CVE-2007-0157 Array index error in the uri_lookup function in the URI parser for neon 0.26.0 to 0.26.2, possibly only on 64-bit platforms, allows remote malicious servers to cause a denial of service (crash) via a....
HighCVSS 7.8
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Array index error in the uri_lookup function in the URI parser for neon 0.26.0 to 0.26.2, possibly only on 64-bit platforms, allows remote malicious servers to cause a denial of service (crash) via a URI with non-ASCII characters, which triggers a buffer under-read due to a type conversion error that generates a negative index.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| neon | = 0.26.0 | No fix listed |
| neon | = 0.26.1 | No fix listed |
| neon | = 0.26.2 | No fix listed |
References
- bugs.debian.org
- bugs.debian.org
- [cadaver] 20070123 release 0.22.5 mailing-list
- [neon] 20070107 invalid chars cause sigserv in neon mailing-list
- 39247 vdb-entry
- 23751 third-party-advisory
- 23763 third-party-advisory
- 23984 third-party-advisory
- MDKSA-2007:013 vendor-advisory
- SUSE-SR:2007:002 vendor-advisory
- 22035 vdb-entry
- ADV-2007-0172 vdb-entry
- ADV-2007-0362 vdb-entry
- www.webdav.org