Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2005-3471 State: PUBLISHED Published: 2005-11-02T23:00:00 Last Updated: 2024-08-07T23:10:08.690Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the ruleset view for MailWatch for MailScanner 1.0.2 allows remote attackers to access arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/17405 - http://www.vupen.com/english/advisories/2005/2276 - http://sourceforge.net/project/shownotes.php?release_id=367923
CVE ID: CVE-2005-3472 State: PUBLISHED Published: 2005-11-03T02:00:00 Last Updated: 2024-08-07T23:10:09.004Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Sun Java System Communications Express 2005Q1 and 2004Q2 allows local and remote attackers to read sensitive information from configuration files. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/20448 - http://www.securityfocus.com/bid/15271 - http://www.vupen.com/english/advisories/2005/2274 - http://sunsolve.sun.com/search/document.do?assetkey=1-26-101948-1 - http://secunia.com/advisories/17395 - http://securitytracker.com/id?1015135
CVE ID: CVE-2005-3473 State: PUBLISHED Published: 2005-11-03T02:00:00 Last Updated: 2024-08-07T23:17:22.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Simple PHP Blog 0.4.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) entry, (2) blog_subject, and (3) blog_text parameters (involving the temp_subject variable) in (a) preview_cgi.php and (b) preview_static_cgi.php, or (4) scheme_name parameter and (5) bg_color parameters (involving the preset_name and result variables) in (c) colors.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/arc
es) in (c) colors.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/415463 - http://securityreason.com/securityalert/138 - http://www.seclab.tuwien.ac.at/advisories/TUVSA-0511-001.txt - http://www.osvdb.org/20436 - http://www.osvdb.org/20437 - http://secunia.com/advisories/17404 - http://www.osvdb.org/20438 - http://www.securityfocus.com/bid/15283
CVE ID: CVE-2005-3474 State: PUBLISHED Published: 2005-11-03T02:00:00 Last Updated: 2024-08-07T23:17:22.243Z Vendors: n/a Products: n/a Problem Types: n/a Description: The aries.sys driver in Sony First4Internet XCP DRM software hides any file, registry key, or process with a name that starts with "$sys$", which allows attackers to hide activities on a system that uses XCP. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/20435 - http://secunia.com/advisories/17408 - http://securitytracker.com/id?1015145 - http://www.sysinternals.com/blog/2005/10/sony-rootkits-and-digital-rights.html
CVE ID: CVE-2005-3475 State: PUBLISHED Published: 2005-11-03T02:00:00 Last Updated: 2024-08-07T23:17:22.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hasbani Web Server (WindWeb) 2.0 allows remote attackers to cause a denial of service (infinite loop) via HTTP crafted GET requests. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/15225 - http://www.osvdb.org/20447 - http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0572.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/24657 - http://www.x0n3-h4ck.org/index.php?name=news&article=92
CVE ID: CVE-2005-3476 State: PUBLISHED Published: 2005-11-03T02:00:00 Last Updated: 2024-08-07T23:17:22.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in HP OpenVMS Integrity 8.2-1 and 8.2, and OpenVMS Alpha 7.3-2 and 8.2, allows local users to cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2005/2275 - http://www.securityfocus.com/archive/1/415464 - http://securitytracker.com/id?1015128 - http://www.securityfocus.com/bid/15261 - http://www.securityfocus.com/archive/1/415464 - http://secunia.com/advisories/17402 - http://www.osvdb.org/20487 - https://exchange.xforce.
