deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2004-0985
Published: 2004-12-31
Description: Internet Explorer 6.x on Windows XP SP2 allows remote attackers to execute arbitrary code, as demonstrated using a document with a draggable file type such as .xml, .doc, .py, .cdf, .css, .pdf, or .ppt, and using ADODB.Connection and ADODB.recordset to write to a .hta file that is interpreted in the Local Zone by HTML Help.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0055&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0857&w=2; http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]2478&w=2
CVE: CVE-2004-0997
Published: 2004-12-31
Description: Unspecified vulnerability in the ptrace MIPS assembly code in Linux kernel 2.4 before 2.4.17 allows local users to gain privileges via unknown vectors.
CVSS Score: 4.6 (MEDIUM)
References: http://kernel.debian.net/debian/pool/main/kernel-source-2.4.17/kernel-source-2.4.17_2.4.17-1woody4_ia64.changes; http://secunia.com/advisories/20162; http://secunia.com/advisories/20163
CVE: CVE-2004-0999
Published: 2004-12-31
Description: zgv 5.5.3 allows remote attackers to cause a denial of service (application crash via segmentation fault) via crafted multiple-image (animated) GIF images.
CVSS Score: 2.6 (LOW)
References: http://www.debian.org/security/2004/dsa-608; http://www.securityfocus.com/bid/11915; https://exchange.xforce.ibmcloud.com/vulnerabilities/18480
CVE: CVE-2004-1017
Published: 2004-12-31
Description: Multiple "overflows" in the io_edgeport driver for Linux kernel 2.4.x have unknown impact and unknown attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/19374; http://secunia.com/advisories/20162; http://secunia.com/advisories/20163
CVE: CVE-2004-1043
Published: 2004-12-31
Description: Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to execute arbitrary code by using the "Related Topics" command in the Help ActiveX Control (hhctrl.ocx) to open a Help popup window containing the PCHealth tools.htm file in the local zone and injecting Javascript to be executed, as demonstrated using "writehta.txt" and the ADODB recordset, which saves a .HTA file to the local system, aka the "HTML Help ActiveX control Cross Domain Vulnerability."
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2004-12/0426.html; http://www.kb.cert.org/vuls/id/972415; http://www.us-cert.gov/cas/techalerts/TA05-012B.html
CVE: CVE-2004-1049
Published: 2004-12-31
Description: Integer overflow in the LoadImage API of the USER32 Lib for Microsoft Windows allows remote attackers to execute arbitrary code via a .bmp, .cur, .ico or .ani file with a large image size field, which leads to a buffer overflow, aka the "Cursor and Icon Format Handling Vulnerability."
CVSS Score: 5.1 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8076&w=2; http://secunia.com/advisories/13645; http://securitytracker.com/id?1012684
CVE: CVE-2004-1050
Published: 2004-12-31
Description: Heap-based buffer overflow in Internet Explorer 6 allows remote attackers to execute arbitrary code via long (1) SRC or (2) NAME attributes in IFRAME, FRAME, and EMBED elements, as originally discovered using the mangleme utility, aka "the IFRAME vulnerability" or the "HTML Elements Vulnerability."
CVSS Score: 10.0 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/028009.html; http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/028035.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1846&w=2
CVE: CVE-2004-1104
Published: 2004-12-31
Description: Microsoft Internet Explorer 6.0 SP2 allows remote attackers to spoof a legitimate URL in the status bar and conduct a phishing attack via a web page that contains a BASE element that points to the legitimate site, followed by an anchor (a) element with an empty "href" attribute, and a FORM whose action points to a malicious URL, and an INPUT submit element that is modified to look like a legitimate URL.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/11273; http://www.kb.cert.org/vuls/id/702086; http://www.securityfocus.com/archive/1/379903
CVE: CVE-2004-1140
Published: 2004-12-31
Description: Ethereal 0.9.0 through 0.10.7 allows remote attackers to cause a denial of service (application hang) and possibly fill available disk space via an invalid RTP timestamp.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000916; http://secunia.com/advisories/13468/; http://www.ciac.org/ciac/bulletins/p-061.shtml
CVE: CVE-2004-1141
Published: 2004-12-31
Description: The HTTP dissector in Ethereal 0.10.1 through 0.10.7 allows remote attackers to cause a denial of service (application crash) via a certain packet that causes the dissector to access previously-freed memory.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000916; http://secunia.com/advisories/13468/; http://www.ciac.org/ciac/bulletins/p-061.shtml
CVE: CVE-2004-1143
Published: 2004-12-31
Description: The password generation in mailman before 2.1.5 generates only 5 million unique passwords, which makes it easier for remote attackers to guess passwords via a brute force attack.
