From cbdfab30924b173c337fd44618ca8ca13d5f34eb Mon Sep 17 00:00:00 2001 From: mnag Date: Tue, 23 May 2006 15:20:45 +0000 Subject: cscope -- buffer overflow vulnerabilities --- security/vuxml/vuln.xml | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) (limited to 'security') diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 578867a3466..8a237a8d4b4 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,38 @@ Note: Please add new entries to the beginning of this file. --> + + cscope -- buffer overflow vulnerabilities + + + cscope + 15.5_2 + + + + +

Jason Duell reports:

+
Cscope contains an alarming number of buffer overflow + vulnerabilities. By a rough count, there are at least 48 places + where we blindly sprintf() a file name into a fixed-length buffer + of size PATHLEN without checking to see if the file's name + is <= PATHLEN. We do similar things with environment variable + values.
+

+ + + + CVE-2004-2541 + http://sourceforge.net/tracker/index.php?func=detail&aid=1064875&group_id=4664&atid=104664 + http://secunia.com/advisories/13237 + + + 2004-11-11 + 2006-05-23 + + + coppermine -- Multiple File Extensions Vulnerability -- cgit