deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-0684
Published: 2005-04-25
Description: Multiple buffer overflows in the web tool for MySQL MaxDB before 7.5.00.26 allows remote attackers to execute arbitrary code via (1) an HTTP GET request with a long file parameter after a percent ("%") sign or (2) a long Lock-Token string to the WebDAV functionality, which is not properly handled by the getLockTokenHeader function in WDVHandler_CommonUtils.c.
CVSS Score: 10.0 (HIGH)
References: http://dev.mysql.com/doc/maxdb/changes/changes_7.5.00.26.html#WebDAV; http://www.idefense.com/application/poi/display?id=234&type=vulnerabilities; http://www.idefense.com/application/poi/display?id=235&type=vulnerabilities
CVE: CVE-2005-1275
Published: 2005-04-25
Description: Heap-based buffer overflow in the ReadPNMImage function in pnm.c for ImageMagick 6.2.1 and earlier allows remote attackers to cause a denial of service (application crash) via a PNM file with a small colors value.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=90423; http://seclists.org/lists/bugtraq/2005/Apr/0407.html; http://www.imagemagick.org/script/changelog.php
CVE: CVE-2005-1295
Published: 2005-04-25
Description: include.cgi script allows remote attackers to read arbitrary files via a full pathname in the argument.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6161&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6161&w=2
CVE: CVE-2005-1296
Published: 2005-04-25
Description: include.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6161&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6161&w=2
CVE: CVE-2005-1297
Published: 2005-04-25
Description: Cross-site scripting (XSS) vulnerability in the include.cgi script allows remote attackers to inject arbitrary web script or HTML via the argument.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6161&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6161&w=2
CVE: CVE-2005-1298
Published: 2005-04-25
Description: The inserter.cgi script allows remote attackers to read arbitrary files via a full pathname in the argument.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3846&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3846&w=2
CVE: CVE-2005-1299
Published: 2005-04-25
Description: The inserter.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3846&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3846&w=2
CVE: CVE-2005-1300
Published: 2005-04-25
Description: Cross-site scripting (XSS) vulnerability in the inserter.cgi script allows remote attackers to inject arbitrary web script or HTML via the argument.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3846&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3846&w=2
CVE: CVE-2005-1317
Published: 2005-04-25
Description: Cross-site scripting (XSS) vulnerability in Horde Chora module before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title.
CVSS Score: 6.8 (MEDIUM)
References: http://cvs.horde.org/diff.php/chora/docs/CHANGES?r1=1.45.2.34&r2=1.45.2.37&ty=h; http://lists.horde.org/archives/chora/Week-of-Mon-20050418/004050.html; http://secunia.com/advisories/15083
CVE: CVE-2005-1270
Published: 2005-04-26
Description: The (1) check_update.sh and (2) rkhunter script in Rootkit Hunter before 1.2.3-r1 create temporary files with predictable file names, which allows local users to overwrite arbitrary files via a symlink attack.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/15127; http://www.gentoo.org/security/en/glsa/glsa-200504-25.xml; http://www.osvdb.org/15861
CVE: CVE-2005-1274
Published: 2005-04-26
Description: Stack-based buffer overflow in the getIfHeader function in the WebDAV functionality in MySQL MaxDB before 7.5.00.26 allows remote attackers to execute arbitrary code via an HTTP unlock request and a long "If" parameter.
CVSS Score: 10.0 (HIGH)
References: http://www.idefense.com/application/poi/display?id=236&type=vulnerabilities; http://www.idefense.com/application/poi/display?id=236&type=vulnerabilities
CVE: CVE-2005-1281
Published: 2005-04-26
Description: Ethereal 0.10.10 and earlier allows remote attackers to cause a denial of service (infinite loop) via a crafted RSVP packet of length 4.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/396930; http://www.securityfocus.com/bid/13391; http://www.securityfocus.com/archive/1/396930
CVE: CVE-2004-1342
Published: 2005-04-27
Description: CVS 1.12 and earlier on Debian GNU/Linux, when using the repouid patch, allows remote attackers to bypass authentication via the pserver access method.
