CVE-2009-1176

2009-03-3118:24:45

Debian Security Bug Tracker

security-tracker.debian.org

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.016 Low

EPSS

Percentile

87.7%

JSON

mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 does not ensure that the string holding the id parameter ends in a ‘\0’ character, which allows remote attackers to conduct buffer-overflow attacks or have unspecified other impact via a long id parameter in a query action.

OSVersionArchitecturePackageVersionFilename
Debian12allmapserver< 5.2.2-1mapserver_5.2.2-1_all.deb
Debian11allmapserver< 5.2.2-1mapserver_5.2.2-1_all.deb
Debian10allmapserver< 5.2.2-1mapserver_5.2.2-1_all.deb
Debian999allmapserver< 5.2.2-1mapserver_5.2.2-1_all.deb
Debian13allmapserver< 5.2.2-1mapserver_5.2.2-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	mapserver	< 5.2.2-1	mapserver_5.2.2-1_all.deb
Debian	11	all	mapserver	< 5.2.2-1	mapserver_5.2.2-1_all.deb
Debian	10	all	mapserver	< 5.2.2-1	mapserver_5.2.2-1_all.deb
Debian	999	all	mapserver	< 5.2.2-1	mapserver_5.2.2-1_all.deb
Debian	13	all	mapserver	< 5.2.2-1	mapserver_5.2.2-1_all.deb