What’s Vulnerable › Vulnerabilities

CVE-2006-1168

• Severity: high (CVSS 7.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2006-08-14 · updated 2026-06-16

Description

The decompress function in compress42.c in (1) ncompress 4.2.4 and (2) liblzw allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code, via crafted data that leads to a buffer underflow.

Affected products

• Ncompress: 4.2.4

References

• http://bugs.gentoo.org/show_bug.cgi?id=141728
• http://downloads.avaya.com/css/P8/documents/100158840
• http://rhn.redhat.com/errata/RHSA-2012-0810.html
• http://secunia.com/advisories/21427
• http://secunia.com/advisories/21434
• http://secunia.com/advisories/21437
• http://secunia.com/advisories/21467
• http://secunia.com/advisories/21880
• http://secunia.com/advisories/22036
• http://secunia.com/advisories/22296
• http://secunia.com/advisories/22377

Get alerted when CVE-2006-1168 or the next vulnerability affects your stack