CVSS Score: 7.5 (HIGH)
References: http://www.debian.org/security/2005/dsa-715; http://www.debian.org/security/2005/dsa-715
CVE: CVE-2004-1487
Published: 2005-04-27
Description: wget 1.8.x and 1.9.x allows a remote malicious web server to overwrite certain files via a redirection URL containing a ".." that resolves to the IP address of the malicious server, which bypasses wget's filtering for ".." sequences.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=261755; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2384&w=2; http://securitytracker.com/id?1012472
CVE: CVE-2004-1488
Published: 2005-04-27
Description: wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP responses to the terminal, which may allow remote malicious web servers to inject terminal escape sequences and execute arbitrary code.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=261755; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2384&w=2; http://secunia.com/advisories/20960
CVE: CVE-2005-0019
Published: 2005-04-27
Description: Unknown vulnerability in hztty 2.0 and earlier allows local users to execute arbitrary commands.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/14236; http://securitytracker.com/id?1013154; http://www.debian.org/security/2005/dsa-675
CVE: CVE-2005-0085
Published: 2005-04-27
Description: Cross-site scripting (XSS) vulnerability in ht://dig (htdig) before 3.1.6-r7 allows remote attackers to execute arbitrary web script or HTML via the config parameter, which is not properly sanitized before it is displayed in an error message.
CVSS Score: 6.8 (MEDIUM)
References: ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.46/SCOSA-2005.46.txt; http://secunia.com/advisories/14255; http://secunia.com/advisories/14276
CVE: CVE-2005-0087
Published: 2005-04-27
Description: The alsa-lib package in Red Hat Linux 4 disables stack protection for the libasound.so library, which makes it easier for attackers to execute arbitrary code if there are other vulnerabilities in the library.
CVSS Score: 4.6 (MEDIUM)
References: http://www.redhat.com/support/errata/RHSA-2005-033.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10355; http://www.redhat.com/support/errata/RHSA-2005-033.html
CVE: CVE-2005-0159
Published: 2005-04-27
Description: The tpkg-* scripts in the toolchain-source 3.0.4 package on Debian GNU/Linux 3.0 allow local users to overwrite arbitrary files via a symlink attack on temporary files.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/14277; http://www.debian.org/security/2005/dsa-679; http://www.securityfocus.com/bid/12540
CVE: CVE-2005-0206
Published: 2005-04-27
Description: The patch for integer overflow vulnerabilities in Xpdf 2.0 and 3.0 (CVE-2004-0888) is incomplete for 64-bit architectures on certain Linux distributions such as Red Hat, which could leave Xpdf users exposed to the original vulnerabilities.
CVSS Score: 7.5 (HIGH)
References: http://www.mandriva.com/security/advisories?name=MDKSA-2005:041; http://www.mandriva.com/security/advisories?name=MDKSA-2005:042; http://www.mandriva.com/security/advisories?name=MDKSA-2005:043
CVE: CVE-2005-0229
Published: 2005-04-27
Description: CitrusDB 0.3.5 and earlier stores the newfile.txt temporary data file under the web root, which allows remote attackers to steal credit card information via a direct request to newfile.txt.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]9417&w=2; http://securitytracker.com/id?1013040; http://www.citrusdb.org/forums/viewtopic.php?t=49
CVE: CVE-2005-0412
Published: 2005-04-27
Description: Cross-site scripting (XSS) vulnerability in Spidean PostWrap allows remote attackers to inject arbitrary HTML and web script via the page parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-02/0065.html; http://securitytracker.com/id?1013130; https://exchange.xforce.ibmcloud.com/vulnerabilities/19261
CVE: CVE-2005-0413
Published: 2005-04-27
Description: Multiple SQL injection vulnerabilities in MyPHP Forum 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the fid in forum.php, (2) the member parameter in member.php, (3) the email parameter in forgot.php, or (4) the nbuser or nbpass parameters in include.php.  NOTE: it was later reported that vector 2 exists in 3.0 and earlier.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://seclists.org/lists/bugtraq/2005/Feb/0125.html; http://secunia.com/advisories/14205; http://securitytracker.com/id?1013136
CVE: CVE-2005-0414
Published: 2005-04-27
Description: SQL injection vulnerability in post.php for MercuryBoard 1.1.1 allows remote attackers to execute arbitrary SQL commands via a reply post action for index.php with (1) the t parameter or (2) the qu parameter.
