CVE-2013-4385 Buffer overflow in the "read-string!" procedure in the "extras" unit in CHICKEN stable before 4.8.0.5 and development snapshots before 4.8.3 allows remote attackers to cause a denial of service (memor...
HighCVSS 7.5
EPSS 3.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in the "read-string!" procedure in the "extras" unit in CHICKEN stable before 4.8.0.5 and development snapshots before 4.8.3 allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute arbitrary code via a "#f" value in the NUM argument.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/chicken(Debian:12) | < 4.8.0.5-1 | 4.8.0.5-1 |
| debian/chicken(Debian:13) | < 4.8.0.5-1 | 4.8.0.5-1 |
| debian/chicken(Debian:14) | < 4.8.0.5-1 | 4.8.0.5-1 |
| call-cc chicken | <= 4.8.0.4 | No fix listed |
| call-cc chicken | = 3.0.0 | No fix listed |
| call-cc chicken | = 3.1.0 | No fix listed |
| call-cc chicken | = 3.2.0 | No fix listed |
| call-cc chicken | = 3.3.0 | No fix listed |
| call-cc chicken | = 3.4.0 | No fix listed |
| call-cc chicken | = 4.0.0 | No fix listed |
| call-cc chicken | = 4.1.0 | No fix listed |
| call-cc chicken | = 4.2.0 | No fix listed |
| call-cc chicken | = 4.3.0 | No fix listed |
| call-cc chicken | = 4.4.0 | No fix listed |
| call-cc chicken | = 4.5.0 | No fix listed |
| call-cc chicken | = 4.6.0 | No fix listed |
| call-cc chicken | = 4.7.0 | No fix listed |
| call-cc chicken | = 4.7.0.6 | No fix listed |
| call-cc chicken | = 4.8.0 | No fix listed |
| call-cc chicken | = 4.8.0.1 | No fix listed |
| call-cc chicken | = 4.8.0.2 | No fix listed |
| call-cc chicken | = 4.8.0.3 | No fix listed |
| call-cc chicken | <= 4.8.1 | No fix listed |
| call-cc chicken | = 4.3.3 | No fix listed |
| call-cc chicken | = 4.3.4 | No fix listed |
Show 24 more
| Product | Affected versions | Fixed in |
|---|---|---|
| call-cc chicken | = 4.3.5 | No fix listed |
| call-cc chicken | = 4.3.6 | No fix listed |
| call-cc chicken | = 4.3.7 | No fix listed |
| call-cc chicken | = 4.4.3 | No fix listed |
| call-cc chicken | = 4.4.4 | No fix listed |
| call-cc chicken | = 4.4.5 | No fix listed |
| call-cc chicken | = 4.4.6 | No fix listed |
| call-cc chicken | = 4.5.2 | No fix listed |
| call-cc chicken | = 4.5.5 | No fix listed |
| call-cc chicken | = 4.5.6 | No fix listed |
| call-cc chicken | = 4.5.7 | No fix listed |
| call-cc chicken | = 4.6.1 | No fix listed |
| call-cc chicken | = 4.6.2 | No fix listed |
| call-cc chicken | = 4.6.3 | No fix listed |
| call-cc chicken | = 4.6.5 | No fix listed |
| call-cc chicken | = 4.6.6 | No fix listed |
| call-cc chicken | = 4.6.7 | No fix listed |
| call-cc chicken | = 4.7.2 | No fix listed |
| call-cc chicken | = 4.7.3 | No fix listed |
| call-cc chicken | = 4.7.4 | No fix listed |
| call-cc chicken | = 4.8.0-rc1 | No fix listed |
| call-cc chicken | = 4.8.0-rc2 | No fix listed |
| call-cc chicken | = 4.8.0-rc3 | No fix listed |
| call-cc chicken | = 4.8.0-rc4 | No fix listed |
References
- Debian Security Tracker CVE-2013-4385 vendor-advisory
- [chicken-announce] 20131003 Chicken 4.8.0.5 released mailing-list patch
- [chicken-announce] 20130926 [SECURITY] Buffer overrun in some uses of read-string! procedure from "extras" mailing-list patch
- [chicken-announce] 20130927 Re: [SECURITY] Buffer overrun in some uses of read-string! procedure from "extras" mailing-list
- 55009 third-party-advisory vendor-advisory
- 62690 vdb-entry
- GLSA-201612-54 vendor-advisory
- bugs.debian.org issue-tracking