CVE-2016-6830: Buffer Overflow
The "process-execute" and "process-spawn" procedures in CHICKEN Scheme used fixed-size buffers for holding the arguments and environment variables to use in its execve() call. This would allow user-supplied argument/environment variable lists to trigger a buffer overrun. This affects all releases of CHICKEN up to and including 4.11 (it will be fixed in 4.12 and 5.0, which are not yet released).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6830?
CVE-2016-6830 is classified as a medium severity vulnerability due to the potential for buffer overflow.
How do I fix CVE-2016-6830?
To fix CVE-2016-6830, update CHICKEN Scheme to version 4.11.1 or later.
What versions of CHICKEN Scheme are affected by CVE-2016-6830?
CVE-2016-6830 affects all versions of CHICKEN Scheme up to and including 4.11.0.
What types of attacks can CVE-2016-6830 enable?
CVE-2016-6830 can enable attackers to execute arbitrary code through a buffer overrun.
Is there a workaround for CVE-2016-6830?
There is no known workaround for CVE-2016-6830; the recommended action is to upgrade to a secure version.