| Vulnerability Name: | CVE-2008-5282 (CCN-46812) | ||||||||
| Assigned: | 2008-11-24 | ||||||||
| Published: | 2008-11-24 | ||||||||
| Updated: | 2018-10-11 | ||||||||
| Summary: | Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0.1 allow remote attackers to execute arbitrary code via (1) a link with a long HREF attribute, and (2) a DIV tag with a long id attribute. | ||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||
| CVSS v2 Severity: | 10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C) 8.5 High (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:U/RC:UR)
5.8 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:POC/RL:U/RC:UR)
| ||||||||
| Vulnerability Type: | CWE-119 | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: CCN Type: BugTraq Mailing List, Mon Nov 24 2008 - 05:26:37 CST Amaya (URL Bar) Remote Stack Overflow Vulnerability Source: MITRE Type: CNA CVE-2008-5282 Source: OSVDB Type: UNKNOWN 50282 Source: OSVDB Type: UNKNOWN 50283 Source: CCN Type: SA32848 Amaya Two Buffer Overflow Vulnerabilities Source: SECUNIA Type: Vendor Advisory 32848 Source: SREASON Type: UNKNOWN 4657 Source: MISC Type: Exploit http://www.bmgsec.com.au/advisory/40/ Source: MISC Type: Exploit http://www.bmgsec.com.au/advisory/41/ Source: CCN Type: OSVDB ID: 50282 Amaya DIV Tag id Parameter Processing Overflow Source: CCN Type: OSVDB ID: 50283 Amaya URL Link Handling Overflow Source: BUGTRAQ Type: UNKNOWN 20081124 Amaya (URL Bar) Remote Stack Overflow Vulnerability Source: BUGTRAQ Type: UNKNOWN 20081124 Amaya (id) Remote Stack Overflow Vulnerability Source: BID Type: UNKNOWN 32442 Source: CCN Type: BID-32442 W3C Amaya 'TtaWCToMBstring()' Multiple Stack Based Buffer Overflow Vulnerabilities Source: VUPEN Type: UNKNOWN ADV-2008-3255 Source: CCN Type: Amaya Web page Amaya Home Page Source: XF Type: UNKNOWN amaya-ttawctombstring-url-bo(46812) | ||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||
| Vulnerability Name: | CVE-2008-5282 (CCN-46813) | ||||||||
| Assigned: | 2008-11-24 | ||||||||
| Published: | 2008-11-24 | ||||||||
| Updated: | 2008-11-24 | ||||||||
| Summary: | Amaya is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the TtaWCToMBstring() function. By sending an overly long string containing certain non-alphanumeric characters to the id parameter, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash. | ||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||
| CVSS v2 Severity: | 10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C) 8.5 High (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:U/RC:UR)
5.8 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:POC/RL:U/RC:UR)
| ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: CCN Type: BugTraq Mailing List, Mon Nov 24 2008 - 05:28:28 CST Amaya (id) Remote Stack Overflow Vulnerability Source: MITRE Type: CNA CVE-2008-5282 Source: CCN Type: SA32848 Amaya Two Buffer Overflow Vulnerabilities Source: CCN Type: OSVDB ID: 50282 Amaya DIV Tag id Parameter Processing Overflow Source: CCN Type: OSVDB ID: 50283 Amaya URL Link Handling Overflow Source: CCN Type: BID-32442 W3C Amaya 'TtaWCToMBstring()' Multiple Stack Based Buffer Overflow Vulnerabilities Source: CCN Type: Amaya Web page Amaya Home Page Source: XF Type: UNKNOWN amaya-ttawctombstring-bo(46813) | ||||||||
| BACK | |||||||||