Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 6 May 2009 18:49:22 +0200
From: Tomas Hoger <>
Subject: Re: Old cscope buffer overflow

On Wed, 6 May 2009 11:49:14 -0400 (EDT) "Steven M. Christey"
<> wrote:

> > If you're preparing cscope updates for CVE-2009-0148 and you may
> > still be shipping packages based on 15.5, you may want to have a
> > look at:
> >
> >
> >
> > Steve, as the first public report for this is from 2006:
> >
> >
> >
> > I believe 2006 CVE id is needed here.
> We recently updated CVE-2009-0148 for overflows in cscope before
> 15.7a. Is this the same issue, or do we need a different one?
> This seems to be distinct from CVE-2006-4262 as well...

Different from both.  CVE-2009-0148 is more of a dupe / re-occurrence /
incomplete fix of even older CVE-2004-2541.  Some vendors originally
addressed that via sprintf -> snprintf across whole sources.  Upstream
instead preferred to use "%.*s" with bit of length math to avoid
overflow and not harm portability.  Though the math could int
underflow, still allowing buffer overflow.

BZ#189666 issue was fixed upstream in 15.6.

Tomas Hoger / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.