272 matches found
CAN-2002-1220
CVE-2002-1220 affects BIND 8, versions 8.3.x through 8.3.3. A remote attacker can cause a denial of service (termination due to assertion failure) by requesting a subdomain that does not exist with an OPT RR containing a large UDP payload. Debian/DSA-196-1 notes a fix in 8.3.3-2.0woody1; other Op...
CAN-2002-1148
CVE-2002-1148 concerns Apache Tomcat 4.x source disclosure via the DefaultServlet. Public details across connected advisories indicate that Tomcat 4.0.4 and earlier (and variants) are vulnerable when both the invoker servlet and the default servlet are used, allowing remote attackers to read the ...
CAN-2003-0056
CVE-2003-0056 concerns a buffer overflow in the setuid program of the slocate secure locate replacement. The vulnerability allows a local attacker to execute arbitrary code with elevated privileges (e.g., as root) by crafting inputs that overflow buffers. Public advisories from Debian, Red Hat, M...
CAN-2003-0108
CVE-2003-0108 corresponds to isakmp_sub_print in tcpdump versions 3.6 through 3.7.1, where a remote attacker can cause a denial of service (CPU consumption) by sending a malformed ISAKMP packet to UDP port 500, potentially triggering an infinite loop. The connected advisories confirm tcpdump as a...
CAN-2003-0154
CVE-2003-0154 concerns the Bonsai Mozilla CVS query tool. The Debian/OpenVAS/Nessus/*CVE entries describe cross‑site scripting (XSS) vulnerabilities in Bonsai’s web CGI suite (cvslog.cgi, cvsblame.cgi, cvsquery.cgi, showcheckins.cgi, cvsqueryform.cgi, and possibly others). The root cause is impro...
CAN-2003-0153
CVE-2003-0153 affects the Bonsai Mozilla CVS query tool. It exposes the tool’s absolute pathname in certain error messages generated by cvslog.cgi, cvsview2.cgi, and multidiff.cgi, resulting in information disclosure. No remediation details are provided in the supplied documents.
CAN-2003-0085
CVE-2003-0085 is a Samba nttrans buffer overflow affecting Samba 2.2.2–2.2.6 where a bug in the length checking of encrypted password change requests enabled an unauthenticated remote attacker to potentially execute code with root privileges. Public exploit material exists (e.g., Metasploit modul...
CAN-2003-0127
Technical details for CVE-2003-0127 are not publicly provided in the supplied documents. No affected products, root cause, or fixes are described here; monitor for future updates.
CAN-2003-0001
CVE-2003-0001 is referenced across multiple connected documents as an Etherleak-related memory disclosure related to Juniper Networks Junos OS and associated PTX/QFX platforms. The Juniper JSA69720 advisory cites two vulnerabilities: Etherleak due to insufficient Ethernet frame padding in NIC dri...
CAN-2003-0213
PoPToP PPTP server vulnerable to a remote buffer overflow (CVE-2003-0213) via ctrlpacket.c. A length field of 0 or 1 feeds a negative value into the read, causing potential buffer overflow and remote code execution or denial of service. Affected versions are PoPToP PPTP server prior to 1.1.4-b3. ...
CAN-2003-0150
CAN-2003-0150 (MySQL) describes a vulnerability in MySQL versions up to and including 3.23.55 where a malicious user could cause the server to run as root by injecting a crafted configuration file. The root cause is the server loading configuration data from files that could be written by or writ...
CAN-2003-0195
CVE-2003-0195 affects CUPS prior to version 1.1.19. A remote attacker can trigger a denial of service by sending an HTTP request to the IPP port (631) that is not properly terminated, causing CUPS to stop responding to other requests. Fix: upgrade to CUPS 1.1.19 or later (upstream) or apply vendo...
CAN-2002-1380
CVE-2002-1380 affects the Linux kernel 2.2.x series. The issue allows a local user to cause a denial of service (kernel crash) by calling mmap() with PROT_READ to access non-readable memory pages via /proc/pid/mem. Public advisories (including Debian DSA-336/DSA-336-2, Mandrake MDKSA-2003:039, EN...
CAN-2003-0619
CVE-2003-0619 is an integer signedness error in the decode_fh function of nfs3xdr.c in the Linux kernel before 2.4.21. This enables remote attackers to trigger a denial of service (kernel panic) by supplying a negative size value in XDR data for an NFSv3 procedure call. Publicly documented refere...
CAN-2003-0536
CVE-2003-0536 is evidenced in connected docs as a directory traversal flaw in phpSysInfo (and related packages) up to version 2.4 and earlier, enabling remote file inclusion via .. sequences in sensor_program or _SERVER[HTTP_ACCEPT_LANGUAGE], potentially allowing reading of arbitrary files and, i...
CAN-2003-0625
CVE-2003-0625 affects the xfstt TrueType font server. An off-by-one error in certain versions allows a remote attacker to read memory from the xfstt process during the connection handshake, potentially leaking sensitive information and aiding fingerprinting or exploitation of other vulnerabilitie...
CAN-2003-0540
CVE-2003-0540 concerns Postfix address parsing. The vulnerability, in Postfix 1.1.12 and earlier, allows remote DoS via a malformed envelope address that can cause the queue manager to lock up or the SMTP listener to halt. This is triggered by specific MAIL FROM/Errors-To or RCPT TO headers conta...
CAN-2003-0706
The CVE-2003-0706 entry is tied to mah-jong (earlier than version 1.5.6) and is described across multiple sources as a remote-denial-of-service vulnerability. Debian’s DSA 378-1 notes that the mah-jong server could be put into a tight loop by a remote attacker, causing it to stop responding to co...
CAN-2003-0705
CVE-2003-0705 affects mah-jong (1.5.6 and earlier). The flaw is a buffer overflow that could be triggered remotely to execute arbitrary code with the privileges of the mah-jong server/user process. Public sources in the provided documents confirm the vulnerability and its remote-execution impact,...