CVE-2005-1394

HighCVSS 7.2/10Last modified Jun 16, 2026

Description

Format string vulnerability in ArcGIS for ESRI ArcInfo Workstation 9.0 allows local users to gain privileges via format string specifiers in the ARCHOME environment variable to (1) wservice or (2) lockmgr.

Metrics

CVSS 2.0 7.2/10AV:L/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-134

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=full-disclosure&m=111489411524630&w=2Mailing List, Third Party Advisory
http://secunia.com/advisories/15196Broken Link
http://securitytracker.com/id?1013852Broken Link, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
http://support.esri.com/index.cfm?fa=downloads.patchesServicePacks.viewPatch&PID=14&MetaID=1015Vendor Advisory
http://www.digitalmunition.com/DMA%5B2005-0425a%5D.txtPatch, Third Party Advisory
http://marc.info/?l=full-disclosure&m=111489411524630&w=2Mailing List, Third Party Advisory
http://secunia.com/advisories/15196Broken Link
http://securitytracker.com/id?1013852Broken Link, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
http://support.esri.com/index.cfm?fa=downloads.patchesServicePacks.viewPatch&PID=14&MetaID=1015Vendor Advisory
http://www.digitalmunition.com/DMA%5B2005-0425a%5D.txtPatch, Third Party Advisory

Timeline

Published: May 3, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-13957.2Buffer overflow in Ce/Ceterm (aka ARPUS/Ce) 2.5.4 and earlier may allow local users to gain privileges via a long (1) XAPPLRESLANGPATH or (2 CVE-2005-13961.2Race condition in Ce/Ceterm (aka ARPUS/Ce) 2.5.4 and earlier allows local users to write to arbitrary files via a symlink attack on the ce_e CVE-2005-13977.5SQL injection vulnerability in search.php for PHP-Calendar before 0.10.3 allows remote attackers to execute arbitrary SQL commands via unkno CVE-2005-13985.0phpcart.php in PHPCart 3.2 allows remote attackers to change product price information by modifying the (1) price or (2) postage parameters.CVE-2005-13994.6FreeBSD 4.6 to 4.11 and 5.x to 5.4 uses insecure default permissions for the /dev/iir device, which allows local users to execute restricted CVE-2005-14004.6The i386_get_ldt system call in FreeBSD 4.7 to 4.11 and 5.x to 5.4 allows local users to access sensitive kernel memory via arguments with n CVE-2005-14017.5Format string vulnerability in the client for Mtp-Target 1.2.2 and earlier allows remote attackers to execute arbitrary code via game messag CVE-2005-14025.0Integer signedness error in certain older versions of the NeL library, as used in Mtp-Target 1.2.2 and earlier, and possibly other products,CVE-2005-14036.8Multiple cross-site scripting (XSS) vulnerabilities in JustWilliam's Amazon Webstore 04050100 allow remote attackers to inject arbitrary web CVE-2005-14045.0MyPHP Forum 1.0 allows remote attackers to spoof the username by modifying the (1) nbuser parameter to post.php or (2) sender parameter to p CVE-2005-14052.1HTTP response splitting vulnerability in the @SetHTTPHeader function in Lotus Domino 6.5.x before 6.5.4 and 6.0.x before 6.0.5 allows attack CVE-2005-14064.6The kernel in FreeBSD 4.x to 4.11 and 5.x to 5.4 does not properly clear certain fixed-length buffers when copying variable-length data for