CVE-2012-2091 Multiple buffer overflows in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a....
HighCVSS 9.3
EPSS 6.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple buffer overflows in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) long string in a rotor tag of an aircraft xml model to the Rotor::getValueforFGSet function in src/FDM/YASim/Rotor.cpp or (2) a crafted UDP packet to the SGSocketUDP::read function in simgear/simgear/simgear/io/sg_socket_udp.cxx.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/flightgear(Debian:12) | < 2.6.0-1.1 | 2.6.0-1.1 |
| debian/flightgear(Debian:13) | < 2.6.0-1.1 | 2.6.0-1.1 |
| debian/simgear(Debian:12) | < 2.10.0-3 | 2.10.0-3 |
| debian/simgear(Debian:13) | < 2.10.0-3 | 2.10.0-3 |
| debian/simgear(Debian:14) | < 2.10.0-3 | 2.10.0-3 |
| flightgear | <= 2.6.0 | No fix listed |
| flightgear | = 1.9.1 | No fix listed |
| flightgear | = 2.0.0 | No fix listed |
| simgear | <= 2.6.0 | No fix listed |
| simgear | = 1.9.1 | No fix listed |
| simgear | = 2.0.0 | No fix listed |
References
- Debian Security Tracker CVE-2012-2091 vendor-advisory
- FEDORA-2012-8647 vendor-advisory
- FEDORA-2012-8650 vendor-advisory
- FEDORA-2012-8615 vendor-advisory
- 48780 third-party-advisory vendor-advisory
- [Flightgear-devel] 20120309 Flightgear and Simgear multiple format string vulnerabilities mailing-list
- [Flightgear-devel] 20120320 Re: Flightgear and Simgear multiple format string vulnerabilities mailing-list
- [oss-security] 20120410 Re: CVE Request: FlightGear and Simgear Multiple vulnerabilities mailing-list
- bugzilla.redhat.com
- GLSA-201603-12 vendor-advisory
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking