CAN-2004-0993

CVE-2004-0993 describes a buffer overflow in hpsockd (the Hewlett-Packard socks server) prior to version 0.6. The overflow, due to missing input sanitising, could be triggered remotely to cause a denial of service or, in some cases, execute arbitrary code. Debian fixed this in 0.6.woody1 (stable)...

CAN-2004-1289

CVE-2004-1289 corresponds to multiple buffer overflow flaws in pcal (notably in getline in pcalutil.c and in get_holiday in readfile.c) that could allow remote code execution via a crafted calendar file. Affected software is pcal (version 4.7.1) across various ecosystems (Debian, Ubuntu, FreeBSD ...

CAN-2004-0561

CVE-2004-0561 is a format string vulnerability in the log routine of the gopherd server (Debian gopher package), affecting version 3.0.3. It allows remote attackers to cause denial of service and possibly execute arbitrary code. Debian security advisories (DSA-638-1) fix the issues by upgrading t...

CAN-2004-1170

CVE-2004-1170 affects the a2ps package (notably versions around 4.13). The connected sources describe a vulnerability where an attacker can leverage shell metacharacters in a file name to execute arbitrary commands remotely, due to insecure handling of the filename in the tool’s processing (e.g.,...

CAN-2004-1076

CVE-2004-1076 affects the Atari800 emulator. The provided sources describe multiple buffer overflows in the RtConfigLoad function in rt-config.c, affecting versions before 1.3.4, allowing local users to execute arbitrary code via large values in the configuration file. Exploitation details are no...

CAN-2004-0914

CVE-2004-0914 is not a reserved entry in the connected data; multiple advisories reference it. The CVE is associated with OpenMotif/Lesstif components and appears in: Gentoo GLSA 200502-06 (lesstif), Ubuntu USN-83-1/2, Debian DSA-816-1, and Red Hat Satellite/OpenMotif-related advisories (RHSA-200...

CAN-2004-0976

CVE-2004-0976 is referenced across multiple advisories (Debian DSA-620-1, Red Hat RHSA-2005:881, Gentoo GLSA 200412-04, Ubuntu USN-16-1) as a Perl-related issue. Public details in connected documents indicate that Solar Designer reported temporary-file handling bugs in Perl modules, potentially a...

CAN-2004-1165

CVE-2004-1165 is referenced in multiple advisories tied to kdelibs/konqueror. The Red Hat RHSA-2005:065 notes two separate flaws: (1) a sandbox/Java-applets issue in Konqueror that could allow a remote attacker to escalate privileges and access arbitrary files, and (2) an FTP kioslave flaw that c...

CAN-2004-0996

CVE-2004-0996 affects the cscope utility (versions 15-4 and 15-5). The root cause is insecure temporary file creation: cscope creates temporary files in world-writable directories with predictable names, enabling a local attacker to perform a symlink attack and overwrite arbitrary files with the ...

CAN-2004-0994

CVE-2004-0994 refers to multiple integer overflows in xzgv (0.8 and earlier) in image processing, notably in read_prf.c/read_prf handling, which can lead to remote code execution via crafted images. Related documents (GLSA-200501-09, OpenVAS entries, and NVD) confirm the issue and classify the im...

CAN-2004-0968

CVE-2004-0968 affects the GNU C Library (glibc). The vulnerability arises from the catchsegv (and related glibcbug) scripts in glibc 2.3.2 and earlier, enabling a local user to overwrite files via a symlink attack on temporary files. Multiple connected entries (CentOS GLSA, Debian DSA, Red Hat/US...

CAN-2004-0998

CVE-2004-0998 is a format-string vulnerability in telnetd-ssl (netkit-telnet-ssl) affecting 0.17 and earlier. The Debian security advisory and Debian tracker entries describe remote arbitrary-code execution as the impact. Remediation in these sources is to upgrade to fixed packages (e.g., 0.17.17...

CAN-2004-1179

CVE-2004-1179 affects the debmake package: the debstd script in debmake 3.6.x before 3.6.10 and 3.7.x before 3.7.7 allows local users to overwrite arbitrary files via a symlink attack in temporary directories. The provided documents identify the affected versions and the local access requirement;...

CAN-2004-1308

CVE-2004-1308 refers to an integer overflow/heap-overflow vulnerability in libtiff used by TIFF parsing. The linked Nessus/CenterOS/RHEL/Ubuntu advisories attribute this to kdegraphics/kfax components, with updates available that backport patches in libtiff. Exploitation would involve a malicious...

CAN-2004-1125

CVE-2004-1125 is a known issue tied to the Xpdf code used by teTeX/tetex across multiple Linux distributions. The vulnerability arises from buffer overflow flaws in Xpdf code (notably Gfx::doImage, ParseCommand, and Decrypt::makeFileKey2) that teTeX embeds, enabling a crafted PDF to crash the pro...

CAN-2004-1026

CVE-2004-1026 is connected to multiple open-source advisories affecting imlib/imlib2 across several distros. Public sources in connected documents identify the vulnerability in imlib (and imlib2) with a high base CVSS of 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C). Gentoo GLSA entries (200412-03 for imlib ...

CAN-2003-0014

CVE-2003-0014 affects the bmv PostScript viewer. The vulnerability is insecure creation of temporary files, enabling a local user to overwrite arbitrary files via a symlink attack in bmv 1.2 and earlier. A fix is available: Debian DSA-633-1 updates to 1.2-14.2 (woody) or 1.2-17 (sid); upgrade rec...

CAN-2004-1181

CVE-2004-1181 corresponds to Debian htmlheadline: multiple insecure uses of temporary files allow a local user to overwrite arbitrary files via a symlink attack on temporary files. Affected package: htmlheadline prior to version 21.8-3. Impact: local privilege/overwrite possibility. Mitigation: u...

CAN-2004-1183

CVE-2004-1183 is a documented integer overflow in the tiffdump utility of libtiff (affecting versions prior to the patch). Several advisories (Ubuntu USN-54-1, Red Hat RHSA-2005:035, Gentoo GLSA-200501-06, SUSE-SA:2005:001, Debian/others) describe that processing carefully crafted TIFF images can...

CAN-2004-1318

Summary of CVE-2004-1318 (Namazu): Namazu2’s namazu.cgi accepts input that is not properly sanitised, allowing a remote attacker to cause cross-site scripting (XSS). The Debian advisories (DSA-627-1) describe the flaw as unsanitised input in Namazu2, with exploitation via a crafted query, notably...