CVE-2009-0148
Last modified
CVE-2009-0148 is a vulnerability of currently unknown severity. Multiple buffer overflows in Cscope before 15.7a allow remote attackers to execute arbitrary code via long strings in input such as (1) source-code tokens and (2) pathnames, related to integer overflows in some cases. NOTE: this issue exists because of an incomplete fix for CVE-2004-2541.. EPSS estimates a 6.77% chance of exploitation in the next 30 days.
Description
Multiple buffer overflows in Cscope before 15.7a allow remote attackers to execute arbitrary code via long strings in input such as (1) source-code tokens and (2) pathnames, related to integer overflows in some cases. NOTE: this issue exists because of an incomplete fix for CVE-2004-2541.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cscope | Cscope | 13.0 |
| Cscope | Cscope | 15.0bl2 |
| Cscope | Cscope | 15.1 |
| Cscope | Cscope | 15.3 |
| Cscope | Cscope | 15.4 |
| Cscope | Cscope | 15.5 |
| Cscope | Cscope | 15.6 |
| Cscope | Cscope | 15.7 |
References
- http://secunia.com/advisories/34978Vendor Advisory
- http://secunia.com/advisories/35074Vendor Advisory
- http://secunia.com/advisories/35213Vendor Advisory
- http://secunia.com/advisories/35214Vendor Advisory
- http://secunia.com/advisories/35462Vendor Advisory
- http://www.us-cert.gov/cas/techalerts/TA09-133A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2009/1238Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1297Vendor Advisory
- http://secunia.com/advisories/34978Vendor Advisory
- http://secunia.com/advisories/35074Vendor Advisory
- http://secunia.com/advisories/35213Vendor Advisory
- http://secunia.com/advisories/35214Vendor Advisory
- http://secunia.com/advisories/35462Vendor Advisory
- http://www.us-cert.gov/cas/techalerts/TA09-133A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2009/1238Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1297Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2009-0148?
How severe is CVE-2009-0148?
How do I fix CVE-2009-0148?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2009
- CVE-2009-0142Race condition in AFP Server in Apple Mac OS X 10.5.6 allows…
- CVE-2009-0143Apple iTunes before 8.1 does not properly inform the user ab…
- CVE-2009-0144CFNetwork in Apple Mac OS X 10.5 before 10.5.7 does not prop…
- CVE-2009-0145CoreGraphics in Apple Mac OS X 10.4.11 and 10.5 before 10.5.…
- CVE-2009-0146Multiple buffer overflows in the JBIG2 decoder in Xpdf 3.02p…
- CVE-2009-0147Multiple integer overflows in the JBIG2 decoder in Xpdf 3.02…
- CVE-2009-0149Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 allows local u…
- CVE-2009-0150Stack-based buffer overflow in Apple Mac OS X 10.5 before 10…
- CVE-2009-0151The screen saver in Dock in Apple Mac OS X 10.5 before 10.5.…
- CVE-2009-0152iChat in Apple Mac OS X 10.5 before 10.5.7 disables SSL for …7.5
- CVE-2009-0153International Components for Unicode (ICU) 4.0, 3.6, and oth…
- CVE-2009-0154Heap-based buffer overflow in Apple Type Services (ATS) in A…
Are you affected by CVE-2009-0148?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST