CVE-2009-3050

{"id": "CVE-2009-3050", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-09-02T17:30:01.313", "references": [{"url": "http://bugs.gentoo.org/show_bug.cgi?id=278186", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://packetstormsecurity.org/0907-exploits/htmldoc-overflow.txt", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/35780", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.htmldoc.org/str.php?L214", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2009/07/25/3", "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2009/07/26/2", "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2009/09/01/1", "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-119"}]}], "descriptions": [{"lang": "en", "value": "Buffer overflow in the set_page_size function in util.cxx in HTMLDOC 1.8.27 and earlier allows context-dependent attackers to execute arbitrary code via a long MEDIA SIZE comment. NOTE: it was later reported that there were additional vectors in htmllib.cxx and ps-pdf.cxx using an AFM font file with a long glyph name, but these vectors do not cross privilege boundaries."}, {"lang": "es", "value": "Desbordamiento de b\u00fafer en la funci\u00f3n set_page_size en util.cxx en HTMLDOC 1.8.27 y versiones anteriores permite a atacantes dependientes de contexto ejecutar c\u00f3digo de su elecci\u00f3n mediante un comentario MEDIA SIZE largo. NOTA: m\u00e1s tarde se inform\u00f3 que hab\u00eda vectores adicionales en htmllib.cxx y ps-pdf.cxx utilizando un archivo de fuentes AFM con un nombre glyph largo, pero estos vectores no traspasan la frontera de privilegios."}], "lastModified": "2009-09-10T04:00:00.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:htmldoc:htmldoc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "869A7EC3-6B3E-45B8-A507-CE0004CC12E0", "versionEndIncluding": "1.8.27"}, {"criteria": "cpe:2.3:a:htmldoc:htmldoc:1.8.24:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DC979928-F1B0-43C6-97A2-066BC6DC5B7A"}, {"criteria": "cpe:2.3:a:htmldoc:htmldoc:1.8.25:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8ACF69DD-2922-4B08-A13C-8F5AB50E2FB8"}, {"criteria": "cpe:2.3:a:htmldoc:htmldoc:1.8.26:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FE1F2321-B852-4660-BAF2-A19B3A501897"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}