CVE-1999-0818

CVE-1999-0818 notes a buffer overflow in Solaris kcms_configure triggered by a long NETPATH environment variable. The vulnerability is local (attack vector Local) with low attack complexity and no authentication, and it has complete impact on confidentiality, integrity, and availability (C:C/I:C/...

CVE-2003-0064

The CVE concerns dtterm and related terminals’ Window Title Reporting feature. An attacker can craft an escape sequence that places the current window title on the command line, and the user must press Enter for the command to execute, enabling arbitrary command execution on the vulnerable host. ...

CVE-2003-1071

The CVE-2003-1071 issue affects the Solaris wall daemon (rpc.walld) on Solaris 2.6–9. Local users can craft messages to logged-on users that appear to come from arbitrary UIDs by closing stderr before executing wall and supplying a spoofed From header. The attack is local and requires no authenti...

CVE-2005-2072

CVE-2005-2072 affects the runtime linker (ld.so) in Solaris 8, 9, and 10, where LD_AUDIT in setuid/setgid contexts can be abused to gain privileges (including by using a long LD_AUDIT value). Connected advisories list vendor patches addressing this: Solaris 8/9/10 patches 109147-44, 109148-42, 11...

CVE-2006-7140

CVE-2006-7140 concerns the libike library used by Sun Solaris components (in.iked, elfsign, kcfd) on Solaris 9/10. When an RSA key with exponent 3 is used, libike removes PKCS#1 padding before hashing, enabling remote attackers to forge a PKCS#1 v1.5 signature signed by that RSA key and to disrup...

CVE-2013-5864

CVE-2013-5864 affects Oracle Solaris, specifically the USB hub driver in Solaris 10 and 11.1. The vulnerability is a local-privilege availability issue allowing a logged-on user to cause an OS hang or a frequently repeatable crash (DOS). Nessus data ties the issue to Solaris patch IDs 149638-02 (...

CVE-2014-0442

CVE-2014-0442 affects Oracle Solaris 9, 10, and 11.1, targeting the Print Filter Utility. The vulnerability is described as unspecified with local-exploit potential and impacts confidentiality, integrity, and availability as per the CVE entry. Connected Nessus/NASL data corroborates affected Sola...

CVE-1999-0051

CVE-1999-0051 affects IRIX FLEXlm LicenseManager versions 4.0–5.0. The issue allows arbitrary file creation and program execution via the LicenseManager component. No explicit patch/version remediation is provided in the documents; one source (PT-1997-1030) recommends disabling FLEXlm on affected...

CVE-1999-0057

The CVE refers to the HP-UX vacation program allowing remote command execution by sending crafted input that causes the Vacation utility to pass arbitrary parameters to sendmail. The issue is associated with HP patch PHNE_16295 for s700/s800 11.00 (HP-UX Vacation patch), indicating the remediatio...

CVE-1999-0109

CVE-1999-0109 describes a buffer overflow in ffbconfig on Solaris 2.5.1 . The affected component is the Solaris ffbconfig, with the root cause identified as a buffer overflow. The available data imply potential impact to confidentiality, integrity, and availability (C, I, A) with a local attack v...

CVE-1999-0129

CVE-1999-0129 affects Sendmail and enables local privilege escalation: authenticated or local users can write to a file and gain group permissions via a ".forward" or ":include:" file. Confirmed in multiple connected documents: OpenVAS notes Sendmail 8.8.x up to 8.8.3 vulnerable to group write/fi...

CVE-1999-0135

The connected documents confirm a local privilege escalation in Solaris via admintool, where a local user can write to arbitrary files and gain root access. The affected component is admintool on Solaris; root-privilege gain is the stated impact. No explicit exploit details, vulnerable version ra...

CVE-1999-0167

CVE-1999-0167 describes a vulnerability in SunOS where NFS file handles are predictable/guessable, allowing an attacker to mount exported file systems without proper authorization. The issue arises from guessable NFS file handles as the root cause, with potential exposure of confidentiality, inte...

CVE-1999-0277

CVE-1999-0277 concerns the WorkMan program, where the vulnerability allows an attacker to overwrite arbitrary files, potentially gaining root access. The connected documents consistently describe the issue as an ability to overwrite files to escalate privileges to root. Specific affected versions...

CVE-1999-0302

CVE-1999-0302 affects SunOS/Solaris FTP clients. A malicious FTP server can coerce the client into executing arbitrary commands, a network-accessible issue with no authentication required. This can impact confidentiality, integrity, and availability as per the CVSS description (base score 7.5, HI...

CVE-1999-0320

CVE-1999-0320 affects SunOS where the rpc.cmsd service is able to overwrite arbitrary files, enabling an attacker to obtain root access. The vulnerability is described as a remote, unauthenticated issue with high impact (COMPLETE confidentiality, integrity, and availability impacts) and a CVSS v2...

