[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 20 Aug 2010 12:52:51 +0200
From: Thomas Biege <thomas@...e.de>
To: oss-security@...ts.openwall.com
Cc: jengelh@...ozas.de
Subject: CVE Request: heap-based buffer overflow in libHX
http://libhx.git.sourceforge.net/git/gitweb.cgi?p=libhx/libhx;a=commitdiff;h=904a46f90dd3f046bfac0b64a5e813d7cd4fca59
string: fixed buffer overflow in HX_split when too few fields are present
Jan Engelhardt [Mon, 16 Aug 2010 17:08:51 +0000 (19:08 +0200)]
When HX_split is called with a maximum number of desired fields (4th
argument != 0), passing in a string that has less fields than that led
to a buffer overrun (write beyond end of malloc'd area).
CVSS Base Score: 10
- Impact Subscore: 10
- Exploitability Subscore: 10
CVSS Temporal Score: 7.4
CVSS Environmental Score: Undefined
Overall CVSS Score: 7.4
CVSS Base vector:: AV:N/AC:L/Au:N/C:C/I:C/A:C
- AV: libHX may be used by network services
- Au: some services may not require authentication
- A: can cause crash when result is freed
CVSS Temporal vectors:: RL:O/RC:C
Affects all versions prior to, and including, 3.5.
--
Thomas Biege <thomas@...e.de>, SUSE LINUX, Security Support & Auditing
SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
