Debian Mapserver vulnerabilities

CVE-2009-1176 [CRITICAL] CVE-2009-1176: mapserver - mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 does no... mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 does not ensure that the string holding the id parameter ends in a '\0' character, which allows remote attackers to conduct buffer-overflow attacks or have unspecified other impact via a long id parameter in a query action. Scope: local bookworm: resolved (fixed in 5.2.2-1) bullseye: resolv

CVE-2009-0842 [MEDIUM] CVE-2009-0842: mapserver - mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attack... mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to read arbitrary invalid .map files via a full pathname in the map parameter, which triggers the display of partial file contents within an error message, as demonstrated by a /tmp/sekrut.map symlink. Scope: local bookworm: resolved (fixed in 5.2.2-1) bullseye: resolved (fixed in

CVE-2007-4629 [HIGH] CVE-2007-4629: mapserver - Buffer overflow in the processLine function in maptemplate.c in MapServer before... Buffer overflow in the processLine function in maptemplate.c in MapServer before 4.10.3 allows attackers to cause a denial of service and possibly execute arbitrary code via a mapfile with a long layer name, group name, or metadata entry name. Scope: local bookworm: resolved (fixed in 4.10.3-1) bullseye: resolved (fixed in 4.10.3-1) forky: resolved (fixed in 4.10.3-

CVE-2007-4542 [MEDIUM] CVE-2007-4542: mapserver - Multiple cross-site scripting (XSS) vulnerabilities in MapServer before 4.10.3 a... Multiple cross-site scripting (XSS) vulnerabilities in MapServer before 4.10.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the (1) processLine function in maptemplate.c and the (2) writeError function in mapserv.c in the mapserv CGI program. Scope: local bookworm: resolved (fixed in 4.10.3-1) bullseye: resolved (