CVE-2006-1236
Buffer overflow in the SetUp function in socket/request.c in CrossFire 1.9.0 allows remote...
CVE-2006-1236 is a high vulnerability (CVSS 7.5) in Crossfire, published March 15, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 28.0%, the 98th percentile. Fixed in crossfire 1.9.0-2.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 28.0%EPSS, 98th percentile
- Exploitation
- None known3 public exploits
- Fixed in
1.9.0-2crossfire +4 more
Description
Buffer overflow in the SetUp function in socket/request.c in CrossFire 1.9.0 allows remote attackers to execute arbitrary code via a long setup sound command, a different vulnerability than CVE-2006-1010.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
crossfireDebian:12 | before 1.9.0-2 | 1.9.0-2 |
crossfireDebian:13 | before 1.9.0-2 | 1.9.0-2 |
crossfireDebian:14 | before 1.9.0-2 | 1.9.0-2 |
crossfireDebian:3.0 | before 1.1.0-1woody2, plus listed versions 1.1.0-11.1.0-1woody1 | 1.1.0-1woody2 |
crossfireDebian:3.1 | before 1.6.0.dfsg.1-4sarge2, plus listed versions 1.6.0.dfsg.1-41.6.0.dfsg.1-4sarge1 | 1.6.0.dfsg.1-4sarge2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | crossfire-server 1.9.0 - 'SetUp()' Remote Buffer Overflow | 2006-03-13 |
| PoC in GitHub | Axua/CVE-2006-1236 | 2019-01-29 |
| Exploit-DB | crossfire-server 1.9.0 - 'SetUp()' Remote Buffer Overflow | 2021-08-18 |
What each source reports
NVD Score used
Buffer overflow in the SetUp function in socket/request.c in CrossFire 1.9.0 allows remote attackers to execute arbitrary code via a long setup sound command, a different vulnerability than CVE-2006-1010.
- Record
CVE-2006-1236- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
Buffer overflow in the SetUp function in socket/request.c in CrossFire 1.9.0 allows remote attackers to execute arbitrary code via a long setup sound command, a different vulnerability than CVE-2006-1010.
- Record
CVE-2006-1236- Updated
- 2026-11-02
EUVDEUVD-2006-1240No score
Buffer overflow in the SetUp function in socket/request.c in CrossFire 1.9.0 allows remote attackers to execute arbitrary code via a long setup sound command, a different vulnerability than CVE-2006-1010.
- Record
EUVD-2006-1240- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3hxr-9gc8-927wNo score
Buffer overflow in the SetUp function in socket/request.c in CrossFire 1.9.0 allows remote...
Buffer overflow in the SetUp function in socket/request.c in CrossFire 1.9.0 allows remote attackers to execute arbitrary code via a long setup sound command, a different vulnerability than CVE-2006-1010.
- Record
GHSA-3hxr-9gc8-927w- Updated
- 2026-11-02
OSVNo score
Buffer overflow in the SetUp function in socket/request.c in CrossFire 1.9.0 allows remote attackers to execute arbitrary code via a long setup sound command, a different vulnerability than CVE-2006-1010.
- Record
CVE-2006-1236- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-1236No score
Buffer overflow in the SetUp function in socket/request.c in CrossFire 1.9.0 allows remote attackers to execute arbitrary code via a long setup sound command, a different vulnerability than CVE-2006-1010.
- Record
DEBIAN-CVE-2006-1236- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.