3.4 * * * : Security Vulnerabilities

Cpe Name:cpe:2.3:o:openbsd:openbsd:3.4:*:*:*:*:*:*:*

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2011-2895	119	Exec Code Overflow	2011-08-19	2017-08-29	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.
2	CVE-2011-2168	189	Overflow	2011-05-24	2011-06-11	5.0	None	Remote	Low	Not required	None	None	Partial
Multiple integer overflows in the glob implementation in libc in OpenBSD before 4.9 might allow context-dependent attackers to have an unspecified impact via a crafted string, related to the GLOB_APPEND and GLOB_DOOFFS flags, a different issue than CVE-2011-0418.
3	CVE-2009-0537	189	DoS Overflow	2009-03-09	2018-10-11	4.9	None	Local	Low	Not required	None	None	Complete
Integer overflow in the fts_build function in fts.c in libc in (1) OpenBSD 4.4 and earlier and (2) Microsoft Interix 6.0 build 10.0.6030.0 allows context-dependent attackers to cause a denial of service (application crash) via a deep directory tree, related to the fts_level structure member, as demonstrated by (a) du, (b) rm, (c) chmod, and (d) chgrp on OpenBSD; and (e) SearchIndexer.exe on Vista Enterprise.
4	CVE-2008-4609	16	DoS	2008-10-20	2021-07-07	7.1	None	Remote	Medium	Not required	None	None	Complete
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.
5	CVE-2005-0740		DoS	2005-01-13	2008-09-05	5.0	None	Remote	Low	Not required	None	None	Partial
The TCP stack (tcp_input.c) in OpenBSD 3.5 and 3.6 allows remote attackers to cause a denial of service (system panic) via crafted values in the TCP timestamp option, which causes invalid arguments to be used when calculating the retransmit timeout.
6	CVE-2004-2338		Bypass	2004-12-31	2008-09-05	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
OpenBSD 3.3 and 3.4 does not properly parse Accept and Deny rules without netmasks on big-endian 64-bit platforms such as SPARC64, which may allow remote attackers to bypass access restrictions.
7	CVE-2004-2230		DoS Overflow	2004-12-31	2017-07-11	2.1	None	Local	Low	Not required	None	None	Partial
Heap-based buffer overflow in isakmpd on OpenBSD 3.4 through 3.6 allows local users to cause a denial of service (panic) and corrupt memory via IPSEC credentials on a socket.
8	CVE-2004-2163		Bypass	2004-12-31	2017-07-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
login_radius on OpenBSD 3.2, 3.5, and possibly other versions does not verify the shared secret in a response packet from a RADIUS server, which allows remote attackers to bypass authentication by spoofing server replies.
9	CVE-2004-1799		Bypass	2004-12-31	2016-10-18	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
PF in certain OpenBSD versions, when stateful filtering is enabled, does not limit packets for a session to the original interface, which allows remote attackers to bypass intended packet filters via spoofed packets to other interfaces.
10	CVE-2004-1471		DoS Exec Code	2004-12-31	2017-07-11	7.1	None	Remote	High	???	Complete	Complete	Complete
Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a wrapper line.
11	CVE-2004-1082			2004-02-03	2018-10-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
mod_digest_apple for Apache 1.3.31 and 1.3.32 on Mac OS X Server does not properly verify the nonce of a client response, which allows remote attackers to replay credentials.
12	CVE-2004-0819		DoS	2004-08-25	2017-07-11	5.0	None	Remote	Low	Not required	None	None	Partial
The bridge functionality in OpenBSD 3.4 and 3.5, when running a gateway configured as a bridging firewall with the link2 option for IPSec enabled, allows remote attackers to cause a denial of service (crash) via an ICMP echo (ping) packet.
13	CVE-2004-0688		Exec Code Overflow	2004-10-20	2018-10-19	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple integer overflows in (1) the xpmParseColors function in parse.c, (2) XpmCreateImageFromXpmImage, (3) CreateXImage, (4) ParsePixels, and (5) ParseAndPutPixels for libXpm before 6.8.1 may allow remote attackers to execute arbitrary code via a malformed XPM image file.
14	CVE-2004-0687		Exec Code Overflow	2004-10-20	2018-10-19	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple stack-based buffer overflows in (1) xpmParseColors in parse.c, (2) ParseAndPutPixels in create.c, and (3) ParsePixels in parse.c for libXpm before 6.8.1 allow remote attackers to execute arbitrary code via a malformed XPM image file.
15	CVE-2004-0492		DoS Exec Code Overflow	2004-08-06	2021-06-06	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied.
16	CVE-2004-0488		Exec Code Overflow	2004-07-07	2021-06-06	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.
