that is mishandled during a toString call a different vulnerability than CVE-2015-8446.


Heap-based buffer overflow in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux Adobe AIR before 20.0.0.204 Adobe AIR SDK before 20.0.0.204 and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via an MP3 file with COMM tags that are mishandled during memory allocation a different vulnerability than CVE-2015-8438.


Buffer overflow in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux Adobe AIR before 20.0.0.204 Adobe AIR SDK before 20.0.0.204 and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors.


Stack-based buffer overflow in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux Adobe AIR before 20.0.0.204 Adobe AIR SDK before 20.0.0.204 and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-8407.


Multiple buffer overflows in Autodesk Design Review (ADR) before 2013 Hotfix 2 allow remote attackers to execute arbitrary code via crafted RLE data in a (1) BMP or (2) FLI file (3) encoded scan lines in a PCX file or (4) DataSubBlock or (5) GlobalColorTable in a GIF file.


Stack-based buffer overflow in the Initialize function in an ActiveX control in IBM SPSS Statistics 19 and 20 before 20.0.0.2-IF0008 21 before 21.0.0.2-IF0010 22 before 22.0.0.2-IF0011 23 before 23.0.0.3-IF0001 and 24 before 24.0.0.0-IF0003 allows remote authenticated users to execute arbitrary code via a long argument.


Stack-based buffer overflow in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux Adobe AIR before 20.0.0.204 Adobe AIR SDK before 20.0.0.204 and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-8457.


Heap-based buffer overflow in AGM.dll in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13 Acrobat and Acrobat Reader DC Classic before 2015.006.30094 and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via a multiple-layer PDF document a different vulnerability than CVE-2015-6696 and CVE-2015-6698.


Buffer overflow in the DNS Client service in Microsoft Windows 2000 SP4 XP SP1 and SP2 and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted record response. NOTE: while MS06-041 implies that there is a single issue there are multiple vectors and likely multiple vulnerabilities related to (1) a heap-based buffer overflow in a DNS server response to the client (2) a DNS server response with malformed ATMA records and (3) a length miscalculation in TXT HINFO X25 and ISDN records.


Buffer overflow in Microsoft Visual Basic for Applications (VBA) SDK 6.0 through 6.4 as used by Microsoft Office 2000 SP3 Office XP SP3 Project 2000 SR1 Project 2002 SP1 Access 2000 Runtime SP3 Visio 2002 SP2 and Works Suite 2004 through 2006 allows user-assisted attackers to execute arbitrary code via unspecified document properties that are not verified when VBA is invoked to open documents.


Buffer overflow in GraceNote CDDBControl ActiveX Control as used by multiple products that use Gracenote CDDB allows remote attackers to execute arbitrary code via a long option string.


Multiple buffer overflows in the ActiveX controls in Newtone ImageKit 5 before Fix 30 and 6 before Fix 40 as used in CASIO Photo Loader software before 3.01 and possibly other software allow remote attackers to execute arbitrary code via a crafted HTML document.


Multiple buffer overflows in IBM Informix Dynamic Server (IDS) before 9.40.TC6 and 10.00 before 10.00.TC3 allow remote authenticated users to execute arbitrary code via (1) the getname function as used by (a) _sq_remview (b) _sq_remproc (c) _sq_remperms (d) _sq_distfetch and (e) _sq_dcatalog; and the (2) SET DEBUG FILE (3) IFX_FILE_TO_FILE (4) FILETOCLOB (5) LOTOFILE and (6) DBINFO functions (product defect IDs 171649 171367 171387 171391 171906 172179).


Heap-based buffer overflow in the it_read_envelope function in Dynamic Universal Music Bibliotheque (DUMB) 0.9.3 and earlier and current CVS as of 20060716 including libdumb allows user-assisted attackers to execute arbitrary code via a \.it\ (Impulse Tracker) file with an envelope with a large number of nodes.


Buffer overflow in the Step-by-Step Interactive Training in Microsoft Windows 2000 SP4 XP SP2 and Professional and Server 2003 SP1 allows remote attackers to execute arbitrary code via a long Syllabus string in crafted bookmark link files (cbo cbl or .cbm) a different issue than CVE-2005-1212.


