PT-2012-1500 · Gypsy · Gypsy

Kees Cook · Published 2012-08-13 · Updated 2013-12-13 · CVE-2011-0524

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions gypsy version 0.8

Description The issue is related to multiple buffer overflows in the NMEA parser, located in the nmea-gen.c file. This can be exploited by local users to cause a denial of service, resulting in a crash. The vulnerability is connected to unspecified vectors related to the sprintf function.

Recommendations For gypsy version 0.8, consider applying patches or updates that address the buffer overflows in the NMEA parser to prevent denial of service attacks. As a temporary workaround, restrict access to the NMEA parser functionality until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2011-0524

Affected Products

Gypsy

References · 10

• http://lists.opensuse.org/opensuse-updates/2012-07/msg00034.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0524 · Security Note
• http://secunia.com/advisories/49991 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106919.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106927.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107020.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/01/25/10 · Note
• https://bugs.freedesktop.org/show_bug.cgi?id=33431 · Note
• https://bugs.launchpad.net/ubuntu/+source/gypsy/+bug/690323 · Note
• http://openwall.com/lists/oss-security/2011/01/24/10 · Note