CVE-2015-4556: Input Validation
It was discovered that the string-translate procedure from the data-structures unit can scan beyond the input string's length up to the length of the source strings in the map that's passed to string-translate. This issue was fixed in master 8a46020, and it will make its way into CHICKEN 4.10.
This bug is present in all released versions of CHICKEN.
Upstream patches: http://lists.nongnu.org/archive/html/chicken-hackers/2015-06/msg00037.html http://lists.nongnu.org/archive/html/chicken-hackers/2015-06/txtHKRTbJy12t.txt
CVE request: http://seclists.org/oss-sec/2015/q2/709
Other sources
The string-translate procedure in the data-structures unit in CHICKEN before 4.10.0 allows remote attackers to cause a denial of service (crash).
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-4556?
CVE-2015-4556 is classified as a medium severity vulnerability.
How do I fix CVE-2015-4556?
To fix CVE-2015-4556, upgrade to version 4.10.0 or higher of the CHICKEN package.
What software is affected by CVE-2015-4556?
CVE-2015-4556 affects CHICKEN version 4.9.0 and earlier.
What is the nature of the vulnerability in CVE-2015-4556?
CVE-2015-4556 allows improper handling of input strings in the string-translate* procedure, potentially causing out-of-bounds access.
When was CVE-2015-4556 discovered?
CVE-2015-4556 was discovered and reported in June 2015.