CVE-2014-6310

CVE-2014-6310 describes a buffer overflow in CHICKEN (versions 4.9.0 and 4.9.0.1) that may allow remote attackers to execute arbitrary code via the 'select' function. The connected documents confirm the affected product and the vulnerable vector, but do not provide specific exploit details, PoCs,...

CVE-2017-11343

CHICKEN Scheme versions up to 4.12.0 are vulnerable to an algorithmic complexity attack due to an incomplete fix for CVE-2012-6125. The issue arises from crafted input causing O(n) symbol-table lookups. The Fedora advisory FEDORA-2017-76ce091a43 provides a fix for CVE-2017-11343 (referenced in th...

CVE-2012-6125

CVE-2012-6125 applies to CHICKEN Scheme prior to 4.8.0, where hash table collision handling enables algorithmic complexity attacks that cause O(n) symbol-table lookups. The consumer-facing effect is resource-heavy lookups potentially impacting availability and response under crafted input. Severa...

CVE-2012-6122

CVE-2012-6122 is a buffer overflow in the thread scheduler of the Chicken Scheme runtime. The flaw allows an attacker to trigger a crash/DoS by opening a file descriptor with a large integer value. The issue affects Chicken releases up to and including 4.8.0.1, with related follow-ons noted (CVE-...

CVE-2022-45145

CVE-2022-45145 concerns CHICKEN 5.x; vulnerability exists in egg-compile.scm that allows arbitrary OS command execution during package installation via escaped characters in a .egg file. Root cause: insecure handling in egg-compile.scm leading to command injection during installation. Affected: C...

CVE-2012-6123

CVE-2012-6123 pertains to the Chicken Scheme interpreter. Versions prior to 4.8.0 fail to properly handle NUL bytes in certain strings, enabling a “poisoned NUL byte” attack. The vulnerability’s practical impact is a flaw in input/string handling that could be exploited by an attacker, with the N...

CVE-2016-6830

The CVE-2016-6830 vulnerability affects CHICKEN Scheme: the process-execute and process-spawn procedures used fixed-size buffers for arguments and environment variables in execve(), enabling buffer overruns from user-supplied lists. Affected releases include all versions up to 4.11; fixes are pla...

CVE-2013-2075

CVE-2013-2075 describes multiple buffer overflows in Chicken (up to 4.8.0.3) affecting the (1) R5RS char-ready, (2) tcp-accept-ready, and (3) file-select procedures. The issue enables a denial-of-service (crash) when a file descriptor with a large integer value is opened, and is noted as stemming...

CVE-2013-2024

In Chicken, CVE-2013-2024 describes an OS command injection vulnerability in the qs procedure from the utils module, affecting versions before 4.9.0. The root cause is unsafely handling or composing OS commands within that path, enabling an attacker to execute arbitrary commands on the host. The ...

CVE-2016-6831

CVE-2016-6831 affects the CHICKEN Scheme compiler. The vulnerability is a memory leak in the process-execute and process-spawn procedures when execve() fails, potentially enabling resource exhaustion or denial of service. Affected releases include all CHICKEN versions up to 4.11; a fix is planned...

CVE-2017-6949

CVE-2017-6949 affects CHICKEN Scheme up to version 4.12.0. A nonstandard CHICKEN extension allocates an SRFI-4 vector in unmanaged memory, and the vector size is passed to malloc() without sanitisation. An unexpected size can lead to a segfault or a buffer overflow. The connected documents refere...

CVE-2012-6124

CVE-2012-6124 concerns Chicken before 4.8.0 on 64‑bit platforms, where a casting error in the random number generator causes it to return a constant value. The vendor notes that this function isn’t used for security purposes. Connected sources (PT-2019-6812/6811) indicate the fix is to upgrade to...

CVE-2017-9334

The CVE-2017-9334 entry affects CHICKEN Scheme prior to version 4.13. It arises from an incorrect pair? check in the Scheme length procedure, causing an unsafe pointer dereference when given an improper list. This leads to a denial of service. The available documents do not specify exploitation d...

CVE-2013-4385

CVE-2013-4385 affects the CHICKEN Scheme implementation. The issue is a buffer overflow in the read-string! procedure in the extras unit, exploitable via a #f value in the NUM argument, leading to memory corruption and an application crash; remote attackers could potentially execute arbitrary cod...

CVE-2014-3776

CVE-2014-3776 affects CHICKEN: a buffer overflow in the read-u8vector! procedure of the srfi-4 unit allows a remote attacker to trigger memory corruption, potentially crash the application or execute code via a malformed NUM argument. Impact is described as memory corruption and possible arbitrar...

CVE-2014-9651

CVE-2014-9651 affects the CHICKEN Scheme implementation. A buffer overflow exists in CHICKEN 4.9.0.x before 4.9.0.2, 4.9.x before 4.9.1, and before 5.0, exploitable via a positive START argument to the substring-index[-ci] procedures. Impact is described as unspecified in the sources. The vulnera...

CVE-2015-4556

CVE-2015-4556 affects the CHICKEN Scheme implementation. The vulnerability lies in the string-translate* procedure in the data-structures unit and is exploitable in CHICKEN builds before version 4.10.0, allowing remote attackers to cause a denial of service (crash). Several sources (NVD, Debian s...

CVE-2013-1874

CVE-2013-1874 describes an untrusted search path vulnerability in Chicken's csi, where local users can execute arbitrary code via a Trojan horse .csirc in the current working directory. Affected: Chicken prior to 4.8.2; fix is to upgrade to 4.8.2 or later. The CVSS data indicates local access wit...