CVE-2012-6089 Multiple stack-based buffer overflows in the canoniseFileName function in os/pl-os.c in SWI-Prolog before 6.2.5 and 6.3.x before 6.3.7 allow remote attackers to cause a denial of service (application....
HighCVSS 7.5
EPSS 4.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple stack-based buffer overflows in the canoniseFileName function in os/pl-os.c in SWI-Prolog before 6.2.5 and 6.3.x before 6.3.7 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted filename.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/swi-prolog(Debian:12) | < 5.10.4-5 | 5.10.4-5 |
| debian/swi-prolog(Debian:13) | < 5.10.4-5 | 5.10.4-5 |
| debian/swi-prolog(Debian:14) | < 5.10.4-5 | 5.10.4-5 |
| swi-prolog | <= 6.2.4 | No fix listed |
| swi-prolog | = 5.6.50 | No fix listed |
| swi-prolog | = 5.6.51 | No fix listed |
| swi-prolog | = 5.6.52 | No fix listed |
| swi-prolog | = 5.6.53 | No fix listed |
| swi-prolog | = 5.6.54 | No fix listed |
| swi-prolog | = 5.6.55 | No fix listed |
| swi-prolog | = 5.6.56 | No fix listed |
| swi-prolog | = 5.6.57 | No fix listed |
| swi-prolog | = 5.6.58 | No fix listed |
| swi-prolog | = 5.6.59 | No fix listed |
| swi-prolog | = 5.6.61 | No fix listed |
| swi-prolog | = 5.6.62 | No fix listed |
| swi-prolog | = 5.6.63 | No fix listed |
| swi-prolog | = 5.6.64 | No fix listed |
| swi-prolog | = 5.8.0 | No fix listed |
| swi-prolog | = 5.8.1 | No fix listed |
| swi-prolog | = 5.8.2 | No fix listed |
| swi-prolog | = 5.8.3 | No fix listed |
| swi-prolog | = 5.10.0 | No fix listed |
| swi-prolog | = 5.10.1 | No fix listed |
| swi-prolog | = 5.10.2 | No fix listed |
Show 17 more
| Product | Affected versions | Fixed in |
|---|---|---|
| swi-prolog | = 5.10.3 | No fix listed |
| swi-prolog | = 5.10.4 | No fix listed |
| swi-prolog | = 5.10.5 | No fix listed |
| swi-prolog | = 6.0.0 | No fix listed |
| swi-prolog | = 6.0.1 | No fix listed |
| swi-prolog | = 6.0.2 | No fix listed |
| swi-prolog | = 6.2.0 | No fix listed |
| swi-prolog | = 6.2.1 | No fix listed |
| swi-prolog | = 6.2.2 | No fix listed |
| swi-prolog | = 6.2.3 | No fix listed |
| swi-prolog | = 6.3.0 | No fix listed |
| swi-prolog | = 6.3.1 | No fix listed |
| swi-prolog | = 6.3.2 | No fix listed |
| swi-prolog | = 6.3.3 | No fix listed |
| swi-prolog | = 6.3.4 | No fix listed |
| swi-prolog | = 6.3.5 | No fix listed |
| swi-prolog | = 6.3.6 | No fix listed |
References
- Debian Security Tracker CVE-2012-6089 vendor-advisory
- [oss-security] 20130103 Re: CVE Request - SWI-Prolog / pl (X < 6.2.5): Multiple (stack-based) buffer overflows in patch canonisation code and when expanding file-names with long paths mailing-list
- www.swi-prolog.org patch
- bugzilla.redhat.com
- [swi-prolog] 20121221 [SWIPL] Ann: SWI-Prolog 6.3.7 and 6.2.5 mailing-list vendor-advisory
- bugs.debian.org issue-tracking