CVSS: 6.9EPSS: 0%CPEs: 1EXPL: 0CVE-2008-5984
https://notcve.org/view.php?id=CVE-2008-5984
Untrusted search path vulnerability in the Python plugin in Dia 0.96.1, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983). Vulnerabilidad de búsqueda de ruta no confiable en la extensión Python en Dia v0.96.1 y posiblemente otras versiones, permite a usuarios locales la ejecución de código de su elección a través de un archivo Python con un caballo de Troya en el directorio actual de trabajo, relacionado con la vulnerabilidad en la función PySys_SetArgv (CVE-2008-5983). • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504251 http://secunia.com/advisories/33672 http://secunia.com/advisories/33703 http://www.mandriva.com/security/advisories?name=MDVSA-2009:040 http://www.mandriva.com/security/advisories?name=MDVSA-2009:046 http://www.openwall.com/lists/oss-security/2009/01/26/2 http://www.securityfocus.com/bid/33448 https://bugzilla.redhat.com/show_bug.cgi?id=481551 https://exchange.xforce.ibmcloud.com/vulnerabilities/48262 https://www.redhat •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2007-3408
https://notcve.org/view.php?id=CVE-2007-3408
Multiple unspecified vulnerabilities in Dia before 0.96.1-6 have unspecified attack vectors and impact, probably involving the use of vulnerable FreeType libraries that contain CVE-2007-2754 and/or CVE-2007-1351. Múltiples vulnerabilidades no especificadas en Dia anterior a 0.96.1-6 tienen impacto y vectores de ataque no especificados, probablemente implicando el uso de librerías FreeType vulnerables que contienen CVE-2007-2754 y/o CVE-2007-1351. • http://secunia.com/advisories/25810 http://sourceforge.net/forum/forum.php?forum_id=709959 http://www.vupen.com/english/advisories/2007/2328 •
CVSS: 7.5EPSS: 2%CPEs: 1EXPL: 0CVE-2006-2453
https://notcve.org/view.php?id=CVE-2006-2453
Multiple unspecified format string vulnerabilities in Dia have unspecified impact and attack vectors, a different set of issues than CVE-2006-2480. • http://secunia.com/advisories/20254 http://secunia.com/advisories/20339 http://secunia.com/advisories/20422 http://secunia.com/advisories/20457 http://secunia.com/advisories/20513 http://securitytracker.com/id?1016203 http://www.gentoo.org/security/en/glsa/glsa-200606-03.xml http://www.mandriva.com/security/advisories?name=MDKSA-2006:093 http://www.novell.com/linux/security/advisories/2006-06-02.html http://www.redhat.com/archives/fedora-package-announce/2006-May/msg00119.html&# • CWE-134: Use of Externally-Controlled Format String •
CVSS: 5.1EPSS: 1%CPEs: 1EXPL: 4CVE-2006-2480 – Dia 0.8x/0.9x - Filename Remote Format String
https://notcve.org/view.php?id=CVE-2006-2480
Format string vulnerability in Dia 0.94 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering errors or warnings, as demonstrated via format string specifiers in a .bmp filename. NOTE: the original exploit was demonstrated through a command line argument, but there are other mechanisms for input that are automatically processed by Dia, such as a crafted .dia file. • https://www.exploit-db.com/exploits/27903 http://bugzilla.gnome.org/show_bug.cgi?id=342111 http://kandangjamur.net/tutorial/dia.txt http://secunia.com/advisories/20199 http://secunia.com/advisories/20254 http://secunia.com/advisories/20339 http://secunia.com/advisories/20422 http://secunia.com/advisories/20457 http://secunia.com/advisories/20513 http://securitytracker.com/id?1016203 http://www.gentoo.org/security/en/glsa/glsa-200606-03.xml http://www.mandriva.com/s • CWE-134: Use of Externally-Controlled Format String •
CVSS: 7.6EPSS: 1%CPEs: 6EXPL: 0CVE-2006-1550 – Dia multiple buffer overflows
https://notcve.org/view.php?id=CVE-2006-1550
Multiple buffer overflows in the xfig import code (xfig-import.c) in Dia 0.87 and later before 0.95-pre6 allow user-assisted attackers to have an unknown impact via a crafted xfig file, possibly involving an invalid (1) color index, (2) number of points, or (3) depth. • http://mail.gnome.org/archives/dia-list/2006-March/msg00149.html http://secunia.com/advisories/19469 http://secunia.com/advisories/19505 http://secunia.com/advisories/19507 http://secunia.com/advisories/19543 http://secunia.com/advisories/19546 http://secunia.com/advisories/19765 http://secunia.com/advisories/19897 http://secunia.com/advisories/19959 http://securitytracker.com/id?1015853 http://www.debian.org/security/2006/dsa-1025 http://www.gentoo.org/security/en/gls • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •