CVE-2004-0172

HIGH 7.2CVE-2004-0172 · Published 15/03/2004 · updated 16/06/2026

In short

CVE-2004-0172 is a HIGH (CVSS 7.2) vulnerability affecting ltrace (juan cespedes).
Chance of exploitation in the next 30 days (EPSS): 0.48%, higher than 41.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
ltrace juan_cespedes	`= 0.3.10`	No fix yet

Description

Heap-based buffer overflow in the search_for_command function of ltrace 0.3.10, if it is installed setuid, could allow local users to execute arbitrary code via a long filename. NOTE: It is unclear whether there are any packages that install ltrace as a setuid program, so this candidate might be REJECTed.

References

lists.grok.org.uk/pipermail/full-disclosure/2003-October/011600.html
lists.grok.org.uk/pipermail/full-disclosure/2003-October/011610.html
securitytracker.com/id
securityfocus.com/bid/8790 · Vendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/13389

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free