CVE-2008-2363 The PartsBatch class in Pan 0.132 and earlier does not properly manage the data structures for Parts batches, which allows remote attackers to cause a denial of service (application crash) and possibl...
HighCVSS 9.3
EPSS 5.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The PartsBatch class in Pan 0.132 and earlier does not properly manage the data structures for Parts batches, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted .nzb file that triggers a heap-based buffer overflow.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pan | <= 0.132 | No fix listed |
| pan | = 0.105 | No fix listed |
| pan | = 0.106 | No fix listed |
| pan | = 0.107 | No fix listed |
| pan | = 0.108 | No fix listed |
| pan | = 0.109 | No fix listed |
| pan | = 0.110 | No fix listed |
| pan | = 0.111 | No fix listed |
| pan | = 0.112 | No fix listed |
| pan | = 0.113 | No fix listed |
| pan | = 0.114 | No fix listed |
| pan | = 0.115 | No fix listed |
| pan | = 0.116 | No fix listed |
| pan | = 0.117 | No fix listed |
| pan | = 0.118 | No fix listed |
| pan | = 0.119 | No fix listed |
| pan | = 0.120 | No fix listed |
| pan | = 0.121 | No fix listed |
| pan | = 0.122 | No fix listed |
| pan | = 0.123 | No fix listed |
| pan | = 0.124 | No fix listed |
| pan | = 0.125 | No fix listed |
| pan | = 0.126 | No fix listed |
| pan | = 0.127 | No fix listed |
| pan | = 0.128 | No fix listed |
Show 6 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pan | = 0.129 | No fix listed |
| pan | = 0.130 | No fix listed |
| pan | = 0.131 | No fix listed |
| debian/pan(Debian:12) | < 0.132-3.1 | 0.132-3.1 |
| debian/pan(Debian:13) | < 0.132-3.1 | 0.132-3.1 |
| debian/pan(Debian:14) | < 0.132-3.1 | 0.132-3.1 |
References
- bugs.gentoo.org patch
- bugzilla.gnome.org patch
- [oss-security] 20080529 CVE-2008-2363: pan - heap overflow mailing-list patch
- 30717 third-party-advisory vendor-advisory
- 31315 third-party-advisory vendor-advisory
- GLSA-200807-15 vendor-advisory
- MDVSA-2008:201 vendor-advisory
- SUSE-SR:2008:013 vendor-advisory
- 29421 patch vdb-entry
- bugzilla.redhat.com
- pan-nzb-bo(42750) vdb-entry
- Debian Security Tracker CVE-2008-2363 vendor-advisory
- bugs.debian.org issue-tracking