What’s Vulnerable › Vulnerabilities
CVE-2004-1235
- Severity: medium (CVSS 6.2 v2.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.9% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2005-04-14 · updated 2026-06-16
Description
Race condition in the (1) load_elf_library and (2) binfmt_aout function calls for uselib in Linux kernel 2.4 through 2.429-rc2 and 2.6 through 2.6.10 allows local users to execute arbitrary code by manipulating the VMA descriptor.
Affected products
- Avaya Converged Communications Server: 2.0
- Avaya Intuity Audix: all versions
- Avaya Mn100: all versions
- Avaya Modular Messaging Message Storage Server: 1.1, 2.0
- Avaya Network Routing: all versions
- Avaya S8300: r2.0.0, r2.0.1
- Avaya S8500: r2.0.0, r2.0.1
- Avaya S8700: r2.0.0, r2.0.1
- Avaya S8710: r2.0.0, r2.0.1
- Conectiva Linux: 10.0
- Linux kernel: 2.4.0, 2.4.0-test1, 2.4.0-test10, 2.4.0-test11, 2.4.0-test12, 2.4.0-test2 (+92)
- Mandrakesoft Mandrake Linux: 9.2, 10.0, 10.1
- Mandrakesoft Mandrake Linux Corporate Server: 2.1, 3.0
- Mandrakesoft Mandrake Multi Network Firewall: 8.2
- Red Hat Enterprise Linux: 3.0, 4.0
- RedHat Enterprise Linux Desktop: 3.0, 4.0
- RedHat Fedora Core: core_1.0, core_2.0, core_3.0
- RedHat Linux: 7.3, 9.0
- Suse Linux: 1.0, 8, 8.1, 8.2, 9.0, 9.1 (+1)
- Ubuntu Linux: 4.1
References
- http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000930
- http://isec.pl/vulnerabilities/isec-0021-uselib.txt
- http://marc.info/?l=bugtraq&m=110512575901427&w=2
- http://secunia.com/advisories/20162
- http://secunia.com/advisories/20163
- http://secunia.com/advisories/20202
- http://secunia.com/advisories/20338
- http://www.debian.org/security/2006/dsa-1067
- http://www.debian.org/security/2006/dsa-1069
- http://www.debian.org/security/2006/dsa-1070
- http://www.debian.org/security/2006/dsa-1082
- http://www.mandriva.com/security/advisories?name=MDKSA-2005:022
Get alerted when CVE-2004-1235 or the next vulnerability affects your stack