CVE-2005-1294

The affixsockregister in the Affix Bluetooth Protocol Stack for Linux might allow local users to gain privileges via a socket call with a negative protocol value, which is used as an array index...

security flaw

The bluezsockcreate function in the Bluetooth stack for Linux kernel 2.4.6 through 2.4.30-rc1 and 2.6 through 2.6.11.5 allows local users to gain privileges via 1 socket or 2 socketpair call with a negative protocol value...

security flaw

Signedness error in the copyfromreadbuf function in ntty.c for Linux kernel 2.6.10 and 2.6.11rc1 allows local users to read kernel memory via a negative argument...

security flaw

The atmgetaddr function in addr.c for Linux kernel 2.6.10 and 2.6.11 before 2.6.11-rc4 may allow local users to trigger a buffer overflow via negative arguments...

security flaw

The bluezsockcreate function in the Bluetooth stack for Linux kernel 2.4.6 through 2.4.30-rc1 and 2.6 through 2.6.11.5 allows local users to gain privileges via 1 socket or 2 socketpair call with a negative protocol value...

CVE-2005-0750

The bluezsockcreate function in the Bluetooth stack for Linux kernel 2.4.6 through 2.4.30-rc1 and 2.6 through 2.6.11.5 allows local users to gain privileges via 1 socket or 2 socketpair call with a negative protocol value...

CVE-2005-0750: Undefined Security Weakness

The bluezsockcreate function in the Bluetooth stack for Linux kernel 2.4.6 through 2.4.30-rc1 and 2.6 through 2.6.11.5 allows local users to gain privileges via 1 socket or 2 socketpair call with a negative protocol value...

libxpm buffer overflow

scan.c for LibXPM may allow attackers to execute arbitrary code via a negative bitmapunit value that leads to a buffer overflow...

CVE-2005-0605: Undefined Security Weakness

scan.c for LibXPM may allow attackers to execute arbitrary code via a negative bitmapunit value that leads to a buffer overflow...

CVE-2005-0531: Undefined Security Weakness

The atmgetaddr function in addr.c for Linux kernel 2.6.10 and 2.6.11 before 2.6.11-rc4 may allow local users to trigger a buffer overflow via negative arguments...

CVE-2005-0492: Improper Input Validation

Adobe Acrobat Reader 6.0.3 and 7.0.0 allows remote attackers to cause a denial of service application crash via a PDF file that contains a negative Count value in the root page node...

CVE-2005-0482

TrackerCam 5.12 and earlier allows remote attackers to cause a denial of service crash via 1 a large number of connections with a negative Content-Length header, possibly triggering an integer signedness error, or 2 a large amount of data...

security flaw

Multiple integer signedness errors in the sgscsiioctl function in scsiioctl.c for Linux 2.6.x allow local users to read or modify kernel memory via negative integers in arguments to the scsi ioctl, which bypass a maximum length check before calling the copyfromuser and copytouser functions...

CVE-2003-1084: Undefined Security Weakness

Monit 1.4 to 4.1 allows remote attackers to cause a denial of service daemon crash via an HTTP POST request with a negative Content-Length field...

CVE-2005-0340: Undefined Security Weakness

Integer signedness error in Apple File Service AFP Server allows remote attackers to cause a denial of service application crash via a negative UAM string length in a FPLoginExt packet...

DEBIAN-CVE-2004-0918

The asnparseheader function asn1.c in the SNMP module for Squid Web Proxy Cache before 2.4.STABLE7 allows remote attackers to cause a denial of service server restart via certain SNMP packets with negative length fields that trigger a memory allocation error...

USN-66-1: PHP vulnerabilities

FraMe from kernelpanik.org reported that the cURL module does not respect openbasedir restrictions. As a result, scripts which used cURL to open files with an user-specified path could read arbitrary local files outside of the openbasedir directory. Stefano Di Paola discovered a vulnerability in...

CVE-2005-0108: Undefined Security Weakness

Apache modauthradius 1.5.4 and libpam-radius-auth allow remote malicious RADIUS servers to cause a denial of service crash via a RADIUSREPLYMESSAGE with a RADIUS attribute length of 1, which leads to a memcpy operation with a -1 length argument...

security flaw

Integer overflow in 1 tifdirread.c and 2 tiffax3.c for libtiff 3.5.7 and 3.7.0 allows remote attackers to execute arbitrary code via a TIFF file containing a TIFFASCII or TIFFUNDEFINED directory entry with a -1 entry count, which leads to a heap-based buffer overflow...

CVE-2004-2592

Quake II server before R1Q2, as used in multiple products, allows remote attackers to cause a denial of service application crash via a modified client that asks the server to send data stored at a negative array offset, which is not handled when processing Configstrings and Baselines...