CVE-2009-0842
Published: 31 March 2009
mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to read arbitrary invalid .map files via a full pathname in the map parameter, which triggers the display of partial file contents within an error message, as demonstrated by a /tmp/sekrut.map symlink.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
mapserver
Launchpad, Ubuntu, Debian |
dapper |
Ignored
(end of life)
|
| gutsy |
Ignored
(end of life, was needed)
|
|
| hardy |
Released
(5.0.0-3ubuntu0.1)
|
|
| intrepid |
Released
(5.0.3-2ubuntu0.1)
|
|
| jaunty |
Released
(5.0.3-3ubuntu0.1)
|
|
| karmic |
Not vulnerable
|
|
| upstream |
Released
(5.2.2-1)
|
|
|
Patches:
upstream: http://trac.osgeo.org/mapserver/changeset/8805 |
||