Buffer overflow in FreeBSD
CVE-2008-2427
Stack-based buffer overflow in NConvert 4.92, GFL SDK 2.82, and XnView 1.93.6 on Windows and 1.70 on Linux and FreeBSD allows user-assisted remote attackers to execute arbitrary code via a crafted format keyword in a Sun TAAC file.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v2 metric
CVSS v2 base score 9.3 (High). Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.161 (96.8th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 96.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.161 · newest: 0.161 · change: 0.000
Affected products
- FreeBSD
- Microsoft Windows Nt
- Pagesperso-Orange Gfl Sdk — versions 2.82
- Pagesperso-Orange Nconvert — versions 4.92
- Pagesperso-Orange Xnview — versions 1.93.6, 1.70
- Red Hat Linux
Weakness classification (CWE)
References
- www.vupen.com/english/advisories/2008/1897 (vdb-entry)
- www.vupen.com/english/advisories/2008/1896 (vdb-entry)
- secunia.com/advisories/30789 (Vendor Advisory, third-party-advisory)
- secunia.com/secunia_research/2008-24/advisory/ (Vendor Advisory)
- www.securityfocus.com/bid/29851 (vdb-entry)
- securitytracker.com/id (vdb-entry)
- www.securityfocus.com/archive/1/493505/100/0/threaded (mailing-list)
- securityreason.com/securityalert/3956 (third-party-advisory)
- secunia.com/advisories/30416 (Vendor Advisory, third-party-advisory)
- www.exploit-db.com/exploits/5951 (exploit)