Multiple stack-based buffer overflows in the get_history function in history.cgi in Nagios Core before 3.4.4 and Icinga 1.6.x before 1.6.2 1.7.x before 1.7.4 and 1.8.x before 1.8.4 might allow remote attackers to execute arbitrary code via a long (1) host_name variable (host parameter) or (2) svc_description variable.