deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-3982
Published: 2007-07-25
Description: Absolute path traversal vulnerability in the Data Dynamics ActiveReport (ActiveReports) ActiveX control in actrpt2.dll 2.5 and earlier allows remote attackers to create or overwrite arbitrary files via a full pathname in the first argument to the SaveLayout method.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/37694; http://secunia.com/advisories/26112; http://www.securityfocus.com/bid/24994
CVE: CVE-2007-3983
Published: 2007-07-25
Description: Absolute path traversal vulnerability in the Data Dynamics DDActiveReports2.ActiveReport.2 (ActiveReports) ActiveX control in arpro2.dll in ActiveReports 2.0 Professional Edition 2.5.0.1308 (SP5 RC) allows remote attackers to create or overwrite arbitrary files via a full pathname in an argument to the SaveLayout method.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/26112; https://exchange.xforce.ibmcloud.com/vulnerabilities/36056; http://secunia.com/advisories/26112
CVE: CVE-2007-3984
Published: 2007-07-25
Description: Buffer overflow in a certain ActiveX control in the NixonMyPrograms class in sasatl.dll 1.5.0.531 in Zenturi ProgramChecker allows remote attackers to execute arbitrary code via a long argument to the Scan method.  NOTE: this is probably a different issue than CVE-2007-2987.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36714; http://www.securityfocus.com/bid/25025; https://www.exploit-db.com/exploits/4214
CVE: CVE-2007-3985
Published: 2007-07-25
Description: Directory traversal vulnerability in file.cgi in Secure Computing SecurityReporter (aka Network Security Analyzer) 4.6.3 allows remote attackers to download arbitrary files via a .. (dot dot) in the name parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0476&w=2; http://osvdb.org/43770; http://secunia.com/advisories/26167
CVE: CVE-2007-3986
Published: 2007-07-25
Description: file.cgi in Secure Computing SecurityReporter (aka Network Security Analyzer) 4.6.3 allows remote attackers to bypass authentication via a name parameter that specifies the eventcache directory and a non-GIF file, which causes the $dontvalidate variable to be set to true. NOTE: a separate traversal vulnerability could be leveraged to download arbitrary files.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0476&w=2; http://secunia.com/advisories/26167; http://www.oliverkarow.de/research/securityreporter.txt
CVE: CVE-2007-3987
Published: 2007-07-25
Description: SQL injection vulnerability in SearchResults.asp in ImageRacer 1.0, when WordSearchCrit is enabled, allows remote attackers to execute arbitrary SQL commands via the SearchWord parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36277; http://outlaw.aria-security.info/?p=7; http://secunia.com/advisories/26169
CVE: CVE-2007-3988
Published: 2007-07-25
Description: Session fixation vulnerability in Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/26142; http://securityreason.com/securityalert/2926; http://www.majorsecurity.de/index_2.php?major_rls=major_rls51
CVE: CVE-2007-3989
Published: 2007-07-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in default.asp in Dora Emlak 1.0, when the goster parameter is set to iletisim, allow remote attackers to inject arbitrary web script or HTML via the (1) Adiniz and (2) Soyadiniz parameters; and possibly other unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/26173; http://www.securityfocus.com/bid/25004; http://www.vupen.com/english/advisories/2007/2605
CVE: CVE-2007-3990
Published: 2007-07-25
Description: SQL injection vulnerability in default.asp in Dora Emlak 1.0, when the goster parameter is set to emlakdetay, allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/26173; http://www.securityfocus.com/bid/25004; http://www.vupen.com/english/advisories/2007/2605
CVE: CVE-2007-3991
