CVE-2009-1577: Buffer Overflow

Reference Links

• http://www.openwall.com/lists/oss-security/2009/05/05/1
• https://bugzilla.redhat.com/show_bug.cgi?id=189666
• http://www.openwall.com/lists/oss-security/2009/05/06/9
• http://cscope.cvs.sourceforge.net/viewvc/cscope/cscope/src/find.c?r1=1.18&r2=1.19
• http://www.openwall.com/lists/oss-security/2009/05/06/10
• https://bugzilla.redhat.com/show_bug.cgi?id=499174
• http://cscope.cvs.sourceforge.net/viewvc/cscope/cscope/src/find.c?view=log#rev1.19
• http://cvs.fedoraproject.org/viewvc/rpms/cscope/devel/cscope-15.5-putstring-overflow.patch
• http://secunia.com/advisories/35213
• http://security.gentoo.org/glsa/glsa-200905-02.xml
• http://www.redhat.com/support/errata/RHSA-2009-1101.html
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50366
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9837
• https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=189666
• https://access.redhat.com/security/cve/CVE-2009-1577
• https://rhn.redhat.com/errata/RHSA-2009-1101.html
• https://www.cve.org/CVERecord?id=CVE-2009-1577 https://nvd.nist.gov/vuln/detail/CVE-2009-1577
• https://access.redhat.com/errata/RHSA-2009:1101
• https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-1577.json

Parent vulnerabilities

(Appears in the following advisories)

• RHSA-2009:1101

Frequently Asked Questions

• What is the severity of CVE-2009-1577?

  CVE-2009-1577 has a high severity due to potential remote code execution via stack-based buffer overflows.

• How do I fix CVE-2009-1577?

  To fix CVE-2009-1577, update Cscope to version 15.6 or later, which addresses the buffer overflow vulnerabilities.

• What versions of Cscope are affected by CVE-2009-1577?

  CVE-2009-1577 affects Cscope versions prior to 15.6, including 15.0bl2, 15.1, 15.3, 15.4, and 15.5.

• What type of attack does CVE-2009-1577 allow?

  CVE-2009-1577 allows user-assisted remote attackers to execute arbitrary code by supplying a long function name or symbol.

• Who can exploit the vulnerabilities described in CVE-2009-1577?

  The vulnerabilities in CVE-2009-1577 can be exploited by remote attackers if a victim is tricked into using a specially crafted source-code file.