CVE-2004-2133

MediumCVSS 4.6/10Last modified Jun 16, 2026

Description

Certain third-party packages for CVSup 16.1h, such as SuSE Linux, contain untrusted paths in the ELF RPATH fields of certain executables, which could allow local users to execute arbitrary code by causing cvsup to link against malicious libraries that are created in world-writable directories such as /usr/src/packages.

Metrics

CVSS 2.0 4.6/10AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0025.htmlExploit, Vendor Advisory
http://marc.info/?l=bugtraq&m=107539776002450&w=2
http://www.securityfocus.com/bid/9523Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/14994
http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0025.htmlExploit, Vendor Advisory
http://marc.info/?l=bugtraq&m=107539776002450&w=2
http://www.securityfocus.com/bid/9523Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/14994

Timeline

Published: Jan 29, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-21344.6Oracle toplink mapping workBench uses a weak encryption algorithm for passwords, which allows local users to decrypt the passwords.CVE-2004-21352.1cryptoloop on Linux kernel 2.6.x, when used on certain file systems with a block size 1024 or greater, has certain "IV computation" weakness CVE-2004-21362.1dm-crypt on Linux kernel 2.6.x, when used on certain file systems with a block size 1024 or greater, has certain "IV computation" weaknesses CVE-2004-21375.0Outlook Express 6.0, when sending multipart e-mail messages using the "Break apart messages larger than" setting, leaks the BCC recipients o CVE-2004-21386.8Cross-site scripting (XSS) vulnerability in AWSguest.php in AllWebScripts MySQLGuest allows remote attackers to inject arbitrary HTML and PH CVE-2004-21397.5Unknown vulnerability in Adminedit.pl YaBB 1 Gold before 1.3.2 allows attackers to execute arbitrary code via settings.pl.CVE-2004-21405.0CRLF injection vulnerability in YaBB 1 Gold before 1.3.2 allows remote attackers to modify text file contents via the subject variable.CVE-2004-214210.0Unknown vulnerability in the remote tape support (remote.c) in the RMT client for Jorg Schilling sdd 1.28 and 1.31 has unknown impact and at CVE-2004-21437.5SQL injection vulnerability in the ReMOSitory Server add-on module to Mambo Portal 4.5.1 (1.09) and earlier allows remote attackers to execu CVE-2004-21447.5Baal Smart Forms before 3.2 allows remote attackers to bypass authentication and obtain system access via a direct request to regadmin.php.CVE-2004-21457.5SQL injection vulnerability in PD9 Software MegaBBS 2 and 2.1 allows remote attackers to execute arbitrary SQL commands via the (1) sortdir CVE-2004-21465.0CRLF injection vulnerability in PD9 Software MegaBBS 2 and 2.1 allows attackers to conduct HTTP response splitting attacks via the fid param