[Forgot Password]
Login  Register Subscribe

23631

 
 

115038

 
 

96174

 
 

909

 
 

78077

 
 

109

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML

CVE-2006-2480

Date: (C)2006-05-19   (M)2017-10-11
 
CVSS Score: 5.1Access Vector: NETWORK
Exploitability Subscore: 4.9Access Complexity: HIGH
Impact Subscore: 6.4Authentication: NONE
 Confidentiality: PARTIAL
 Integrity: PARTIAL
 Availability: PARTIAL











Format string vulnerability in Dia 0.94 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering errors or warnings, as demonstrated via format string specifiers in a .bmp filename. NOTE: the original exploit was demonstrated through a command line argument, but there are other mechanisms for input that are automatically processed by Dia, such as a crafted .dia file.

Reference:
SECTRACK-1016203
BID-18078
http://www.securityfocus.com/archive/82/433313/30/0/threaded
SECUNIA-20199
SECUNIA-20254
SECUNIA-20339
SECUNIA-20422
SECUNIA-20457
SECUNIA-20513
OSVDB-25699
ADV-2006-1908
GLSA-200606-03
MDKSA-2006:093
RHSA-2006:0541
SUSE-SR:2006:012
USN-286-1
http://bugzilla.gnome.org/show_bug.cgi?id=342111
http://kandangjamur.net/tutorial/dia.txt

CWE    1
CWE-134

© 2013 SecPod Technologies