Unscored severity · published Aug 23, 2006
CVE-2006-4262
Multiple buffer overflows in cscope 15.5 and earlier allow user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via multiple vectors…
–
CVSS
4%
EPSS
No
On KEV
Description
Multiple buffer overflows in cscope 15.5 and earlier allow user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via multiple vectors including (1) a long pathname that is not properly handled during file list parsing, (2) long pathnames that result from path variable expansion such as tilde expansion for the HOME environment variable, and (3) a long -f (aka reffile) command line argument.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.0% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Cscope · Cscope
through 15.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-4262
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-4262
Vendor Advisory
http://secunia.com/advisories/21601
Vendor Advisory
http://secunia.com/advisories/22239
Vendor Advisory
http://secunia.com/advisories/22515
security.gentoo.org
http://security.gentoo.org/glsa/glsa-200610-08.xml
sourceforge.net
http://sourceforge.net/mailarchive/forum.php?thread_id=30266760&forum_id=33500
sourceforge.net
http://sourceforge.net/mailarchive/forum.php?thread_id=30266761&forum_id=33500
More from Cscope
–
CVE-2009-1577
Multiple stack-based buffer overflows in the putstring function in find.c in Cscope before 15.6 allow user-assisted remote attackers to execute arbitrary code via a long (1)…
–
CVE-2009-0148
Multiple buffer overflows in Cscope before 15.7a allow remote attackers to execute arbitrary code via long strings in input such as (1) source-code tokens and (2) pathnames,…
–
CVE-2004-0996
main.c in cscope 15-4 and 15-5 creates temporary files with predictable filenames, which allows local users to overwrite arbitrary files via a symlink attack
–
CVE-2004-2541
Buffer overflow in Cscope 15.5, and possibly multiple overflows, allows remote attackers to execute arbitrary code via a C file with a long #include line that is later browsed by…