Multiple stack-based buffer overflows in eIQnetworks Enterprise Security Analyzer (ESA) before 2.5.0 as used in products including (a) Sidewinder (b) iPolicy Security Manager (c) Astaro Report Manager (d) Fortinet FortiReporter (e) Top Layer Network Security Analyzer and possibly other products allow remote attackers to execute arbitrary code via long (1) DELTAINTERVAL (2) LOGFOLDER (3) DELETELOGS (4) FWASERVER (5) SYSLOGPUBLICIP (6) GETFWAIMPORTLOG (7) GETFWADELTA (8) DELETERDEPDEVICE (9) COMPRESSRAWLOGFILE (10) GETSYSLOGFIREWALLS (11) ADDPOLICY and (12) EDITPOLICY commands to the Syslog daemon (syslogserver.exe); (13) GUIADDDEVICE (14) ADDDEVICE and (15) DELETEDEVICE commands to the Topology server (Topology.exe); the (15) LICMGR_ADDLICENSE command to the License Manager (EnterpriseSecurityAnalyzer.exe); the (16) TRACE and (17) QUERYMONITOR commands to the Monitoring agent (Monitoring.exe); and possibly other vectors related to the Syslog daemon (syslogserver.exe).


Buffer overflow in SIPfoundry sipXtapi released before 20060324 allows remote attackers to execute arbitrary code via a long CSeq field value in an INVITE message.


Buffer overflow in AOL You've Got Pictures (YGP) Pic Downloader YGPPDownload ActiveX control (AOL.PicDownloadCtrl.1 YGPPicDownload.dll) as used in America Online 9.0 Security Edition allows remote attackers to execute arbitrary code via a long argument to the SetAlbumName method.


Stack-based buffer overflow in the Sky Software FileView ActiveX control as used in WinZip 10 before build 7245 and in certain other applications allows remote attackers to execute arbitrary code via a long FilePattern attribute in a WZFILEVIEW object a different vulnerability than CVE-2006-5198.


Multiple stack-based buffer overflows in Tumbleweed Email Firewall (EMF) allow remote attackers to execute arbitrary code via an email attachment with an LHA archive that contains a (1) file or (2) directory with a long LHA extended header (3) an LHA archive in which the \temporary pathname\ field for decompressed output is greater than 2 bytes or (4) an LHA archive with a long filename.


Buffer overflow in IBM Informix Dynamic Server (IDS) 9.40.TC7 9.40.TC8 10.00.TC4 and 10.00.TC5 when running on Windows allows remote attackers to execute arbitrary code via a long username which causes an overflow in vsprintf when displaying in the resulting error message. NOTE: this issue is due to an incomplete fix for CVE-2006-3853.


Heap-based buffer overflow in httpdget.c in mpg123 before 0.59s-rll allows remote attackers to execute arbitrary code via a long URL which is not properly terminated before being used with the strncpy function. NOTE: This appears to be the result of an incomplete patch for CVE-2004-0982.


Buffer overflow in FileCOPA FTP Server before 1.01 released on 18th July 2006 allows remote authenticated attackers to execute arbitrary code via a long argument to the LIST command.


Stack-based buffer overflow in EFS Software Easy File Sharing FTP Server 2.0 allows remote attackers to execute arbitrary code via a long argument to the PASS command. NOTE: the provenance of this information is unknown; the details are obtained from third party information.


Multiple buffer overflows in multiplay.cpp in UFO2000 svn 1057 allow remote attackers to execute arbitrary code via (1) a long unit name in Net::recv_add_unit ; (2) large values to Net::recv_rules Net::recv_select_unit Net::recv_options and Net::recv_unit_data; and (3) a large mapdata GEODATA structure in Net::recv_map_data.


Unspecified vulnerability in Microsoft Hyperlink Object Library (hlink.dll) possibly a buffer overflow allows user-assisted attackers to execute arbitrary code via crafted hyperlinks that are not properly handled when hlink.dll \uses a file containing a malformed function \ aka \Hyperlink Object Function Vulnerability.\


Stack-based buffer overflow in ITIRecorder.MicRecorder ActiveX control in iarecord.dll in InterActual Player before 2.6 allows remote attackers to execute arbitrary code via a long argument to the Files method. NOTE: the provenance of this information is unknown; the details are obtained from third party information.


