Debian Mapserver vulnerabilities

CVE-2021-32062 [MEDIUM] CVE-2021-32062: mapserver - MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4... MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enforce the MS_MAP_NO_PATH and MS_MAP_PATTERN restrictions that are intended to control the locations from which a mapfile may be loaded (with MapServer CGI). Scope: local bookworm: resolved (fixed in 7.6.2-2) bullseye: resolved

CVE-2009-0842 [MEDIUM] CVE-2009-0842: mapserver - mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attack... mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to read arbitrary invalid .map files via a full pathname in the map parameter, which triggers the display of partial file contents within an error message, as demonstrated by a /tmp/sekrut.map symlink. Scope: local bookworm: resolved (fixed in 5.2.2-1) bullseye: resolved (fixed in

CVE-2007-4542 [MEDIUM] CVE-2007-4542: mapserver - Multiple cross-site scripting (XSS) vulnerabilities in MapServer before 4.10.3 a... Multiple cross-site scripting (XSS) vulnerabilities in MapServer before 4.10.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the (1) processLine function in maptemplate.c and the (2) writeError function in mapserv.c in the mapserv CGI program. Scope: local bookworm: resolved (fixed in 4.10.3-1) bullseye: resolved (

CVE-2010-2539 [LOW] CVE-2010-2539: mapserver - Buffer overflow in the msTmpFile function in maputil.c in mapserv in MapServer b... Buffer overflow in the msTmpFile function in maputil.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 allows local users to cause a denial of service via vectors involving names of temporary files. Scope: local bookworm: resolved (fixed in 5.6.4-1) bullseye: resolved (fixed in 5.6.4-1) forky: resolved (fixed in 5.6.4-1) sid: resolved (fixed in 5.6.4-1) tr