focus.com/archive/1/415464 - http://secunia.com/advisories/17402 - http://www.osvdb.org/20487 - https://exchange.xforce.ibmcloud.com/vulnerabilities/22939
CVE ID: CVE-2005-3477 State: PUBLISHED Published: 2005-11-03T02:00:00 Last Updated: 2024-08-07T23:17:22.311Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple interpretation error in the image upload handling code in Invision Gallery 2.0.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML or script in an image whose type does not match its extension, which is rendered by Internet Explorer due to CVE-2005-3312. NOTE: it could be argued that this vulnerability is due to a design flaw in Internet Explorer and the proper fix should be in that browser; if so, then this should not be treated as a vulnerability in Invision Gallery. Additional Analyst N
be in that browser; if so, then this should not be treated as a vulnerability in Invision Gallery. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/17393 - http://securityreason.com/securityalert/105 - http://www.securityfocus.com/bid/15286 - http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0519.html
CVE ID: CVE-2005-3478 State: PUBLISHED Published: 2005-11-03T02:00:00 Last Updated: 2024-08-07T23:17:22.756Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in index.php in PHPCafe.net Tutorials Manager 1.0 Beta 2 allows remote attackers to execute arbitrary SQL commands via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/24604 - http://www.securityfocus.com/bid/15244 - http://www.osvdb.org/22795 - http://www.securityfocus.com/archive/1/435206/100/0/threaded
CVE ID: CVE-2005-3479 State: PUBLISHED Published: 2005-11-03T02:00:00 Last Updated: 2024-08-07T23:17:22.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in login.asp in Ringtail CaseBook 6.1.0 allows remote attackers to inject arbitrary web script or HTML via the users parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.procheckup.com/Vulner_PR0412.php - http://secunia.com/advisories/17383 - http://www.osvdb.org/20423
CVE ID: CVE-2005-3480 State: PUBLISHED Published: 2005-11-03T02:00:00 Last Updated: 2024-08-07T23:17:22.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: login.asp in Ringtail CaseBook 6.1.0 displays different error messages depending on whether a user exists or not, which allows remote attackers to determine valid usernames. Additional Analyst Notes: - CVE Program Container: References: - http://www.procheckup.com/Vulner_PR0413.php - http://secunia.com/advisories/17383 - http://www.osvdb.org/20422
CVE ID: CVE-2005-3481 State: PUBLISHED Published: 2005-11-03T02:00:00 Last Updated: 2024-08-07T23:17:22.464Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco IOS 12.0 to 12.4 might allow remote attackers to execute arbitrary code via a heap-based buffer overflow in system timers. NOTE: this issue does not correspond to a specific vulnerability, rather a general weakness that only increases the feasibility of exploitation of any vulnerabilities that might exist. Such design-level weaknesses normally are not included in CVE, so perhaps this issue should be REJECTed. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/562945 - http://s
ECTed. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/562945 - http://secunia.com/advisories/17413 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4914 - http://www.vupen.com/english/advisories/2005/2282 - http://www.securityfocus.com/bid/15275 - http://securitytracker.com/id?1015139 - http://www.cisco.com/warp/public/707/cisco-sa-20051102-timers.shtml
CVE ID: CVE-2005-3482 State: PUBLISHED Published: 2005-11-03T02:00:00 Last Updated: 2024-08-07T23:17:22.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco 1200, 1131, and 1240 series Access Points, when operating in Lightweight Access Point Protocol (LWAPP) mode and controlled by 2000 and 4400 series Airespace WLAN controllers running 3.1.59.24, allow remote attackers to send unencrypted traffic to a secure network using frames with the MAC address of an authenticated end host. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/139 - http://www.osvdb.org/20454 - http://www.securityfocus.com/bid/15272 - http://secunia.co
tyreason.com/securityalert/139 - http://www.osvdb.org/20454 - http://www.securityfocus.com/bid/15272 - http://secunia.com/advisories/17406 - http://securitytracker.com/id?1015140 - http://www.cisco.com/warp/public/707/cisco-sa-20051102-lwapp.shtml - http://www.vupen.com/english/advisories/2005/2278
