[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244411

 
 

909

 
 

193363

 
 

277

Paid content will be excluded from the download.


Download | Alert*
CVE
view JSON

CVE-2006-2480Date: (C)2006-05-19   (M)2023-12-22


Format string vulnerability in Dia 0.94 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering errors or warnings, as demonstrated via format string specifiers in a .bmp filename. NOTE: the original exploit was demonstrated through a command line argument, but there are other mechanisms for input that are automatically processed by Dia, such as a crafted .dia file.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 5.1
Exploit Score: 4.9
Impact Score: 6.4
 
CVSS V2 Metrics:
Access Vector: NETWORK
Access Complexity: HIGH
Authentication: NONE
Confidentiality: PARTIAL
Integrity: PARTIAL
Availability: PARTIAL
  
Reference:
SECTRACK-1016203
BID-18078
http://www.securityfocus.com/archive/82/433313/30/0/threaded
SECUNIA-20199
SECUNIA-20254
SECUNIA-20339
SECUNIA-20422
SECUNIA-20457
SECUNIA-20513
OSVDB-25699
ADV-2006-1908
GLSA-200606-03
MDKSA-2006:093
RHSA-2006:0541
SUSE-SR:2006:012
USN-286-1
http://bugzilla.gnome.org/show_bug.cgi?id=342111
http://kandangjamur.net/tutorial/dia.txt
oval:org.mitre.oval:def:11224

CWE    1
CWE-134

© SecPod Technologies