Published: 2007-07-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in cv.asp in Asp cvmatik 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Adiniz (Ady), (2) Soyadiniz (Soyady), (3) Ehliyet, (4) Askerlik, and (5) GSM parameters; and possibly other unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/25008.html; http://osvdb.org/36471; http://secunia.com/advisories/26174
CVE: CVE-2007-3992
Published: 2007-07-25
Description: SQL injection vulnerability in vir_login.asp in iExpress Property Pro allows remote attackers to execute arbitrary SQL commands via the Password parameter.  NOTE: the Username parameter is covered by CVE-2006-6029.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/26153; http://secunia.com/advisories/26153
CVE: CVE-2007-3993
Published: 2007-07-25
Description: Unspecified vulnerability in the attachment filter in Kerio MailServer before 6.4.1 has unknown impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/38571; http://secunia.com/advisories/26185; http://www.kerio.com/kms_history.html
CVE: CVE-2007-5645
Published: 2007-07-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-5645.  Reason: This candidate is a duplicate of CVE-2006-5645, due to a typo.  Notes: All CVE users should reference CVE-2006-5645 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2007-0060
Published: 2007-07-26
Description: Stack-based buffer overflow in the Message Queuing Server (Cam.exe) in CA (formerly Computer Associates) Message Queuing (CAM / CAFT) software before 1.11 Build 54_4 on Windows and NetWare, as used in CA Advantage Data Transport, eTrust Admin, certain BrightStor products, certain CleverPath products, and certain Unicenter products, allows remote attackers to execute arbitrary code via a crafted message to TCP port 3104.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/26190; http://supportconnectw.ca.com/public/dto_transportit/infodocs/camsgquevul-secnot.asp; http://www.ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=149809
CVE: CVE-2007-3302
Published: 2007-07-26
Description: The CallCode ActiveX control in caller.dll 3.0 before 20070713, and 3.0 SP1 before 3.0.5.81, in CA (formerly Computer Associates) eTrust Intrusion Detection allows remote attackers to load arbitrary DLLs on a client system, and execute code from these DLLs, via unspecified "scriptable functions."
CVSS Score: 9.3 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=568; http://secunia.com/advisories/26134; http://supportconnectw.ca.com/public/etrust/etrust_intrusion/infodocs/eid-callervilnsecnot.asp
CVE: CVE-2007-3875
Published: 2007-07-26
Description: arclib.dll before 7.3.0.9 in CA Anti-Virus (formerly eTrust Antivirus) 8 and certain other CA products allows remote attackers to cause a denial of service (infinite loop and loss of antivirus functionality) via an invalid "previous listing chunk number" field in a CHM file.
CVSS Score: 4.3 (MEDIUM)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=567; http://secunia.com/advisories/26155; http://supportconnectw.ca.com/public/antivirus/infodocs/caprodarclib-secnot.asp
CVE: CVE-2007-4005
Published: 2007-07-26
Description: Stack-based buffer overflow in Mike Dubman Windows RSH daemon (rshd) 1.7 allows remote attackers to execute arbitrary code via a long string to the shell port (514/tcp).  NOTE: this might overlap CVE-2007-4006.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/26197; http://www.securityfocus.com/bid/25044; http://www.securitytracker.com/id?1018459
CVE: CVE-2007-4006
Published: 2007-07-26
Description: Buffer overflow in Mike Dubman Windows RSH daemon (rshd) 1.7 has unknown impact and remote attack vectors, aka ZD-00000034.  NOTE: this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release actionable advisories. A CVE has been assigned for tracking purposes, but duplicates with other CVEs are difficult to determine.
CVSS Score: 6.8 (MEDIUM)
References: http://www.wslabi.com/wabisabilabi/initPublishedBid.do?; http://www.wslabi.com/wabisabilabi/initPublishedBid.do?
