CVE-2009-1176
published 2009-03-31CVE-2009-1176: mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 does not ensure that the string holding the id parameter ends in a '\0' character…
PriorityP343critical10CVSS 2.0
AVNACLAuNCCICAC
EPSS
4.09%
89.5th percentile
mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 does not ensure that the string holding the id parameter ends in a '\0' character, which allows remote attackers to conduct buffer-overflow attacks or have unspecified other impact via a long id parameter in a query action.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | mapserver | < mapserver 5.2.2-1 (bookworm) | mapserver 5.2.2-1 (bookworm) |
| osgeo | mapserver | — | — |
| osgeo | mapserver | — | — |
| osgeo | mapserver | — | — |
| osgeo | mapserver | — | — |
| osgeo | mapserver | — | — |
| osgeo | mapserver | — | — |
| osgeo | mapserver | — | — |
| osgeo | mapserver | — | — |
| osgeo | mapserver | — | — |
| osgeo | mapserver | — | — |
| osgeo | mapserver | — | — |
| osgeo | mapserver | >= 0 < 5.2.2-1 | 5.2.2-1 |
| osgeo | mapserver | >= 0 < 5.2.2-1 | 5.2.2-1 |
| osgeo | mapserver | >= 0 < 5.2.2-1 | 5.2.2-1 |
| osgeo | mapserver | >= 0 < 5.2.2-1 | 5.2.2-1 |
| umn | mapserver | — | — |
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv10.0CRITICAL
vendor_debian10.0LOW
vendor_redhat10.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2009-1176: mapserver - mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 does no...
vendor_debian·2009·CVSS 10.0
CVE-2009-1176 [CRITICAL] CVE-2009-1176: mapserver - mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 does no...
mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 does not ensure that the string holding the id parameter ends in a '\0' character, which allows remote attackers to conduct buffer-overflow attacks or have unspecified other impact via a long id parameter in a query action.
Scope: local
bookworm: resolved (fixed in 5.2.2-1)
bullseye: resolved (fixed in 5.2.2-1)
forky: resolved (fixed in 5.2.2-1)
sid: resolved (fixed in 5.2.2-1)
trixie: resolved (fixed in 5.2.2-1)
Red Hat
mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)
vendor_redhat·CVSS 10.0
CVE-2009-1177 [CRITICAL] mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)
mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)
Multiple stack-based buffer overflows in maptemplate.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 have unknown impact and remote attack vectors.
Red Hat
mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)
vendor_redhat·CVSS 10.0
CVE-2009-0839 [CRITICAL] mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)
mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)
Stack-based buffer overflow in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when the server has a map with a long IMAGEPATH or NAME attribute, allows remote attackers to execute arbitrary code via a crafted id parameter in a query action.
Red Hat
mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)
vendor_redhat·CVSS 10.0
CVE-2009-1176 [CRITICAL] mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)
mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)
mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 does not ensure that the string holding the id parameter ends in a '\0' character, which allows remote attackers to conduct buffer-overflow attacks or have unspecified other impact via a long id parameter in a query action.
Red Hat
mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)
vendor_redhat·CVSS 10.0
CVE-2009-0842 [CRITICAL] mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)
mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)
mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to read arbitrary invalid .map files via a full pathname in the map parameter, which triggers the display of partial file contents within an error message, as demonstrated by a /tmp/sekrut.map symlink.
Red Hat
mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)
vendor_redhat·CVSS 10.0
CVE-2009-0841 [CRITICAL] mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)
mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)
Directory traversal vulnerability in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when running on Windows with Cygwin, allows remote attackers to create arbitrary files via a .. (dot dot) in the id parameter.
Red Hat
mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)
vendor_redhat·CVSS 10.0
CVE-2009-0840 [CRITICAL] mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)
mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)
Heap-based buffer underflow in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to have an unknown impact via a negative value in the Content-Length HTTP header.
Red Hat
mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)
vendor_redhat·CVSS 10.0
CVE-2009-0843 [CRITICAL] mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)
mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)
The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists.
GHSA
GHSA-2mr8-vqq3-7957: mapserv
ghsa_unreviewed·2022-05-02
CVE-2009-1176 [HIGH] CWE-119 GHSA-2mr8-vqq3-7957: mapserv
mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 does not ensure that the string holding the id parameter ends in a '\0' character, which allows remote attackers to conduct buffer-overflow attacks or have unspecified other impact via a long id parameter in a query action.
OSV
CVE-2009-1176: mapserv
osv·2009-03-31·CVSS 10.0
CVE-2009-1176 [CRITICAL] CVE-2009-1176: mapserv
mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 does not ensure that the string holding the id parameter ends in a '\0' character, which allows remote attackers to conduct buffer-overflow attacks or have unspecified other impact via a long id parameter in a query action.
No detection rules found.
No public exploits indexed.
Bugzilla
mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)
bugzilla·2009-04-01·CVSS 10.0
CVE-2009-0839 [CRITICAL] mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)
mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)
New upstream mapserver versions 5.2.2 and 4.10.4 have been released:
http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html
to address multiple security issues found during the security audit of the mapserver's code. Details about issues fixed:
http://www.securityfocus.com/archive/1/archive/1/502271/100/0/threaded
http://www.positronsecurity.com/advisories/2009-000.html
CVE assigned to the issues:
CVE-2009-0839:
Stack-based buffer overflow in mapserv.c in mapserv in MapServer 4.x
before 4.10.4 and 5.x before 5.2.2, when the server has a map with a
long IMAGEPATH or NAME attribute, allows remote attackers to e
Bugzilla
CVE-2008-3143 python: Multiple integer overflows discovered by Google
bugzilla·2008-07-11·CVSS 7.5
CVE-2008-3143 [HIGH] CVE-2008-3143 python: Multiple integer overflows discovered by Google
CVE-2008-3143 python: Multiple integer overflows discovered by Google
Description of problem:
Added checks for integer overflows, contributed by Google. Some are
only available if asserts are left in the code, in cases where they
can't be triggered from Python code.
Proposed upstream patch:
http://svn.python.org/view?rev=60793&view=rev
Discussion:
The Red Hat Security Response Team has rated this issue as having low security
impact, a future update may address this flaw. More information regarding
issue severity can be found here:
http://www.redhat.com/security/updates/classification/
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Via RHSA-2009:1176 https://rhn.redhat.com/errata/RHSA-2009-1176.html
---
This issue has been addressed in follow
http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.htmlhttp://secunia.com/advisories/34603http://www.positronsecurity.com/advisories/2009-000.htmlhttp://www.securityfocus.com/archive/1/502271/100/0/threadedhttp://www.securityfocus.com/bid/34306http://www.securitytracker.com/id?1021952https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00147.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-April/msg00170.htmlhttp://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.htmlhttp://secunia.com/advisories/34603http://www.positronsecurity.com/advisories/2009-000.htmlhttp://www.securityfocus.com/archive/1/502271/100/0/threadedhttp://www.securityfocus.com/bid/34306http://www.securitytracker.com/id?1021952https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00147.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-April/msg00170.html
2009-03-31
Published