2005

A regression error in the Red Hat Enterprise Linux 4 kernel 4GB/4GB split patch omits an "access check," which allows lo

helvis 1.8h2_1 and earlier stores recovery files in world readable directories with world readable permissions, which al

helvis 1.8h2_1 and earlier allows local users to recover and read the files of other users via the elvrec setuid program

helvis 1.8h2_1 and earlier allows local users to delete arbitrary files via the elvprsv setuid program.

The unw_unwind_to_user function in unwind.c on Itanium (ia64) architectures in Linux kernel 2.6 allows local users to ca

Linux kernel 2.6 on Itanium (ia64) architectures allows local users to cause a denial of service via a "missing Itanium

Firefox 0.9, Thunderbird 0.6 and other versions before 0.9, and Mozilla 1.7 before 1.7.5 save temporary files with world

Directory traversal vulnerability in ftpfile in the Vacation plugin 0.15 and earlier for Squirrelmail allows local users

Linux kernel before 2.6.9, when running on the AMD64 and Intel EM64T architectures, allows local users to write to privi

Unknown vulnerability in Linux kernel 2.4.x, 2.5.x, and 2.6.x allows NFS clients to cause a denial of service via O_DIRE

firehol.sh in FireHOL before 1.224 creates temporary files with predictable file names, which could allow local users to

MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 allows remote authenticated users to gain sensitive information via

Buffer overflow in Painkiller 1.35 and earlier, and possibly other versions before 1.61, allows remote authenticated use

The Finder in Mac OS X and earlier allows local users to overwrite arbitrary files and gain privileges by creating a har

SafeNet SoftRemote VPN Client stores the VPN password (pre-shared key) in cleartext in memory of the IreIKE.exe process,

The dcopidlng script in KDE 3.2.x and 3.3.x creates temporary files with predictable filenames, which allows local users

remstats 1.0.13 and earlier, when processing uptime data, allows local users to create or overwrite arbitrary files via

Desktop Communication Protocol (DCOP) daemon, aka dcopserver, in KDE before 3.4 allows local users to cause a denial of

The ext2_make_empty function call in the Linux kernel before 2.6.11.6 does not properly initialize memory when creating

gr_osview in SGI IRIX 6.5.22, and possibly other 6.5 versions, does not drop privileges when opening description files w

gr_osview in SGI IRIX does not drop privileges before opening files, which allows local users to overwrite arbitrary fil

Linux kernel 2.6.10 and 2.6.11rc1-bk6 uses different size types for offset arguments to the proc_file_read and locks_rea

Signedness error in the copy_from_read_buf function in n_tty.c for Linux kernel 2.6.10 and 2.6.11rc1 allows local users

The atm_get_addr function in addr.c for Linux kernel 2.6.10 and 2.6.11 before 2.6.11-rc4 may allow local users to trigge

The reiserfs_copy_from_user_to_file_region function in reiserfs/file.c for Linux kernel 2.6.10 and 2.6.11 before 2.6.11-

Buffer overflow in Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to cause a

Firefox before 1.0.1 and Mozilla Suite before 1.7.6 use a predictable filename for the plugin temporary directory, which

PHP 4 (PHP4) allows attackers to cause a denial of service (daemon crash) by using the readfile function on a file whose

Unknown vulnerability in HP OpenVMS VAX 7.x and 6.x and OpenVMS Alpha 7.x or 6.x allows local users to access privileged

MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, uses predictable file names when creating temporary tables, which allo

Wine 20050211 and earlier creates temp files with world readable permissions and predictable file names, which allows lo

Citrix Metaframe Password Manager 2.5 and earlier stores a password in cleartext although it is obfuscated when presente

Microsoft Windows XP SP1 allows local users to cause a denial of service (system crash) via an empty datagram to a raw I

cdrecord before 4:2.0, when DEBUG is enabled, allows local users to overwrite arbitrary files via a symlink attack on te

AS/400 running OS400 5.2 installs and enables LDAP by default, which allows remote authenticated users to obtain OS/400

Remote Desktop in Windows XP SP1 does not verify the "Force shutdown from a remote system" setting, which allows remote

AIO in the Linux kernel 2.6.11 on the PPC64 or IA64 architectures with CONFIG_HUGETLB_PAGE enabled allows local users to

The SmartScan feature in the Auto-Protect module for Symantec Norton AntiVirus 2004 and 2005, as also used in Internet S

An error in the Toshiba ACPI BIOS 1.6 causes the BIOS to only examine the first slot in the Master Boot Record (MBR) tab

Integer signedness error in the parse_machfile function in the mach-o loader (mach_loader.c) for the Darwin Kernel as us

The shmem_nopage function in shmem.c for the tmpfs driver in Linux kernel 2.6 does not properly verify the address argum

unshar (unshar.c) in sharutils 4.2.1 allows local users to overwrite arbitrary files via a symlink attack on the unsh.X

RC.BOOT in IBM AIX 5.1, 5.2, and 5.3 does not "use a secure location for temporary files," which allows local users to h

crontab in Vixie cron 4.1, when running with the -e option, allows local users to read the cron files of other users by

The fib_seq_start function in fib_hash.c in Linux kernel allows local users to cause a denial of service (system crash)

Linksys WET11 1.5.4 allows remote attackers to change the password without providing the original password via the data

tetex in Novell Linux Desktop 9 allows local users to determine the existence of arbitrary files via a symlink attack in

GetDataBack for NTFS 2.31 stores the username and license key in plaintext in the Name value in the License registry key

Sudo VISudo 1.6.8 and earlier allows local users to corrupt arbitrary files via a symlink attack on temporary files.

eGroupWare 1.0.6 and earlier, when an e-mail is composed with an attachment but not sent, will send that attachment in t