CVE-2007-2954

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

Multiple stack-based buffer overflows in the Spooler service (nwspool.dll) in Novell Client 4.91 SP2 through SP4 for Windows allow remote attackers to execute arbitrary code via certain long arguments to the (1) RpcAddPrinterDriver, (2) RpcGetPrinterDriverDirectory, and other unspecified RPC requests, aka Novell bug 300870, a different vulnerability than CVE-2006-5854.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://download.novell.com/Download?buildid=VOXNZb-6t_g~Patch
http://osvdb.org/37321
http://secunia.com/advisories/26374Patch, Vendor Advisory
http://secunia.com/secunia_research/2007-57/advisory/Patch, Vendor Advisory
http://securitytracker.com/id?1018623Patch
http://www.securityfocus.com/bid/25474Patch
http://www.vupen.com/english/advisories/2007/3006Vendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-07-045/
https://exchange.xforce.ibmcloud.com/vulnerabilities/35824
http://download.novell.com/Download?buildid=VOXNZb-6t_g~Patch
http://osvdb.org/37321
http://secunia.com/advisories/26374Patch, Vendor Advisory
http://secunia.com/secunia_research/2007-57/advisory/Patch, Vendor Advisory
http://securitytracker.com/id?1018623Patch
http://www.securityfocus.com/bid/25474Patch
http://www.vupen.com/english/advisories/2007/3006Vendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-07-045/
https://exchange.xforce.ibmcloud.com/vulnerabilities/35824

Timeline

Published: Aug 31, 2007
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-29556.8Multiple unspecified "input validation error" vulnerabilities in multiple ActiveX controls in NavComUI.dll, as used in multiple Norton AntiV CVE-2007-29566.8Stack-based buffer overflow in the readRadianceHeader function in (1) src/fileformat/rgbeio.cpp in pfstools 1.6.2 and (2) src/Fileformat/rgb CVE-2007-29579.3Integer overflow in McAfee E-Business Server before 8.5.3 for Solaris, and before 8.1.2 for Linux, HP-UX, and AIX, allows remote attackers t CVE-2007-29586.8Format string vulnerability in the inc_put_error function in src/inc.c in Sylpheed 2.4.4, and Sylpheed-Claws (Claws Mail) 1.9.100 and 2.10.0 CVE-2007-29597.5SQL injection vulnerability in manufacturer.php in cpCommerce before 1.1.0 allows remote attackers to execute arbitrary SQL commands via the CVE-2007-29607.5Multiple directory traversal vulnerabilities in Scallywag 2005-04-25 allow remote attackers to include and execute arbitrary local files via CVE-2007-29617.5Unrestricted file upload vulnerability in FileCloset before 1.1.5 allows remote attackers to upload arbitrary PHP files via unspecified vect CVE-2007-29624.3Cross-site scripting (XSS) vulnerability in search.php in Particle Gallery 1.0.1 and earlier allows remote attackers to inject arbitrary web CVE-2007-29634.3Multiple cross-site scripting (XSS) vulnerabilities in Invision Power Board (IPB or IP.Board) 2.2.2, and possibly earlier, allows remote att CVE-2007-29645.0The fsmsh.dll host module in F-Secure Policy Manager Server 7.00 and earlier allows remote attackers to cause a denial of service (applicati CVE-2007-29657.2Unspecified vulnerability in the Real-time Scanning component in multiple F-Secure products, including Internet Security 2005, 2006 and 2007 CVE-2007-29667.5Buffer overflow in the LHA decompression component in F-Secure anti-virus products for Microsoft Windows and Linux before 20070529 allows re