All the vulnerabilites related to gnu - findutils
cve-2001-1036
Vulnerability from cvelistv5
Published
2003-04-02 05:00
Modified
2024-08-08 04:44
Severity ?
Summary
GNU locate in findutils 4.1 on Slackware 7.1 and 8.0 allows local users to gain privileges via an old formatted filename database (locatedb) that contains an entry with an out-of-range offset, which causes locate to write to arbitrary process memory.
References
https://exchange.xforce.ibmcloud.com/vulnerabilities/6932vdb-entry, x_refsource_XF
http://www.securityfocus.com/bid/3127vdb-entry, x_refsource_BID
http://www.securityfocus.com/archive/1/200991mailing-list, x_refsource_BUGTRAQ
http://www.osvdb.org/5477vdb-entry, x_refsource_OSVDB
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T04:44:06.643Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "locate-command-execution(6932)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/6932"
          },
          {
            "name": "3127",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/3127"
          },
          {
            "name": "20010801 Slackware 8.0, 7.1 Vulnerability: /usr/bin/locate",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/200991"
          },
          {
            "name": "5477",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/5477"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2001-08-01T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "GNU locate in findutils 4.1 on Slackware 7.1 and 8.0 allows local users to gain privileges via an old formatted filename database (locatedb) that contains an entry with an out-of-range offset, which causes locate to write to arbitrary process memory."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2002-02-06T10:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "locate-command-execution(6932)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/6932"
        },
        {
          "name": "3127",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/3127"
        },
        {
          "name": "20010801 Slackware 8.0, 7.1 Vulnerability: /usr/bin/locate",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/200991"
        },
        {
          "name": "5477",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/5477"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2001-1036",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "GNU locate in findutils 4.1 on Slackware 7.1 and 8.0 allows local users to gain privileges via an old formatted filename database (locatedb) that contains an entry with an out-of-range offset, which causes locate to write to arbitrary process memory."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "locate-command-execution(6932)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/6932"
            },
            {
              "name": "3127",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/3127"
            },
            {
              "name": "20010801 Slackware 8.0, 7.1 Vulnerability: /usr/bin/locate",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/200991"
            },
            {
              "name": "5477",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/5477"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2001-1036",
    "datePublished": "2003-04-02T05:00:00",
    "dateReserved": "2002-01-31T00:00:00",
    "dateUpdated": "2024-08-08T04:44:06.643Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2007-2452
Vulnerability from cvelistv5
Published
2007-06-04 16:00
Modified
2024-08-07 13:42
Severity ?
Summary
Heap-based buffer overflow in the visit_old_format function in locate/locate.c in locate in GNU findutils before 4.2.31 might allow context-dependent attackers to execute arbitrary code via a long pathname in a locate database that has the old format, a different vulnerability than CVE-2001-1036.
