PatchTheCVECVE-2004-0834: Format string vulnerability in Speedtouch USB driver before 1.3.1 allows local users to execute arbitrary code
40
This month
HIGH 7.2WATCHLISTDOWNGRADEDOWNGRADEMITIGATE
CVE-2004-0834 is a high-severity flaw (CVSS 7.2) affecting mandrake multi network firewall, speedtouch usb driver, linux. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Format string vulnerability in Speedtouch USB driver before 1.3.1 allows local users to execute arbitrary code via (1) modem_run, (2) pppoa2, or (3) pppoa3.
Why this priority
- High severity
- On your watchlist
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 7.2 (High) |
| EPSS exploit chance | 0.4% (top 62%) |
| CISA exploited list | No |
| Published | 2004-12-23 |
| Last modified | 2026-06-16 |
Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
mandrakesoft mandrake multi network firewall DOWNGRADE
Affected: 8.2
Fixed in: no fixed release known
Safe to downgrade to: a release before 8.2
1. Check installed version
apt-cache policy mandrake-multi-network-firewall || rpm -q mandrake-multi-network-firewall || mandrake-multi-network-firewall --version
2. No fixed release: DOWNGRADE to a release before 8.2 (Debian / Ubuntu)
apt-cache madison mandrake-multi-network-firewall
sudo apt install mandrake-multi-network-firewall=<VERSION_BEFORE_8.2>
sudo apt-mark hold mandrake-multi-network-firewall
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list mandrake-multi-network-firewall
sudo dnf downgrade mandrake-multi-network-firewall-<VERSION_BEFORE_8.2>
sudo dnf versionlock add mandrake-multi-network-firewall
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
speedtouch speedtouch usb driver DOWNGRADE
Affected: 1.0 · 1.1 · 1.2 · 1.2_beta1 · 1.2_beta2 · 1.2_beta3 · 1.3
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.0
1. Check installed version
apt-cache policy speedtouch-usb-driver || rpm -q speedtouch-usb-driver || speedtouch-usb-driver --version
2. No fixed release: DOWNGRADE to a release before 1.0 (Debian / Ubuntu)
apt-cache madison speedtouch-usb-driver
sudo apt install speedtouch-usb-driver=<VERSION_BEFORE_1.0>
sudo apt-mark hold speedtouch-usb-driver
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list speedtouch-usb-driver
sudo dnf downgrade speedtouch-usb-driver-<VERSION_BEFORE_1.0>
sudo dnf versionlock add speedtouch-usb-driver
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
gentoo linux MITIGATE
Affected: 1.4
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.4
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
mandrakesoft mandrake linux MITIGATE
Affected: 8.2 · 9.0 · 9.1 · 9.2 · 10.0 · 10.1
Fixed in: no fixed release known
Safe to downgrade to: a release before 8.2
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
mandrakesoft mandrake linux corporate server MITIGATE
Affected: 2.1
Fixed in: no fixed release known
Safe to downgrade to: a release before 2.1
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2004-0834?
mandrake multi network firewall: downgrade or apply the listed mitigation; speedtouch usb driver: downgrade or apply the listed mitigation; linux: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2004-0834 being exploited?
CVE-2004-0834 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2004-0834 affect?
CVE-2004-0834 affects mandrake multi network firewall, speedtouch usb driver, linux. Severity is high (CVSS 7.2). Format string vulnerability in Speedtouch USB driver before 1.3.1 allows local users to execute arbitrary code via (1) modem_run, (2) pppoa2, or (3) pppoa3.
How urgent is CVE-2004-0834?
Priority 40/100. High severity; On your watchlist
Related CVEs
- CVE-2007-5116 HIGH 7.5 DOWNGRADE DOWNGRADE Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 all
- CVE-2007-1352 LOW 3.8 DOWNGRADE DOWNGRADE Integer overflow in the FontFileInitTable function in X.Org libXfont before 20070403 allows remote authenticat
- CVE-2004-2395 LOW 2.1 DOWNGRADE MITIGATE Memory leak in passwd 0.68 allows local users to cause a denial of service (memory consumption) via a large nu
- CVE-2004-2394 LOW 2.1 DOWNGRADE MITIGATE Off-by-one error in passwd 0.68 and earlier, when using the --stdin option, causes passwd to use the first 78
- CVE-2004-1051 HIGH 7.2 DOWNGRADE MITIGATE sudo before 1.6.8p2 allows local users to execute arbitrary commands by using "()" style environment variables