CVSS Score: 7.5 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286796; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6351&w=2; http://secunia.com/advisories/13603/
CVE: CVE-2004-1144
Published: 2004-12-31
Description: Unknown vulnerability in the 32bit emulation code in Linux 2.4 on AMD64 systems allows local users to gain privileges.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9798&w=2; http://www.redhat.com/support/errata/RHSA-2004-689.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/18686
CVE: CVE-2004-1146
Published: 2004-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in (1) main.c and (2) login.c for CVSTrac before 1.1.5 allow remote attackers to inject arbitrary HTML and web script.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-December/030222.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1253&w=2; http://www.cvstrac.org/cvstrac/chngview?cn=320
CVE: CVE-2004-1150
Published: 2004-12-31
Description: Stack-based buffer overflow in the in_cdda.dll plugin for Winamp 5.0 through 5.08c allows attackers to execute arbitrary code via a cda:// URL with a long (1) device name or (2) sound track number, as demonstrated with a .m3u or .pls playlist file.
CVSS Score: 5.1 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8614&w=2; http://secunia.com/advisories/13781; http://www.nsfocus.com/english/homepage/research/0501.htm
CVE: CVE-2004-1155
Published: 2004-12-31
Description: Internet Explorer 5.01 through 6 allows remote attackers to spoof arbitrary web sites by injecting content from one window into another window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability.  NOTE: later research shows that Internet Explorer 7 on Windows XP SP2 is also vulnerable.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/13251/; http://secunia.com/advisories/22628; http://secunia.com/multiple_browsers_window_injection_vulnerability_test/
CVE: CVE-2004-1156
Published: 2004-12-31
Description: Mozilla before 1.7.6, and Firefox before 1.0.1, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/13129/; http://secunia.com/multiple_browsers_window_injection_vulnerability_test/; http://secunia.com/secunia_research/2004-13/advisory/
CVE: CVE-2004-1166
Published: 2004-12-31
Description: CRLF injection vulnerability in Microsoft Internet Explorer 6.0.2800.1106 and earlier allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded newline ("%0a") before the FTP command, which causes the commands to be inserted into the resulting FTP session, as demonstrated using a PORT command.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5359&w=2; http://secunia.com/advisories/13404; http://secunia.com/advisories/29346
CVE: CVE-2004-1173
Published: 2004-12-31
Description: Internet Explorer 6 allows remote attackers to bypass the popup blocker via the document object model (DOM) methods in the DHTML Dynamic HTML (DHTML) Editing Component (DEC) and Javascript that calls showModalDialog.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5795&w=2; http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]9952&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/18444
CVE: CVE-2004-1179
Published: 2004-12-31
Description: The debstd script in debmake 3.6.x before 3.6.10 and 3.7.x before 3.7.7 allows local users to overwrite arbitrary files via a symlink attack on temporary directories.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/13633/; http://www.debian.org/security/2004/dsa-615; http://www.derkeiler.com/Mailing-Lists/Full-Disclosure/2004-12/0645.html
CVE: CVE-2004-1182
Published: 2004-12-31
Description: hfaxd in HylaFAX before 4.2.1, when installed with a "weak" hosts.hfaxd file, allows remote attackers to authenticate and bypass intended access restrictions via a crafted (1) username or (2) hostname that satisfies a regular expression that is matched against a hosts.hfaxd entry without a password.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7585&w=2; http://marc.info/?l=hylafax&m=[PII_REDACTED]1558&w=2; http://secunia.com/advisories/13812
CVE: CVE-2004-1186
Published: 2004-12-31
Description: Multiple buffer overflows in enscript 1.6.3 allow remote attackers or local users to cause a denial of service (application crash).