CVE: CVE-2007-4007
Published: 2007-07-26
Description: PHP remote file inclusion vulnerability in index.php in Article Directory (Article Site Directory) allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
CVSS Score: 9.3 (HIGH)
References: http://darkcode.ath.cx/f0rum/ind3x.php?action=vthread&forum=12&topic=114; http://osvdb.org/39107; http://www.securityfocus.com/bid/25042
CVE: CVE-2007-4008
Published: 2007-07-26
Description: Directory traversal vulnerability in custom.php in Entertainment Media Sharing CMS allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pagename parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/36919; http://secunia.com/advisories/26194; http://www.securityfocus.com/bid/25039
CVE: CVE-2007-4009
Published: 2007-07-26
Description: PHP remote file inclusion vulnerability in admin/business_inc/saveserver.php in SWSoft Confixx Pro 2.0.12 through 3.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the thisdir parameter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: ftp://download1.swsoft.com/Confixx/security_hotfix/1/release_notes.txt; http://secunia.com/advisories/26300; http://www.securityfocus.com/bid/25036
CVE: CVE-2007-4010
Published: 2007-07-26
Description: The win32std extension in PHP 5.2.3 does not follow safe_mode and disable_functions restrictions, which allows remote attackers to execute arbitrary commands via the win_shell_execute function.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/bid/25041; https://exchange.xforce.ibmcloud.com/vulnerabilities/35604; https://www.exploit-db.com/exploits/4218
CVE: CVE-2007-4011
Published: 2007-07-26
Description: Cisco 4100 and 4400, Airespace 4000, and Catalyst 6500 and 3750 Wireless LAN Controller (WLC) software before 3.2 20070727, 4.0 before 20070727, and 4.1 before 4.1.180.0 allows remote attackers to cause a denial of service (traffic amplification or ARP storm) via a crafted unicast ARP request that (1) has a destination MAC address unknown to the Layer-2 infrastructure, aka CSCsj69233; or (2) occurs during Layer-3 roaming across IP subnets, aka CSCsj70841.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/26161; http://www.cisco.com/en/US/products/products_security_advisory09186a008088ab28.shtml; http://www.securityfocus.com/bid/25043
CVE: CVE-2007-4012
Published: 2007-07-26
Description: Cisco 4100 and 4400, Airespace 4000, and Catalyst 6500 and 3750 Wireless LAN Controller (WLC) software 4.1 before 4.1.180.0 allows remote attackers to cause a denial of service (ARP storm) via a broadcast ARP packet that "targets the IP address of a known client context", aka CSCsj50374.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/26161; http://www.cisco.com/en/US/products/products_security_advisory09186a008088ab28.shtml; http://www.securityfocus.com/bid/25043
CVE: CVE-2007-4013
Published: 2007-07-26
Description: Multiple unspecified vulnerabilities in (1) Net6Helper.DLL (aka Net6Launcher Class) 4.5.2 and earlier, (2) npCtxCAO.dll (aka Citrix Endpoint Analysis Client) in a Firefox plugin directory, and (3) a second npCtxCAO.dll (aka CCAOControl Object) before 4.5.0.0 in Citrix Access Gateway Standard Edition before 4.5.5 and Advanced Edition before 4.5 HF1 have unknown impact and attack vectors, possibly related to buffer overflows.  NOTE: vector 3 might overlap CVE-2007-3679.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/37842; http://osvdb.org/37843; http://osvdb.org/37844
CVE: CVE-2007-4014
Published: 2007-07-26
Description: Cross-site scripting (XSS) vulnerability in a certain index.php installation script related to the (1) Blix 0.9.1, (2) Blixed 1.0, and (3) BlixKrieg (Blix Krieg) 2.2 themes for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter, possibly a related issue to CVE-2007-2757.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/26109; http://secunia.com/advisories/26115; http://secunia.com/advisories/26116
CVE: CVE-2007-4015
Published: 2007-07-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-0011.  Reason: This candidate is a duplicate of CVE-2007-0011.  Notes: All CVE users should reference CVE-2007-0011 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2007-4016
Published: 2007-07-26
Description: Unspecified vulnerability in the client components in Citrix Access Gateway Standard Edition before 4.5.5 and Advanced Edition before 4.5 HF1 allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/43983; http://secunia.com/advisories/26143; http://support.citrix.com/article/CTX113815
CVE: CVE-2007-4017
Published: 2007-07-26
Description: Cross-site request forgery (CSRF) vulnerability in the web-based administration console in Citrix Access Gateway before firmware 4.5.5 allows remote attackers to perform certain configuration changes as administrators.
