CAN-2004-0968

CVE-2004-0968 affects the GNU C Library (glibc). The vulnerability arises from the catchsegv (and related glibcbug) scripts in glibc 2.3.2 and earlier, enabling a local user to overwrite files via a symlink attack on temporary files. Multiple connected entries (CentOS GLSA, Debian DSA, Red Hat/US...

CAN-2004-0998

CVE-2004-0998 is a format-string vulnerability in telnetd-ssl (netkit-telnet-ssl) affecting 0.17 and earlier. The Debian security advisory and Debian tracker entries describe remote arbitrary-code execution as the impact. Remediation in these sources is to upgrade to fixed packages (e.g., 0.17.17...

CAN-2004-1179

CVE-2004-1179 affects the debmake package: the debstd script in debmake 3.6.x before 3.6.10 and 3.7.x before 3.7.7 allows local users to overwrite arbitrary files via a symlink attack in temporary directories. The provided documents identify the affected versions and the local access requirement;...

CAN-2004-1308

CVE-2004-1308 refers to an integer overflow/heap-overflow vulnerability in libtiff used by TIFF parsing. The linked Nessus/CenterOS/RHEL/Ubuntu advisories attribute this to kdegraphics/kfax components, with updates available that backport patches in libtiff. Exploitation would involve a malicious...

CAN-2004-1125

CVE-2004-1125 is a known issue tied to the Xpdf code used by teTeX/tetex across multiple Linux distributions. The vulnerability arises from buffer overflow flaws in Xpdf code (notably Gfx::doImage, ParseCommand, and Decrypt::makeFileKey2) that teTeX embeds, enabling a crafted PDF to crash the pro...

CAN-2004-1026

CVE-2004-1026 is connected to multiple open-source advisories affecting imlib/imlib2 across several distros. Public sources in connected documents identify the vulnerability in imlib (and imlib2) with a high base CVSS of 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C). Gentoo GLSA entries (200412-03 for imlib ...

CAN-2003-0014

CVE-2003-0014 affects the bmv PostScript viewer. The vulnerability is insecure creation of temporary files, enabling a local user to overwrite arbitrary files via a symlink attack in bmv 1.2 and earlier. A fix is available: Debian DSA-633-1 updates to 1.2-14.2 (woody) or 1.2-17 (sid); upgrade rec...

CAN-2004-1181

CVE-2004-1181 corresponds to Debian htmlheadline: multiple insecure uses of temporary files allow a local user to overwrite arbitrary files via a symlink attack on temporary files. Affected package: htmlheadline prior to version 21.8-3. Impact: local privilege/overwrite possibility. Mitigation: u...

CAN-2004-1183

CVE-2004-1183 is a documented integer overflow in the tiffdump utility of libtiff (affecting versions prior to the patch). Several advisories (Ubuntu USN-54-1, Red Hat RHSA-2005:035, Gentoo GLSA-200501-06, SUSE-SA:2005:001, Debian/others) describe that processing carefully crafted TIFF images can...

CAN-2004-1318

Summary of CVE-2004-1318 (Namazu): Namazu2’s namazu.cgi accepts input that is not properly sanitised, allowing a remote attacker to cause cross-site scripting (XSS). The Debian advisories (DSA-627-1) describe the flaw as unsanitised input in Namazu2, with exploitation via a crafted query, notably...

CAN-2004-1010

CVE-2004-1010 is tied to a zip package flaw that multiple advisories reference (Ubuntu USN-18-1, Debian DSA-624-1, Gentoo GLSA, FreeBSD ports, etc.). The concrete issue is a buffer overflow triggered when creating ZIP archives with very long path names, which can allow code execution with the pri...

CAN-2004-1106

CVE-2004-1106 affects the gallery web application (PHP4-based photo album). The connected OpenVAS entries and Debian advisory describe a cross-site scripting vulnerability exploitable via specially formed URLs, enabling injection of arbitrary code. Debian’s DSA-642-1 and the linked Gentoo/FreeBSD...

CAN-2004-0555

The CVE CAN-2004-0555 entry corresponds to a buffer overflow in the Debian queue project (queue/queued.c and related files) prior to version 1.30.1, enabling remote code execution. Public sources in the connected documents identify the affected product as the queue load-balancing system, with the...

CAN-2004-1189

CVE-2004-1189 is a legitimate Kerberos (krb5) vulnerability affecting multiple platforms (Ubuntu, Debian, Gentoo, FreeBSD, etc.). The issue is described as a buffer overflow in the add_to_history() function of the MIT Kerberos 5 implementation, which could allow an authenticated attacker to execu...

CAN-2004-1282

LinPopUp (Linpopup) is affected by CVE-2004-1282. The vulnerability resides in the buffer handling for the strexpand function in string.c of LinPopUp 1.2.0, which allows a remote attacker to execute arbitrary code by sending a crafted message during a Reply operation. Public advisories (Debian DS...

CAN-2004-1182

HylaFAX contains a vulnerability in hfaxd (CVE-2004-1182) where, if a weak hosts.hfaxd file is used, a remote attacker can authenticate by supplying a crafted username or hostname that matches a regex against the hosts.hfaxd entry without a password. Affected: HylaFAX with weak hosts.hfaxd config...

CAN-2004-1091

CVE-2004-1091 affects Midnight Commander (mc) prior to 4.5.55, allowing remote attackers to cause a denial of service by triggering a null dereference. This is documented in multiple sources (NVD/CVE records) and is part of a set of issues tied to mc as described in OpenVAS and IDS advisories. Th...

CAN-2005-0020

CVE-2005-0020 describes a buffer overflow in playmidi prior to 2.4 that could allow a local user to execute arbitrary code. This vulnerability is documented across multiple sources (NVD, OSV, Debian/DSA entries, CVE listing, and vendor advisories) with the impact restricted to local privilege esc...

CAN-2005-0084

Technical details for CVE-2005-0084 are not provided in the supplied documents. No concrete product/vulnerability information is present. Monitor for updates from the referenced advisories and connected sources for affected products, impact, and fixes.

CAN-2005-0015

CVE-2005-0015 concerns Sword (diatheke CGI) 1.5.7a, where missing input sanitising in the diatheke CGI script allows remote attackers to execute arbitrary commands via shell metacharacters in a URL. Affected software is Sword under the Debian DSA-650-1 advisory; multiple sources (NVD, OSV, CVE li...