CAN-2002-1132

SquirrelMail vulnerability CVE-2002-1132: versions up to 1.2.7 and earlier allow remote attackers to determine the absolute pathname of options.php via a malformed optpage argument, leading to information disclosure. Debian advisories state the fix is in version 1.2.6-1.2 for woody and 1.2.8-1.1 ...

CAN-2003-0962

CVE-2003-0962 refers to a heap-overflow bug in rsync prior to 2.5.7, occurring when rsync is run in server mode (listening on port 873). The vulnerability allows a remote attacker to execute arbitrary code with the privileges of the rsync server by sending malformed requests, potentially affectin...

CAN-2004-0888

CVE-2004-0888 concerns an integer overflow in the CUPS pdftops filter. The issue can allow remote code execution on 64-bit platforms when a crafted PDF is printed via the lp user. Several advisories (RHSA-2008-0206, CESA-2008:0206, MDKSA/MCU references) indicate that patches backported to Red Hat...

CAN-2004-1014

CVE-2004-1014 affects nfs-utils (statd) where statd did not ignore the SIGPIPE signal, allowing remote attackers to cause a denial-of-service by terminating a TCP connection prematurely. Documented in NFS-related advisories (Debian DSA 606-1, Red Hat RHSA-2005:014, Ubuntu USN-36-1) and noted by N...

CAN-2004-0852

CVE-2004-0852 describes a buffer overflow in htget 0.93 that allows remote code execution via a crafted URL. Debian's DSA-611-1 fixes this in htget 0.93-1.1woody1. Root cause: improper bounds handling in URL processing. Impact: remote attacker could execute arbitrary code on vulnerable systems. R...

CAN-2003-0949

CVE-2003-0949 relates to xsok, a X11 Sokoban game, where xsok 1.02 does not properly drop privileges before locating and executing the gunzip program. This local-privilege-escalation flaw allows a local user to run arbitrary commands with the GID of games. Public sources in the connected docs (NV...

CAN-2004-1287

Two stack-based buffer overflow bugs in NASM were disclosed, leading to CVE-2004-1287 and CVE-2005-1194. An updated NASM package fixes these issues; Red Hat RHSA-2005:381 (and CentOS/CESA advisories) note the vulnerability in NASM up to affected versions and recommend upgrading to patched package...

CAN-2004-0915

The provided Connected docs confirm CVE-2004-0915 affects ViewCVS prior to 0.9.2. The tar export feature bypasses the hide_cvsroot and forbidden settings, enabling remote attackers to leak restricted repository information. Gentoo GLSA 200412-26 links this CAN-2004-0915 issue with an information ...

CAN-2004-1076

CVE-2004-1076 affects the Atari800 emulator. The provided sources describe multiple buffer overflows in the RtConfigLoad function in rt-config.c, affecting versions before 1.3.4, allowing local users to execute arbitrary code via large values in the configuration file. Exploitation details are no...

CAN-2004-0996

CVE-2004-0996 affects the cscope utility (versions 15-4 and 15-5). The root cause is insecure temporary file creation: cscope creates temporary files in world-writable directories with predictable names, enabling a local attacker to perform a symlink attack and overwrite arbitrary files with the ...

CAN-2004-0994

CVE-2004-0994 refers to multiple integer overflows in xzgv (0.8 and earlier) in image processing, notably in read_prf.c/read_prf handling, which can lead to remote code execution via crafted images. Related documents (GLSA-200501-09, OpenVAS entries, and NVD) confirm the issue and classify the im...

CAN-2004-0968

CVE-2004-0968 affects the GNU C Library (glibc). The vulnerability arises from the catchsegv (and related glibcbug) scripts in glibc 2.3.2 and earlier, enabling a local user to overwrite files via a symlink attack on temporary files. Multiple connected entries (CentOS GLSA, Debian DSA, Red Hat/US...

CAN-2004-0998

CVE-2004-0998 is a format-string vulnerability in telnetd-ssl (netkit-telnet-ssl) affecting 0.17 and earlier. The Debian security advisory and Debian tracker entries describe remote arbitrary-code execution as the impact. Remediation in these sources is to upgrade to fixed packages (e.g., 0.17.17...

CAN-2003-0014

CVE-2003-0014 affects the bmv PostScript viewer. The vulnerability is insecure creation of temporary files, enabling a local user to overwrite arbitrary files via a symlink attack in bmv 1.2 and earlier. A fix is available: Debian DSA-633-1 updates to 1.2-14.2 (woody) or 1.2-17 (sid); upgrade rec...

CAN-2004-1106

CVE-2004-1106 affects the gallery web application (PHP4-based photo album). The connected OpenVAS entries and Debian advisory describe a cross-site scripting vulnerability exploitable via specially formed URLs, enabling injection of arbitrary code. Debian’s DSA-642-1 and the linked Gentoo/FreeBSD...

CAN-2004-1189

CVE-2004-1189 is a legitimate Kerberos (krb5) vulnerability affecting multiple platforms (Ubuntu, Debian, Gentoo, FreeBSD, etc.). The issue is described as a buffer overflow in the add_to_history() function of the MIT Kerberos 5 implementation, which could allow an authenticated attacker to execu...

CAN-2004-1282

LinPopUp (Linpopup) is affected by CVE-2004-1282. The vulnerability resides in the buffer handling for the strexpand function in string.c of LinPopUp 1.2.0, which allows a remote attacker to execute arbitrary code by sending a crafted message during a Reply operation. Public advisories (Debian DS...

CAN-2005-0084

Technical details for CVE-2005-0084 are not provided in the supplied documents. No concrete product/vulnerability information is present. Monitor for updates from the referenced advisories and connected sources for affected products, impact, and fixes.

CAN-2005-0005

CVE-2005-0005 is not a standalone hidden entry: connected advisories tie this CVE to ImageMagick-related issues across multiple distributions (Debian DSA-646-1, Gentoo GLSA 200501-26/37, FreeBSD ports, Ubuntu USN-62-1, etc.). The OpenVAS data show a base CVSS v2 of 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P...

CAN-2005-0078

CVE-2005-0078 refers to a KDE screensaver issue disclosed in early KDE/kdelibs/kdebase advisories. The KDE screensaver (kscreensaver) in KDE up to version 3.0.5 fails to properly check the return value from a critical function, enabling a local attacker with physical access to crash the screensav...