Buffer overflow in CHICKEN 4.9.0 and 4.9.0.1 may allow remote attackers to execute arbitrary code via the 'select' function.
It was discovered that the string-translate procedure from the data-structures unit can scan beyond the input string's length up to the length of the source strings in the map that's passed to string-translate. This issue was fixed in master 8a46020, and it will make its way into CHICKEN 4.10.
This bug is present in all released versions of CHICKEN.
Upstream patches: http://lists.nongnu.org/archive/html/chicken-hackers/2015-06/msg00037.html http://lists.nongnu.org/archive/html/chicken-hackers/2015-06/txtHKRTbJy12t.txt
CVE request: http://seclists.org/oss-sec/2015/q2/709