7.5
CVSSv2

CVE-2006-1168

Published: 14/08/2006 Updated: 07/11/2023
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
VMScore: 668
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

The decompress function in compress42.c in (1) ncompress 4.2.4 and (2) liblzw allows remote malicious users to cause a denial of service (crash), and possibly execute arbitrary code, via crafted data that leads to a buffer underflow.

Vulnerable Product Search on Vulmon Subscribe to Product

ncompress ncompress 4.2.4

Vendor Advisories

Synopsis Low: busybox security and bug fix update Type/Severity Security Advisory: Low Topic Updated busybox packages that fix two security issues and several bugs arenow available for Red Hat Enterprise Linux 6The Red Hat Security Response Team has rated this update as having lowsecurity impact Common Vu ...
Synopsis Low: busybox security and bug fix update Type/Severity Security Advisory: Low Topic Updated busybox packages that fix two security issues and two bugs are nowavailable for Red Hat Enterprise Linux 5The Red Hat Security Response Team has rated this update as having lowsecurity impact Common Vulner ...
Tavis Ormandy from the Google Security Team discovered a missing boundary check in ncompress, the original Lempel-Ziv compress and uncompress programs, which allows a specially crafted datastream to underflow a buffer with attacker controlled data For the stable distribution (sarge) this problem has been fixed in version 424-15sarge2 For the un ...
A buffer underflow flaw was found in the way the uncompress utility of BusyBox expanded certain archive files compressed using Lempel-Ziv compression If a user were tricked into expanding a specially-crafted archive file with uncompress, it could cause BusyBox to crash or, potentially, execute arbitrary code with the privileges of the user running ...