CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Gentoo : Security Vulnerabilities (CVSS score between 5 and 5.99)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Copy Results Download Results Select Table
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2012-2983 287 2012-09-11 2013-04-12
5.0
 None Remote Low Not required Partial None None
file/edit_html.cgi in Webmin 1.590 and earlier does not perform an authorization check before showing a file's unedited contents, which allows remote attackers to read arbitrary files via the file field.
2 CVE-2006-3005 DoS 2006-06-13 2008-09-05
5.0
 None Remote Low Not required None None Partial
The JPEG library in media-libs/jpeg before 6b-r7 on Gentoo Linux is built without the -maxmem feature, which could allow context-dependent attackers to cause a denial of service (memory exhaustion) via a crafted JPEG file that exceeds the intended memory limits.
3 CVE-2005-3785 2005-11-23 2008-09-05
5.0
 None Remote Low Not required None Partial None
Second-order symlink vulnerability in eix-sync.in in Ebuild IndeX (eix) before 0.5.0_pre2 allows local users to overwrite arbitrary files via a symlink attack on the exi.X.sync temporary file, which is processed by the diff-eix program.
4 CVE-2005-3624 189 Overflow 2005-12-31 2010-11-19
5.0
 None Remote Low Not required None Partial None
The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to corrupt the heap via negative or large integers in a CCITTFaxDecode stream, which lead to integer overflows and integer underflows.
5 CVE-2005-1267 DoS 2005-06-10 2010-08-21
5.0
 None Remote Low Not required None None Partial
The bgp_update_print function in tcpdump 3.x does not properly handle a -1 return value from the decode_prefix4 function, which allows remote attackers to cause a denial of service (infinite loop) via a crafted BGP packet.
6 CVE-2005-1121 Exec Code 2005-05-02 2008-09-05
5.0
 None Remote Low Not required None Partial None
Format string vulnerability in the my_xlog function in lib.c for Oops! Proxy Server 1.5.23 and earlier, as called by the auth functions in the passwd_mysql and passwd_pgsql modules, may allow attackers to execute arbitrary code via a URL.
7 CVE-2005-0667 Exec Code Overflow 2005-03-07 2008-09-05
5.1
 User Remote High Not required Partial Partial Partial
Buffer overflow in Sylpheed before 1.0.3 and other versions before 1.9.5 allows remote attackers to execute arbitrary code via an e-mail message with certain headers containing non-ASCII characters that are not properly handled when the user replies to the message.
8 CVE-2005-0470 DoS Overflow 2005-03-14 2008-09-05
5.0
 None Remote Low Not required None None Partial
Buffer overflow in wpa_supplicant before 0.2.7 allows remote attackers to cause a denial of service (segmentation fault) via invalid EAPOL-Key packet data.
9 CVE-2005-0427 2005-05-02 2008-09-05
5.0
 None Remote Low Not required Partial None None
The ebuild of Webmin before 1.170-r3 on Gentoo Linux includes the encrypted root password in the miniserv.users file when building a tbz2 of the webmin package, which allows remote attackers to obtain and possibly crack the encrypted password.
10 CVE-2004-1491 Exec Code 2004-12-31 2008-09-05
5.0
 None Remote Low Not required None Partial None
Opera 7.54 and earlier uses kfmclient exec to handle unknown MIME types, which allows remote attackers to execute arbitrary code via a shortcut or launcher that contains an Exec entry.
11 CVE-2004-1174 DoS 2005-04-14 2008-09-10
5.0
 None Remote Low Not required None None Partial
direntry.c in Midnight Commander (mc) 4.5.55 and earlier allows attackers to cause a denial of service by "manipulating non-existing file handles."
12 CVE-2004-1167 2005-01-10 2008-09-10
5.0
 None Remote Low Not required None Partial None
mirrorselect before 0.89 creates temporary files in a world-writable location with predictable file names, which allows remote attackers to overwrite arbitrary files via a symlink attack.
13 CVE-2004-1093 DoS 2005-04-14 2008-09-10
5.0
 None Remote Low Not required None None Partial
Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service via "use of already freed memory."
14 CVE-2004-1092 DoS 2005-04-14 2008-09-10
5.0
 None Remote Low Not required None None Partial
Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service by causing mc to free unallocated memory.
15 CVE-2004-1091 DoS 2005-04-14 2008-09-10
5.0
 None Remote Low Not required None None Partial
Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service by triggering a null dereference.
