Date: Wed, 6 May 2009 11:42:09 -0400 (EDT) From: "Steven M. Christey" <coley@...us.mitre.org> To: oss-security@...ts.openwall.com cc: "Steven M. Christey" <coley@...us.mitre.org> Subject: Re: CVE request: file security issue ====================================================== Name: CVE-2009-1515 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1515 Reference: MISC:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=515603 Reference: MISC:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=525820 Reference: CONFIRM:ftp://ftp.astron.com/pub/file/file-5.01.tar.gz Reference: BID:34745 Reference: URL:http://www.securityfocus.com/bid/34745 Reference: OSVDB:54100 Reference: URL:http://www.osvdb.org/54100 Reference: SECUNIA:34881 Reference: URL:http://secunia.com/advisories/34881 Heap-based buffer overflow in the cdf_read_sat function in src/cdf.c in Christos Zoulas file 5.00 allows user-assisted remote attackers to execute arbitrary code via a crafted compound document file, as demonstrated by a .msi, .doc, or .mpp file. NOTE: some of these details are obtained from third party information.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.