CVE-2003-0172

The CVE-2003-0172 issue affects PHP 4.3.1 on Windows (and possibly other OSes) due to a buffer overflow in the openlog function triggered by a long filename argument. The vulnerability allows remote attackers to cause a crash and potentially execute arbitrary code. The provided documents describe...

CVE-2003-0178

Multiple buffer overflows in Lotus Domino Web Server before 6.0.1 allow remote attackers to cause a denial of service or execute arbitrary code via 1 the sViewName option in the PresetFields parameter for iNotes, 2 the Foldername option in the PresetFields parameter for iNotes, or 3 a long Host...

CVE-2003-0165

Format string vulnerability in Eye Of Gnome EOG allows attackers to execute arbitrary code via format string specifiers in a command line argument for the file to display...

CVE-2003-0181

Lotus Domino Web Server nhttp.exe before 6.0.1 allows remote attackers to cause a denial of service via a "Fictionary Value Field POST request" as demonstrated using the sValidation form with a long, unknown parameter name...

CVE-2003-0165

Eye of GNOME (EOG) 2.2.0 and earlier is affected by a format-string vulnerability in the command-line filename handling, allowing an attacker to execute arbitrary code with the user’s privileges. Exploitation would require a crafted filename passed to EOG (e.g., via mailcap/mail clients). Patches...

CVE-2003-0179

CVE-2003-0179 describes a buffer overflow in the COM Object Control Handler for Lotus Domino before/including 6.0.1, exploitable via multiple vectors through the iNotes ActiveX control’s InitializeUsingNotesUserName method. The issue allows remote attackers to execute arbitrary code on affected s...

CVE-2003-0172

Buffer overflow in openlog function for PHP 4.3.1 on Windows operating system, and possibly other OSes, allows remote attackers to cause a crash and possibly execute arbitrary code via a long filename argument...

CVE-2003-0165

Format string vulnerability in Eye Of Gnome EOG allows attackers to execute arbitrary code via format string specifiers in a command line argument for the file to display...

CVE-2003-0181

CVE-2003-0181 affects Lotus Domino Web Server (nhttp.exe) prior to 6.0.1. The vulnerability stems from processing a POST request in the s_Validation form with a long, unknown parameter name, enabling remote attackers to cause a denial of service. Impact is denial of service (availability) with no...

CVE-2003-0167

Multiple off-by-one buffer overflows in the IMAP capability for Mutt 1.3.28 and earlier, and Balsa 1.2.4 and earlier, allow a remote malicious IMAP server to cause a denial of service crash and possibly execute arbitrary code via a specially crafted mail folder, a different vulnerability than...

CVE-2003-0083

Apache 1.3 before 1.3.25 and Apache 2.0 before version 2.0.46 does not filter terminal escape sequences from its access logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences, a different vulnerabilit...

CVE-2003-0083

CVE-2003-0083 affects Apache 1.3.x (before 1.3.25) and Apache 2.0.x (before 2.0.46). The issue is that terminal escape sequences are not filtered from access logs, enabling insertion of escape sequences into terminal emulators vulnerable to such sequences. This is a separate vulnerability from CV...

CVE-2003-0166

Integer signedness error in emalloc function for PHP before 4.3.2 allow remote attackers to cause a denial of service memory consumption and possibly execute arbitrary code via negative arguments to functions such as 1 socketrecv, 2 socketrecvfrom, and possibly other functions...

CVE-2003-0106

The HTTP proxy for Symantec Enterprise Firewall SEF 7.0 allows proxy users to bypass pattern matching for blocked URLs via requests that are URL-encoded with escapes, Unicode, or UTF-8...

CVE-2003-0166

PHP prior to 4.3.2 is affected by CVE-2003-0166 due to a signedness error in emalloc() that can allow remote attackers to cause memory exhaustion and potentially execute arbitrary code via negative arguments to functions such as socket_recv and socket_recvfrom (and possibly others). The issue ste...

Horde IMP mailbox.php3 Multiple Parameter SQL Injection

The remote server is running IMP, a web-based mail client. There is a bug in the installed version which allows an attacker to perform a SQL injection attack using the 'actionID' parameter of the 'mailbox.php3' script. An attacker may use this flaw to gain unauthorized access to a user mailbox or...

CVE-2003-0072

CVE-2003-0072 describes a remote, authenticated denial-of-service in the Kerberos 5 Key Distribution Center (KDC) for krb5 1.2.7 and earlier. A specific protocol request can trigger an out-of-bounds read of an array, crashing KDCs within the same realm. Connected advisories reference this CVE amo...

CVE-2003-0082

The CVE-2003-0082 issue affects the KDC in Kerberos 5 (krb5) 1.2.7 and earlier. A remote, authenticated attacker can trigger a protocol request that causes the KDC to corrupt its heap (buffer underrun), leading to a denial of service (KDC crash) within the same realm. The connected advisories con...

CVE-2003-0153

CVE-2003-0153 affects the bonsai Mozilla CVS query tool. The vulnerability is an absolute path disclosure exposed in error messages generated by cvslog.cgi, cvsview2.cgi, and multidiff.cgi. Connected records confirm Debian advisory DSA-265-1 documents the issue and notes a missing update; OpenVAS...

CVE-2003-0159

Ethereal 0.9.9 and earlier are affected by a heap-based buffer overflow in the NTLMSSP code, enabling remote DoS and possibly arbitrary code execution. Exploitation via crafted packets (e.g., SOCKS) is noted in advisories. Remediation: update to Ethereal 0.9.11 or later (0.9.13 as noted in RHSA-2...