CVE-2004-0172
Heap-based buffer overflow in the search_for_command function of ltrace 0.3.10, if it is...
Heap-based buffer overflow in the search_for_command function of ltrace 0.3.10, if it is installed setuid, could allow local users to execute arbitrary code via a long filename. NOTE: It is unclear whether there are any packages that install ltrace as a setuid program, so this candidate might be REJECTed.
Exploit likelihood
What each source reports
NVD Score used
Heap-based buffer overflow in the search_for_command function of ltrace 0.3.10, if it is installed setuid, could allow local users to execute arbitrary code via a long filename. NOTE: It is unclear whether there are any packages that install ltrace as a setuid program, so this candidate might be REJECTed.
- Record
CVE-2004-0172- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Heap-based buffer overflow in the search_for_command function of ltrace 0.3.10, if it is installed setuid, could allow local users to execute arbitrary code via a long filename. NOTE: It is unclear whether there are any packages that install ltrace as a setuid program, so this candidate might be REJECTed.
- Record
CVE-2004-0172- Updated
- 2026-11-02
EUVDEUVD-2004-0172 No score
Heap-based buffer overflow in the search_for_command function of ltrace 0.3.10, if it is installed setuid, could allow local users to execute arbitrary code via a long filename. NOTE: It is unclear whether there are any packages that install ltrace as a setuid program, so this candidate might be REJECTed.
- Record
EUVD-2004-0172- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7mw5-528h-7m9c No score
Heap-based buffer overflow in the search_for_command function of ltrace 0.3.10, if it is...
Heap-based buffer overflow in the search_for_command function of ltrace 0.3.10, if it is installed setuid, could allow local users to execute arbitrary code via a long filename. NOTE: It is unclear whether there are any packages that install ltrace as a setuid program, so this candidate might be REJECTed.
- Record
GHSA-7mw5-528h-7m9c- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2004-0172 is a high vulnerability (CVSS 7.2) in Juan Cespedes Ltrace, published February 23, 2004. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. No source names a fixed version.
References
lists.grok.org.uk/pipermail/full-disclosure/2003-October/011610.html
securitytracker.com/id?1007896
securityfocus.com/bid/8790
exchange.xforce.ibmcloud.com/vulnerabilities/13389
nvd.nist.gov/vuln/detail/CVE-2004-0172
github.com/advisories/GHSA-7mw5-528h-7m9c