Vulnerability in Brandon Long Clearsilver

CVE-2011-4357

Format string vulnerability in the p_cgi_error function in python/neo_cgi.c in the Python CGI Kit (neo_cgi) module for Clearsilver 0.10.5 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers that are not properly handled when creating CGI error messages using the cgi_error API function.

EPSS: 0.030 (86.1th percentile) — read the EPSS interpretation.

Affected products

Brandon_long Clearsilver — versions 0.1, 0.2, 0.2.1
N/a — versions n/a

Weakness classification (CWE)

CWE-134 — Use of Externally-Controlled Format String

References

secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (vendor-advisory, x_refsource_DEBIAN)
secalert@redhat.com (x_refsource_OSVDB, vdb-entry)
secalert@redhat.com (mailing-list, x_refsource_MLIST)
secalert@redhat.com (vdb-entry, x_refsource_XF)
secalert@redhat.com (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)