CVE-2008-1391

Advisory lineage Upstream: 0 Downstream: 2
Modified
Published: 27 Mar 2008, 17:00
Last modified:07 Aug 2024, 08:17

Vulnerability Summary

Overall Risk (default)
medium
44/100
CVSS Score
7.5 HIGH
v2.0 (nvd)
EPSS Score
19.06% MEDIUM
19% probability -1.06%
KEV
Not listed
Ransomware
No reports
Public exploits
3 found
Dark Web
Not detected

Timeline

27 Mar 2008, 17:00
Published
Vulnerability first disclosed
07 Aug 2024, 08:17
Last Modified
Vulnerability information updated

Description

Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to (1) the strfmon function in lib/libc/stdlib/strfmon.c, related to the GET_NUMBER macro; and (2) the printf function, related to left_prec and right_prec.

CVSS Metrics

  • v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 19.06%• Percentile: 95%

Techniques & Countermeasures

  • CWE-189•Numeric Errors

    Weaknesses in this category are related to improper calculation or conversion of numbers.

Affected Systems

  • freebsd•freebsd

    6.0 | 6.0:release | 6.0:stable | 6.0_p5_release | 7.0 | 7.0:pre-release | 7.0_beta4 | 7.0_releng

  • netbsd•netbsd

    4.0

References (15)