References
http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083vendor-advisory, x_refsource_HP
https://exchange.xforce.ibmcloud.com/vulnerabilities/34628vdb-entry, x_refsource_XF
http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083vendor-advisory, x_refsource_HP
http://www.vupen.com/english/advisories/2007/2015vdb-entry, x_refsource_VUPEN
http://secunia.com/advisories/40551third-party-advisory, x_refsource_SECUNIA
http://osvdb.org/36827vdb-entry, x_refsource_OSVDB
http://www.securityfocus.com/archive/1/470108/100/0/threadedmailing-list, x_refsource_BUGTRAQ
http://secunia.com/advisories/25477third-party-advisory, x_refsource_SECUNIA
http://securityreason.com/securityalert/2760third-party-advisory, x_refsource_SREASON
http://www.vupen.com/english/advisories/2010/1796vdb-entry, x_refsource_VUPEN
http://www.securitytracker.com/id?1018183vdb-entry, x_refsource_SECTRACK
http://www.securityfocus.com/bid/24250vdb-entry, x_refsource_BID
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T13:42:33.417Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "SSRT100018",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083"
          },
          {
            "name": "findutils-filename-bo(34628)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34628"
          },
          {
            "name": "HPSBMA02554",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083"
          },
          {
            "name": "ADV-2007-2015",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/2015"
          },
          {
            "name": "40551",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/40551"
          },
          {
            "name": "36827",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/36827"
          },
          {
            "name": "20070530 GNU Findutils release 4.2.31 fixes CVE-2007-2452 (GNU locate heap buffer overrun)",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/470108/100/0/threaded"
          },
          {
            "name": "25477",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/25477"
          },
          {
            "name": "2760",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/2760"
          },
          {
            "name": "ADV-2010-1796",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/1796"
          },
          {
            "name": "1018183",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1018183"
          },
          {
            "name": "24250",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/24250"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-05-30T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Heap-based buffer overflow in the visit_old_format function in locate/locate.c in locate in GNU findutils before 4.2.31 might allow context-dependent attackers to execute arbitrary code via a long pathname in a locate database that has the old format, a different vulnerability than CVE-2001-1036."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-16T14:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "SSRT100018",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083"
        },
        {
          "name": "findutils-filename-bo(34628)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34628"
        },
        {
          "name": "HPSBMA02554",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083"
        },
        {
          "name": "ADV-2007-2015",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/2015"
        },
        {
          "name": "40551",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/40551"
        },
        {
          "name": "36827",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/36827"
        },
        {
          "name": "20070530 GNU Findutils release 4.2.31 fixes CVE-2007-2452 (GNU locate heap buffer overrun)",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/470108/100/0/threaded"
        },
        {
          "name": "25477",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/25477"
        },
        {
          "name": "2760",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/2760"
        },
        {
          "name": "ADV-2010-1796",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/1796"
        },
        {
          "name": "1018183",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1018183"
        },
        {
          "name": "24250",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/24250"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2007-2452",
    "datePublished": "2007-06-04T16:00:00",
    "dateReserved": "2007-05-02T00:00:00",
    "dateUpdated": "2024-08-07T13:42:33.417Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Vulnerability from fkie_nvd
Published
2001-08-31 04:00
Modified
2024-11-20 23:36
Severity ?
Summary
GNU locate in findutils 4.1 on Slackware 7.1 and 8.0 allows local users to gain privileges via an old formatted filename database (locatedb) that contains an entry with an out-of-range offset, which causes locate to write to arbitrary process memory.
References
cve@mitre.orghttp://www.osvdb.org/5477
cve@mitre.orghttp://www.securityfocus.com/archive/1/200991
cve@mitre.orghttp://www.securityfocus.com/bid/3127Exploit, Vendor Advisory
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/6932
af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/5477
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/200991
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/3127Exploit, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/6932
Impacted products
Vendor Product Version
gnu findutils 4.0
gnu findutils 4.1
slackware slackware_linux 7.1
slackware slackware_linux 8.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gnu:findutils:4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "7CA98BAA-CDE7-4255-B4A9-926CA2BF9783",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:findutils:4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "82F0B7F9-8A8E-4717-9C78-A26141AC66BC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:slackware:slackware_linux:7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0297F56-5F41-48FD-AB47-36E3BD2AB7E7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:slackware:slackware_linux:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "78D76664-F4AC-470A-9686-3F708922A340",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "GNU locate in findutils 4.1 on Slackware 7.1 and 8.0 allows local users to gain privileges via an old formatted filename database (locatedb) that contains an entry with an out-of-range offset, which causes locate to write to arbitrary process memory."
    }
  ],
  "id": "CVE-2001-1036",
  "lastModified": "2024-11-20T23:36:43.167",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.2,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 10.0,
        "obtainAllPrivilege": true,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2001-08-31T04:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://www.osvdb.org/5477"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/200991"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "http://www.securityfocus.com/bid/3127"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/6932"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/5477"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/200991"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "http://www.securityfocus.com/bid/3127"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/6932"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2007-06-04 16:30
Modified
2024-11-21 00:30
Severity ?
