Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 12 May 2008 16:14:19 -0400 (EDT)
From: "Steven M. Christey" <>
Subject: Re: Multiples vulnerabilities in wordnet

I've assigned CVE-2008-2149 to just deal with the "overflow in a long
command line" as reported for the searchwn function.  This is based on the
comment in the Gentoo bug report that "I have seen that Wordnet is
sometimes used as a backend in e.g. web applications," otherwise might
have dismissed it as just a regular command-line overflow.  (Increasing
application connectivity is making this distinction harder, though.)

If additional detailed research is performed, then other CVEs could be
assigned accordingly.

- Steve

Name: CVE-2008-2149
Status: Candidate
Reference: CONFIRM:

Stack-based buffer overflow in the searchwn function in Wordnet 2.0,
2.1, and 3.0 might allow context-dependent attackers to execute
arbitrary code via a long command line option.  NOTE: this issue
probably does not cross privilege boundaries except in cases in which
Wordnet is used as a back end.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.