CVE-2002-0760

CVE-2002-0760 describes a race condition in bzip2 prior to 1.0.2 across FreeBSD 4.5 and earlier, and OpenLinux 3.1/3.1.1, where files are decompressed with world-readable permissions before being reset to the permissions specified in the archive, potentially allowing local users to read files dur...

CVE-2002-0873

The CVE-2002-0873 issue affects l2tpd versions around 0.67, where a long attribute/value could overflow and overwrite the vendor field, potentially via a buffer overflow. Additionally, the affected code paths may fail to initialize the random number generator, enabling some predictability in keys...

CVE-2002-0014

CVE-2002-0014 affects Pine up to version 4.43 and earlier. The vulnerability lies in URL-handling code that allows remote attackers to execute arbitrary commands when a URL enclosed in single quotes and containing shell metacharacters is processed. Impact is remote code execution with network acc...

CVE-2002-0754

Affected software : Kerberos 5 su (k5su) in FreeBSD 4.4 and earlier. Vulnerability : k5su relies on the getlogin system call to determine if the user running k5su is root, which could allow a root-initiated process to regain its privileges after it has dropped them. Impact : potential privilege e...

CVE-2002-0169

The CVE-2002-0169 issue concerns the default DocBook stylesheet shipped with Red Hat Linux 6.2–7.2. The insecure option in the stylesheet allowed an untrusted DocBook document to cause file writes outside the current directory by using a full pathname as an element identifier, potentially affecti...

CVE-2002-0638

CVE-2002-0638 concerns the util-linux package’s login utilities (notably setpwnam.c used by chfn/chsh). The advisory describes a race condition caused by inadequate locking of a temporary file used when modifying /etc/passwd, enabling a local attacker to escalate privileges. The issue affects Red...

CVE-2002-0650

The keep-alive mechanism for Microsoft SQL Server 2000 allows remote attackers to cause a denial of service bandwidth consumption via a "ping" style packet to the Resolution Service UDP port 1434 with a spoofed IP address of another SQL Server system, which causes the two servers to exchange...

CVE-2002-0543

Directory traversal vulnerability in Aprelium Abyss Web Server abyssws before 1.0.0.2 allows remote attackers to read files outside the web root, including the abyss.conf file, via URL-encoded .. dot dot sequences in the HTTP request...

CVE-2002-0741

psyBNC 2.3 allows remote attackers to cause a denial of service CPU consumption and resource exhaustion by sending a PASS command with a long password argument and quickly killing the connection, which is not properly terminated by psyBNC...

CVE-2002-0887

scoadmin for Caldera/SCO OpenServer 5.0.5 and 5.0.6 allows local users to overwrite arbitrary files via a symlink attack on temporary files, as demonstrated using log files...

CVE-2002-0033

Heap-based buffer overflow in cfsdcalloc function of Solaris cachefsd allows remote attackers to execute arbitrary code via a request with a long directory and cache name...

CVE-2002-0826

Buffer overflow in WSFTP FTP Server 3.1.1 allows remote authenticated users to execute arbitrary code via a long SITE CPWD command...

CVE-2002-0401

SMB dissector in Ethereal 0.9.3 and earlier allows remote attackers to cause a denial of service crash or execute arbitrary code via malformed packets that cause Ethereal to dereference a NULL pointer...

CVE-2002-0935

Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service resource exhaustion via a large number of requests to the server with null characters, which causes the working threads to hang...

CVE-2002-0640

Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication PAMAuthenticationViaKbdInt...

CVE-2002-0163

Heap-based buffer overflow in Squid before 2.4 STABLE4, and Squid 2.5 and 2.6 until March 12, 2002 distributions, allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via compressed DNS responses...

CVE-2002-0569

Oracle 9i Application Server allows remote attackers to bypass access restrictions for configuration files via a direct request to the XSQL Servlet XSQLServlet...

CVE-2002-0826

Summary: CVE-2002-0826 affects WS_FTP Server versions prior to 3.1.2. Affected component: the CPWD command handling in WS_FTP Server. Root cause: unchecked/buffer overflow when processing long CPWD arguments, enabling a remote attacker with authentication to potentially execute arbitrary code. Im...

CVE-2002-0847

tinyproxy HTTP proxy 1.5.0, 1.4.3, and earlier allows remote attackers to execute arbitrary code via memory that is freed twice double-free...

CVE-2002-0454

Qpopper aka in.qpopper or popper 4.0.3 and earlier allows remote attackers to cause a denial of service CPU consumption via a very large string, which causes an infinite loop...