CVE-2008-4933
Buffer overflow in the hfsplus_find_cat function in fs/hfsplus/catalog.c in the Linux kernel before 2.6.28-rc1 allows attackers to cause a denial of service (memory corruption or system crash) via an hfsplus filesystem image with an invalid catalog…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.90%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Buffer overflow in the hfsplus_find_cat function in fs/hfsplus/catalog.c in the Linux kernel before 2.6.28-rc1 allows attackers to cause a denial of service (memory corruption or system crash) via an hfsplus filesystem image with an invalid catalog namelength field, related to the hfsplus_cat_build_key_uni function.
- CVSS 2.0
- 7.8 HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
- EPSS
- 2.90% probability · 86th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- linux/linux kernel
- Source
- cve@mitre.org
References
- http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.27.y.git%3Ba=commit%3Bh=efc7ffcb4237f8cb9938909041c4ed38f6e1bf40
- http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.28-rc1
- http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00010.html
- http://rhn.redhat.com/errata/RHSA-2009-0264.html
- http://secunia.com/advisories/32510Vendor Advisory
- http://secunia.com/advisories/32918
- http://secunia.com/advisories/32998
- http://secunia.com/advisories/33180
- http://secunia.com/advisories/33556
- http://secunia.com/advisories/33641
- http://secunia.com/advisories/33704
- http://secunia.com/advisories/33858
- http://www.debian.org/security/2008/dsa-1681
- http://www.debian.org/security/2008/dsa-1687
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:234
- http://www.openwall.com/lists/oss-security/2008/11/03/2
- http://www.redhat.com/support/errata/RHSA-2009-0014.html
- http://www.securityfocus.com/bid/32093Patch
- http://www.ubuntu.com/usn/usn-679-1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46405
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11061
- http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.27.y.git%3Ba=commit%3Bh=efc7ffcb4237f8cb9938909041c4ed38f6e1bf40
- http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.28-rc1
- http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00010.html
- http://rhn.redhat.com/errata/RHSA-2009-0264.html
- http://secunia.com/advisories/32510Vendor Advisory
- http://secunia.com/advisories/32918
- http://secunia.com/advisories/32998
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.