CVE-2004-0784

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

The smiley theme functionality in Gaim before 0.82 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of the tar file that is dragged to the smiley selector.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://gaim.sourceforge.net/security/?id=1Patch, Vendor Advisory
http://www.fedoranews.org/updates/FEDORA-2004-278.shtmlPatch, Vendor Advisory
http://www.fedoranews.org/updates/FEDORA-2004-279.shtmlPatch, Vendor Advisory
http://www.gentoo.org/security/en/glsa/glsa-200408-27.xmlVendor Advisory
http://www.redhat.com/support/errata/RHSA-2004-400.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/17144
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10008
http://gaim.sourceforge.net/security/?id=1Patch, Vendor Advisory
http://www.fedoranews.org/updates/FEDORA-2004-278.shtmlPatch, Vendor Advisory
http://www.fedoranews.org/updates/FEDORA-2004-279.shtmlPatch, Vendor Advisory
http://www.gentoo.org/security/en/glsa/glsa-200408-27.xmlVendor Advisory
http://www.redhat.com/support/errata/RHSA-2004-400.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/17144
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10008

Timeline

Published: Oct 20, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-07857.5Multiple buffer overflows in Gaim before 0.82 allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1 CVE-2004-07865.0The IPv6 URI parsing routines in the apr-util library for Apache 2.0.50 and earlier allow remote attackers to cause a denial of service (chi CVE-2004-07874.3Cross-site scripting (XSS) vulnerability in the web frontend in OpenCA 0.9.1-8 and earlier, and 0.9.2 RC6 and earlier, allows remote attacke CVE-2004-07885.0Integer overflow in the ICO image decoder for (1) gdk-pixbuf before 0.22 and (2) gtk2 before 2.2.4 allows remote attackers to cause a denial CVE-2004-07895.0Multiple implementations of the DNS protocol, including (1) Poslib 1.0.2-1 and earlier as used by Posadis, (2) Axis Network products before CVE-2004-07905.0Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error CVE-2004-07915.0Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (network throughput reduction for TCP connectio CVE-2004-07926.4Directory traversal vulnerability in the sanitize_path function in util.c for rsync 2.6.2 and earlier, when chroot is disabled, allows attac CVE-2004-07937.2The calendar program in bsdmainutils 6.0 through 6.0.14 does not drop root privileges when executed with the -a flag, which allows attackers CVE-2004-07945.1Multiple signal handler race conditions in lukemftpd (aka tnftpd before 20040810) allow remote authenticated attackers to cause a denial of CVE-2004-07957.2DB2 8.1 remote command server (DB2RCMD.EXE) executes the db2rcmdc.exe program as the db2admin administrator, which allows local users to gai CVE-2004-07965.0SpamAssassin 2.5x, and 2.6x before 2.64, allows remote attackers to cause a denial of service via certain malformed messages.