Integer underflow in filecpnt.exe in FileCOPA FTP Server 1.01 before 2006-07-21 allow remote authenticated users to execute arbitrary code via a long argument to the (1) CWD (2) DELE (3) MDTM and (4) MKD commands which triggers a stack-based buffer overflow.


Stack-based buffer overflow in Warzone 2100 and Warzone Resurrection 2.0.3 and earlier allows remote attackers to execute arbitrary code via a (1) long message handled by the recvTextMessage function in multiplay.c or a (2) long filename handled by NETrecvFile function in netplay/netplay.c.


Stack-based buffer overflow in the Universal Plug and Play (UPnP) service in D-Link DI-524 DI-604 Broadband Router DI-624 D-Link DI-784 WBR-1310 Wireless G Router WBR-2310 RangeBooster G Router and EBR-2310 Ethernet Broadband Router allows remote attackers to execute arbitrary code via a long M-SEARCH request to UDP port 1900.


Buffer overflow in the daemon function in midirecord.cc in Tuomas Airaksinen Midirecord 2.0 allows local users to execute arbitrary code via a long command line argument (filename). NOTE: This may not be a vulnerability if Midirecord is not installed setuid.


Heap-based buffer overflow in OpenOffice.org (aka StarOffice) 1.1.x up to 1.1.5 and 2.0.x before 2.0.3 allows user-assisted attackers to execute arbitrary code via a crafted OpenOffice XML document that is not properly handled by (1) Calc (2) Draw (3) Impress (4) Math or (5) Writer aka \File Format / Buffer Overflow Vulnerability.\


Buffer overflow in in_midi.dll for WinAmp 2.90 up to 5.23 including 5.21 allows remote attackers to execute arbitrary code via a crafted .mid (MIDI) file.


Buffer overflow in certain Asian language versions of Microsoft Excel might allow user-assisted attackers to execute arbitrary code via a crafted STYLE record in a spreadsheet that triggers the overflow when the user attempts to repair the document or selects the \Style\ option as demonstrated by nanika.xls. NOTE: Microsoft has confirmed to CVE via e-mail that this is different than the other Excel vulnerabilities announced before 20060707 including CVE-2006-3059 and CVE-2006-3086.


Buffer overflow in Hawk Monitoring Agent (HMA) for TIBCO Hawk before 4.6.1 and TIBCO Runtime Agent (TRA) before 5.4 allows authenticated users to execute arbitrary code via the configuration for tibhawkhma.


The iax_net_read function in the iaxclient open source library as used in multiple products including (a) LoudHush 1.3.6 (b) IDE FISK 1.35 and earlier (c) Kiax 0.8.5 and earlier (d) DIAX (e) Ziaxphone (f) IAX Phone (g) X-lite (h) MediaX (i) Extreme Networks ePhone and (j) iaxComm before 1.2.0 allows remote attackers to execute arbitrary code via crafted IAX 2 (IAX2) packets with truncated (1) full frames or (2) mini-frames which are detected in a length check but still processed leading to buffer overflows related to negative length values.


Multiple buffer overflows in the (1) vGetPost and (2) main functions in easy-scart.c through easy-scart6.c in iShopCart allow remote attackers to execute arbitrary code by sending a large amount of data containing \Submit\ in an sslinvoice action and allow remote attackers to have an unknown impact via a large amount of posted data.


Buffer overflow in CGI scripts in Nagios 1.x before 1.4 and 2.x before 2.3 allows remote attackers to execute arbitrary code via a negative content length (Content-Length) HTTP header.


Buffer overflow in KarjaSoft Sami FTP Server 2.0.2 and earlier allows remote attackers to execute arbitrary code via a long (1) USER or (2) PASS command.


