CVE-2005-4866

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

Stack-based buffer overflow in JDBC Applet Server in IBM DB2 8.1 allows remote attackers to execute arbitrary by connecting and sending a long username, then disconnecting gracefully and reconnecting and sending a short username and an unexpected db2java.zip version, which causes a null terminator to be removed and leads to the overflow.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-119

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Dec 31, 2005
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2005

CVE-2005-48679.3Stack-based buffer overflow in the SATENCRYPT function in IBM DB2 8.1, when Satellite Administration (SATADMIN) is enabled, allows remote atCVE-2005-48687.1Shared memory sections and events in IBM DB2 8.1 have default permissions of read and write for the Everyone group, which allows local usersCVE-2005-48692.1The (1) to_char and (2) to_date function in IBM DB2 8.1 allows local users to cause a denial of service (application crash) via an empty strCVE-2005-48704.3Stack-based buffer overflows in the (1) xmlvarcharfromfile, (2) xmlclobfromfile, (3) xmlfilefromvarchar, and (4) xmlfilefromclob function caCVE-2005-48714.3Certain XML functions in IBM DB2 8.1 run with the privileges of DB2 instead of the logged-in user, which allows remote attackers to create oCVE-2005-48724.3Perl-Compatible Regular Expression (PCRE) library before 6.2 does not properly count the number of named capturing subpatterns, which allowsCVE-2005-48737.5Multiple stack-based buffer overflows in the phpcups PHP module for CUPS 1.1.23rc1 might allow context-dependent attackers to execute arbitrCVE-2005-48744.3The XMLHttpRequest object in Mozilla 1.7.8 supports the HTTP TRACE method, which allows remote attackers to obtain (1) proxy authentication CVE-2005-48757.5TYPO3 3.8.0 and earlier allows remote attackers to obtain sensitive information via a direct request to misc/phpcheck/, which invokes the phCVE-2005-48764.3Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin console in Openfire (formerly Wildfire) 2.2.2, and possiCVE-2005-48774.3Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin console in Openfire (formerly Wildfire) 2.3.0 Beta 2 allCVE-2005-48784.3Multiple cross-site scripting (XSS) vulnerabilities in (1) acid_qry_main.php in Analysis Console for Intrusion Databases (ACID) 0.9.6b20 and