Mod_Gzip 1.3.x - Debug Mode

ModGzip 1.3.x - Debug Mode // source: https://www.securityfocus.com/bid/7769/info Modgzip is reported prone to a stack overflow, format string vulnerability and a file corruption issue due to a predictable naming scheme for log files. Exploitation of these issues could result in execution of...

Mod_NTLM 0.x - Authorisation Format String

ModNTLM 0.x - Authorisation Format String source: https://www.securityfocus.com/bid/7393/info A format string vulnerability has been reported for the modntlm Apache module. The problem occurs when logging authentication strings passed in HTTP requests. By passing malicious format specifiers in a...

Mod_NTLM 0.x - Authorisation Format String

source: https://www.securityfocus.com/bid/7393/info A format string vulnerability has been reported for the modntlm Apache module. The problem occurs when logging authentication strings passed in HTTP requests. By passing malicious format specifiers in a request, it may be possibile for an attack...

CVE-2002-0690

Format string vulnerability in McAfee Security ePolicy Orchestrator ePO 2.5.1 allows remote attackers to execute arbitrary code via an HTTP GET request with a URI containing format strings...

CVE-2002-1415

Format string vulnerability in SMTP service for WebEasyMail 3.4.2.2 and earlier allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via format strings in SMTP requests...

Eye of Gnome contains format string vulnerability in the file name handling of command line arguments

Overview Eye of Gnome contains a format string vulnerability that may allow remote attackers to execute arbitrary code with the privileges of the user running the application, typically an unprivileged system user. Description Eye of Gnome EOG is an image viewing application that is part of the...

Format string vulnerability in SSLtelnet

SSLtelnet contains a format string vulnerability that could allow remote code execution and privilege escalation...

CVE-2002-0412

NTOP is affected by CVE-2002-0412 due to a format string vulnerability in the TraceEvent function prior to version 2.1. The issue allows remote attackers to execute arbitrary code by injecting format strings into syslog calls. Attack vectors include an HTTP GET request, or credentials supplied in...

CVE-2002-0573

CVE-2002-0573 affects Solaris systems running the rpc.rwalld daemon (Solaris 2.5.1–8). The issue is a format-string vulnerability in the error-handling path of rpc.rwalld, which can allow a remote attacker to execute arbitrary code with the daemon’s privileges (typically root) by sending a specia...

CVE-2002-0716

CVE-2002-0716 describes a format string vulnerability in the crontab component of SCO OpenServer 5.0.5 and 5.0.6 . The issue arises from format string specifiers in the file name argument , allowing local users to gain privileges . The vulnerability is tied to the crontab handling of a file name ...

CVE-2002-0916

This CVE (CVE-2002-0916) affects Squid 2.4.STABLE6 and earlier, in the Stellar-X msntauth authentication module. The issue is a format string vulnerability in the allowuser code that handles the user name, where untrusted input is used in a syslog call, enabling remote code execution. Documents c...

CVE-2002-1049

CVE-2002-1049 is a format string vulnerability in HylaFAX faxgetty prior to 4.1.3. The TSI data element is used in a format string without proper sanitization, allowing remote attackers to crash the faxgetty process (denial of service). Several advisories reference this issue, with Debian noting ...

CVE-2002-1051

The CVE-2002-1051 entry concerns NANOG traceroute (traceroute-nanog). A format string vulnerability exists in TrACESroute 6.0 GOLD that allows local users to execute arbitrary code via the -T (terminator) argument. The issue is tied to NANOG traceroute’s handling of input leading to potential cod...

CVE-2001-0891

CVE-2001-0891 describes a format string vulnerability in the NQS daemon (nqsdaemon) of NQE 3.3.0.16 on CRAY UNICOS and SGI IRIX. A local user could gain root privileges by submitting a batch job with a name containing formatting characters (via qsub). The connected documents confirm the vulnerabi...

CVE-2002-0246

Format string vulnerability in the message catalog library functions in UnixWare 7.1.1 allows local users to gain privileges by modifying the LCMESSAGE environment variable to read other message catalogs containing format strings from setuid programs such as vxprint...

CVE-2002-0501

Format string vulnerability in logprint function of Posadis DNS server before version m5pre2 allows local users and possibly remote attackers to execute arbitrary code via format strings that are inserted into logging messages...

CVE-2002-0573

Format string vulnerability in RPC wall daemon rpc.rwalld for Solaris 2.5.1 through 8 allows remote attackers to execute arbitrary code via format strings in a message that is not properly provided to the syslog function when the wall command cannot be executed...

CVE-2002-0817

Format string vulnerability in super for Linux allows local users to gain root privileges via a long command line argument...

CVE-2002-0851

Format string vulnerability in ISDN Point to Point Protocol PPP daemon ipppd in the ISDN4Linux i4l package allows local users to gain root privileges via format strings in the device name command line argument, which is not properly handled in a call to syslog...

CVE-2002-0916

Format string vulnerability in the allowuser code for the Stellar-X msntauth authentication module, as distributed in Squid 2.4.STABLE6 and earlier, allows remote attackers to execute arbitrary code via format strings in the user name, which are not properly handled in a syslog call...