Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2009-0148

Multiple buffer overflows in Cscope before 15.7a allow remote attackers to execute arbitrary code via long strings in input such as (1) source-code tokens and (2) pathnames, related to integer overflows in some cases. NOTE: this issue exists because of an incomplete fix for CVE-2004-2541.

Published

2009-05-05T17:30:00.233

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 9.3 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

8.6

Impact Score

10.0

Weaknesses

Type: Primary
CWE-119

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	cscope	cscope	13.0	Yes
Application	cscope	cscope	15.0bl2	Yes
Application	cscope	cscope	15.1	Yes
Application	cscope	cscope	15.3	Yes
Application	cscope	cscope	15.4	Yes
Application	cscope	cscope	15.5	Yes
Application	cscope	cscope	15.6	Yes
Application	cscope	cscope	15.7	Yes

References

http://lists.apple.com/archives/security-announce/2009/May/msg00002.html ([email protected])
http://secunia.com/advisories/34978 Vendor Advisory ([email protected])
http://secunia.com/advisories/35074 Vendor Advisory ([email protected])
http://secunia.com/advisories/35213 Vendor Advisory ([email protected])
http://secunia.com/advisories/35214 Vendor Advisory ([email protected])
http://secunia.com/advisories/35462 Vendor Advisory ([email protected])
http://security.gentoo.org/glsa/glsa-200905-02.xml ([email protected])
http://sourceforge.net/forum/forum.php?forum_id=947983 Patch ([email protected])
http://sourceforge.net/mailarchive/forum.php?thread_name=E1LsGx3-00015K-TN%40ddv4jf1.ch3.sourceforge.com&forum_name=cscope-cvs ([email protected])
http://sourceforge.net/project/shownotes.php?group_id=4664&release_id=679527 Patch ([email protected])
http://support.apple.com/kb/HT3549 ([email protected])
http://www.debian.org/security/2009/dsa-1806 ([email protected])
http://www.openwall.com/lists/oss-security/2009/05/06/9 ([email protected])
http://www.redhat.com/support/errata/RHSA-2009-1101.html ([email protected])
http://www.redhat.com/support/errata/RHSA-2009-1102.html ([email protected])
http://www.securityfocus.com/bid/34805 ([email protected])
http://www.securitytracker.com/id?1022218 ([email protected])
http://www.us-cert.gov/cas/techalerts/TA09-133A.html US Government Resource ([email protected])
http://www.vupen.com/english/advisories/2009/1238 Vendor Advisory ([email protected])
http://www.vupen.com/english/advisories/2009/1297 Vendor Advisory ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=490667 ([email protected])
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9633 ([email protected])
http://lists.apple.com/archives/security-announce/2009/May/msg00002.html (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/34978 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/35074 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/35213 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/35214 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/35462 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://security.gentoo.org/glsa/glsa-200905-02.xml (af854a3a-2127-422b-91ae-364da2661108)
http://sourceforge.net/forum/forum.php?forum_id=947983 Patch (af854a3a-2127-422b-91ae-364da2661108)
http://sourceforge.net/mailarchive/forum.php?thread_name=E1LsGx3-00015K-TN%40ddv4jf1.ch3.sourceforge.com&forum_name=cscope-cvs (af854a3a-2127-422b-91ae-364da2661108)
http://sourceforge.net/project/shownotes.php?group_id=4664&release_id=679527 Patch (af854a3a-2127-422b-91ae-364da2661108)
http://support.apple.com/kb/HT3549 (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2009/dsa-1806 (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2009/05/06/9 (af854a3a-2127-422b-91ae-364da2661108)
http://www.redhat.com/support/errata/RHSA-2009-1101.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.redhat.com/support/errata/RHSA-2009-1102.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/34805 (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id?1022218 (af854a3a-2127-422b-91ae-364da2661108)
http://www.us-cert.gov/cas/techalerts/TA09-133A.html US Government Resource (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2009/1238 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2009/1297 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=490667 (af854a3a-2127-422b-91ae-364da2661108)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9633 (af854a3a-2127-422b-91ae-364da2661108)