CAN-2004-1051

CVE-2004-1051 affects sudo before 1.6.8p2, enabling local users to execute arbitrary commands by exploiting how bash environments can define functions with the same names as commands via () style variables. Public records in NVD confirm the vulnerability in sudo, with Debian advisories (DSA 596-1...

CAN-2004-1013

The CVE CVE-2004-1013 is represented in connected OpenVAS entries linked to Cyrus IMAPd advisories across multiple platforms (Ubuntu USN-31-1, Debian DSA-597-1, Gentoo GLSA 200411-34, FreeBSD ports). The evidence indicates a Cyrus IMAPd vulnerability likely caused by buffer overflow in the argume...

CAN-2002-0986

CVE-2002-0986 concerns the PHP mail() function in PHP 4.x up to 4.2.2, which does not filter ASCII control characters from its arguments. This could allow remote attackers to modify mail message content, including headers, and potentially use PHP as a “spam proxy.” The connected documents confirm...

CAN-2002-1132

SquirrelMail vulnerability CVE-2002-1132: versions up to 1.2.7 and earlier allow remote attackers to determine the absolute pathname of options.php via a malformed optpage argument, leading to information disclosure. Debian advisories state the fix is in version 1.2.6-1.2 for woody and 1.2.8-1.1 ...

CAN-2003-0902

CVE-2003-0902 affects minimalist mailing list manager (versions 2.4, 2.2 and possibly others) with a remote code execution vulnerability due to unsanitised input. Debian DSAs confirm fixes: upgrade to minimalist 2.4-1 (sid) or 2.2-4 (woody). Other references (NVD/Nessus/OpenVAS) corroborate unkno...

CAN-2003-0962

CVE-2003-0962 refers to a heap-overflow bug in rsync prior to 2.5.7, occurring when rsync is run in server mode (listening on port 873). The vulnerability allows a remote attacker to execute arbitrary code with the privileges of the rsync server by sending malformed requests, potentially affectin...

CAN-2004-0888

CVE-2004-0888 concerns an integer overflow in the CUPS pdftops filter. The issue can allow remote code execution on 64-bit platforms when a crafted PDF is printed via the lp user. Several advisories (RHSA-2008-0206, CESA-2008:0206, MDKSA/MCU references) indicate that patches backported to Red Hat...

CAN-2004-1014

CVE-2004-1014 affects nfs-utils (statd) where statd did not ignore the SIGPIPE signal, allowing remote attackers to cause a denial-of-service by terminating a TCP connection prematurely. Documented in NFS-related advisories (Debian DSA 606-1, Red Hat RHSA-2005:014, Ubuntu USN-36-1) and noted by N...

CAN-2003-0985

The provided OpenVAS/DSA/Gentoo entries reference CVE-2003-0985 in kernel-related advisories (e.g., Debian DSA 417-1/417-2, Gentoo GLSA 200401-01) affecting 2.4.x kernel packages (kernel-image-2.4.18-1-alpha, kernel-patch-2.4.18-powerpc, etc.). The CVSS base is shown as 7.2 with vector AV:L/AC:L/...

CAN-2004-0852

CVE-2004-0852 describes a buffer overflow in htget 0.93 that allows remote code execution via a crafted URL. Debian's DSA-611-1 fixes this in htget 0.93-1.1woody1. Root cause: improper bounds handling in URL processing. Impact: remote attacker could execute arbitrary code on vulnerable systems. R...

CAN-2003-0949

CVE-2003-0949 relates to xsok, a X11 Sokoban game, where xsok 1.02 does not properly drop privileges before locating and executing the gunzip program. This local-privilege-escalation flaw allows a local user to run arbitrary commands with the GID of games. Public sources in the connected docs (NV...

CAN-2004-0975

CVE-2004-0975 concerns the der_chop script in the OpenSSL package used by Trustix Secure Linux 1.5–2.1 and other OSes. The vulnerability arises from a symlink-based attack on temporary files, allowing local users to overwrite files. Connected documents confirm der_chop as the affected component a...

CAN-2004-1287

Two stack-based buffer overflow bugs in NASM were disclosed, leading to CVE-2004-1287 and CVE-2005-1194. An updated NASM package fixes these issues; Red Hat RHSA-2005:381 (and CentOS/CESA advisories) note the vulnerability in NASM up to affected versions and recommend upgrading to patched package...

CAN-2004-0915

The provided Connected docs confirm CVE-2004-0915 affects ViewCVS prior to 0.9.2. The tar export feature bypasses the hide_cvsroot and forbidden settings, enabling remote attackers to leak restricted repository information. Gentoo GLSA 200412-26 links this CAN-2004-0915 issue with an information ...

CAN-2004-0999

ZGV is affected by CVE-2004-0999. Affected software: zgv (SVGAlib graphics viewer). Vulnerability: remote attacker can cause a denial of service (application crash/segmentation fault) by feeding crafted multiple-image (animated) GIFs. Root cause: described as integer overflows and unsanitised inp...

CAN-2004-0993

CVE-2004-0993 describes a buffer overflow in hpsockd (the Hewlett-Packard socks server) prior to version 0.6. The overflow, due to missing input sanitising, could be triggered remotely to cause a denial of service or, in some cases, execute arbitrary code. Debian fixed this in 0.6.woody1 (stable)...

CAN-2004-1289

CVE-2004-1289 corresponds to multiple buffer overflow flaws in pcal (notably in getline in pcalutil.c and in get_holiday in readfile.c) that could allow remote code execution via a crafted calendar file. Affected software is pcal (version 4.7.1) across various ecosystems (Debian, Ubuntu, FreeBSD ...

CAN-2004-0561

CVE-2004-0561 is a format string vulnerability in the log routine of the gopherd server (Debian gopher package), affecting version 3.0.3. It allows remote attackers to cause denial of service and possibly execute arbitrary code. Debian security advisories (DSA-638-1) fix the issues by upgrading t...

CAN-2004-1170

CVE-2004-1170 affects the a2ps package (notably versions around 4.13). The connected sources describe a vulnerability where an attacker can leverage shell metacharacters in a file name to execute arbitrary commands remotely, due to insecure handling of the filename in the tool’s processing (e.g.,...

CAN-2004-1076

CVE-2004-1076 affects the Atari800 emulator. The provided sources describe multiple buffer overflows in the RtConfigLoad function in rt-config.c, affecting versions before 1.3.4, allowing local users to execute arbitrary code via large values in the configuration file. Exploitation details are no...