Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 5 Nov 2008 09:07:23 +0100
From: Thomas Biege <>
Subject: CVE request: libcdaudio

we need a CVE-ID for a buffer overflow in libcdaudio.
It is a remotely exploitable heap-based buffer overflow.

--- src/cddb.c
+++ src/cddb.c
@@ -1679,7 +1679,7 @@ cddb_read_disc_data(int cd_desc, struct disc_data

       while(!feof(cddb_data)) {
-       fgets(inbuffer, 512, cddb_data);
+       fgets(inbuffer, 256, cddb_data);
        cddb_process_line(inbuffer, data);

 Thomas Biege <>, SUSE LINUX, Security Support & Auditing
 SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)
           Hamming's Motto:
           The purpose of computing is insight, not numbers.
                                -- Richard W. Hamming

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