CVSS Score: 7.5 (HIGH)
References: http://cvs.sunsite.dk/viewcvs.cgi/mercury/func/post.php.diff?r1=1.68&r2=1.70; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2354&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2358&w=2
CVE: CVE-2005-0415
Published: 2005-04-27
Description: Multiple memory leaks in the MQL parser in Emdros before 1.1.22 allow remote attackers to cause a denial of service (memory consumption) via malformed MQL statements.
CVSS Score: 5.0 (MEDIUM)
References: http://sourceforge.net/project/shownotes.php?release_id=303465; http://sourceforge.net/tracker/index.php?func=detail&aid=1116935&group_id=37219&atid=419458; https://exchange.xforce.ibmcloud.com/vulnerabilities/19273
CVE: CVE-2005-0416
Published: 2005-04-27
Description: The Windows Animated Cursor (ANI) capability in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allows remote attackers to execute arbitrary code via the AnimationHeaderBlock length field, which leads to a stack-based buffer overflow.
CVSS Score: 7.5 (HIGH)
References: http://eeye.com/html/research/advisories/AD20050111.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8397&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7760&w=2
CVE: CVE-2005-0417
Published: 2005-04-27
Description: Unknown "high risk" vulnerability in DB2 Universal Database 8.1 and earlier has unknown impact and attack vectors.  NOTE: due to the delayed disclosure of details for this issue, this candidate may be SPLIT in the future.  In addition, this may be a duplicate of other issues as reported by the vendor.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2825&w=2; http://www.ngssoftware.com/advisories/db2-09-05-05.htm; http://www.securityfocus.com/bid/12508
CVE: CVE-2005-0419
Published: 2005-04-27
Description: Multiple heap-based buffer overflows in 3Com 3CServer allow remote authenticated users to execute arbitrary code via long FTP commands, as demonstrated using the STAT command.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6130&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/19250; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6130&w=2
CVE: CVE-2005-0420
Published: 2005-04-27
Description: Microsoft Outlook Web Access (OWA), when used with Exchange, allows remote attackers to redirect users to arbitrary URLs for login via a link to the owalogon.asp application.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-601
References: http://seclists.org/lists/fulldisclosure/2005/Feb/0106.html; http://secunia.com/advisories/14144; http://www.securityfocus.com/bid/12459
CVE: CVE-2005-0421
Published: 2005-04-27
Description: DelphiTurk FTP 1.0 stores usernames and passwords in the profile.dat file, which allows local users to gain privileges.
CVSS Score: 2.1 (LOW)
References: http://securitytracker.com/id?1013139; https://exchange.xforce.ibmcloud.com/vulnerabilities/19248; http://securitytracker.com/id?1013139
CVE: CVE-2005-0422
Published: 2005-04-27
Description: DelphiTurk CodeBank (aka KodBank) 3.1 and earlier stores usernames and passwords in the Codebank registry key, which allows local users to gain privileges.
CVSS Score: 2.1 (LOW)
References: http://securitytracker.com/id?1013139; https://exchange.xforce.ibmcloud.com/vulnerabilities/19248; http://securitytracker.com/id?1013139
CVE: CVE-2005-0423
Published: 2005-04-27
Description: SQL injection vulnerability in login.asp in ASPjar Guestbook allows remote attackers to execute arbitrary SQL commands via the password field.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1701&w=2; http://secunia.com/advisories/14225/; http://www.securityfocus.com/bid/12521
CVE: CVE-2005-0424
Published: 2005-04-27
Description: Unknown vulnerability in the delete.asp program in certain versions of ASPjar Guestbook allows remote attackers to delete messages.  NOTE: there is insufficient information to know if this is the same issue as CVE-2002-1730.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1701&w=2; http://secunia.com/advisories/14225/; http://www.securityfocus.com/bid/12521
CVE: CVE-2005-1063
Published: 2005-04-29
Description: The administration protocol for Kerio WinRoute Firewall 6.x up to 6.0.10, Personal Firewall 4.x up to 4.1.2, and MailServer up to 6.0.8 allows remote attackers to cause a denial of service (CPU consumption) via certain attacks that force the product to "compute unexpected conditions" and "perform cryptographic operations."
