SQL Injection in Osgeo Mapserver
CVE-2011-2703
Multiple SQL injection vulnerabilities in MapServer before 4.10.7, 5.x before 5.6.7, and 6.x before 6.0.1 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) OGC filter encoding or (2) WMS time support.
Vulnerability class: SQL Injection
EPSS: 0.016 (81.9th percentile) — read the EPSS interpretation.
Affected products
- Osgeo Mapserver — versions 4.2.0, 4.4.0, 4.6.0
- Umn Mapserver — versions 5.2.2, 5.2.3, 5.6.4
- N/a — versions n/a
Weakness classification (CWE)
References
- 45318 (x_refsource_SECUNIA, third-party-advisory, Vendor Advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Patch)
- [oss-security] 20110719 CVE Request -- MapServer -- SQL injections in OGC filter encoding and in WMS time support. (mailing-list, x_refsource_MLIST, Patch)
- 45257 (x_refsource_SECUNIA, third-party-advisory, Vendor Advisory)
- DSA-2285 (vendor-advisory, x_refsource_DEBIAN)
- secalert@redhat.com (x_refsource_CONFIRM, Patch)
- [oss-security] 20110719 CVE Request -- MapServer -- Stack based buffer overflow [was: Re: Re: CVE Request -- MapServer -- SQL injections in OGC filter encoding and in WMS time support.] (mailing-list, x_refsource_MLIST, Patch)
- 45368 (x_refsource_SECUNIA, third-party-advisory, Vendor Advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Patch)
- [mapserver-users] 20110713 MapServer 6.0.1, 5.6.7 and 4.10.7 releases with security fixes (mailing-list, x_refsource_MLIST, Patch)