Multiple heap-based buffer underflows in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x through 4.10.4 and 5.x before 5.4.2 allow remote attackers to execute arbitrary code via (1) a crafted Content-Length HTTP header or (2) a large HTTP request, related to an integer overflow that triggers a heap-based buffer overflow. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-0840.
Buffer overflow in the msTmpFile function in maputil.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 allows local users to cause a denial of service via vectors involving names of temporary files.
mapserv.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 does not properly restrict the use of CGI command-line arguments that were intended for debugging, which allows remote attackers to have an unspecified impact via crafted arguments.
Multiple SQL injection flaws and one stack based buffer overflow flaw were found in MapServer: [1] http://lists.osgeo.org/pipermail/mapserver-users/2011-July/069430.html
More from [1]:
MapServer developers have discovered flaws in the OGC filter support in MapServer. That code is used in support of WFS, WMS-SLD and SOS specifications.
All versions may be susceptible to SQL injection under certain circumstances. The extent of the vulnerability depends on the MapServer version, relational database and mapfile configuration being used. All users are strongly encouraged to upgrade to these latest releases.
The 5.6.7 and 4.10.7 releases also address one significant potentially exploitable buffer overflow (6.0 branch is not vulneralble).
References: [1] http://lists.osgeo.org/pipermail/mapserver-users/2011-July/069430.html [2] http://trac.osgeo.org/mapserver/ticket/3903 [3] https://bugzilla.redhat.com/showbug.cgi?id=722545 [4] http://www.openwall.com/lists/oss-security/2011/07/19/11 (CVE Request)
Relevant upstream patches: [5] http://trac.osgeo.org/mapserver/attachment/ticket/3903/ticket39036.0.x.patch (for 6.0.x branch) [6] http://trac.osgeo.org/mapserver/attachment/ticket/3903/ticket39035.6.x.patch (for 5.6.x branch) [7] http://trac.osgeo.org/mapserver/attachment/ticket/3903/ticket39035.4.x.patch (for 5.4.x branch) [8] http://trac.osgeo.org/mapserver/attachment/ticket/3903/ticket39035.2.x.patch (for 5.2.x branch) [9] http://trac.osgeo.org/mapserver/attachment/ticket/3903/ticket39035.0.x.patch (for 5.0.x branch) [10] http://trac.osgeo.org/mapserver/attachment/ticket/3903/ticket39034.10.x.patch (for 4.10.x branch)
Stack-based buffer overflow in MapServer before 4.10.7 and 5.x before 5.6.7 allows remote attackers to execute arbitrary code via vectors related to OGC filter encoding.
In MapServer before 7.0.3, OGR driver error messages are too verbose and may leak sensitive information if data connection fails.
MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enforce the MSMAPNOPATH and MSMAPPATTERN restrictions that are intended to control the locations from which a mapfile may be loaded (with MapServer CGI).