Multiple heap-based buffer overflows in Libextractor 0.5.13 and earlier allow remote attackers to execute arbitrary code via (1) the asf_read_header function in the ASF plugin (plugins/asfextractor.c) and (2) the parse_trak_atom function in the QT plugin (plugins/qtextractor.c).


Buffer overflow in MP3Info 0.8.4 allows attackers to execute arbitrary code via a long command line argument. NOTE: if mp3info is not installed setuid or setgid in any reasonable context then this issue might not be a vulnerability.


Multiple buffer overflows in (1) CxAce60.dll and (2) CxAce60u.dll in SpeedProject Squeez 5.10 Build 4460 and SpeedCommander 10.52 Build 4450 and 11.01 Build 4450 allow user-assisted remote attackers to execute arbitrary code via an ACE archive that contains a file with a long filename.


Buffer overflow in Unicode processing in the logging functionality in Pablo Software Solutions Quick 'n Easy FTP Server Professional and Lite probably 3.0 allows remote authenticated users to execute arbitrary code by sending a command with a long argument which triggers a buffer overflow when an admin selects the Logging section in the FTP server main window. NOTE: the original researcher claims that the vendor disputes this issue.


Stack-based buffer overflow in (1) WeOnlyDo wodSSHServer ActiveX Component 1.2.7 and 1.3.3 DEMO as used in other products including (2) FreeSSHd 1.0.9 and (3) freeFTPd 1.0.10 allows remote attackers to execute arbitrary code via a long key exchange algorithm string.


Buffer overflow in BankTown Client Control (aka BtCxCtl20Com) 1.4.2.51817 and possibly 1.5.2.50209 allows remote attackers to execute arbitrary code via a long string in the first argument to SetBannerUrl. NOTE: portions of these details are obtained from third party information.


Buffer overflow in SWS web Server 0.1.7 allows remote attackers to execute arbitrary code via a long request.


Buffer overflow in avahi-core in Avahi before 0.6.10 allows local users to execute arbitrary code via unknown vectors.


Stack-based buffer overflow in the tiffsplit command in libtiff 3.8.2 and earlier might might allow attackers to execute arbitrary code via a long filename. NOTE: tiffsplit is not setuid. If there is not a common scenario under which tiffsplit is called with attacker-controlled command line arguments then perhaps this issue should not be included in CVE.


Buffer overflow in XM Easy Personal FTP Server 4.3 and earlier allows remote attackers to execute arbitrary code probably via a USER command with a long username.


Stack-based buffer overflow in the CL_ParseDownload function of Quake 3 Engine 1.32c and earlier as used in multiple products allows remote attackers to execute arbitrary code via a svc_download command with compressed data that triggers the overflow during expansion.


Buffer overflow in raydium_network_read function in network.c in Raydium SVN revision 312 and earlier allows remote attackers to execute arbitrary code by sending packets with long global variables to the client.


Stack-based buffer overflow in the info tip shell extension (zipinfo.dll) in PicoZip 4.01 allows remote attackers to execute arbitrary code via a long filename in an (1) ACE (2) RAR or (3) ZIP archive which is triggered when the user moves the mouse over the archive.


Heap-based buffer overflow in the TZipTV component in (1) ZipTV for Delphi 7 2006.1.26 and for C++ Builder 2006-1.16 (2) PentaZip 8.5.1.190 and PentaSuite-PRO 8.5.1.221 and possibly other products allows user-assisted attackers to execute arbitrary code via an ARJ archive with a long header. NOTE: the ACE archive vector is covered by CVE-2005-2856.


Buffer overflow in Alt-N MDaemon possibly 9.0.1 and earlier allows remote attackers to execute arbitrary code via a long A0001 argument that begins with a '\' (double quote).


Buffer overflow in ArgoSoft FTP Server 1.4.3.6 allows remote attackers to execute arbitrary code via Unicode in the RNTO command as demonstrated by the Infigo FTPStress Fuzzer.


Buffer overflow in the ART Image Rendering component (jgdw400.dll) in Microsoft Windows XP SP1 and Sp2 Server 2003 SP1 and earlier and Windows 98 and Me allows remote attackers to execute arbitrary code via a crafted ART image that causes heap corruption.


