National Vulnerability Database

National Vulnerability Database

National Vulnerability

Search Results (Refine Search)

Search Parameters:
  • Contains Software Flaws (CVE)
  • CPE Product Version: cpe:/o:linux:linux_kernel:2.0.4
There are 2,492 matching records.
Displaying matches 2381 through 2400.
Vuln ID Summary CVSS Severity

The CIFS filesystem in the Linux kernel before 2.6.22, when Unix extension support is enabled, does not honor the umask of a process, which allows local users to gain privileges.

Published: September 13, 2007; 09:17:00 PM -04:00
    V2: 4.4 MEDIUM

Linux kernel 2.4.35 and other versions allows local users to send arbitrary signals to a child process that is running at higher privileges by causing a setuid-root parent process to die, which delivers an attacker-controlled parent process death signal (PR_SET_PDEATHSIG).

Published: August 14, 2007; 01:17:00 PM -04:00
    V2: 1.9 LOW

The xfer_secondary_pool function in drivers/char/random.c in the Linux kernel 2.4 before 2.4.35 performs reseed operations on only the first few bytes of a buffer, which might make it easier for attackers to predict the output of the random number generator, related to incorrect use of the sizeof operator.

Published: August 13, 2007; 05:17:00 PM -04:00
    V2: 6.8 MEDIUM

The drm/i915 component in the Linux kernel before, when used with i965G and later chipsets, allows local users with access to an X11 session and Direct Rendering Manager (DRM) to write to arbitrary memory locations and gain privileges via a crafted batchbuffer.

Published: August 13, 2007; 03:17:00 PM -04:00
    V2: 6.0 MEDIUM

The Linux kernel before 2.6.23-rc1 checks the wrong global variable for the CIFS sec mount option, which might allow remote attackers to spoof CIFS network traffic that the client configured for security signatures, as demonstrated by lack of signing despite sec=ntlmv2i in a SetupAndX request.

Published: August 09, 2007; 05:17:00 PM -04:00
    V2: 4.3 MEDIUM

Stack-based buffer overflow in the random number generator (RNG) implementation in the Linux kernel before 2.6.22 might allow local root users to cause a denial of service or gain privileges by setting the default wakeup threshold to a value greater than the output pool size, which triggers writing random numbers to the stack by the pool transfer function involving "bound check ordering". NOTE: this issue might only cross privilege boundaries in environments that have granular assignment of privileges for root.

Published: July 27, 2007; 05:30:00 PM -04:00
    V2: 4.6 MEDIUM

Rule Set Based Access Control (RSBAC) before 1.3.5 does not properly use the Linux Kernel Crypto API for the Linux kernel 2.6.x, which allows context-dependent attackers to bypass authentication controls via unspecified vectors, possibly involving User Management password hashing and unchecked function return codes.

Published: July 23, 2007; 07:30:00 PM -04:00
    V2: 6.4 MEDIUM

Buffer overflow in Hitachi Cosminexus V4 through V7, Processing Kit for XML before 20070511, Developer's Kit for Java before 20070312, and third-party products that use this software, allows attackers to have an unknown impact via certain GIF images, related to use of GIF image processing APIs by a Java application.

Published: July 15, 2007; 07:30:00 PM -04:00
    V2: 10.0 HIGH

The signal handling in the Linux kernel before 2.6.22, including 2.6.2, when running on PowerPC systems using HTX, allows local users to cause a denial of service via unspecified vectors involving floating point corruption and concurrency, related to clearing of MSR bits.

Published: July 10, 2007; 06:30:00 PM -04:00
    V2: 2.1 LOW

The decode_choice function in net/netfilter/nf_conntrack_h323_asn1.c in the Linux kernel before, 2.6.21.x before, and before 2.6.22 allows remote attackers to cause a denial of service (crash) via an encoded, out-of-range index value for a choice field, which triggers a NULL pointer dereference.

Published: July 09, 2007; 09:30:00 PM -04:00
    V2: 7.8 HIGH

The lcd_write function in drivers/usb/misc/usblcd.c in the Linux kernel before 2.6.22-rc7 does not limit the amount of memory used by a caller, which allows local users to cause a denial of service (memory consumption).

Published: July 03, 2007; 06:30:00 AM -04:00
    V2: 4.9 MEDIUM

Integer underflow in the cpuset_tasks_read function in the Linux kernel before, and 2.6.21.x before, when the cpuset filesystem is mounted, allows local users to obtain kernel memory contents by using a large offset when reading the /dev/cpuset/tasks file.

Published: June 11, 2007; 06:30:00 PM -04:00
    V2: 2.1 LOW

PHP remote file inclusion vulnerability in index.php in Achievo 1.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the config_atkroot parameter.

Published: May 17, 2007; 03:30:00 PM -04:00
    V2: 10.0 HIGH

formmail.php in Jetbox CMS 2.1 allows remote attackers to send arbitrary e-mails (spam) via modified recipient, _SETTINGS[allowed_email_hosts][], and subject parameters.

Published: May 16, 2007; 06:30:00 PM -04:00
    V2: 5.8 MEDIUM

The png_handle_tRNS function in pngrutil.c in libpng before 1.0.25 and 1.2.x before 1.2.17 allows remote attackers to cause a denial of service (application crash) via a grayscale PNG image with a bad tRNS chunk CRC value.

Published: May 16, 2007; 06:30:00 PM -04:00
    V2: 5.0 MEDIUM

The compat_sys_mount function in fs/compat.c in Linux kernel 2.6.20 and earlier allows local users to cause a denial of service (NULL pointer dereference and oops) by mounting a smbfs file system in compatibility mode ("mount -t smbfs").

Published: May 14, 2007; 01:19:00 PM -04:00
    V2: 4.0 MEDIUM

Memory leak in the PPP over Ethernet (PPPoE) socket implementation in the Linux kernel before 2.6.21-git8 allows local users to cause a denial of service (memory consumption) by creating a socket using connect, and releasing it before the PPPIOCGCHAN ioctl is initialized.

Published: May 08, 2007; 07:19:00 PM -04:00
    V2: 4.9 MEDIUM

The nl_fib_lookup function in net/ipv4/fib_frontend.c in Linux Kernel before allows attackers to cause a denial of service (kernel panic) via NETLINK_FIB_LOOKUP replies, which trigger infinite recursion and a stack overflow.

Published: May 07, 2007; 03:19:00 PM -04:00
    V2: 4.9 MEDIUM

The _udp_lib_get_port function in net/ipv4/udp.c in Linux kernel 2.6.21 and earlier does not prevent a bind to a port with a local address when there is already a bind to that port with a wildcard local address, which might allow local users to intercept local traffic for daemons or other applications.

Published: May 03, 2007; 01:19:00 PM -04:00
    V2: 4.6 MEDIUM

Multiple cross-site scripting (XSS) vulnerabilities in freePBX 2.2.x allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, (3) Call-ID, (4) User-Agent, and unspecified other SIP protocol fields, which are stored in /var/log/asterisk/full and displayed by admin/modules/logfiles/asterisk-full-log.php.

Published: April 24, 2007; 01:19:00 PM -04:00
    V2: 6.8 MEDIUM