CAN-2004-0563

The CVE CAN-2004-0563 (CVE-2004-0563) relates to freenet6 where the tspc.conf file is world-readable, exposing potential sensitive data (e.g., username and password) to local users. Connected advisories confirm Debian’s DSA-555-1 and related Debian security notices describe a local information-le...

CAN-2004-0881

CVE-2004-0881 affects getmail: getmail 4.x before 4.2.0 and other versions before 3.2.5. When run as root, it allows local users to overwrite arbitrary files via a symlink attack on subdirectories of the maildir. Impact is local file writes. Remediation: upgrade to getmail 4.2.0 or newer (or 3.2....

CAN-2004-0833

CVE-2004-0833 affects sendmail on Debian GNU/Linux where the sasl-bin integration leaves a fixed username/password in the SASL database configuration. This misconfiguration could allow remote attackers to use Sendmail as an open mail relay and send spam messages. Public references include Debian ...

CAN-2004-0802

Multiple connected entries reference CVE-2004-0802 in imlib2 (notably Debian DSA-552-1 and FreeBSD/OpenVAS entries). The Debian advisory lists CVSS base 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P). Descriptions indicate that a missing update is the issue, but no concrete root-cause, vulnerable versions, or ...

CAN-2004-0837

MODE C The CVE CAN-2004-0837 (CVE-2004-0837) has concrete OpenVAS/related advisories tying it to MySQL in multiple decks. Affected entries/drivers include: SUSE/SLES9 (Security update for MySQL; CVSS 10.0; patches 120293-02, 120292-02), Gentoo GLSA 200410-22 (MySQL), Gentoo/OpenVAS entries refere...

CAN-2004-0918

CVE-2004-0918 is a vulnerability in Squid’s SNMP parser. The asn_parse_header function in the SNMP module can be forced to allocate memory incorrectly by SNMP packets with negative or malformed ASN.1 length fields, allowing a remote attacker to cause a denial of service (server restart) and disco...

CAN-2004-0983

CVE-2004-0983 is discussed across OpenVAS/NESSUS entries and JVNDB as a Ruby CGI DoS issue. The underlying problem is Ruby’s CGI handling (cgi.rb) entering an infinite loop due to improper input validation, enabling a Denial of Service. Public documents describe the issue and advise updating/reme...

CAN-2004-1006

CVE-2004-1006 is a format-string vulnerability in ISC DHCP’s dhcpd log/error handling (errwarn.c) that may allow remote code execution via crafted DNS messages on vulnerable DHCP servers/relays/clients. Public OpenVAS entries label isc-dhcpd format-string vulnerabilities with CVSS 10.0 (AV:N/AC:L...

CAN-2004-0645

CVE-2004-0645 affects abiword via a vulnerability in the wv library (buffer overflow) that could allow arbitrary code execution. The connected advisories (Debian DSA-579-1, Debian DSA-579-1 variants, and Gentoo/OpenVAS entries) confirm the issue and indicate the vulnerable component as abiword wi...

CAN-2004-0989

CVE-2004-0989 affects libxml (libxml2) with multiple buffer overflow bugs in FTP URL parsing and DNS-related handling. Public sources in connected documents confirm Vulnerable versions include pre-2.6.14, with cited issues in libxml 2.6.12/2.6.13 and related code paths (FTP URL, FTP proxy URL, DN...

CAN-2004-0970

CVE-2004-0970 concerns the gzip package: the (1) gzexe, (2) zdiff, and (3) znew scripts in the gzip package allow local users to overwrite files via a symlink attack on temporary files. This is a local privilege/overwrite issue, not remote code execution. The vulnerability is tied to the handling...

CAN-2004-0940

CVE-2004-0940 describes a buffer overflow in Apache’s mod_include (SSI) affecting Apache 1.3.x up to 1.3.32, exploitable by local users who can create SSI documents to execute arbitrary code as the apache user. Public references in connected docs show multiple advisories and patches across platfo...

CAN-2004-0987

CVE-2004-0987 affects yardradius, a YARD radius authentication/server. The vulnerability is a stack/remote buffer overflow in the process_menu function (yardradius 1.0.20 and earlier), allowing remote attackers to execute arbitrary code with root/system privileges. Public sources (NVD/CVE entries...

CAN-2002-0986

CVE-2002-0986 concerns the PHP mail() function in PHP 4.x up to 4.2.2, which does not filter ASCII control characters from its arguments. This could allow remote attackers to modify mail message content, including headers, and potentially use PHP as a “spam proxy.” The connected documents confirm...

CAN-2002-1132

SquirrelMail vulnerability CVE-2002-1132: versions up to 1.2.7 and earlier allow remote attackers to determine the absolute pathname of options.php via a malformed optpage argument, leading to information disclosure. Debian advisories state the fix is in version 1.2.6-1.2 for woody and 1.2.8-1.1 ...

CAN-2003-0962

CVE-2003-0962 refers to a heap-overflow bug in rsync prior to 2.5.7, occurring when rsync is run in server mode (listening on port 873). The vulnerability allows a remote attacker to execute arbitrary code with the privileges of the rsync server by sending malformed requests, potentially affectin...

CAN-2004-1014

CVE-2004-1014 affects nfs-utils (statd) where statd did not ignore the SIGPIPE signal, allowing remote attackers to cause a denial-of-service by terminating a TCP connection prematurely. Documented in NFS-related advisories (Debian DSA 606-1, Red Hat RHSA-2005:014, Ubuntu USN-36-1) and noted by N...

CAN-2003-0985

The provided OpenVAS/DSA/Gentoo entries reference CVE-2003-0985 in kernel-related advisories (e.g., Debian DSA 417-1/417-2, Gentoo GLSA 200401-01) affecting 2.4.x kernel packages (kernel-image-2.4.18-1-alpha, kernel-patch-2.4.18-powerpc, etc.). The CVSS base is shown as 7.2 with vector AV:L/AC:L/...

CAN-2003-0972

Mode C: The CAN-2003-0972 entry corresponds to the Debian screen local vulnerability (integer overflow) affecting screen, a VT100/ANSI terminal multiplexer. The connected advisories describe an exploitable condition causing local privilege escalation by overflowing buffers through crafted escape ...

CAN-2004-0852

CVE-2004-0852 describes a buffer overflow in htget 0.93 that allows remote code execution via a crafted URL. Debian's DSA-611-1 fixes this in htget 0.93-1.1woody1. Root cause: improper bounds handling in URL processing. Impact: remote attacker could execute arbitrary code on vulnerable systems. R...