REDHAT-BUG-499174: Buffer Overflow
A stack-based buffer overflow existed in cscope's putstring function in cscope's versions prior to 15.6. A long function or symbol name in source code file could result in cscope crash or code execution when searching the source code for any function or symbol name.
Issue was originally reported via bug #189666, it can be reproduced using memcheck/tests/match-overrun.c from valgrind source tarball.
In cscope 15.6, putstring was replaced with function fetchstringfromdbase, which accepts target buffer size as its argument.
Upstream commit: http://cscope.cvs.sourceforge.net/viewvc/cscope/cscope/src/find.c?view=log#rev1.19
Patch, which was used in Fedora cscope packages and is used in cscope packages in Red Hat Enterprise Linux 5: http://cvs.fedoraproject.org/viewvc/rpms/cscope/devel/cscope-15.5-putstring-overflow.patch
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-499174?
REDHAT-BUG-499174 is a critical vulnerability due to stack-based buffer overflow that can lead to application crash or potential code execution.
How do I fix REDHAT-BUG-499174?
To fix REDHAT-BUG-499174, upgrade cscope to version 15.6 or later.
What causes REDHAT-BUG-499174?
REDHAT-BUG-499174 is caused by a stack-based buffer overflow in the putstring function of cscope when handling long function or symbol names.
Which versions of cscope are affected by REDHAT-BUG-499174?
Versions of cscope prior to 15.6 are affected by REDHAT-BUG-499174.
What are the potential impacts of REDHAT-BUG-499174?
The potential impacts of REDHAT-BUG-499174 include software crashes and remote code execution vulnerabilities.