16 CVE-2004-1090 DoS 2005-04-14 2008-09-10
5.0
 None Remote Low Not required None None Partial
Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service via "a corrupt section header."
17 CVE-2004-1027 Dir. Trav. 2005-03-01 2008-09-05
5.0
 None Remote Low Not required None Partial None
Directory traversal vulnerability in the -x (extract) command line option in unarj allows remote attackers to overwrite arbitrary files via an arj archive with filenames that contain .. (dot dot) sequences.
18 CVE-2004-1009 DoS 2005-04-14 2008-09-10
5.0
 None Remote Low Not required None None Partial
Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service (infinite loop) via unknown attack vectors.
19 CVE-2004-0983 DoS 2005-03-01 2010-08-21
5.0
 None Remote Low Not required None None Partial
The CGI module in Ruby 1.6 before 1.6.8, and 1.8 before 1.8.2, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a certain HTTP request.
20 CVE-2004-0930 DoS 2005-01-27 2010-08-21
5.0
 None Remote Low Not required None None Partial
The ms_fnmatch function in Samba 3.0.4 and 3.0.7 and possibly other versions allows remote authenticated users to cause a denial of service (CPU consumption) via a SAMBA request that contains multiple * (wildcard) characters.
21 CVE-2004-0918 399 DoS 2005-01-27 2010-08-21
5.0
 None Remote Low Not required None None Partial
The asn_parse_header function (asn1.c) in the SNMP module for Squid Web Proxy Cache before 2.4.STABLE7 allows remote attackers to cause a denial of service (server restart) via certain SNMP packets with negative length fields that trigger a memory allocation error.
22 CVE-2004-0809 DoS 2004-09-16 2010-08-21
5.0
 None Remote Low Not required None None Partial
The mod_dav module in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (child process crash) via a certain sequence of LOCK requests for a location that allows WebDAV authoring access.
23 CVE-2004-0749 2004-12-23 2008-09-05
5.0
 None Remote Low Not required Partial None None
The mod_authz_svn module in Subversion 1.0.7 and earlier does not properly restrict access to all metadata on unreadable paths, which could allow remote attackers to gain sensitive information via (1) svn log -v, (2) svn propget, or (3) svn blame, and other commands that follow renames.
24 CVE-2004-0635 DoS 2004-12-06 2010-08-21
5.0
 None Remote Low Not required None None Partial
The SNMP dissector in Ethereal 0.8.15 through 0.10.4 allows remote attackers to cause a denial of service (process crash) via a (1) malformed or (2) missing community string, which causes an out-of-bounds read.
25 CVE-2004-0634 DoS 2004-12-06 2010-08-21
5.0
 None Remote Low Not required None None Partial
The SMB SID snooping capability in Ethereal 0.9.15 to 0.10.4 allows remote attackers to cause a denial of service (process crash) via a handle without a policy name, which causes a null dereference.
26 CVE-2004-0633 DoS Overflow 2004-12-06 2010-08-21
5.0
 None Remote Low Not required None None Partial
The iSNS dissector for Ethereal 0.10.3 through 0.10.4 allows remote attackers to cause a denial of service (process abort) via an integer overflow.
27 CVE-2004-0626 DoS 2004-12-06 2008-09-05
5.0
 None Remote Low Not required None None Partial
The tcp_find_option function of the netfilter subsystem in Linux kernel 2.6, when using iptables and TCP options rules, allows remote attackers to cause a denial of service (CPU consumption by infinite loop) via a large option length that produces a negative integer after a casting operation to the char type.
28 CVE-2004-0604 DoS 2004-12-06 2008-09-05
5.0
 None Remote Low Not required None None Partial
The HTTP client and server in giFT-FastTrack 0.8.6 and earlier allows remote attackers to cause a denial of service (crash), possibly via an empty search query, which triggers a NULL dereference.
29 CVE-2004-0417 Overflow 2004-08-06 2010-08-21
5.0
 None Remote Low Not required None None Partial
Integer overflow in the "Max-dotdot" CVS protocol command (serve_max_dotdot) for CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to cause a server crash, which could cause temporary data to remain undeleted and consume disk space.
30 CVE-2004-0232 DoS Exec Code 2004-08-18 2008-09-10
5.0
 None Remote Low Not required None None Partial
Multiple format string vulnerabilities in Midnight Commander (mc) before 4.6.0 may allow attackers to cause a denial of service or execute arbitrary code.
Total number of vulnerabilities : 30   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.