CVEvulnerability

CVE-2009-2281

10.0 HIGH Published 2009-10-23 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2009-10-23
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-119

Description

Multiple heap-based buffer underflows in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x through 4.10.4 and 5.x before 5.4.2 allow remote attackers to execute arbitrary code via (1) a crafted Content-Length HTTP header or (2) a large HTTP request, related to an integer overflow that triggers a heap-based buffer overflow. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-0840.

Affected configurations

• osgeo mapserver 4.2.0 • osgeo mapserver 4.4.0 • osgeo mapserver 4.6.0 • osgeo mapserver 4.8.0 • osgeo mapserver 4.10.0 • osgeo mapserver 4.10.1 • osgeo mapserver 4.10.2 • osgeo mapserver 4.10.3 • osgeo mapserver 4.10.4 • osgeo mapserver 5.0.0 • osgeo mapserver 5.2.0 • osgeo mapserver 5.4.0 • osgeo mapserver 5.4.1 • umn mapserver 4.0

Related

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References