CVE-2012-4426 Multiple format string vulnerabilities in mcrypt 2.6.8 and earlier might allow user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involv...
MediumCVSS 6.8
EPSS 4.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple format string vulnerabilities in mcrypt 2.6.8 and earlier might allow user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involving (1) errors.c or (2) mcrypt.c.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/mcrypt(Debian:12) | < 2.6.8-1.1 | 2.6.8-1.1 |
| debian/mcrypt(Debian:13) | < 2.6.8-1.1 | 2.6.8-1.1 |
| debian/mcrypt(Debian:14) | < 2.6.8-1.1 | 2.6.8-1.1 |
| mcrypt | <= 2.6.8 | No fix listed |
| mcrypt | = 2.6.4 | No fix listed |
| mcrypt | = 2.6.5 | No fix listed |
| mcrypt | = 2.6.6 | No fix listed |
| mcrypt | = 2.6.7 | No fix listed |
References
- Debian Security Tracker CVE-2012-4426 vendor-advisory
- [oss-security] 20120906 Re: CVE request - mcrypt buffer overflow flaw mailing-list
- [oss-security] 20120906 Re: CVE request - mcrypt buffer overflow flaw mailing-list
- [oss-security] 20120910 Re: CVE request - mcrypt buffer overflow flaw mailing-list
- [oss-security] 20120913 Re: CVE request - mcrypt buffer overflow flaw mailing-list
- 55557 vdb-entry