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://secunia.com/advisories/35074; http://securitytracker.com/id?1012965
CVE: CVE-2004-1189
Published: 2004-12-31
Description: The add_to_history function in svr_principal.c in libkadm5srv for MIT Kerberos 5 (krb5) up to 1.3.5, when performing a password change, does not properly track the password policy's history count and the maximum number of keys, which can cause an array index out-of-bounds error and may allow authenticated users to execute arbitrary code via a heap-based buffer overflow.
CVSS Score: 7.2 (HIGH)
CWE: CWE-787
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000917; http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html; http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html
CVE: CVE-2004-1198
Published: 2004-12-31
Description: Microsoft Internet Explorer allows remote attackers to cause a denial of service (application crash from memory consumption), as demonstrated using Javascript code that continuously creates nested arrays and then sorts the newly created arrays.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-11/1221.html; http://www.securityfocus.com/archive/1/382257; http://www.securityfocus.com/bid/11751
CVE: CVE-2004-1200
Published: 2004-12-31
Description: Firefox and Mozilla allow remote attackers to cause a denial of service (application crash from memory consumption), as demonstrated using Javascript code that continuously creates nested arrays and then sorts the newly created arrays.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-November/029434.html; http://lists.grok.org.uk/pipermail/full-disclosure/2004-November/029491.html; http://www.securityfocus.com/bid/11752
CVE: CVE-2004-1234
Published: 2004-12-31
Description: load_elf_binary in Linux before 2.4.26 allows local users to cause a denial of service (system crash) via an ELF binary in which the interpreter is NULL.
CVSS Score: 2.1 (LOW)
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=142965; http://linux.bkbits.net:8080/linux-2.4/cset%404076466d_SqUm4azg4_v3FIG2-X6XQ; http://secunia.com/advisories/20162
CVE: CVE-2004-1236
Published: 2004-12-31
Description: Buffer overflow in the LDAP component for Netscape Directory Server (NDS) 3.6 on HP-UX and other operating systems allows remote attackers to execute arbitrary code.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6120; http://secunia.com/advisories/14960; http://sunsolve.sun.com/search/document.do?assetkey=1-26-57754-1
CVE: CVE-2004-1238
Published: 2004-12-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2004.  Notes: none
CVE: CVE-2004-1239
Published: 2004-12-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2004.  Notes: none
CVE: CVE-2004-1240
Published: 2004-12-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2004.  Notes: none
CVE: CVE-2004-1241
Published: 2004-12-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2004.  Notes: none
CVE: CVE-2004-1242
Published: 2004-12-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2004.  Notes: none
CVE: CVE-2004-1243
Published: 2004-12-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2004.  Notes: none
CVE: CVE-2004-1296
Published: 2004-12-31
Description: The (1) eqn2graph and (2) pic2graph scripts in groff 1.18.1 allow local users to overwrite arbitrary files via a symlink attack on temporary files.
CVSS Score: 2.1 (LOW)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286371; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286372; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5424&w=2
CVE: CVE-2004-1306
Published: 2004-12-31
Description: Heap-based buffer overflow in winhlp32.exe in Windows NT, Windows 2000 through SP4, Windows XP through SP2, and Windows 2003 allows remote attackers to execute arbitrary code via a crafted .hlp file.
CVSS Score: 5.1 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9440&w=2; http://www.securityfocus.com/bid/12092; http://www.xfocus.net/flashsky/icoExp/
CVE: CVE-2004-1327
Published: 2004-12-31
Description: Buffer overflow in Crystal FTP Client 2.8 allows remote malicious servers to execute arbitrary code via a response to a LIST command that contains a file name with a long extension.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4337&w=2; http://secunia.com/advisories/13583/; http://www.securityfocus.com/bid/12038
CVE: CVE-2004-1328
Published: 2004-12-31
Description: Unknown vulnerability in newgrp in HP-UX B.11.00, B.11.04, and B.11.11 allows local users to gain elevated privileges.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5320&w=2; http://secunia.com/advisories/13565/; http://www.securityfocus.com/bid/12029
CVE: CVE-2004-1330
Published: 2004-12-31
Description: Buffer overflow in paginit in AIX 5.1 through 5.3 allows local users to execute arbitrary code via a long username.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0123&w=2; http://www-1.ibm.com/support/search.wss?rs=0&q=IY64312&apar=only; http://www-1.ibm.com/support/search.wss?rs=0&q=IY64358&apar=only
CVE: CVE-2004-1332
Published: 2004-12-31
Description: Stack-based buffer overflow in the FTP daemon in HP-UX 11.11i, with the -v (debug) option enabled, allows remote attackers to execute arbitrary code via a long command request.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0695&w=2; http://secunia.com/advisories/13608; http://securitytracker.com/id?1012650
CVE: CVE-2004-1343
Published: 2004-12-31
Description: CVS 1.12 and earlier on Debian GNU/Linux does not properly handle when a mapping for the current repository does not exist in the cvs-repouids file, which allows remote attackers to cause a denial of service (server crash).
CVSS Score: 5.0 (MEDIUM)
References: http://www.debian.org/security/2005/dsa-715; http://www.debian.org/security/2005/dsa-715
CVE: CVE-2004-1382
Published: 2004-12-31
Description: The glibcbug script in glibc 2.3.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files, a different vulnerability than CVE-2004-0968.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9801&w=2; http://www.debian.org/security/2005/dsa-636; http://www.mandriva.com/security/advisories?name=MDKSA-2004:159
CVE: CVE-2004-1383
Published: 2004-12-31
Description: Multiple SQL injection vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to execute arbitrary SQL statements via the (1) order, (2) project_id, (3) pro_main, or (4) hours_id parameters to index.php or (5) ticket_id to viewticket_details.php.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9072&w=2; http://www.gentoo.org/security/en/glsa/glsa-200501-08.xml; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]4
CVE: CVE-2004-1384
Published: 2004-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) kp3, (2) type, (3) msg, (4) forum_id, (5) pos, (6) cats_app, (7) cat_id, (8) msgball[msgnum], (9) fldball[acctnum] parameters to index.php or (10) ticket_id to viewticket_details.php.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9072&w=2; http://www.gentoo.org/security/en/glsa/glsa-200501-08.xml; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]4
CVE: CVE-2004-1385
Published: 2004-12-31
Description: phpGroupWare 0.9.16.003 and earlier allows remote attackers to gain sensitive information via (1) unexpected characters in the session ID such as shell metacharacters, (2) an invalid appname parameter to preferences.php or (3) an invalid menuaction parameter to index.php, which reveals the web server path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9072&w=2; http://www.gentoo.org/security/en/glsa/glsa-200501-08.xml; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]4
CVE: CVE-2004-1386
Published: 2004-12-31
Description: TikiWiki before 1.8.4.1 does not properly verify uploaded images, which could allow remote attackers to upload and execute arbitrary PHP scripts, a different vulnerability than CVE-2005-0200.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://securitytracker.com/id?1012700; http://tikiwiki.org/tiki-read_article.php?articleId=97; http://www.ciac.org/ciac/bulletins/p-084.shtml
CVE: CVE-2004-1387
Published: 2004-12-31
Description: The check_forensic script in apache-utils package 1.3.31 allows local users to overwrite or create arbitrary files via a symlink attack on temporary files.
CVSS Score: 2.1 (LOW)
References: http://lists.debian.org/debian-apache/2005/01/msg00076.html; http://secunia.com/advisories/13925; https://exchange.xforce.ibmcloud.com/vulnerabilities/18993
CVE: CVE-2004-1388
Published: 2004-12-31
Description: Format string vulnerability in the gpsd_report function for BerliOS GPD daemon (gpsd, formerly pygps) 1.9.0 through 2.7 allows remote attackers to execute arbitrary code via certain GPS requests containing format string specifiers that are not properly handled in syslog calls.