17	CVE-2004-0482		Overflow	2004-07-07	2017-07-11	4.6	None	Local	Low	Not required	Partial	Partial	Partial
Multiple integer overflows in (1) procfs_cmdline.c, (2) procfs_fpregs.c, (3) procfs_linux.c, (4) procfs_regs.c, (5) procfs_status.c, and (6) procfs_subr.c in procfs for OpenBSD 3.5 and earlier allow local users to read sensitive kernel memory and possibly perform other unauthorized activities.
18	CVE-2004-0418		Exec Code	2004-08-06	2018-05-03	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
serve_notify in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle empty data lines, which may allow remote attackers to perform an "out-of-bounds" write for a single byte to execute arbitrary code or modify critical program data.
19	CVE-2004-0417		Overflow	2004-08-06	2018-05-03	5.0	None	Remote	Low	Not required	None	None	Partial
Integer overflow in the "Max-dotdot" CVS protocol command (serve_max_dotdot) for CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to cause a server crash, which could cause temporary data to remain undeleted and consume disk space.
20	CVE-2004-0416	119	Exec Code Overflow	2004-08-06	2018-05-03	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code.
21	CVE-2004-0414		DoS Exec Code	2004-08-06	2018-05-03	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle malformed "Entry" lines, which prevents a NULL terminator from being used and may lead to a denial of service (crash), modification of critical program data, or arbitrary code execution.
22	CVE-2004-0257		DoS	2004-11-23	2017-10-10	5.0	None	Remote	Low	Not required	None	None	Partial
OpenBSD 3.4 and NetBSD 1.6 and 1.6.1 allow remote attackers to cause a denial of service (crash) by sending an IPv6 packet with a small MTU to a listening port and then issuing a TCP connect to that port.
23	CVE-2004-0171		DoS	2004-03-15	2017-10-10	5.0	None	Remote	Low	Not required	None	None	Partial
FreeBSD 5.1 and earlier, and Mac OS X before 10.3.4, allows remote attackers to cause a denial of service (resource exhaustion of memory buffers and system crash) via a large number of out-of-sequence TCP packets, which prevents the operating system from creating new connections.
24	CVE-2004-0112		DoS	2004-11-23	2021-11-08	5.0	None	Remote	Low	Not required	None	None	Partial
The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.
25	CVE-2004-0106			2004-03-03	2017-10-11	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Multiple unknown vulnerabilities in XFree86 4.1.0 to 4.3.0, related to improper handling of font files, a different set of vulnerabilities than CVE-2004-0083 and CVE-2004-0084.
26	CVE-2004-0084		Exec Code Overflow	2004-03-03	2017-10-11	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Buffer overflow in the ReadFontAlias function in XFree86 4.1.0 to 4.3.0, when using the CopyISOLatin1Lowered function, allows local or remote authenticated users to execute arbitrary code via a malformed entry in the font alias (font.alias) file, a different vulnerability than CVE-2004-0083 and CVE-2004-0106.
27	CVE-2004-0083		Exec Code Overflow	2004-03-03	2017-10-11	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Buffer overflow in ReadFontAlias from dirfile.c of XFree86 4.1.0 through 4.3.0 allows local users and remote attackers to execute arbitrary code via a font alias file (font.alias) with a long token, a different vulnerability than CVE-2004-0084 and CVE-2004-0106.
28	CVE-2004-0081		DoS	2004-11-23	2021-11-08	5.0	None	Remote	Low	Not required	None	None	Partial
OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the Codenomicon TLS Test Tool.
29	CVE-2004-0079		DoS	2004-11-23	2021-11-08	5.0	None	Remote	Low	Not required	None	None	Partial
The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference.
30	CVE-2003-0955		DoS Exec Code Overflow	2003-12-15	2016-10-18	4.6	None	Local	Low	Not required	Partial	Partial	Partial
OpenBSD kernel 3.3 and 3.4 allows local users to cause a denial of service (kernel panic) and possibly execute arbitrary code in 3.4 via a program with an invalid header that is not properly handled by (1) ibcs2_exec.c in the iBCS2 emulation (compat_ibcs2) or (2) exec_elf.c, which leads to a stack-based buffer overflow.
31	CVE-2003-0804		DoS	2003-11-17	2008-09-10	5.0	None	Remote	Low	Not required	None	None	Partial
The arplookup function in FreeBSD 5.1 and earlier, Mac OS X before 10.2.8, and possibly other BSD-based systems, allows remote attackers on a local subnet to cause a denial of service (resource starvation and panic) via a flood of spoofed ARP requests.

Total number of vulnerabilities : 31 Page : 1 (This Page)