CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 9495 | CVE-2004-1067 | Candidate | Off-by-one error in the mysasl_canon_user function in Cyrus IMAP Server 2.2.9 and earlier leads to a buffer overflow, which may allow remote attackers to execute arbitrary code via the username. | Assigned (20041129) | None (candidate not yet proposed) | View | |
| 9494 | CVE-2004-1066 | Candidate | The cmdline pseudofiles in (1) procfs on FreeBSD 4.8 through 5.3, and (2) linprocfs on FreeBSD 5.x through 5.3, do not properly validate a process argument vector, which allows local users to cause a denial of service (panic) or read portions of kernel memory. NOTE: this candidate might be SPLIT into 2 separate items in the future. | Assigned (20041129) | None (candidate not yet proposed) | View | |
| 9493 | CVE-2004-1065 | Candidate | Buffer overflow in the exif_read_data function in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to execute arbitrary code via a long section name in an image file. | Assigned (20041123) | None (candidate not yet proposed) | View | |
| 9492 | CVE-2004-1064 | Candidate | The safe mode checks in PHP 4.x to 4.3.9 and PHP 5.x to 5.0.2 truncate the file path before passing the data to the realpath function, which could allow attackers to bypass safe mode. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion. | Assigned (20041123) | REVIEWING(1) Christey | Christey> There is active disagreement regarding whether this satisfies the | criteria for inclusion in CVE, because the attack vectors require | function parameters that are typically controlled only by the | application developer, not an external attacker. This would mean that | only the PHP application owner could exploit it. | | Since various PHP functions already allow the application owner to | execute commands, no additional privileges would be gained by | exploiting such a bug. However, if safe_mode is enabled in PHP, then | the PHP functions related to execution are restricted | (e.g. shell_exec()). Thus, exploitation may allow the PHP application | owner to execute code *despite* the configured restrictions imposed by | safe mode, which then qualifies this as a vulnerability. | View |
| 9491 | CVE-2004-1063 | Candidate | PHP 4.x to 4.3.9, and PHP 5.x to 5.0.2, when running in safe mode on a multithreaded Unix webserver, allows local users to bypass safe_mode_exec_dir restrictions and execute commands outside of the intended safe_mode_exec_dir via shell metacharacters in the current directory name. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion. | Assigned (20041123) | REVIEWING(1) Christey | Christey> There is active disagreement regarding whether this satisfies the | criteria for inclusion in CVE, because the attack vectors require | function parameters that are typically controlled only by the | application developer, not an external attacker. This would mean that | only the PHP application owner could exploit it. | | Since various PHP functions already allow the application owner to | execute commands, no additional privileges would be gained by | exploiting such a bug. However, if safe_mode is enabled in PHP, then | the PHP functions related to execution are restricted | (e.g. shell_exec()). Thus, exploitation may allow the PHP application | owner to execute code *despite* the configured restrictions imposed by | safe mode, which then qualifies this as a vulnerability. | View |
Page 19045 of 20943, showing 5 records out of 104715 total, starting on record 95221, ending on 95225