CVE ID: CVE-2005-3483 State: PUBLISHED Published: 2005-11-03T22:00:00 Last Updated: 2024-08-07T23:17:22.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in GO-Global for Windows 3.1.0.3270 and earlier allows remote attackers to execute arbitrary code via a data block that is longer than the specified data block size. Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=full-disclosure&m=113095918810489&w=2 - http://aluigi.altervista.org/adv/ggwbof-adv.txt - http://secunia.com/advisories/17424 - http://www.vupen.com/english/advisories/2005/2290 - http://www.securityfocus.com/bid/15285 - http://www.osvdb.org/20464
CVE ID: CVE-2005-3484 State: PUBLISHED Published: 2005-11-03T22:00:00 Last Updated: 2024-08-07T23:17:22.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in NeroNET 1.2.0.2 and earlier allows remote attackers to read arbitrary files with certain file extensions (such as ZIP, AVI, JPG, TXT, and HTML) via ".." and hex-encoded (1) slash "/" ("%2f") or (2) backslash "\" ("%5c") sequences. Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=full-disclosure&m=113096009930152&w=2 - http://www.securityfocus.com/bid/15288 - http://secunia.com/advisories/17421 - http://aluigi.altervista.org/adv/neronet-adv.txt - http://ww
focus.com/bid/15288 - http://secunia.com/advisories/17421 - http://aluigi.altervista.org/adv/neronet-adv.txt - http://www.vupen.com/english/advisories/2005/2287
CVE ID: CVE-2005-3485 State: PUBLISHED Published: 2005-11-03T22:00:00 Last Updated: 2024-08-07T23:17:22.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in Glider Collect'n kill 1.0.0.0 allows remote attackers to execute arbitrary code via a gl_playerEnter command with a long player name. Additional Analyst Notes: - CVE Program Container: References: - http://aluigi.altervista.org/adv/gliderbof-adv.txt - http://secunia.com/advisories/17422 - http://marc.info/?l=full-disclosure&m=113095975721571&w=2 - http://www.vupen.com/english/advisories/2005/2286 - http://www.securityfocus.com/bid/15280 - http://www.osvdb.org/20463
CVE ID: CVE-2005-3486 State: PUBLISHED Published: 2005-11-03T22:00:00 Last Updated: 2024-08-07T23:17:22.340Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple format string vulnerabilities in Scorched 3D 39.1 (bf) and earlier allow remote attackers to execute arbitrary code via various (1) GLConsole::addLine, (2) ServerCommon::sendString, (3) ServerCommon::serverLog functions, and possibly other unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://aluigi.altervista.org/adv/scorchbugs-adv.txt - http://www.securityfocus.com/bid/15292 - http://www.gentoo.org/security/en/glsa/glsa-200511-12.xml - http://secunia.com/advisories/17423 - http
s.com/bid/15292 - http://www.gentoo.org/security/en/glsa/glsa-200511-12.xml - http://secunia.com/advisories/17423 - http://www.vupen.com/english/advisories/2005/2288 - http://marc.info/?l=full-disclosure&m=113095941031946&w=2
CVE ID: CVE-2005-3487 State: PUBLISHED Published: 2005-11-03T22:00:00 Last Updated: 2024-08-07T23:17:22.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple buffer overflows in Scorched 3D 39.1 (bf) and earlier allow remote attackers to execute arbitrary code via various (1) GLConsole::addLine, (2) ServerCommon::sendString, (3) ServerCommon::serverLog functions, (4) a long command that is not properly handled in ComsMessageHandler.cpp when generating an error message, (5) a long UniqueID value in Logger.cpp, and possibly other unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/20468 - http://aluigi.altervista.org/adv
onal Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/20468 - http://aluigi.altervista.org/adv/scorchbugs-adv.txt - http://www.securityfocus.com/bid/15292 - http://www.gentoo.org/security/en/glsa/glsa-200511-12.xml - http://secunia.com/advisories/17423 - http://www.vupen.com/english/advisories/2005/2288 - http://www.osvdb.org/20469 - http://marc.info/?l=full-disclosure&m=113095941031946&w=2
CVE ID: CVE-2005-3488 State: PUBLISHED Published: 2005-11-03T22:00:00 Last Updated: 2024-08-07T23:17:22.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: Scorched 3D 39.1 (bf) and earlier allows remote attackers to cause a denial of service (long loop and server hang) via a negative numplayers value that bypasses a signed check in ServerConnectHandler.cpp. Additional Analyst Notes: - CVE Program Container: References: - http://aluigi.altervista.org/adv/scorchbugs-adv.txt - http://www.securityfocus.com/bid/15292 - http://www.gentoo.org/security/en/glsa/glsa-200511-12.xml - http://secunia.com/advisories/17423 - http://www.vupen.com/english/advisories/2005/2288 - http://marc.info/
