CVE-2009-2281

描述

Multiple heap-based buffer underflows in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x through 4.10.4 and 5.x before 5.4.2 allow remote attackers to execute arbitrary code via (1) a crafted Content-Length HTTP header or (2) a large HTTP request, related to an integer overflow that triggers a heap-based buffer overflow. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-0840.

如何修補 CVE-2009-2281

要修補 CVE-2009-2281,請將受影響套件升級到下列已修補版本。

• Debian/mapserver—升級至 5.4.2-1 或更新版本

CVE-2009-2281 正在被利用嗎?

中等 — EPSS 為 5.9%,可持續追蹤但非最高優先。

受影響套件(1)

• from 0, < 5.4.2-1

參考連結(1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2009-2281