CVE-2006-0855

Severity: medium (CVSS 5.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-02-23 · updated 2026-06-16
Weakness: CWE-119

Description

Stack-based buffer overflow in the fullpath function in misc.c for zoo 2.10 and earlier, as used in products such as Barracuda Spam Firewall, allows user-assisted attackers to execute arbitrary code via a crafted ZOO file that causes the combine function to return a longer string than expected.

Affected products

Rahul Dhesi Zoo: through 2.10

References

http://archives.neohapsis.com/archives/bugtraq/2006-04/0061.html
http://secunia.com/advisories/19002
http://secunia.com/advisories/19130
http://secunia.com/advisories/19148
http://secunia.com/advisories/19166
http://secunia.com/advisories/19408
http://secunia.com/advisories/19514
http://securityreason.com/securityalert/546
http://securitytracker.com/id?1015668
http://securitytracker.com/id?1015866
http://www.debian.org/security/2006/dsa-991
http://www.gentoo.org/security/en/glsa/glsa-200603-05.xml

Get alerted when CVE-2006-0855 or the next vulnerability affects your stack