CVSS Score: 5.0 (MEDIUM)
References: http://research.tic.udc.es/scg/advisories/20050429-2.txt; http://www.kerio.com/security_advisory.html; http://www.securityfocus.com/archive/1/397220
CVE: CVE-1999-1374
Published: 2005-05-02
Description: perlshop.cgi shopping cart program stores sensitive customer information in directories and files that are under the web root, which allows remote attackers to obtain that information via an HTTP request.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9402&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9402&w=2
CVE: CVE-1999-1557
Published: 2005-05-02
Description: Buffer overflow in the login functions in IMAP server (imapd) in Ipswitch IMail 5.0 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via (1) a long user name or (2) a long password.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7336&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/1895; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7336&w=2
CVE: CVE-2001-1420
Published: 2005-05-02
Description: AOL Instant Messenger (AIM) 4.7 allows remote attackers to cause a denial of service (application crash) via a long filename, possibly caused by a buffer overflow.
CVSS Score: 5.0 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/972499; http://www.kb.cert.org/vuls/id/JARL-569MEK; http://www.securityfocus.com/archive/1/218920
CVE: CVE-2002-0646
Published: 2005-05-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2002-0371.  Reason: This candidate is a reservation duplicate of CVE-2002-0371.  Notes: CVE-2002-0371 should be used instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2002-1370
Published: 2005-05-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2002-1367.  Reason: This CAN was originally assigned for the theft of root certificates in CUPS, but it was later deemed to be a legitimate result of exploiting a different vulnerability, CVE-2002-1367, so it is not a distinct vulnerability.  Notes: All CVE users should reference CVE-2002-1367 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-0001
Published: 2005-05-02
Description: Race condition in the page fault handler (fault.c) for Linux kernel 2.2.x to 2.2.7, 2.4 to 2.4.29, and 2.6 to 2.6.10, when running on multiprocessor machines, allows local users to execute arbitrary code via concurrent threads that share the same virtual memory space and simultaneously request stack expansion.
CVSS Score: 6.9 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000930; http://isec.pl/vulnerabilities/isec-0022-pagefault.txt; http://lists.grok.org.uk/pipermail/full-disclosure/2005-January/030826.html
CVE: CVE-2005-0002
Published: 2005-05-02
Description: poppassd_pam 1.0 and earlier, when changing a user password, does not verify that the user entered the old password correctly, which allows remote attackers to change passwords for arbitrary users.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/13865; http://security.gentoo.org/glsa/glsa-200501-22.xml; http://securitytracker.com/id?1012840
CVE: CVE-2005-0005
Published: 2005-05-02
Description: Heap-based buffer overflow in psd.c for ImageMagick 6.1.0, 6.1.7, and possibly earlier versions allows remote attackers to execute arbitrary code via a .PSD image file with a large number of layers.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7215&w=2; http://www.debian.org/security/2005/dsa-646; http://www.gentoo.org/security/en/glsa/glsa-200501-37.xml
CVE: CVE-2005-0006
Published: 2005-05-02
Description: The COPS dissector in Ethereal 0.10.6 through 0.10.8 allows remote attackers to cause a denial of service (infinite loop).
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/13946/; http://www.ciac.org/ciac/bulletins/p-106.shtml; http://www.ethereal.com/appnotes/enpa-sa-00017.html
CVE: CVE-2005-0007
Published: 2005-05-02
Description: Unknown vulnerability in the DLSw dissector in Ethereal 0.10.6 through 0.10.8 allows remote attackers to cause a denial of service (application crash from assertion).
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/13946/; http://www.ciac.org/ciac/bulletins/p-106.shtml; http://www.ethereal.com/appnotes/enpa-sa-00017.html
CVE: CVE-2005-0008
Published: 2005-05-02
Description: Unknown vulnerability in the DNP dissector in Ethereal 0.10.5 through 0.10.8 allows remote attackers to cause "memory corruption."
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/13946/; http://www.ciac.org/ciac/bulletins/p-106.shtml; http://www.ethereal.com/appnotes/enpa-sa-00017.html
CVE: CVE-2005-0009
Published: 2005-05-02
Description: Unknown vulnerability in the Gnutella dissector in Ethereal 0.10.6 through 0.10.8 allows remote attackers to cause a denial of service (application crash).
