7.8

CVE-2008-2954

Exploit
client/NmdcHub.cpp in Linux DC++ (linuxdcpp) before 0.707 allows remote attackers to cause a denial of service (crash) via an empty private message, which triggers an out-of-bounds read.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Direct Connect Version0.686
Linux ≫ Direct Connect Version0.699
Linux ≫ Direct Connect Version0.700
Linux ≫ Direct Connect Version0.701
Linux ≫ Direct Connect Version0.702
Linux ≫ Direct Connect Version0.703
Linux ≫ Direct Connect Version0.704
Linux ≫ Direct Connect Version0.705
Linux ≫ Direct Connect Version0.706
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.66% 0.882
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 10 6.9
AV:N/AC:L/Au:N/C:N/I:N/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://secunia.com/advisories/30907
http://secunia.com/advisories/30918
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00101.html
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00116.html
http://cvs.berlios.de/cgi-bin/viewcvs.cgi/linuxdcpp/linuxdcpp/Changelog.txt
http://cvs.berlios.de/cgi-bin/viewcvs.cgi/linuxdcpp/linuxdcpp/client/NmdcHub.cpp.diff?r1=1.14&r2=1.15&sortby=date
Exploit
http://dcplusplus.svn.sourceforge.net/viewvc/dcplusplus/dcplusplus/trunk/changelog.txt?r1=1027&r2=1026&pathrev=1027
http://www.securityfocus.com/bid/30037
http://www.securitytracker.com/id?1020409
http://www.securitytracker.com/id?1020410
https://exchange.xforce.ibmcloud.com/vulnerabilities/43566