Date: Fri, 20 Aug 2010 12:52:51 +0200 From: Thomas Biege <thomas@...e.de> To: oss-security@...ts.openwall.com Cc: jengelh@...ozas.de Subject: CVE Request: heap-based buffer overflow in libHX http://libhx.git.sourceforge.net/git/gitweb.cgi?p=libhx/libhx;a=commitdiff;h=904a46f90dd3f046bfac0b64a5e813d7cd4fca59 string: fixed buffer overflow in HX_split when too few fields are present Jan Engelhardt [Mon, 16 Aug 2010 17:08:51 +0000 (19:08 +0200)] When HX_split is called with a maximum number of desired fields (4th argument != 0), passing in a string that has less fields than that led to a buffer overrun (write beyond end of malloc'd area). CVSS Base Score: 10 - Impact Subscore: 10 - Exploitability Subscore: 10 CVSS Temporal Score: 7.4 CVSS Environmental Score: Undefined Overall CVSS Score: 7.4 CVSS Base vector:: AV:N/AC:L/Au:N/C:C/I:C/A:C - AV: libHX may be used by network services - Au: some services may not require authentication - A: can cause crash when result is freed CVSS Temporal vectors:: RL:O/RC:C Affects all versions prior to, and including, 3.5. -- Thomas Biege <thomas@...e.de>, SUSE LINUX, Security Support & Auditing SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