CVE-2004-1917 Format string vulnerability in test_func_func in LCDProc 0.4.1 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the str variable.
HighCVSS 7.5
EPSS 4.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Format string vulnerability in test_func_func in LCDProc 0.4.1 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the str variable.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lcdproc | = 0.3 | No fix listed |
| lcdproc | = 0.4 | No fix listed |
| lcdproc | = 0.4.1_r1 | No fix listed |
| lcdproc | = 4.0 | No fix listed |
| lcdproc | = 4.1 | No fix listed |
| lcdproc | = 4.2 | No fix listed |
| lcdproc | = 4.3 | No fix listed |
| lcdproc | = 4.4 | No fix listed |
| debian/lcdproc(Debian:12) | < 0.4.5 | 0.4.5 |
| debian/lcdproc(Debian:13) | < 0.4.5 | 0.4.5 |
| debian/lcdproc(Debian:14) | < 0.4.5 | 0.4.5 |
References
- lists.omnipotent.net exploit vendor-advisory
- 20040408 PSR - #2004-002 Remote - LCDProc mailing-list
- 11333 exploit patch third-party-advisory vendor-advisory
- GLSA-200404-19 patch vendor-advisory
- 10085 exploit patch vdb-entry vendor-advisory
- lcdproc-testfuncfunc-format-string(15817) vdb-entry
- Debian Security Tracker CVE-2004-1917 vendor-advisory