CVE-2004-1235: Avaya Converged Communications Server

Medium severity, CVSS 6.2. EPSS: 2.9% chance of exploitation in the next 30 days.

Race condition in the (1) load_elf_library and (2) binfmt_aout function calls for uselib in Linux kernel 2.4 through 2.429-rc2 and 2.6 through 2.6.10 allows local users to execute arbitrary code by manipulating the VMA descriptor.

Affected products

• Avaya Converged Communications Server: version 2.0 only
• Avaya Intuity Audix: any version
• Avaya MN100: any version
• Avaya Modular Messaging Message Storage Server: version 1.1 only; version 2.0 only
• Avaya Network Routing: any version
• Avaya s8300: version r2.0.0 only; version r2.0.1 only
• Avaya s8500: version r2.0.0 only; version r2.0.1 only
• Avaya s8700: version r2.0.0 only; version r2.0.1 only
• Avaya s8710: version r2.0.0 only; version r2.0.1 only
• Conectiva Linux: version 10.0 only
• Linux Linux Kernel: version 2.4.0 only; version 2.4.1 only; version 2.4.2 only; version 2.4.3 only; version 2.4.4 only; version 2.4.5 only; …
• Mandrakesoft Mandrake Linux: version 9.2 only; version 10.0 only; version 10.1 only
• Mandrakesoft Mandrake Linux Corporate Server: version 2.1 only; version 3.0 only
• Mandrakesoft Mandrake Multi Network Firewall: version 8.2 only
• Red Hat Enterprise Linux: version 3.0 only; version 4.0 only
• Red Hat Enterprise Linux Desktop: version 3.0 only; version 4.0 only
• Red Hat Fedora Core: version core_1.0 only; version core_2.0 only; version core_3.0 only
• Red Hat Linux: version 7.3 only; version 9.0 only
• Suse Suse Linux: version 1.0 only; version 8 only; version 8.1 only; version 8.2 only; version 9.0 only; version 9.1 only; …
• Ubuntu Ubuntu Linux: version 4.1 only

Published 2005-04-14. Last modified 2026-06-16.