511-12.xml - http://secunia.com/advisories/17423 - http://www.vupen.com/english/advisories/2005/2288 - http://marc.info/?l=full-disclosure&m=113095941031946&w=2
CVE ID: CVE-2005-3489 State: PUBLISHED Published: 2005-11-04T00:00:00 Last Updated: 2024-08-07T23:17:22.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in Asus Video Security 3.5.0.0 and earlier, when using authorization, allows remote attackers to execute arbitrary code via a long username/password string. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/20457 - http://secunia.com/advisories/17419 - http://aluigi.altervista.org/adv/asusvsbugs-adv.txt - http://www.securityfocus.com/bid/15279 - http://www.vupen.com/english/advisories/2005/2289 - http://marc.info/?l=full-disclosure&m=113096055302614&w=2
CVE ID: CVE-2005-3490 State: PUBLISHED Published: 2005-11-04T00:00:00 Last Updated: 2024-08-07T23:17:22.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the web server in Asus Video Security 3.5.0.0 and earlier allows remote attackers to read arbitrary files via "../" or "..\" sequences in the URL. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/17419 - http://aluigi.altervista.org/adv/asusvsbugs-adv.txt - http://www.securityfocus.com/bid/15281 - http://marc.info/?l=full-disclosure&m=113096055302614&w=2
CVE ID: CVE-2005-3491 State: PUBLISHED Published: 2005-11-04T00:00:00 Last Updated: 2024-08-07T23:17:22.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple buffer overflows in the receiver function in loop.c in FlatFrag 0.3 and earlier allow remote attackers to execute arbitrary code via the (1) version, (2) name, and (3) model fields. Additional Analyst Notes: - CVE Program Container: References: - http://aluigi.altervista.org/adv/flatfragz-adv.txt - http://www.securityfocus.com/bid/15287 - http://www.securityfocus.com/archive/1/415636/30/0/threaded - http://www.osvdb.org/20769 - http://marc.info/?l=full-disclosure&m=113096078606274&w=2
CVE ID: CVE-2005-3492 State: PUBLISHED Published: 2005-11-04T00:00:00 Last Updated: 2024-08-07T23:17:22.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: FlatFrag 0.3 and earlier allows remote attackers to cause a denial of service (crash) by sending an NT_CONN_OK command from a client that is not connected, which triggers a null dereference. Additional Analyst Notes: - CVE Program Container: References: - http://aluigi.altervista.org/adv/flatfragz-adv.txt - http://www.vupen.com/english/advisories/2005/2285 - http://www.securityfocus.com/bid/15287 - http://www.osvdb.org/20770 - http://www.securityfocus.com/archive/1/415636/30/0/threaded - http://marc.info/?l=full-disclosure&m=1
.osvdb.org/20770 - http://www.securityfocus.com/archive/1/415636/30/0/threaded - http://marc.info/?l=full-disclosure&m=113096078606274&w=2
CVE ID: CVE-2005-3493 State: PUBLISHED Published: 2005-11-04T00:00:00 Last Updated: 2024-08-07T23:17:22.337Z Vendors: n/a Products: n/a Problem Types: n/a Description: Battle Carry .005 and earlier allows remote attackers to cause a denial of service (inaccessible port) via a large packet, which triggers a socket error and terminates the socket that is listening on the server's UDP port. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2005/2284 - http://aluigi.altervista.org/adv/bcarrydos-adv.txt - http://www.securityfocus.com/bid/15282 - http://secunia.com/advisories/17417 - http://marc.info/?l=full-disclosure&m=113096122630102&w=2
CVE ID: CVE-2005-3494 State: PUBLISHED Published: 2005-11-04T00:00:00 Last Updated: 2024-08-07T23:17:22.263Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Ar-blog 5.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a blog comment. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/17307 - http://securitytracker.com/id?1015100 - http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/038133.html - http://www.securityfocus.com/bid/15201
CVE ID: CVE-2005-3495 State: PUBLISHED Published: 2005-11-04T00:00:00 Last Updated: 2024-08-07T23:17:22.781Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ar-blog 5.2 and earlier allows remote attackers to bypass authentication by modifying cookies. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/17307 - http://www.securityfocus.com/bid/15203 - http://securitytracker.com/id?1015100 - http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/038133.html
CVE ID: CVE-2005-3496 State: PUBLISHED Published: 2005-11-04T00:00:00 Last Updated: 2024-08-07T23:17:22.345Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in PHP Handicapper allows remote attackers to inject arbitrary web script or HTML via the msg parameter to msg.php. NOTE: some sources identify a second vector in the login parameter to process_signup.php, but the original source says that it is for CRLF injection (CVE-2005-4712). Also note: the vendor has disputed CVE-2005-3497, and it is possible that the dispute was intended to include this issue as well. If so, followup investigation strongly suggests that the original report is cor
