VDB
CVE-2009-2281
CVE-2009-2281
PUBLISHED
CVSS 10 CRITICAL
Multiple heap-based buffer underflows in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x through 4.10.4 and 5.x before 5.4.2 allow remote attackers to execute arbitrary code via (1) a crafted Content-Length HTTP header or (2) a large HTTP request, related to an integer overflow that triggers a heap-based buffer overflow. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-0840.
EPSS 5.95% · 93.3th percentile
Risk Scores
CVSS 2.0
10
EPSS Score
5.95%
93.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| umn | mapserver | 4.0 |
| osgeo | mapserver | 4.2.0, 4.4.0, 4.10.1 |
| n/a | n/a | * |
Timeline
- Oct 23, 2009 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- Jul 13, 2022 EPSS Score
- Sep 5, 2022 EPSS Score
- Dec 20, 2022 EPSS Score
- Feb 11, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- May 27, 2023 EPSS Score
- Jul 19, 2023 EPSS Score
- Nov 2, 2023 EPSS Score
- Dec 25, 2023 EPSS Score
References
- http://security.debian.org/pool/updates/main/m/mapserver/mapserver_4.10.0-5.1+etch4.diff.gz url
- http://trac.osgeo.org/mapserver/browser/tags/rel-5-4-2/mapserver/HISTORY.TXT url
- http://trac.osgeo.org/mapserver/ticket/2943 url
- http://security.debian.org/pool/updates/main/m/mapserver/mapserver_5.0.3-3+lenny4.diff.gz url
- [oss-security] 20090701 Re: incorrect upstream fix for CVE-2009-0840 (mapserver) mailing-list
- [oss-security] 20090701 Re: incorrect upstream fix for CVE-2009-0840 (mapserver) mailing-list
- DSA-1914 vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2009-2281 advisory