CveMateVulnerability intelligence

Mandrakesoft vulnerabilities, page 3

139 vulnerabilities

Known vulnerabilities in Mandrakesoft products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 6 products.

CVE-2001-0120immuniximmunix+225y ago07-05-2001 04:00

useradd program in shadow-utils program may allow local users to overwrite arbitrary files via a symlink attack.CVE-2001-0108mandrakesoftmandrake_linux+125y ago18-09-2001 04:00

PHP Apache module 4.0.4 and earlier allows remote attackers to bypass .htaccess access restrictions via a malformed HTTP request on an unrestricted page that causes PHP to use those access controls on the next page that is requested.CVE-2005-2377mandrakesoftmandrake_linux21y ago26-07-2005 04:00

nss_ldap 181 to versions before 213, as used in Mandrake Corporate Server and Mandrake 10.0, and other operating systems, does not properly handle a SIGPIPE signal when sending a search request to an LDAP directory server, which might allow remote attackers to cause a denial of service (crond and other application crash) if they can cause an LDAP server to become unavailable. NOTE: it is not clear whether this attack scenario is sufficient to include this item in CVE.CVE-2005-1379mandrakesoftmandrake_lam-runtime21y ago02-05-2005 04:00

The LAM runtime environment package (lam-runtime-7.0.6-2mdk) on Mandrake Linux installs the mpi user without a password, which allows local users to gain privileges.CVE-2005-1267debiantcpdump+821y ago20-06-2005 04:00

The bgp_update_print function in tcpdump 3.x does not properly handle a -1 return value from the decode_prefix4 function, which allows remote attackers to cause a denial of service (infinite loop) via a crafted BGP packet.CVE-2005-0503debianuim+221y ago21-02-2005 05:00

uim before 0.4.5.1 trusts certain environment variables when libUIM is used in setuid or setgid applications, which allows local users to gain privileges.CVE-2005-0003avayaconverged_communications_server+1121y ago20-01-2005 05:00

The 64 bit ELF support in Linux kernel 2.6 before 2.6.10, on 64-bit architectures, does not properly check for overlapping VMA (virtual memory address) allocations, which allows local users to cause a denial of service (system crash) or execute arbitrary code via a crafted ELF or a.out file.CVE-2005-0020debianplaymidi+321y ago22-01-2005 05:00

Buffer overflow in playmidi before 2.4 allows local users to execute arbitrary code.CVE-2005-0473mandrakesoftmandrake_linux+421y ago19-02-2005 05:00

The HTML parsing functions in Gaim before 1.1.3 allow remote attackers to cause a denial of service (application crash) via malformed HTML that causes "an invalid memory access," a different vulnerability than CVE-2005-0208.CVE-2005-0605altlinuxalt_linux+7921y ago04-03-2005 05:00

scan.c for LibXPM may allow attackers to execute arbitrary code via a negative bitmap_unit value that leads to a buffer overflow.CVE-2005-0472debiangaim+521y ago19-02-2005 05:00

Gaim before 1.1.3 allows remote attackers to cause a denial of service (infinite loop) via malformed SNAC packets from (1) AIM or (2) ICQ.CVE-2005-0206asciiptex+2721y ago15-02-2005 05:00

The patch for integer overflow vulnerabilities in Xpdf 2.0 and 3.0 (CVE-2004-0888) is incomplete for 64-bit architectures on certain Linux distributions such as Red Hat, which could leave Xpdf users exposed to the original vulnerabilities.CVE-2005-0085debianhtdig+821y ago15-02-2005 05:00

Cross-site scripting (XSS) vulnerability in ht://dig (htdig) before 3.1.6-r7 allows remote attackers to execute arbitrary web script or HTML via the config parameter, which is not properly sanitized before it is displayed in an error message.CVE-2005-3624conectivalinux+3120y ago06-01-2006 22:00

The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to corrupt the heap via negative or large integers in a CCITTFaxDecode stream, which lead to integer overflows and integer underflows.CVE-2005-3625conectivalinux+3120y ago06-01-2006 22:00

Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (infinite loop) via streams that end prematurely, as demonstrated using the (1) CCITTFaxDecode and (2) DCTDecode streams, aka "Infinite CPU spins."CVE-2005-3626conectivalinux+3120y ago06-01-2006 22:00

Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (crash) via a crafted FlateDecode stream that triggers a null dereference.CVE-2008-0595debiandbus+818y ago29-02-2008 19:00

dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.CVE-2000-1059mandrakesoftmandrake_linux25y ago22-01-2001 05:00

The default configuration of the Xsession file in Mandrake Linux 7.1 and 7.0 bypasses the Xauthority access control mechanism with an "xhost + localhost" command, which allows local users to sniff X Windows events and gain privileges.CVE-2000-1042mandrakesoftmandrake_linux25y ago22-01-2001 05:00

Buffer overflow in ypserv in Mandrake Linux 7.1 and earlier, and possibly other Linux operating systems, allows an attacker to gain root privileges when ypserv is built without a vsyslog() function.CVE-2000-1043mandrakesoftmandrake_linux25y ago22-01-2001 05:00

Format string vulnerability in ypserv in Mandrake Linux 7.1 and earlier, and possibly other Linux operating systems, allows an attacker to gain root privileges when ypserv is built without a vsyslog() function.