CVSS Score: 7.6 (HIGH)
References: http://osvdb.org/37841; http://secunia.com/advisories/26143; http://support.citrix.com/article/CTX113817
CVE: CVE-2007-4018
Published: 2007-07-26
Description: Citrix Access Gateway Advanced Edition before firmware 4.5.5 allows attackers to redirect users to arbitrary web sites and conduct phishing attacks via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/37840; http://secunia.com/advisories/26143; http://support.citrix.com/article/CTX113816
CVE: CVE-2007-3566
Published: 2007-07-26
Description: Stack-based buffer overflow in the database service (ibserver.exe) in Borland InterBase 2007 before SP2 allows remote attackers to execute arbitrary code via a long size value in a create request to port 3050/tcp.
CVSS Score: 7.5 (HIGH)
References: http://dvlabs.tippingpoint.com/advisory/TPTI-07-13; http://dvlabs.tippingpoint.com/blog/2007/07/24/step-by-step-of-how-tpti-07-013-was-discovered; http://osvdb.org/38602
CVE: CVE-2007-4020
Published: 2007-07-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in login.php in AdMan 1.0.20051202 FF 3 patch and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) user and (2) pwd parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/36332; http://pridels-team.blogspot.com/2007/07/adman-xss-vuln.html; http://secunia.com/advisories/26206
CVE: CVE-2007-4021
Published: 2007-07-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in login.php in Brain Book Software Secure 1.0.20070629 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) user and (2) pwd parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels-team.blogspot.com/2007/07/secure-xss-vuln.html; http://www.securityfocus.com/bid/25024; http://www.vupen.com/english/advisories/2007/2656
CVE: CVE-2007-4022
Published: 2007-07-26
Description: Cross-site scripting (XSS) vulnerability in frontend/x/htaccess/changepro.html in cPanel 10.9.1 allows remote attackers to inject arbitrary web script or HTML via the resname parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/26191; http://securityreason.com/securityalert/2930; http://www.securityfocus.com/archive/1/474556/100/0/threaded
CVE: CVE-2007-4023
Published: 2007-07-26
Description: Cross-site scripting (XSS) vulnerability in the login CGI program in Aruba Mobility Controller 2.5.4.18 and earlier, and 2.4.8.6-FIPS and earlier FIPS versions, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/36469; http://secunia.com/advisories/26192; http://www.arubanetworks.com/support/alerts/aid-070907b.asc
CVE: CVE-2007-4024
Published: 2007-07-26
Description: Cross-site scripting (XSS) vulnerability in W1L3D4_aramasonuc.asp in W1L3D4 Philboard 0.3 allows remote attackers to inject arbitrary web script or HTML via the searchterms parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/26182; http://www.securityfocus.com/bid/25055; http://www.vupen.com/english/advisories/2007/2645
CVE: CVE-2007-4025
Published: 2007-07-26
Description: Unspecified vulnerability in Sun Java System (SJS) Application Server 8.1 through 9.0 before 20070724 on Windows allows remote attackers to obtain JSP source code via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/37250; http://secunia.com/advisories/26187; http://sunsolve.sun.com/search/document.do?assetkey=1-26-103000-1
CVE: CVE-2007-4026
Published: 2007-07-26
Description: epesi framework before 0.8.6 does not properly verify file extensions, which allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors involving the gallery images upload feature. NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/38600; http://secunia.com/advisories/26175; http://sourceforge.net/project/shownotes.php?release_id=527102
CVE: CVE-2007-4027
Published: 2007-07-26
Description: Buffer overflow in cli32 in Areca CLI 1.72.250 and earlier might allow local users to gain privileges via a long argument.  NOTE: this program is not setuid by default, but there are some usage scenarios in which an administrator might make it setuid.
