FKIE_CVE-2006-3251

Vulnerability from fkie_nvd - Published: 2006-06-27 18:05 - Updated: 2026-06-16 22:26
Severity
Summary
Heap-based buffer overflow in the array_push function in hashcash.c for Hashcash before 1.21 might allow attackers to execute arbitrary code via crafted entries.
References
cve@mitre.orghttp://secunia.com/advisories/20800Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/20846Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/21146Vendor Advisory
cve@mitre.orghttp://www.debian.org/security/2006/dsa-1114
cve@mitre.orghttp://www.gentoo.org/security/en/glsa/glsa-200606-25.xml
cve@mitre.orghttp://www.hashcash.org/source/CHANGELOG
cve@mitre.orghttp://www.securityfocus.com/bid/18659Patch
cve@mitre.orghttp://www.vupen.com/english/advisories/2006/2551Vendor Advisory
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/27422
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/20800Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/20846Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/21146Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2006/dsa-1114
af854a3a-2127-422b-91ae-364da2661108http://www.gentoo.org/security/en/glsa/glsa-200606-25.xml
af854a3a-2127-422b-91ae-364da2661108http://www.hashcash.org/source/CHANGELOG
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/18659Patch
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2006/2551Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/27422
Impacted products
Vendor Product Version
hashcash hashcash *
hashcash hashcash 1.00
hashcash hashcash 1.01
hashcash hashcash 1.02
hashcash hashcash 1.03
hashcash hashcash 1.04
hashcash hashcash 1.05
hashcash hashcash 1.06
hashcash hashcash 1.07
hashcash hashcash 1.08
hashcash hashcash 1.09
hashcash hashcash 1.10
hashcash hashcash 1.11
hashcash hashcash 1.12
hashcash hashcash 1.13
hashcash hashcash 1.14
hashcash hashcash 1.15
hashcash hashcash 1.16
hashcash hashcash 1.17
hashcash hashcash 1.18
hashcash hashcash 1.19
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hashcash:hashcash:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0C41452-0374-4E1D-B608-8EDE233C2476",
              "versionEndIncluding": "1.20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashcash:hashcash:1.00:*:*:*:*:*:*:*",
              "matchCriteriaId": "65CBCB5D-58F6-40DD-9614-91BF586E61F9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashcash:hashcash:1.01:*:*:*:*:*:*:*",
              "matchCriteriaId": "A96B34E0-9386-4936-B214-62AE89F3719B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashcash:hashcash:1.02:*:*:*:*:*:*:*",
              "matchCriteriaId": "1C11EE1F-FDA4-42E7-B180-B9AEE314C5C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashcash:hashcash:1.03:*:*:*:*:*:*:*",
              "matchCriteriaId": "07CF74FD-1833-4A1A-A306-8E82F2E7C548",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashcash:hashcash:1.04:*:*:*:*:*:*:*",
              "matchCriteriaId": "C1B08A94-5792-41D1-AF6E-BFC684797954",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashcash:hashcash:1.05:*:*:*:*:*:*:*",
              "matchCriteriaId": "5BCF3B97-3B1B-439B-BEFA-A46EA8FDD2F2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashcash:hashcash:1.06:*:*:*:*:*:*:*",
              "matchCriteriaId": "4DD5C44F-D35E-44CE-9F53-F0417AE13B3C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashcash:hashcash:1.07:*:*:*:*:*:*:*",
              "matchCriteriaId": "949C12FC-47EC-4569-A94E-84EFB37680F1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashcash:hashcash:1.08:*:*:*:*:*:*:*",
              "matchCriteriaId": "E7EB97DC-4109-4C2A-842A-373D36977DB2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashcash:hashcash:1.09:*:*:*:*:*:*:*",
              "matchCriteriaId": "4DE9787F-5DCF-4EFD-9FCC-DD4C8DCD113C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashcash:hashcash:1.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "05D1FFD8-755F-4B7E-8E45-25789E5D816F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashcash:hashcash:1.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "1EB3DBD1-D3A8-43AE-B1A0-9F38FD090FAB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashcash:hashcash:1.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "DDCBD2CA-59A9-4CEA-B123-EFF854B0E655",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashcash:hashcash:1.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "BDB18B81-7158-4366-A6D4-4F2072B81DA9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashcash:hashcash:1.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "6152DF4C-DE31-4724-BEFF-1F5081D044F7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashcash:hashcash:1.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "ECD231A8-E9B7-4B1C-A9FD-0448D51FC99F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashcash:hashcash:1.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "C07E038B-91DB-4539-95D8-55F0A50AEDE2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashcash:hashcash:1.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "2A175EB6-0A7C-489D-AF57-BBFE5E380D76",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashcash:hashcash:1.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "0437D295-BB19-4CA0-9084-553A0C07CD65",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashcash:hashcash:1.19:*:*:*:*:*:*:*",
              "matchCriteriaId": "CFC00C60-E987-48CA-B41A-6B8D7C3CDF93",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Heap-based buffer overflow in the array_push function in hashcash.c for Hashcash before 1.21 might allow attackers to execute arbitrary code via crafted entries."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de b\u00fafer basado en pila en la funci\u00f3n array_push en hashcash.c para Hashcash anterior v1.21 puede permitir a atacantes ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de entradas manipuladas. \r\n"
    }
  ],
  "id": "CVE-2006-3251",
  "lastModified": "2026-06-16T22:26:42.433",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": true,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2006-06-27T18:05:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/20800"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/20846"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/21146"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2006/dsa-1114"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200606-25.xml"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.hashcash.org/source/CHANGELOG"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/18659"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2006/2551"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27422"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/20800"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/20846"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/21146"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2006/dsa-1114"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200606-25.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.hashcash.org/source/CHANGELOG"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/18659"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2006/2551"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27422"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.