intended to include this issue as well. If so, followup investigation strongly suggests that the original report is correct. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/20479 - http://www.zone-h.org/advisories/read/id=8360 - http://www.securityfocus.com/bid/15294 - http://www.vupen.com/english/advisories/2005/2292 - http://secunia.com/advisories/17412 - http://www.osvdb.org/20480
CVE ID: CVE-2005-3497 State: PUBLISHED Published: 2005-11-04T00:00:00 Last Updated: 2024-08-07T23:17:22.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in process_signup.php in PHP Handicapper allows remote attackers to execute arbitrary SQL commands via the serviceid parameter. NOTE: on 20060210, the vendor disputed this issue, saying "this is 100% false reporting, this is a slander campaign from a customer who had a vulnerability in his SERVER not the software." However, followup investigation strongly suggests that the original report is correct Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/20481 - http://
report is correct Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/20481 - http://www.securityfocus.com/bid/15298 - http://www.zone-h.org/advisories/read/id=8360 - http://www.vupen.com/english/advisories/2005/2292 - http://secunia.com/advisories/17412
CVE ID: CVE-2005-3498 State: PUBLISHED Published: 2005-11-04T00:00:00 Last Updated: 2024-08-07T23:17:22.699Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM WebSphere Application Server 5.0.x before 5.02.15, 5.1.x before 5.1.1.8, and 6.x before fixpack V6.0.2.5, when session trace is enabled, records a full URL including the queryString in the trace logs when an application encodes a URL, which could allow attackers to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg27004980 - http://www.securityfocus.com/bid/15303 - http://securitytracker.com/id?1015134 - http://www-1.ibm.com
&uid=swg27004980 - http://www.securityfocus.com/bid/15303 - http://securitytracker.com/id?1015134 - http://www-1.ibm.com/support/docview.wss?uid=swg24010781 - http://www.vupen.com/english/advisories/2005/2291
CVE ID: CVE-2005-3499 State: PUBLISHED Published: 2005-11-04T00:00:00 Last Updated: 2024-08-07T23:17:22.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: Frisk F-Prot Antivirus allows remote attackers to bypass protection via a ZIP file with a version header greater than 15, which prevents F-Prot from decompressing and analyzing the file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/15293 - http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0073.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/22967 - http://www.osvdb.org/20865 - http://www.securityfocus.com/archive/1/502370/100/0/threaded - http://secur
ilities/22967 - http://www.osvdb.org/20865 - http://www.securityfocus.com/archive/1/502370/100/0/threaded - http://securitytracker.com/id?1015148 - http://thierry.sniff-em.com/research/fprot.html - http://www.securityfocus.com/archive/1/415637/30/0/threaded - http://www.zoller.lu/research/fprot.htm
CVE ID: CVE-2005-3500 State: PUBLISHED Published: 2005-11-05T11:00:00 Last Updated: 2024-08-07T23:17:22.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: The tnef_attachment function in tnef.c for Clam AntiVirus (ClamAV) before 0.87.1 allows remote attackers to cause a denial of service (infinite loop and memory exhaustion) via a crafted value in a CAB file that causes ClamAV to repeatedly scan the same block. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/17451 - http://www.gentoo.org/security/en/glsa/glsa-200511-04.xml - http://securityreason.com/securityalert/152 - http://secunia.com/advisories/17501 - http://secunia.com/adviso
1-04.xml - http://securityreason.com/securityalert/152 - http://secunia.com/advisories/17501 - http://secunia.com/advisories/17184 - http://www.osvdb.org/20483 - http://www.mandriva.com/security/advisories?name=MDKSA-2005:205 - http://secunia.com/advisories/17559 - http://www.idefense.com/application/poi/display?id=333&type=vulnerabilities - http://www.securityfocus.com/bid/15316 - http://sourceforge.net/project/shownotes.php?release_id=368319 - http://www.vupen.com/english/advisories/2005/2294 - http://www.debian.org/security/2005/dsa-887 - http://secunia.com/advisories/17434 - http://securitytracker.com/id?1015154