CVSS Score: 7.5 (HIGH)
References: http://lists.berlios.de/pipermail/gpsd-announce/2005-January/000018.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1505&w=2; http://www.digitalmunition.com/DMA%5B2005-0125a%5D.txt
CVE: CVE-2004-1389
Published: 2004-12-31
Description: Unknown vulnerability in the Veritas NetBackup Administrative Assistant interface for NetBackup BusinesServer 3.4, 3.4.1, and 4.5, DataCenter 3.4, 3.4.1, and 4.5, Enterprise Server 5.1, and NetBackup Server 5.0 and 5.1, allows attackers to execute arbitrary commands via the bpjava-susvc process, possibly related to the call-back feature.
CVSS Score: 6.0 (MEDIUM)
References: http://secunia.com/advisories/12901/; http://seer.support.veritas.com/docs/271727.htm; http://www.ciac.org/ciac/bulletins/p-020.shtml
CVE: CVE-2004-1390
Published: 2004-12-31
Description: Multiple buffer overflows in the PPPoE daemon (PPPoEd) in QNX RTP 6.1 allow remote attackers to execute arbitrary code via a long argument to the (1) -F, (2) name, (3) en, (4) upscript, (5) downscript, (6) retries, (7) timeout, (8) scriptdetach, (9) noscript, (10) nodetach, (11) remote_mac, or (12) local_mac flags.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-09/0155.html; http://www.kb.cert.org/vuls/id/961686; http://www.rfdslabs.com.br/qnx-advs-01-2004.txt
CVE: CVE-2004-1391
Published: 2004-12-31
Description: Untrusted execution path vulnerability in the PPPoE daemon (PPPoEd) in QNX RTP 6.1 allows local users to execute arbitrary programs by modifying the PATH environment variable to point to a malicious mount program.
CVSS Score: 4.6 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-09/0155.html; http://www.kb.cert.org/vuls/id/577566; http://www.osvdb.org/9661
CVE: CVE-2004-1392
Published: 2004-12-31
Description: PHP 4.0 with cURL functions allows remote attackers to bypass the open_basedir setting and read arbitrary files via a file: URL argument to the curl_init function.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6099&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0934&w=2; http://securitytracker.com/id?1011984
CVE: CVE-2004-1393
Published: 2004-12-31
Description: Unknown vulnerability in the tcsetattr function for Sun Solaris for SPARC 2.6, 7, and 8 allows local users to cause a denial of service (system hang).
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/10730/; http://sunsolve.sun.com/search/document.do?assetkey=1-26-57474-1; http://www.auscert.org.au/render.html?it=3806
CVE: CVE-2004-1394
Published: 2004-12-31
Description: The pfexec function for Sun Solaris 8 and 9 does not properly handle when a custom profile contains an invalid entry in the exec_attr database, which may allow local users with custom rights profiles to execute profile commands with additional privileges.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/10755/; http://sunsolve.sun.com/search/document.do?assetkey=1-26-57453-1; http://www.auscert.org.au/render.html?it=3800
CVE: CVE-2004-1395
Published: 2004-12-31
Description: The Lithtech engine, as used in (1) Contract Jack 1.1 and earlier, (2) No one lives forever 2 1.3 and earlier, (3) Tron 2.0 1.042 and earlier, (4) F.E.A.R. (First Encounter Assault and Recon), and possibly other games, allows remote attackers to cause a denial of service (connection refused) via a UDP packet that causes recvfrom to generate a return code that causes the listening loop to exit, as demonstrated using zero byte packets or packets between 8193 and 12280 bytes, which result in conditions that are not "Operation would block."
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/lithsock-adv.txt; http://lists.grok.org.uk/pipermail/full-disclosure/2004-December/029932.html; http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/038095.html