CVE-2006-1269

Severity: medium (CVSS 6.2 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-03-19 · updated 2026-06-16

Description

Buffer overflow in the parse function in parse.c in zoo 2.10 might allow local users to execute arbitrary code via long filename command line arguments, which are not properly handled during archive creation. NOTE: since this issue is local and not setuid, the set of attack scenarios is limited, although is reasonable to expect that there are some situations in which the zoo user might automatically list attacker-controlled filenames to add to the zoo archive.

Affected products

Rahul Dhesi Zoo: 2.10

References

http://secunia.com/advisories/19250
http://secunia.com/advisories/19254
http://www.gentoo.org/security/en/glsa/glsa-200603-12.xml
http://www.securityfocus.com/bid/17126
http://www.vupen.com/english/advisories/2006/0969
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=183426
https://exchange.xforce.ibmcloud.com/vulnerabilities/25264
http://secunia.com/advisories/19250
http://secunia.com/advisories/19254
http://www.gentoo.org/security/en/glsa/glsa-200603-12.xml
http://www.securityfocus.com/bid/17126
http://www.vupen.com/english/advisories/2006/0969

Get alerted when CVE-2006-1269 or the next vulnerability affects your stack