Summary
Heap-based buffer overflow in the visit_old_format function in locate/locate.c in locate in GNU findutils before 4.2.31 might allow context-dependent attackers to execute arbitrary code via a long pathname in a locate database that has the old format, a different vulnerability than CVE-2001-1036.
References
secalert@redhat.comhttp://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083
secalert@redhat.comhttp://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083
secalert@redhat.comhttp://osvdb.org/36827
secalert@redhat.comhttp://secunia.com/advisories/25477Patch, Vendor Advisory
secalert@redhat.comhttp://secunia.com/advisories/40551
secalert@redhat.comhttp://securityreason.com/securityalert/2760
secalert@redhat.comhttp://www.securityfocus.com/archive/1/470108/100/0/threaded
secalert@redhat.comhttp://www.securityfocus.com/bid/24250Patch
secalert@redhat.comhttp://www.securitytracker.com/id?1018183
secalert@redhat.comhttp://www.vupen.com/english/advisories/2007/2015
secalert@redhat.comhttp://www.vupen.com/english/advisories/2010/1796
secalert@redhat.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/34628
af854a3a-2127-422b-91ae-364da2661108http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083
af854a3a-2127-422b-91ae-364da2661108http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/36827
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/25477Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/40551
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/2760
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/470108/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/24250Patch
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1018183
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2007/2015
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2010/1796
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/34628
Impacted products
Vendor Product Version
gnu findutils 4.0
gnu findutils 4.1
gnu findutils 4.2.28
gnu findutils 4.2.29
gnu findutils 4.2.30


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gnu:findutils:4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "7CA98BAA-CDE7-4255-B4A9-926CA2BF9783",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:findutils:4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "82F0B7F9-8A8E-4717-9C78-A26141AC66BC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:findutils:4.2.28:*:*:*:*:*:*:*",
              "matchCriteriaId": "F259F661-06F3-48A9-96B5-C50A3D96E441",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:findutils:4.2.29:*:*:*:*:*:*:*",
              "matchCriteriaId": "B462C06B-B665-4B56-9A93-3F96C328C72A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:findutils:4.2.30:*:*:*:*:*:*:*",
              "matchCriteriaId": "CC81E4F7-6889-490C-9F11-79A5D693F695",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Heap-based buffer overflow in the visit_old_format function in locate/locate.c in locate in GNU findutils before 4.2.31 might allow context-dependent attackers to execute arbitrary code via a long pathname in a locate database that has the old format, a different vulnerability than CVE-2001-1036."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de b\u00fafer basado en pila en la funci\u00f3n visit_old_format en locate/locate.c en GNU findutils anterior a 4.2.31 podr\u00eda permitir a atacantes dependientes del contexto ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de un nombre de ruta largo en un base de datos localizada que tenga un formato viejo, una vulnerabilidad diferente que CVE-2001-1036."
    }
  ],
  "id": "CVE-2007-2452",
  "lastModified": "2024-11-21T00:30:49.510",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2007-06-04T16:30:00.000",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://osvdb.org/36827"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/25477"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/40551"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://securityreason.com/securityalert/2760"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/archive/1/470108/100/0/threaded"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/24250"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securitytracker.com/id?1018183"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.vupen.com/english/advisories/2007/2015"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.vupen.com/english/advisories/2010/1796"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34628"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/36827"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/25477"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/40551"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/2760"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/470108/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/24250"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1018183"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2007/2015"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2010/1796"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34628"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vendorComments": [
    {
      "comment": "Not vulnerable.  Red Hat did not ship GNU locate in Red Hat Enterprise Linux 2.1, 3, 4, or 5.  This issue does not affect the \u2019mlocate\u2019 or \u2019slocate\u2019 packages that are supplied with Red Hat Enterprise Linux.",
      "lastModified": "2007-06-11T00:00:00",
      "organization": "Red Hat"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}