CVE-2006-4127

Severity: medium (CVSS 4.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-08-14 · updated 2026-06-16

Description

Multiple format string vulnerabilities in DConnect Daemon 0.7.0 and earlier allow remote administrators to execute arbitrary code via format string specifiers that are not properly handled when calling the (1) privmsg() or (2) pubmsg functions from (a) cmd.user.c, (b) penalties.c, or (c) cmd.dc.c.

Affected products

Dconnect Daemon: 0.0.2, 0.0.3, 0.7.0

References

http://secunia.com/advisories/21384
http://securityreason.com/securityalert/1377
http://securitytracker.com/id?1016641
http://www.dc.ds.pg.gda.pl/
http://www.dc.ds.pg.gda.pl/?page=doc&doc=changelog
http://www.securityfocus.com/archive/1/442440/100/0/threaded
http://www.securityfocus.com/bid/19371
http://www.vupen.com/english/advisories/2006/3181
https://exchange.xforce.ibmcloud.com/vulnerabilities/28280
http://secunia.com/advisories/21384
http://securityreason.com/securityalert/1377
http://securitytracker.com/id?1016641

Get alerted when CVE-2006-4127 or the next vulnerability affects your stack