PT-2012-1500 · Gypsy · Gypsy

Kees Cook · Publicado 2012-08-13 · Atualizado 2013-12-13 · CVE-2011-0524

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions gypsy version 0.8

Description The issue is related to multiple buffer overflows in the NMEA parser, located in the nmea-gen.c file. This can be exploited by local users to cause a denial of service, resulting in a crash. The vulnerability is connected to unspecified vectors related to the sprintf function.

Recommendations For gypsy version 0.8, consider applying patches or updates that address the buffer overflows in the NMEA parser to prevent denial of service attacks. As a temporary workaround, restrict access to the NMEA parser functionality until a patch is available.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2011-0524

Produtos afetados

Gypsy

Referências · 10

• http://openwall.com/lists/oss-security/2011/01/25/10 · Nota
• http://lists.opensuse.org/opensuse-updates/2012-07/msg00034.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-0524 · Nota de Segurança
• https://bugs.freedesktop.org/show_bug.cgi?id=33431 · Nota
• https://bugs.launchpad.net/ubuntu/+source/gypsy/+bug/690323 · Nota
• http://secunia.com/advisories/49991 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2011/01/24/10 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106919.html · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106927.html · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107020.html · Aviso do Fabricante