CVE-2011-2703 Multiple SQL injection vulnerabilities in MapServer before 4.10.7, 5.x before 5.6.7, and 6.x before 6.0.1 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) OGC filter...
HighCVSS 7.5
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in MapServer before 4.10.7, 5.x before 5.6.7, and 6.x before 6.0.1 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) OGC filter encoding or (2) WMS time support.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/mapserver(Debian:12) | < 6.0.1-1 | 6.0.1-1 |
| debian/mapserver(Debian:13) | < 6.0.1-1 | 6.0.1-1 |
| debian/mapserver(Debian:14) | < 6.0.1-1 | 6.0.1-1 |
| osgeo mapserver | <= 4.10.6 | No fix listed |
| osgeo mapserver | = 4.2.0-beta1 | No fix listed |
| osgeo mapserver | = 4.4.0 | No fix listed |
| osgeo mapserver | = 4.4.0-beta1 | No fix listed |
| osgeo mapserver | = 4.4.0-beta2 | No fix listed |
| osgeo mapserver | = 4.4.0-beta3 | No fix listed |
| osgeo mapserver | = 4.6.0 | No fix listed |
| osgeo mapserver | = 4.6.0-beta1 | No fix listed |
| osgeo mapserver | = 4.6.0-beta2 | No fix listed |
| osgeo mapserver | = 4.6.0-beta3 | No fix listed |
| osgeo mapserver | = 4.6.0-rc1 | No fix listed |
| osgeo mapserver | = 4.8.0-beta1 | No fix listed |
| osgeo mapserver | = 4.8.0-beta2 | No fix listed |
| osgeo mapserver | = 4.8.0-beta3 | No fix listed |
| osgeo mapserver | = 4.8.0-rc1 | No fix listed |
| osgeo mapserver | = 4.8.0-rc2 | No fix listed |
| osgeo mapserver | = 4.10.0 | No fix listed |
| osgeo mapserver | = 4.10.0-beta1 | No fix listed |
| osgeo mapserver | = 4.10.0-beta2 | No fix listed |
| osgeo mapserver | = 4.10.0-beta3 | No fix listed |
| osgeo mapserver | = 4.10.0-rc1 | No fix listed |
| osgeo mapserver | = 4.10.1 | No fix listed |
Show 47 more
| Product | Affected versions | Fixed in |
|---|---|---|
| osgeo mapserver | = 4.10.2 | No fix listed |
| osgeo mapserver | = 4.10.3 | No fix listed |
| osgeo mapserver | = 4.10.4 | No fix listed |
| osgeo mapserver | = 4.10.5 | No fix listed |
| osgeo mapserver | = 5.0.0 | No fix listed |
| osgeo mapserver | = 5.0.0-beta1 | No fix listed |
| osgeo mapserver | = 5.0.0-beta2 | No fix listed |
| osgeo mapserver | = 5.0.0-beta3 | No fix listed |
| osgeo mapserver | = 5.0.0-beta4 | No fix listed |
| osgeo mapserver | = 5.0.0-beta5 | No fix listed |
| osgeo mapserver | = 5.0.0-beta6 | No fix listed |
| osgeo mapserver | = 5.0.0-rc1 | No fix listed |
| osgeo mapserver | = 5.0.0-rc2 | No fix listed |
| osgeo mapserver | = 5.2.0 | No fix listed |
| osgeo mapserver | = 5.2.0-beta1 | No fix listed |
| osgeo mapserver | = 5.2.0-beta2 | No fix listed |
| osgeo mapserver | = 5.2.0-beta3 | No fix listed |
| osgeo mapserver | = 5.2.0-beta4 | No fix listed |
| osgeo mapserver | = 5.2.0-rc1 | No fix listed |
| osgeo mapserver | = 5.2.1 | No fix listed |
| osgeo mapserver | = 5.4.0 | No fix listed |
| osgeo mapserver | = 5.4.0-beta1 | No fix listed |
| osgeo mapserver | = 5.4.0-beta2 | No fix listed |
| osgeo mapserver | = 5.4.0-beta3 | No fix listed |
| osgeo mapserver | = 5.4.0-beta4 | No fix listed |
| osgeo mapserver | = 5.4.0-rc1 | No fix listed |
| osgeo mapserver | = 5.4.0-rc2 | No fix listed |
| osgeo mapserver | = 5.4.1 | No fix listed |
| osgeo mapserver | = 5.4.2 | No fix listed |
| osgeo mapserver | = 5.6.0 | No fix listed |
| osgeo mapserver | = 5.6.1 | No fix listed |
| osgeo mapserver | = 5.6.3 | No fix listed |
| umn mapserver | = 5.2.2 | No fix listed |
| umn mapserver | = 5.2.3 | No fix listed |
| umn mapserver | = 5.6.4 | No fix listed |
| umn mapserver | = 5.6.5 | No fix listed |
| umn mapserver | = 5.6.6 | No fix listed |
| umn mapserver | = 6.0.0 | No fix listed |
| umn mapserver | = 6.0.0-beta1 | No fix listed |
| umn mapserver | = 6.0.0-beta2 | No fix listed |
| umn mapserver | = 6.0.0-beta3 | No fix listed |
| umn mapserver | = 6.0.0-beta4 | No fix listed |
| umn mapserver | = 6.0.0-beta5 | No fix listed |
| umn mapserver | = 6.0.0-beta6 | No fix listed |
| umn mapserver | = 6.0.0-beta7 | No fix listed |
| umn mapserver | = 6.0.0-rc1 | No fix listed |
| umn mapserver | = 6.0.0-rc2 | No fix listed |
References
- Debian Security Tracker CVE-2011-2703 vendor-advisory
- [mapserver-users] 20110713 MapServer 6.0.1, 5.6.7 and 4.10.7 releases with security fixes mailing-list patch
- 45257 third-party-advisory vendor-advisory
- 45318 third-party-advisory vendor-advisory
- 45368 third-party-advisory vendor-advisory
- trac.osgeo.org patch
- DSA-2285 vendor-advisory
- [oss-security] 20110719 CVE Request -- MapServer -- SQL injections in OGC filter encoding and in WMS time support. mailing-list patch
- [oss-security] 20110719 CVE Request -- MapServer -- Stack based buffer overflow [was: Re: Re: CVE Request -- MapServer -- SQL injections in OGC filter encoding and in WMS time support.] mailing-list patch
- [oss-security] 20110720 Re: CVE Request -- MapServer -- Stack based buffer overflow [was: Re: Re: CVE Request -- MapServer -- SQL injections in OGC filter encoding and in WMS time support.] mailing-list patch
- 48720 vdb-entry
- bugzilla.redhat.com patch
- bugzilla.redhat.com patch
- mapserver-multiple-sql-injection(68682) vdb-entry