CVE-1999-1080

In SunOS 5.7, rmmount may mount file systems without the nosuid flag, allowing local users with physical access to gain root privileges by mounting media containing a setuid program and running volcheck when nosuid is not specified in rmmount.conf. This vulnerability stems from mounting behavior ...

CVE-1999-1587

Technical details for CVE-1999-1587 are not publicly provided in the supplied documents. Monitor for updates; the files here do not specify affected versions, impact, or fixes.

CVE-2000-0030

CVE-2000-0030 affects Solaris dmispd dmi_cmd, allowing a local user to exhaust restricted disk space by adding files to /var/dmi/db. The NVD entry lists a MEDIUM base score (5.0) with availability impact and no confidentiality/integrity impact, and indicates a local-access condition despite the C...

CVE-2001-0426

CVE-2001-0426 describes a buffer overflow in the dtsession component affecting Solaris (and possibly other OSes) that lets local users gain privileges when a long LANG environment variable is processed. The vulnerability is triggered by excessively long LANG values, leading to privilege escalatio...

CVE-2001-1244

Technical details such as affected products, versions, and root cause are not publicly provided in the connected documents. Monitor CVE-2001-1244 updates for concrete details.

CVE-2003-0027

The CVE-2003-0027 vulnerability affects Sun KCMS kcms_server on Solaris. The KCS_OPEN_PROFILE call does not properly validate the fileName, allowing a remote attacker to perform directory traversal and read arbitrary files. The ToolTalk database server (rpc.ttdbserverd) TT_ISBUILD() procedure can...

CVE-2003-1078

The CVE-2003-1078 entry concerns the FTP client for Solaris 2.6, 7, and 8. When the debug (-d) flag is enabled, the client displays the user password on the screen during login, revealing the password in cleartext. The available documents confirm the affected software and the login-password expos...

CVE-2004-1180

CVE-2004-1180 affects netkit-rwho (rwhod) prior to version 0.17 on little-endian architectures. The Debian/DSA entries describe a vulnerability with missing input validation in rwhod that can be exploited remotely to crash the listening process (DoS). Debian fixes are available: 0.17-4woody2 (sta...

CVE-2006-0161

Technical details about CVE-2006-0161 are not provided in the connected documents. The initial description notes uncertainty; no affected versions, impact, or remediation are specified here. Monitor for updates.

CVE-2007-0895

CVE-2007-0895 describes a race condition in Solaris rm during recursive directory deletion (-r/-R) that can let a local user delete files as the rm owner by moving a directory to a higher level as deletion occurs, causing rm to chdir to ".." up to the root filesystem. Connected advisories link to...

CVE-2007-3094

CVE-2007-3094 affects Sun Solaris Solaris Management Console (SMC) on Solaris 8–10 prior to 20070605. The issue is an unspecified vulnerability in the authentication mechanism that allows remote authenticated users to execute arbitrary code via the WBEM server. Exploitation is described as networ...

CVE-2011-2289

CVE-2011-2289 concerns an unspecified local vulnerability in Oracle Solaris 10 related to LiveUpgrade. Connected sources confirm affected platforms and concrete remediation: Solaris 10 x86: patch 121429-15 (Live Upgrade Zones Support Patch) — install to mitigate. Solaris 10 SPARC: patch 121428-15...

CVE-2013-1498

CVE-2013-1498 affects Oracle Sun Solaris 10/11 Kernel/IO. The Nessus entry indicates a Kernel/IO vulnerability exploitable with local access that can cause an OS hang or crash (complete DOS). Affected versions are Solaris 10/11; remediation appears via patch 149164-01 (as referenced in the Solari...

CVE-2014-0447

CVE-2014-0447 affects Oracle Solaris 10 and 11.1 kernel. The connected sources specify: a local vulnerability in the Solaris kernel that, when exploited by a local user, can cause an unauthorized OS hang or frequently occurring crash (complete DOS). Affected are Solaris 10 and 11.1 (kernel compon...

CVE-1999-0033

CVE-1999-0033 : Description indicates command execution on Sun systems caused by a buffer overflow in the at program. Affected software: Sun systems, component: at. Root cause: buffer overflow in at allows arbitrary command execution. Impact: unauthorized command execution with likely complete sy...

CVE-1999-0875

Technical details (affected products/versions, exploitation, or mitigations) for CVE-1999-0875 are not provided in the supplied documents. Monitor for updates and additional disclosures.

CVE-2002-1589

CVE-2002-1589 corresponds to an unknown vulnerability in Solaris 8 where setting bit 0x02 (TEST / KMF_DEADBEEF) in the kmem_flags kernel parameter allows a local user to trigger a system panic (DoS). The Connected documents do not provide additional concrete technical details (no product/version ...