Buffer overflow in Microsoft Word in Office 2000 SP3 Office XP SP3 Office 2003 Sp1 and SP2 and Microsoft Works Suites through 2006 allows user-assisted attackers to execute arbitrary code via a malformed object pointer as originally reported by ISC on 20060519 for a zero-day attack.


The dvd_read_bca function in the DVD handling code in drivers/cdrom/cdrom.c in Linux kernel 2.2.16 and later versions assigns the wrong value to a length variable which allows local users to execute arbitrary code via a crafted USB Storage device that triggers a buffer overflow.


Buffer overflow in WDM.exe in WarFTPD allows remote attackers to execute arbitrary code via unspecified arguments as demonstrated by the Infigo FTPStress Fuzzer.


Buffer overflow in JuniperSetupDLL.dll loaded from JuniperSetup.ocx by the Juniper SSL-VPN Client when accessing a Juniper NetScreen IVE device running IVE OS before 4.2r8.1 5.0 before 5.0r6.1 5.1 before 5.1r8 5.2 before 5.2r4.1 or 5.3 before 5.3r2.1 allows remote attackers to execute arbitrary code via a long argument in the ProductName parameter.


Buffer overflow in (1) TZipBuilder 1.79.03.01 (2) Abakt 0.9.2 and 0.9.3-beta1 (3) CAM UnZip 4.0 and 4.3 and possibly other products allows user-assisted attackers to execute arbitrary code via a ZIP archive that contains a file with a long file name.


The crypto.signText function in Mozilla Firefox and Thunderbird before 1.5.0.4 allows remote attackers to execute arbitrary code via certain optional Certificate Authority name arguments which causes an invalid array index and triggers a buffer overflow.


Buffer overflow in the Remote Access Connection Manager service (RASMAN) service in Microsoft Windows 2000 SP4 XP SP1 and SP2 and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted \RPC related requests \ that lead to registry corruption and stack corruption aka the \RASMAN Registry Corruption Vulnerability.\


Buffer overflow in jetAudio 6.2.6.8330 (Basic) and possibly other versions allows user-assisted attackers to execute arbitrary code via an audio file (such as WMA) with long ID Tag values including (1) Title (2) Author and (3) Album which triggers the overflow in the tooltip display string if the sound card driver is disabled or incorrectly installed.


Multiple buffer overflows in Raydium before SVN revision 310 allow remote attackers to execute arbitrary code via a large packet when logged via (1) the raydium_log function in log.c or (2) the raydium_console_line_add function in console.c possibly from a long player name.


Heap-based buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a crafted BMP file that triggers the overflow in the ReadBMP function. NOTE: this issue was originally included as item 3 in CVE-2006-1983 but it has been given a separate identifier because it is a distinct issue.


Stack-based buffer overflow in Pragma FortressSSH 4.0.7.20 allows remote attackers to execute arbitrary code via long SSH_MSG_KEXINIT messages which may cause an overflow when being logged. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Buffer overflow in cram.dll in QUALCOMM Eudora WorldMail 3.0 allows remote attackers to execute arbitrary code via an IMAP APPEND command with a long message literal argument as demonstrated by Worldmail.pl. NOTE: this is a different vector and a different manipulation than CVE-2005-4267 so it might be a different vulnerability than CVE-2005-4267.


flex.skl in Will Estes and John Millaway Fast Lexical Analyzer Generator (flex) before 2.5.33 does not allocate enough memory for grammars containing (1) REJECT statements or (2) trailing context rules which causes flex to generate code that contains a buffer overflow that might allow context-dependent attackers to execute arbitrary code.


Multiple buffer overflows in NullSoft Winamp 5.13 and earlier allow remote attackers to execute arbitrary code via (1) an m3u file containing a long URL ending in .wma (2) a pls file containing a File1 field with a long URL ending in .wma or (3) an m3u file with a long filename variants of CVE-2005-3188 and CVE-2006-0476.


Buffer overflow in Mail in Apple Mac OS X 10.4 up to 10.4.5 when patched with Security Update 2006-001 allows remote attackers to execute arbitrary code via a long Real Name value in an e-mail attachment sent in AppleDouble format which triggers the overflow when the user double-clicks on an attachment.


