PT-2013-1883 · Swi+1 · Swi-Prolog+1

Jan Lieskovsky + 1 · Publicado 2013-01-04 · Atualizado 2018-03-04 · CVE-2012-6090

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SWI-Prolog versions prior to 6.2.5 SWI-Prolog versions 6.3.x prior to 6.3.7

Description The issue is related to multiple stack-based buffer overflows in the expand function in os/pl-glob.c. This can be exploited by remote attackers using a crafted filename, potentially leading to a denial of service (application crash) or possibly the execution of arbitrary code.

Recommendations For SWI-Prolog versions prior to 6.2.5, update to version 6.2.5 or later. For SWI-Prolog versions 6.3.x prior to 6.3.7, update to version 6.3.7 or later.

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2018-1360

CVE-2012-6090

Produtos afetados

Alt Linux

Swi-Prolog

Referências · 29

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6090 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-06186 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-08774 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2012-6090 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-08771 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-08769 · Nota de Segurança
• https://lists.iai.uni-bonn.de/pipermail/swi-prolog/2012/009428.html · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2013/01/03/7 · Nota
• http://swi-prolog.org/git/pl.git/commitdiff/b2c88972e7515ada025e97e7d3ce3e34f81cf33e · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-6090 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2012-6090 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=891577 · Nota
• https://bdu.fstec.ru/vul/2015-08770 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6089 · Nota de Segurança
• https://packages.altlinux.org/ru/vuln/CVE-2012-6090 · Nota