CVE-2007-2835 Memory corruption in n/a
Local attackers can exploit stack-based buffer overflows in unicon-imc2 via a long HOME variable to gain elevated privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2007-2835?
CVE-2007-2835 is a medium-severity memory corruption vulnerability in n/a, published on 3 Jul 2007. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Multiple stack-based buffer overflows in (1) CCE_pinyin.c and (2) xl_pinyin.c in ImmModules/cce/ in unicon-imc2 3.0.4, as used by zhcon and other applications, allow local users to gain privileges via a long HOME environment variable.
Which versions are affected by CVE-2007-2835?
It affects 1 product.
Products include Unicon-Imc2 Unicon-Imc2.
How do I fix CVE-2007-2835?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2007-2835 being exploited?
There is no known exploitation of CVE-2007-2835 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2007-2835, DSA-1328-1, GHSA-v885-jj2f-cf66.