CVE-2009-3617 — Vulnetix

CVE-2009-3617 PUBLISHED CVSS 7.599999904632568 HIGH

Format string vulnerability in the AbstractCommand::onAbort function in src/AbstractCommand.cc in aria2 before 1.6.2, when logging is enabled, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a download URI. NOTE: some of these details are obtained from third party information.

EPSS 14.03% · 94.5th percentile

Risk Scores

CVSS 2.0

7.599999904632568

EPSS Score

14.03%

94.5th percentile

Affected Products

Vendor	Product	Versions
n/a	n/a	n/a
tatsuhiro_tsujikawa	aria2	0.11.3, 0.11.4, 0.11.5

Exploit Intelligence

https://fedorahosted.org/rel-eng/ticket/2495 (circl)
http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/src/AbstractCommand.cc?r1=1539&r2=1572 (circl)
ADV-2009-2960 (circl)
[oss-security] 20091016 CVE Request - aria2 - 1.6.2 (circl)
https://bugzilla.redhat.com/show_bug.cgi?id=529342 (circl)
31732 (circl)
59087 (circl)
[oss-security] 20091016 Re: CVE Request - aria2 - 1.6.2 (circl)
http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NEWS?revision=1586 (circl)

Timeline

Oct 20, 2009 CVE Published
Feb 4, 2022 EPSS Score
Mar 29, 2022 EPSS Score
May 20, 2022 EPSS Score
Sep 4, 2022 EPSS Score
Oct 26, 2022 EPSS Score
Dec 18, 2022 EPSS Score
Feb 3, 2023 EPSS Score
Feb 9, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Apr 3, 2023 EPSS Score
May 25, 2023 EPSS Score

References

https://fedorahosted.org/rel-eng/ticket/2495 url
http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/src/AbstractCommand.cc?r1=1539&r2=1572 url
ADV-2009-2960 vdb
[oss-security] 20091016 CVE Request - aria2 - 1.6.2 mailing-list
https://bugzilla.redhat.com/show_bug.cgi?id=529342 url
31732 third-party-advisory
59087 vdb
[oss-security] 20091016 Re: CVE Request - aria2 - 1.6.2 mailing-list
http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NEWS?revision=1586 url
https://nvd.nist.gov/vuln/detail/CVE-2009-3617 advisory

Open in Interactive Console →