CVSS Score: 6.6 (MEDIUM)
References: http://osvdb.org/38999; http://securityreason.com/securityalert/2928; http://www.devtarget.org/areca-advisory-07-2007.txt
CVE: CVE-2007-4028
Published: 2007-07-26
Description: Absolute path traversal vulnerability in index.php in Webspell 4.01.02 allows remote attackers to include and execute arbitrary local files via a full pathname in the site parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37516; http://secunia.com/advisories/26172; http://securityreason.com/securityalert/2927
CVE: CVE-2007-3106
Published: 2007-07-26
Description: lib/info.c in libvorbis 1.1.2, and possibly other versions before 1.2.0, allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via invalid (1) blocksize_0 and (2) blocksize_1 values, which trigger a "heap overwrite" in the _01inverse function in res0.c.  NOTE: this issue has been RECAST so that CVE-2007-4029 handles additional vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/24923; http://secunia.com/advisories/26087; http://secunia.com/advisories/26232
CVE: CVE-2007-3333
Published: 2007-07-26
Description: Stack-based buffer overflow in capture in IBM AIX 5.3 SP6 and 5.2.0 allows remote attackers to execute arbitrary code via a large number of terminal control sequences.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: ftp://aix.software.ibm.com/aix/efixes/security/README; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=570; http://secunia.com/advisories/26219
CVE: CVE-2007-4003
Published: 2007-07-26
Description: pioout in IBM AIX 5.3 SP6 allows local users to execute arbitrary code by specifying a malicious library with the -R (ParseRoutine) command line argument.
CVSS Score: 6.9 (MEDIUM)
References: ftp://aix.software.ibm.com/aix/efixes/security/README; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=569; http://secunia.com/advisories/26219
CVE: CVE-2007-4004
Published: 2007-07-26
Description: Buffer overflow in the ftp client in IBM AIX 5.3 SP6 and 5.2.0 allows local users to execute arbitrary code via unspecified vectors that trigger the overflow in a gets function call.  NOTE: the client is setuid root on AIX, so this issue crosses privilege boundaries.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: ftp://aix.software.ibm.com/aix/efixes/security/README; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=571; http://secunia.com/advisories/26219
CVE: CVE-2007-4029
Published: 2007-07-26
Description: libvorbis 1.1.2, and possibly other versions before 1.2.0, allows context-dependent attackers to cause a denial of service via (1) an invalid mapping type, which triggers an out-of-bounds read in the vorbis_info_clear function in info.c, and (2) invalid blocksize values that trigger a segmentation fault in the read function in block.c.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/24923; http://secunia.com/advisories/26087; http://secunia.com/advisories/26232
CVE: CVE-2007-1354
Published: 2007-07-27
Description: The Access Control functionality (JMXOpsAccessControlFilter) in JMX Console in JBoss Application Server 4.0.2 and 4.0.5 before 20070416 uses a member variable to store the roles of the current user, which allows remote authenticated administrators to trigger a race condition and gain privileges by logging in during a session by a more privileged administrator, as demonstrated by privilege escalation from Read Mode to Write Mode.
CVSS Score: 6.0 (MEDIUM)
References: http://jira.jboss.com/jira/browse/ASPATCH-172; http://jira.jboss.com/jira/browse/ASPATCH-175; http://osvdb.org/46765
CVE: CVE-2007-2874
Published: 2007-07-27
Description: Buffer overflow in the wpa_printf function in the debugging code in wpa_supplicant in the Fedora NetworkManager package before 0.6.5-3.fc7 allows user-assisted remote attackers to execute arbitrary code via malformed frames on a WPA2 network.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.8 (MEDIUM)
References: http://fedoraproject.org/wiki/FSA/F7/FEDORA-2007-0186; http://osvdb.org/46833; http://www.redhat.com/archives/fedora-package-announce/2007-June/msg00032.html
CVE: CVE-2007-3105
Published: 2007-07-27
Description: Stack-based buffer overflow in the random number generator (RNG) implementation in the Linux kernel before 2.6.22 might allow local root users to cause a denial of service or gain privileges by setting the default wakeup threshold to a value greater than the output pool size, which triggers writing random numbers to the stack by the pool transfer function involving "bound check ordering".  NOTE: this issue might only cross privilege boundaries in environments that have granular assignment of privileges for root.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/26500; http://secunia.com/advisories/26643; http://secunia.com/advisories/26647