Vulnerability Details : CVE-2012-2108
Stack-based buffer overflow in the main function in util/lpci_main.c in Csound before 5.17.2, when converting a file, allows user-assisted remote attackers to execute arbitrary code via a crafted file.
Vulnerability category: OverflowExecute code
Products affected by CVE-2012-2108
- cpe:2.3:a:csounds:csound:*:*:*:*:*:*:*:*
- cpe:2.3:a:csounds:csound:5.13.0:*:*:*:*:*:*:*
- cpe:2.3:a:csounds:csound:5.15.0:*:*:*:*:*:*:*
- cpe:2.3:a:csounds:csound:5.13.1:*:*:*:*:*:*:*
- cpe:2.3:a:csounds:csound:5.14.0:*:*:*:*:*:*:*
- cpe:2.3:a:csounds:csound:5.14.1:*:*:*:*:*:*:*
- cpe:2.3:a:csounds:csound:5.14.2:*:*:*:*:*:*:*
- cpe:2.3:a:csounds:csound:5.12.4:*:*:*:*:*:*:*
- cpe:2.3:a:csounds:csound:5.16:*:*:*:*:*:*:*
- cpe:2.3:a:csounds:csound:5.12.3:*:*:*:*:*:*:*
- cpe:2.3:a:csounds:csound:5.12:*:*:*:*:*:*:*
- cpe:2.3:a:csounds:csound:5.16.1:*:*:*:*:*:*:*
- cpe:2.3:a:csounds:csound:5.12.1:*:*:*:*:*:*:*
- cpe:2.3:a:csounds:csound:5.10:*:*:*:*:*:*:*
- cpe:2.3:a:csounds:csound:5.11.1:*:*:*:*:*:*:*
- cpe:2.3:a:csounds:csound:5.11:*:*:*:*:*:*:*
- cpe:2.3:a:csounds:csound:5.10.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2012-2108
15.88%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 95 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2012-2108
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST |
CWE ids for CVE-2012-2108
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-2108
-
http://www.securityfocus.com/bid/52876
Csound 'main()' Stack Based Buffer Overflow And Integer-overflow Vulnerabilities
-
http://lists.opensuse.org/opensuse-updates/2012-04/msg00057.html
openSUSE-SU-2012:0550-1: moderate: update for csound
-
http://www.openwall.com/lists/oss-security/2012/04/16/9
oss-security - Re: CVE Requests: Multiple security flaws in csound5
-
http://www.openwall.com/lists/oss-security/2012/04/16/1
oss-security - CVE Requests: Multiple security flaws in csound5
-
http://csound.git.sourceforge.net/git/gitweb.cgi?p=csound/csound5.git%3Ba=commitdiff%3Bh=61d1df45ca9a52bab62892a3c3a13c41e6384505
Csound / None tools
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/74649
Csound main() function pci_main.c buffer overflow CVE-2012-2108 Vulnerability Report
-
https://bugzilla.redhat.com/show_bug.cgi?id=810810
810810 – (CVE-2012-2108) CVE-2012-2108 Csound: Stack-based buffer overflow in lpc_import
Jump to