CVE-2009-2281
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2009-2281
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2009-2281.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2009-2281
- Related
- Published
- 2009-10-23T18:30:00Z
- Modified
- 2025-01-09T23:00:04Z
- Summary
- [none]
- Details
-
Multiple heap-based buffer underflows in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x through 4.10.4 and 5.x before 5.4.2 allow remote attackers to execute arbitrary code via (1) a crafted Content-Length HTTP header or (2) a large HTTP request, related to an integer overflow that triggers a heap-based buffer overflow. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-0840.
- References
-
- http://www.debian.org/security/2009/dsa-1914
- http://security.debian.org/pool/updates/main/m/mapserver/mapserver_4.10.0-5.1+etch4.diff.gz
- http://security.debian.org/pool/updates/main/m/mapserver/mapserver_5.0.3-3+lenny4.diff.gz
- http://trac.osgeo.org/mapserver/browser/tags/rel-5-4-2/mapserver/HISTORY.TXT
- http://trac.osgeo.org/mapserver/ticket/2943
- http://www.openwall.com/lists/oss-security/2009/07/01/1
- http://www.openwall.com/lists/oss-security/2009/07/01/6
- https://security-tracker.debian.org/tracker/CVE-2009-2281
Affected packages
Debian:11 / mapserver
Package
- Name
- mapserver
- Purl
- pkg:deb/debian/mapserver?arch=source
Debian:12 / mapserver
Package
- Name
- mapserver
- Purl
- pkg:deb/debian/mapserver?arch=source
Debian:13 / mapserver
Package
- Name
- mapserver
- Purl
- pkg:deb/debian/mapserver?arch=source