CVE-2009-1255

The process_stat function in (1) Memcached before 1.2.8 and (2) MemcacheDB 1.2.0 discloses (a) the contents of /proc/self/maps in response to a stats maps command and (b) memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain sensitive information such as the locations of memory regions, and defeat ASLR protection, by sending a command to the daemon's TCP port.

• CWE-200

• http://archives.neohapsis.com/archives/fulldisclosure/2009-04/0282.html
• http://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98&r=98
• http://code.google.com/p/memcachedb/source/detail?r=98
• http://code.google.com/p/memcachedb/source/diff?spec=svn98&r=98&format=side&path=/trunk/memcachedb.cExploit, Patch
• http://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40e
• http://osvdb.org/54127
• http://secunia.com/advisories/34915Vendor Advisory
• http://secunia.com/advisories/34932Vendor Advisory
• http://secunia.com/advisories/35175
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:105
• http://www.positronsecurity.com/advisories/2009-001.htmlExploit
• http://www.securityfocus.com/archive/1/503064/100/0/threaded
• http://www.securityfocus.com/bid/34756
• http://www.securitytracker.com/id?1022140
• http://www.vupen.com/english/advisories/2009/1196Vendor Advisory
• http://www.vupen.com/english/advisories/2009/1197Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50221
• https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00851.html
• https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01256.html
• http://archives.neohapsis.com/archives/fulldisclosure/2009-04/0282.html
• http://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98&r=98
• http://code.google.com/p/memcachedb/source/detail?r=98
• http://code.google.com/p/memcachedb/source/diff?spec=svn98&r=98&format=side&path=/trunk/memcachedb.cExploit, Patch
• http://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40e
• http://osvdb.org/54127
• http://secunia.com/advisories/34915Vendor Advisory
• http://secunia.com/advisories/34932Vendor Advisory
• http://secunia.com/advisories/35175
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:105
• http://www.positronsecurity.com/advisories/2009-001.htmlExploit
• http://www.securityfocus.com/archive/1/503064/100/0/threaded
• http://www.securityfocus.com/bid/34756
• http://www.securitytracker.com/id?1022140
• http://www.vupen.com/english/advisories/2009/1196Vendor Advisory
• http://www.vupen.com/english/advisories/2009/1197Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50221
• https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00851.html
• https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01256.html

Published

Apr 30, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-1249Cross-site scripting (XSS) vulnerability in Feed element map…
• CVE-2009-1250The cache manager in the client in OpenAFS 1.0 through 1.4.8…
• CVE-2009-1251Heap-based buffer overflow in the cache manager in the clien…
• CVE-2009-1252Stack-based buffer overflow in the crypto_recv function in n…
• CVE-2009-1253James Stone Tunapie 2.1 allows local users to overwrite arbi…
• CVE-2009-1254James Stone Tunapie 2.1 allows remote attackers to execute a…
• CVE-2009-1256SQL injection vulnerability in FlexCMS 2.5 allows remote att…
• CVE-2009-1257Heap-based buffer overflow in Magic ISO Maker 5.5 build 0274…
• CVE-2009-1258SQL injection vulnerability in the RD-Autos (com_rdautos) co…
• CVE-2009-1259SQL injection vulnerability in inc/bb/topic.php in Insane Vi…
• CVE-2009-1260Multiple stack-based buffer overflows in UltraISO 9.3.3.2685…
• CVE-2009-1261Multiple cross-site scripting (XSS) vulnerabilities in Web H…