CVE-2004-0159

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Format string vulnerability in hsftp 1.11 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via file names containing format string characters that are not properly handled when executing an "ls" command.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

No affected versions have been published.

Timeline

Published
Mar 15, 2004
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2004

CVE-2004-01607.2Synaesthesia 2.2 and earlier allows local users to execute arbitrary code via a symlink attack on the configuration file.CVE-2004-01617.5Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use RFCVE-2004-01627.5Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME encapsulation that uCVE-2004-01635.0Sygate Secure Enterprise (SSE) 3.5MR3 and earlier does not change the key used to encrypt data, which allows remote attackers to cause a denCVE-2004-01645.0KAME IKE daemon (racoon) does not properly handle hash values, which allows remote attackers to delete certificates via (1) a certain deleteCVE-2004-01655.0Format string vulnerability in Point-to-Point Protocol (PPP) daemon (pppd) 2.4.0 for Mac OS X 10.3.2 and earlier allows remote attackers to CVE-2004-01665.0Unknown vulnerability in Safari web browser for Mac OS X 10.2.8 related to "the display of URLs in the status bar."CVE-2004-01677.5DiskArbitration in Mac OS X 10.2.8 and 10.3.2 does not properly initialize writeable removable media.CVE-2004-016810.0Unknown vulnerability in CoreFoundation for Mac OS X 10.3.2, related to "notification logging."CVE-2004-01695.0QuickTime Streaming Server in MacOS X 10.2.8 and 10.3.2 allows remote attackers to cause a denial of service (crash) via DESCRIBE requests wCVE-2004-01715.0FreeBSD 5.1 and earlier, and Mac OS X before 10.3.4, allows remote attackers to cause a denial of service (resource exhaustion of memory bufCVE-2004-01727.2Heap-based buffer overflow in the search_for_command function of ltrace 0.3.10, if it is installed setuid, could allow local users to execut