Buffer overflow in the Web Client service (WebClnt.dll) for Microsoft Windows XP SP1 and SP2 and Server 2003 up to SP1 allows remote authenticated users or Guests to execute arbitrary code via crafted RPC requests a different vulnerability than CVE-2005-1207.


** DISPUTED ** Buffer overflow in the font command of mIRC probably 6.16 allows local users to execute arbitrary code via a long string. NOTE: the original researcher claims that issue has been disputed by the vendor and that the vendor stated \as far as I can tell this is neither an exploit nor a vulnerability. The above report describes a local bug in mIRC.\ It could be that this is only exploitable by the user of the application and thus would not cross privilege boundaries unless under an otherwise restrictive environment such as a kiosk.


Buffer overflow in Change passwd 3.1 (chpasswd) SquirrelMail plugin allows local users to execute arbitrary code via long command line arguments.


Buffer overflow in NicoFTP 3.0.1.19 and earlier might allow local users to execute arbitrary code via a long string in the \Name of site\ field of an FTP account. NOTE: because this program executes with the privileges of the invoking user and because remote programs do not normally have the ability to create or modify FTP accounts in this program there may not be a typical attack vector for the issue that crosses privilege boundaries. Therefore this may not be a vulnerability.


Buffer overflow in BitComet Client 0.60 allows remote attackers to execute arbitrary code when the publisher's name link is clicked via a long publisher URI in a torrent file.


Heap-based buffer overflow in the bitmap processing routine in Microsoft Windows Media Player 7.1 on Windows 2000 SP4 Media Player 9 on Windows 2000 SP4 and XP SP1 and Media Player 10 on XP SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted bitmap (.BMP) file that specifies a size of 0 but contains additional data.


Buffer overflow in playlistimport.cpp in Kaffeine Player 0.4.2 through 0.7.1 allows user-assisted attackers to execute arbitrary code via long HTTP request headers when Kaffeine is \fetching remote playlists\ which triggers the overflow in the http_peek function.


Stack-based buffer overflow in Safari in Mac OS X 10.4.5 and earlier and 10.3.9 and earlier allows remote attackers to execute arbitrary code via unspecified vectors involving a web page with crafted JavaScript a different vulnerability than CVE-2005-4504.


Buffer overflow in the Bluetooth OBEX Object Push service in \Blue Neighbors.EXE\ in AmbiCom Blue Neighbors 2.50 Build 2500 and earlier allows remote attackers to execute arbitrary code via a long file name as demonstrated via a long RFILE argument to ussp-push.


Buffer overflow in multiple F-Secure Anti-Virus products and versions for Windows and Linux including Anti-Virus for Windows Servers 5.52 and earlier Internet Security 2004 2005 and 2006 and Anti-Virus for Linux Servers 4.64 and earlier allows remote attackers to execute arbitrary code via crafted ZIP archives.


Buffer overflow in termsh on SCO OpenServer 5.0.7 allows remote attackers to execute arbitrary code via a long -o command line argument. NOTE: this is probably a different vulnerability than CVE-2005-0351 since it involves a distinct attack vector.


Stack-based buffer overflow in Novell GroupWise Messenger before 2.0 Public Beta 2 allows remote attackers to execute arbitrary code via a long Accept-Language value without a comma or semicolon. NOTE: due to a typo the original ZDI advisory accidentally referenced CVE-2006-0092. This is the correct identifier.


Heap-based buffer overflow in T2EMBED.DLL in Microsoft Windows 2000 SP4 XP SP1 and SP2 and Server 2003 up to SP1 Windows 98 and Windows ME allows remote attackers to execute arbitrary code via an e-mail message or web page with a crafted Embedded Open Type (EOT) web font that triggers the overflow during decompression.


Buffer overflow in swfformat.dll in multiple RealNetworks products and versions including RealPlayer 10.x RealOne Player Rhapsody 3 and Helix Player allows remote attackers to execute arbitrary code via a crafted SWF (Flash) file with (1) a size value that is less than the actual size or (2) other unspecified manipulations.