CVE-2011-2704 Stack-based buffer overflow in MapServer before 4.10.7 and 5.x before 5.6.7 allows remote attackers to execute arbitrary code via vectors related to OGC filter encoding.
HighCVSS 7.5
EPSS 5.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Stack-based buffer overflow in MapServer before 4.10.7 and 5.x before 5.6.7 allows remote attackers to execute arbitrary code via vectors related to OGC filter encoding.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/mapserver(Debian:12) | < 6.0.1-1 | 6.0.1-1 |
| debian/mapserver(Debian:13) | < 6.0.1-1 | 6.0.1-1 |
| debian/mapserver(Debian:14) | < 6.0.1-1 | 6.0.1-1 |
| osgeo mapserver | <= 4.10.6 | No fix listed |
| osgeo mapserver | = 4.2.0-beta1 | No fix listed |
| osgeo mapserver | = 4.4.0 | No fix listed |
| osgeo mapserver | = 4.4.0-beta1 | No fix listed |
| osgeo mapserver | = 4.4.0-beta2 | No fix listed |
| osgeo mapserver | = 4.4.0-beta3 | No fix listed |
| osgeo mapserver | = 4.6.0 | No fix listed |
| osgeo mapserver | = 4.6.0-beta1 | No fix listed |
| osgeo mapserver | = 4.6.0-beta2 | No fix listed |
| osgeo mapserver | = 4.6.0-beta3 | No fix listed |
| osgeo mapserver | = 4.6.0-rc1 | No fix listed |
| osgeo mapserver | = 4.8.0-beta1 | No fix listed |
| osgeo mapserver | = 4.8.0-beta2 | No fix listed |
| osgeo mapserver | = 4.8.0-beta3 | No fix listed |
| osgeo mapserver | = 4.8.0-rc1 | No fix listed |
| osgeo mapserver | = 4.8.0-rc2 | No fix listed |
| osgeo mapserver | = 4.10.0 | No fix listed |
| osgeo mapserver | = 4.10.0-beta1 | No fix listed |
| osgeo mapserver | = 4.10.0-beta2 | No fix listed |
| osgeo mapserver | = 4.10.0-beta3 | No fix listed |
| osgeo mapserver | = 4.10.0-rc1 | No fix listed |
| osgeo mapserver | = 4.10.1 | No fix listed |
Show 37 more
| Product | Affected versions | Fixed in |
|---|---|---|
| osgeo mapserver | = 4.10.2 | No fix listed |
| osgeo mapserver | = 4.10.3 | No fix listed |
| osgeo mapserver | = 4.10.4 | No fix listed |
| osgeo mapserver | = 4.10.5 | No fix listed |
| osgeo mapserver | = 5.0.0 | No fix listed |
| osgeo mapserver | = 5.0.0-beta1 | No fix listed |
| osgeo mapserver | = 5.0.0-beta2 | No fix listed |
| osgeo mapserver | = 5.0.0-beta3 | No fix listed |
| osgeo mapserver | = 5.0.0-beta4 | No fix listed |
| osgeo mapserver | = 5.0.0-beta5 | No fix listed |
| osgeo mapserver | = 5.0.0-beta6 | No fix listed |
| osgeo mapserver | = 5.0.0-rc1 | No fix listed |
| osgeo mapserver | = 5.0.0-rc2 | No fix listed |
| osgeo mapserver | = 5.2.0 | No fix listed |
| osgeo mapserver | = 5.2.0-beta1 | No fix listed |
| osgeo mapserver | = 5.2.0-beta2 | No fix listed |
| osgeo mapserver | = 5.2.0-beta3 | No fix listed |
| osgeo mapserver | = 5.2.0-beta4 | No fix listed |
| osgeo mapserver | = 5.2.0-rc1 | No fix listed |
| osgeo mapserver | = 5.2.1 | No fix listed |
| osgeo mapserver | = 5.4.0 | No fix listed |
| osgeo mapserver | = 5.4.0-beta1 | No fix listed |
| osgeo mapserver | = 5.4.0-beta2 | No fix listed |
| osgeo mapserver | = 5.4.0-beta3 | No fix listed |
| osgeo mapserver | = 5.4.0-beta4 | No fix listed |
| osgeo mapserver | = 5.4.0-rc1 | No fix listed |
| osgeo mapserver | = 5.4.0-rc2 | No fix listed |
| osgeo mapserver | = 5.4.1 | No fix listed |
| osgeo mapserver | = 5.4.2 | No fix listed |
| osgeo mapserver | = 5.6.0 | No fix listed |
| osgeo mapserver | = 5.6.1 | No fix listed |
| osgeo mapserver | = 5.6.3 | No fix listed |
| umn mapserver | = 5.2.2 | No fix listed |
| umn mapserver | = 5.2.3 | No fix listed |
| umn mapserver | = 5.6.4 | No fix listed |
| umn mapserver | = 5.6.5 | No fix listed |
| umn mapserver | = 5.6.6 | No fix listed |
References
- Debian Security Tracker CVE-2011-2704 vendor-advisory
- [mapserver-users] 20110713 MapServer 6.0.1, 5.6.7 and 4.10.7 releases with security fixes mailing-list patch
- 45257 third-party-advisory vendor-advisory
- 45368 third-party-advisory vendor-advisory
- trac.osgeo.org patch
- DSA-2285 vendor-advisory
- [oss-security] 20110719 CVE Request -- MapServer -- Stack based buffer overflow [was: Re: Re: CVE Request -- MapServer -- SQL injections in OGC filter encoding and in WMS time support.] mailing-list patch
- [oss-security] 20110720 Re: CVE Request -- MapServer -- Stack based buffer overflow [was: Re: Re: CVE Request -- MapServer -- SQL injections in OGC filter encoding and in WMS time support.] mailing-list patch
- 48720 vdb-entry
- bugzilla.redhat.com patch
- mapserver-ogc-bo(68719) vdb-entry