5

CVE-2008-2953

Exploit
Linux DC++ (linuxdcpp) before 0.707 allows remote attackers to cause a denial of service (crash) via "partial file list requests" that trigger a NULL pointer dereference.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Direct Connect Version 0.686
Linux ≫ Direct Connect Version 0.699
Linux ≫ Direct Connect Version 0.700
Linux ≫ Direct Connect Version 0.701
Linux ≫ Direct Connect Version 0.702
Linux ≫ Direct Connect Version 0.703
Linux ≫ Direct Connect Version 0.704
Linux ≫ Direct Connect Version 0.705
Linux ≫ Direct Connect Version 0.706
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.23% 0.866
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://cvs.berlios.de/cgi-bin/viewcvs.cgi/linuxdcpp/linuxdcpp/client/ShareManager.cpp.diff?r1=1.14&r2=1.15&sortby=date
Exploit
http://secunia.com/advisories/30812
Vendor Advisory
http://secunia.com/advisories/30907
http://secunia.com/advisories/30918
http://sourceforge.net/project/shownotes.php?release_id=608612&group_id=40287
http://www.securityfocus.com/bid/29924
http://www.securitytracker.com/id?1020407
http://www.securitytracker.com/id?1020408
https://exchange.xforce.ibmcloud.com/vulnerabilities/43341
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00101.html
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00116.html