Buffer overflow in Thekelleys Dnsmasq
CVE-2009-2957
Heap-based buffer overflow in the tftp_request function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, might allow remote attackers to execute arbitrary code via a long filename in a TFTP packet, as demonstrated by a read (aka RRQ) request.
Vulnerability class: Buffer Overflow
EPSS: 0.127 (95.8th percentile) — read the EPSS interpretation.
Affected products
- Thekelleys Dnsmasq — versions 0.4, 0.5, 0.6
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Patch, vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_SECUNIA, third-party-advisory)
- cve@mitre.org (x_refsource_UBUNTU, vendor-advisory)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (signature, x_refsource_OVAL, vdb-entry)
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
- cve@mitre.org (Patch, x_refsource_MISC)
- cve@mitre.org (x_refsource_REDHAT, vendor-advisory)
- cve@mitre.org (x_refsource_REDHAT, vendor-advisory)