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/13946/; http://www.ciac.org/ciac/bulletins/p-106.shtml; http://www.ethereal.com/appnotes/enpa-sa-00017.html
CVE: CVE-2005-0010
Published: 2005-05-02
Description: Unknown vulnerability in the MMSE dissector in Ethereal 0.10.4 through 0.10.8 allows remote attackers to cause a denial of service by triggering a free of statically allocated memory.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/13946/; http://www.ciac.org/ciac/bulletins/p-106.shtml; http://www.ethereal.com/appnotes/enpa-sa-00017.html
CVE: CVE-2005-0011
Published: 2005-05-02
Description: Multiple vulnerabilities in fliccd, when installed setuid root as part of the kdeedu Kstars support for Instrument Neutral Distributed Interface (INDI) in KDE 3.3 to 3.3.2, allow local users and remote attackers to execute arbitrary code via stack-based buffer overflows.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/14306; http://www.gentoo.org/security/en/glsa/glsa-200502-23.xml; http://www.kde.org/info/security/advisory-20050215-1.txt
CVE: CVE-2005-0012
Published: 2005-05-02
Description: Format string vulnerability in the a_Interface_msg function in Dillo before 0.8.3-r4 allows remote attackers to execute arbitrary code via format string specifiers in a web page.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/13760/; http://secunia.com/advisories/13764; http://www.gentoo.org/security/en/glsa/glsa-200501-11.xml
CVE: CVE-2005-0013
Published: 2005-05-02
Description: nwclient.c in ncpfs before 2.2.6 does not drop root privileges before executing utilities using the NetWare client functions, which allows local users to gain privileges.
CVSS Score: 7.2 (HIGH)
References: ftp://platan.vc.cvut.cz/pub/linux/ncpfs/Changes-2.2.6; http://securitytracker.com/id?1013019; http://www.debian.org/security/2005/dsa-665
CVE: CVE-2005-0014
Published: 2005-05-02
Description: Buffer overflow in ncplogin in ncpfs before 2.2.6 allows remote malicious NetWare servers to execute arbitrary code on the NetWare client.
CVSS Score: 7.5 (HIGH)
References: ftp://platan.vc.cvut.cz/pub/linux/ncpfs/Changes-2.2.6; http://securitytracker.com/id?1013019; http://www.gentoo.org/security/en/glsa/glsa-200501-44.xml
CVE: CVE-2005-0015
Published: 2005-05-02
Description: diatheke.pl in Sword 1.5.7a allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/13897; http://secunia.com/advisories/13941; http://securitytracker.com/id?1012955
CVE: CVE-2005-0017
Published: 2005-05-02
Description: The f2c translator in the f2c package 3.1 allows local users to read arbitrary files via a symlink attack on temporary files.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/14041; http://secunia.com/advisories/14052; http://secunia.com/advisories/14067
CVE: CVE-2005-0018
Published: 2005-05-02
Description: The f2 shell script in the f2c package 3.1 allows local users to read arbitrary files via a symlink attack on temporary files.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/14041; http://secunia.com/advisories/14052; http://securitytracker.com/id?1013028
CVE: CVE-2005-0021
Published: 2005-05-02
Description: Multiple buffer overflows in Exim before 4.43 may allow attackers to execute arbitrary code via (1) an IPv6 address with more than 8 components, as demonstrated using the -be command line option, which triggers an overflow in the host_aton function, or (2) the -bh command line option or dnsdb PTR lookup, which triggers an overflow in the dns_build_reverse function.
CVSS Score: 7.2 (HIGH)
References: http://ftp6.us.freebsd.org/pub/mail/exim/ChangeLogs/ChangeLog-4.44; http://security.gentoo.org/glsa/glsa-200501-23.xml; http://www.debian.org/security/2005/dsa-635
CVE: CVE-2005-0022
Published: 2005-05-02
Description: Buffer overflow in the spa_base64_to_bits function in Exim before 4.43, as originally obtained from Samba code, and as called by the auth_spa_client function, may allow attackers to execute arbitrary code during SPA authentication.
CVSS Score: 4.6 (MEDIUM)
References: http://ftp6.us.freebsd.org/pub/mail/exim/ChangeLogs/ChangeLog-4.44; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8614&w=2; http://security.gentoo.org/glsa/glsa-200501-23.xml
CVE: CVE-2005-0033
Published: 2005-05-02
Description: Buffer overflow in the code for recursion and glue fetching in BIND 8.4.4 and 8.4.5 allows remote attackers to cause a denial of service (crash) via queries that trigger the overflow in the q_usedns array that tracks nameservers and addresses.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.1/SCOSA-2006.1.txt; http://secunia.com/advisories/14009; http://secunia.com/advisories/18291