CVE-2003-0669

The CVE-2003-0669 entry relates to Solaris, affecting versions 2.6 through 9. The vulnerability is described as unknown, causing a denial of service (system panic) via a rare race condition or an attack by local users. The available connected documents do not provide concrete technical details su...

CVE-2004-1355

Technical details about CVE-2004-1355 are not publicly available in the provided documents; monitor for updates.

CVE-2005-0426

The CVE-2005-0426 entry relates to Solaris 8 and Solaris 9, describing a remote denial-of-service in which heavy UDP usage can trigger a NULL dereference. The affected component is not explicitly named beyond “Heavy UDP Usage,” and the public description indicates a vulnerability in how UDP traff...

CVE-2007-3223

CVE-2007-3223 affects Sun Solaris 10 before 20070613: the NFS server is vulnerable to remote denial of service via certain XDR data in NFS requests, likely tied to processing in xdr_bool and xdrmblk_getint32. Affected product: Solaris 10 (NFS server); vulnerability type: unspecified in the descri...

CVE-2007-5921

CVE-2007-5921 concerns an unspecified vulnerability in the ioctl interface of the Solaris Volume Manager (SVM) on Solaris 9 and 10 that allows local users to trigger a denial of service (panic). The core issue and affected components are not detailed in the initial description. Connected document...

CVE-2008-0964

The CVE-2008-0964 issue affects SunOS/Solaris snoop for several Solaris releases. The root cause is a stack-based buffer overflow in snoop when handling SMB traffic with the -o option omitted, enabling remote code execution. Concrete fixes are available via Solaris patch updates: 108964-11 (Solar...

CVE-2012-4294

Wireshark 1.8.x before 1.8.2 is affected by CVE-2012-4294 due to a buffer overflow in the ERF dissector’s channelised_fill_sdh_g707_format function, allowing remote attackers to execute arbitrary code via a large speed value. The issue is fixed in Wireshark 1.8.2; upgrading to that version is the...

CVE-1999-0263

The CVE-1999-0263 entry concerns Solaris SUNWadmap. The documented vulnerability indicates that SUNWadmap can be exploited to obtain root access. The available connected documents corroborate this impact, with no additional technical specifics (e.g., exact vulnerable function, version ranges, exp...

CVE-1999-0315

CVE-1999-0315 : A buffer overflow in the Solaris fdformat command can grant root access to local users. This is corroborated by the Red Hat CVE entry and the CVE record. The provided documents do not specify affected Solaris versions, concrete patch versions, or remediation steps. No exploitation...

CVE-1999-0691

CVE-1999-0691 : A buffer overflow in the AddSuLog function of the CDE dtaction utility allows local users to gain root privileges via a long user name. This is corroborated by Red Hat’s security entry and other references; no exploit details or patches are provided in the available documents. The...

CVE-1999-0835

CVE-1999-0835 describes a denial-of-service in BIND named caused by a buffer overflow in the rrextract routine when decoding SIG records. In particular, for T_SIG, the code computes an unsigned length and copies data with a potentially large third argument to memcpy if the computed length is malf...

CVE-1999-0851

CVE-1999-0851 affects ISC BIND with a denial-of-service via naptr. Connected sources indicate multiple remote vulnerabilities in BIND and provide a remediation: upgrade to BIND 8.2.2-P5 or 4.9.7-REL. The vulnerability is described as DoS on the named service; no exploit details or vector are prov...

CVE-2000-0317

CVE-2000-0317 describes a buffer overflow in Solaris 7 lpset, leading to local root privileges when a long -r option is supplied. The entry specifically notes local privilege escalation, but the provided documents do not include detailed information on affected versions beyond Solaris 7, nor expl...

CVE-2002-1345

Technical details for CVE-2002-1345 are not provided in the supplied connected documents; no explicit affected products, versions, or fixes are available here. Monitor for updates.

CVE-2005-4797

CVE-2005-4797: A directory-traversal vulnerability in the Solaris printd (lp) daemon (lpd) affects Solaris 7–10. It allows remote deletion of arbitrary files via ".." in an Unlink data file command, with the lpd process typically running as root. Public references include Metasploit exposure (Sol...

CVE-2011-2295

CVE-2011-2295 affects Oracle Solaris 8, 9, 10 and 11 Express. A local user can exploit a flaw in the USB driver by presenting a malformed USB configuration descriptor, triggering a kernel stack overflow in EHCI and potentially enabling arbitrary code execution (as described in the advisory/NGS di...

CVE-2014-6473

CVE-2014-6473 affects Oracle Solaris 10/11 (Zone Framework). The Solaris Zone Framework vulnerability allows a local attacker to achieve arbitrary code execution, potentially taking control of the OS. Affected platforms include Solaris 10 SPARC with branded zones; the vulnerability is discussed i...