Skip to content
Fencer Vulns
medium 6.2

CVE-2006-1269 json

Buffer overflow in the parse function in parse.c in zoo 2.10 might allow local users to execute arbitrary code via long filename command li…

published 2006-03-19 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-1273

cvss
6.2
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 63%
public exploits
1
Exploit-DB

Summary

Buffer overflow in the parse function in parse.c in zoo 2.10 might allow local users to execute arbitrary code via long filename command line arguments, which are not properly handled during archive creation. NOTE: since this issue is local and not setuid, the set of attack scenarios is limited, although is reasonable to expect that there are some situations in which the zoo user might automatically list attacker-controlled filenames to add to the zoo archive.

Patch / fix

Timeline

  1. First public exploit (EDB-27425)
  2. Published

Exploit prediction

1.02% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-27425 Zoo 2.10 - Parse.c Local Buffer Overflow dos, 2006-03-16
  • gentoo.org http://www.gentoo.org/security/en/glsa/glsa-200603-12.xml referenced PoC, tagged "exploit" by a source, unverified
  • bugzilla.redhat.com https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=183426 referenced PoC, tagged "exploit" by a source, unverified
  • secunia.com http://secunia.com/advisories/19250 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 6.2 AV:L/AC:H/Au:N/C:C/I:C/A:C

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.