moinejf abcm2ps 8.13.20 is affected by: Incorrect Access Control. The impact is: Allows attackers to cause a denial of service attack via a crafted file. The component is: front.c, function txtadd. The fixed version is: after commit commit 08aef597656d065e86075f3d53fda89765845eae.

Stack-based buffer overflow in the getkey function in parse.c in abcm2ps through 8.13.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.

Stack-based buffer overflow in the delayedoutput function in music.c in abcm2ps through 8.13.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.

Multiple unspecified vulnerabilities in abcm2ps before 5.9.13 have unknown impact and attack vectors, a different issue than CVE-2010-3441.

Abcm2ps upstream has released latest v5.9.13 version, fixing "yet more multiple unspecified vulnerabilities": [1] http://moinejf.free.fr/abcm2ps-5.txt

Current versions of abcm2ps package, present in Fedora release of 11, 12, and 13, are v5.9.5 based (and potentially vulnerable).

Please rebase to new version to overcome these.

Abcm2ps upstream has released: [1] http://moinejf.free.fr/ [2] http://moinejf.free.fr/abcm2ps-5.9.12.tar.gz

latest v5.9.12 version, addressing "some security vulnerabilities" [3] http://moinejf.free.fr/abcm2ps-5.txt

References: [4] http://secunia.com/advisories/39345/

Requests for CVE(s) and further flaw(s) information: [5] http://www.openwall.com/lists/oss-security/2010/04/08/5 [6] http://www.openwall.com/lists/oss-security/2010/04/08/6

Buffer overflow in the putwords function in subs.c for abcm2ps 3.7.20 allows remote attackers to execute arbitrary code via crafted ABC files.