OSV-2026-1198 Stack-buffer-overflow in msLayoutTextSymbol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=551099259 Crash type: Stack-buffer-overflow READ 4 Crash state: msLayoutTextSymbol msWriteErrorImage msWMSException...

Astra Linux – Vulnerability in mapserver

MapServer is a system for developing web-based GIS applications. From version 6.4.0 to before version 8.6.3, msSLDParseUserStyle always called SLDApplyRuleValuespsRule, psLayer, 1 for any that contained . It assumed that msSLDParseRule had added a class. When the rule had no symbolizer a...

The vulnerability of the MapServer geographic data rendering parser’s SLD system, related to buffer overflows, allows attackers to cause service failures.

The vulnerability of the MapServer geographic data rendering parser’s SLD system is related to buffer overflow attacks. Exploiting this vulnerability can allow an attacker to cause a service failure...

Astra Linux – Vulnerability in mapserver

MapServer is a system for developing web-based GIS applications. Starting from version 4.2 and before version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD Styled Layer Descriptor parser allowed a remote, unauthenticated attacker to crash the MapServer process by sending a crafted SLD...

Astra Linux – Vulnerability in mapserver

MapServer is a system for developing web-based GIS applications. Prior to version 8.4.1, the XML Filter Query directive’s PropertyName was vulnerable to Boolean-based SQL injection. It seems that expression checking was bypassed by introducing double quote characters in PropertyName, allowing...

Linux Distros Unpatched Vulnerability : CVE-2026-45104

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls SLDApplyRuleValuespsRule, psLayer...

Security update for mapserver (important)

openSUSE security update: security update for mapserver ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20857-1 Rating: important References: bsc1260869 bsc1266663 Cross-References: CVE-2026-33721 CVE-2026-45104 Affected Products: openSUSE Leap 16.0...

OPENSUSE-SU-2026:20857-1 Security update for mapserver

This update for mapserver fixes the following issues: Changes in mapserver: - Update to releasee 8.6.3 SLD parser: fix out of bounds access on SLD with only a Rule with a ElseFilter but without a symbolizer CVE-2026-33721, boo1260869 CVE-2026-45104, boo1266663...

[SECURITY] Fedora 43 Update: mapserver-8.6.3-1.fc43

MapServer is an Open Source platform for publishing spatial data and interactive mapping applications to the web...

SUSE CVE-2026-45104

MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls SLDApplyRuleValuespsRule, psLayer, 1; for any carrying - it assumes msSLDParseRule added one class. When the rule has no symbolizer a structurally valid SLD, msSLDParseRul...

Fedora 43 : mapserver (2026-1aa6743d40)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-1aa6743d40 advisory. Update to mapserver-8.6.3. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

CVE-2026-45104

A flaw was found in MapServer. A remote attacker can exploit this vulnerability by sending a specially crafted Styled Layer Descriptor SLD via the Web Map Service WMS SLDBODY parameter. This can lead to a NULL pointer dereference, causing a Denial of Service DoS condition...

CVE-2026-45104

MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls SLDApplyRuleValuespsRule, psLayer, 1; for any carrying — it assumes msSLDParseRule added one class. When the rule has no symbolizer a structurally valid SLD, msSLDParseRul...

DEBIAN-CVE-2026-45104

MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls SLDApplyRuleValuespsRule, psLayer, 1; for any carrying — it assumes msSLDParseRule added one class. When the rule has no symbolizer a structurally valid SLD, msSLDParseRul...

CVE-2026-45104

MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls SLDApplyRuleValuespsRule, psLayer, 1; for any carrying — it assumes msSLDParseRule added one class. When the rule has no symbolizer a structurally valid SLD, msSLDParseRul...

UBUNTU-CVE-2026-45104

MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls SLDApplyRuleValuespsRule, psLayer, 1; for any carrying — it assumes msSLDParseRule added one class. When the rule has no symbolizer a structurally valid SLD, msSLDParseRul...

CVE-2026-45104 MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY`

MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls SLDApplyRuleValuespsRule, psLayer, 1; for any carrying — it assumes msSLDParseRule added one class. When the rule has no symbolizer a structurally valid SLD, msSLDParseRul...

CVE-2026-45104

MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls SLDApplyRuleValuespsRule, psLayer, 1; for any carrying — it assumes msSLDParseRule added one class. When the rule has no symbolizer a structurally valid SLD, msSLDParseRul...

CVE-2026-45104 MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY`

MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls SLDApplyRuleValuespsRule, psLayer, 1; for any carrying — it assumes msSLDParseRule added one class. When the rule has no symbolizer a structurally valid SLD, msSLDParseRul...

CVE-2026-45104

MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls SLDApplyRuleValuespsRule, psLayer, 1; for any carrying — it assumes msSLDParseRule added one class. When the rule has no symbolizer a structurally valid SLD, msSLDParseRul...