Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2008-1391
Modified
More InfoOfficial Page
Source-cve@mitre.org
View Known Exploited Vulnerability (KEV) details
Published At-27 Mar, 2008 | 17:44
Updated At-23 Apr, 2026 | 00:35

Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to (1) the strfmon function in lib/libc/stdlib/strfmon.c, related to the GET_NUMBER macro; and (2) the printf function, related to left_prec and right_prec.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary2.07.5HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
Type: Primary
Version: 2.0
Base score: 7.5
Base severity: HIGH
Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
CPE Matches
FreeBSD Foundation
freebsd
>>freebsd>>6.0
cpe:2.3:o:freebsd:freebsd:6.0:*:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>6.0
cpe:2.3:o:freebsd:freebsd:6.0:release:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>6.0
cpe:2.3:o:freebsd:freebsd:6.0:stable:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>6.0_p5_release
cpe:2.3:o:freebsd:freebsd:6.0_p5_release:*:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>7.0
cpe:2.3:o:freebsd:freebsd:7.0:*:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>7.0
cpe:2.3:o:freebsd:freebsd:7.0:pre-release:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>7.0_beta4
cpe:2.3:o:freebsd:freebsd:7.0_beta4:*:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>7.0_releng
cpe:2.3:o:freebsd:freebsd:7.0_releng:*:*:*:*:*:*:*
NetBSD
netbsd
>>netbsd>>4.0
cpe:2.3:o:netbsd:netbsd:4.0:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-189Primarynvd@nist.gov
CWE ID: CWE-189
Type: Primary
Source: nvd@nist.gov
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
Organization : Red Hat
Last Modified : 2009-09-24T00:00:00

Red Hat does not consider this to be a security issue. Properly written application should not use arbitrary untrusted data as part of the format string passed to functions as strfmon or printf family functions.

References
HyperlinkSourceResource
http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/stdlib/strfmon.ccve@mitre.org
N/A
http://lists.apple.com/archives/security-announce//2008//Dec/msg00000.htmlcve@mitre.org
N/A
http://secunia.com/advisories/29574cve@mitre.org
N/A
http://secunia.com/advisories/33179cve@mitre.org
N/A
http://securityreason.com/achievement_securityalert/53cve@mitre.org
Exploit
http://securityreason.com/securityalert/3770cve@mitre.org
Exploit
http://support.apple.com/kb/HT3338cve@mitre.org
N/A
http://www.debian.org/security/2010/dsa-2058cve@mitre.org
N/A
http://www.securityfocus.com/archive/1/490158/100/0/threadedcve@mitre.org
N/A
http://www.securityfocus.com/bid/28479cve@mitre.org
N/A
http://www.securitytracker.com/id?1019722cve@mitre.org
N/A
http://www.us-cert.gov/cas/techalerts/TA08-350A.htmlcve@mitre.org
US Government Resource
http://www.vupen.com/english/advisories/2008/3444cve@mitre.org
N/A
https://exchange.xforce.ibmcloud.com/vulnerabilities/41504cve@mitre.org
N/A
https://lists.opensuse.org/opensuse-security-announce/2010-10/msg00007.htmlcve@mitre.org
N/A
http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/stdlib/strfmon.caf854a3a-2127-422b-91ae-364da2661108
N/A
http://lists.apple.com/archives/security-announce//2008//Dec/msg00000.htmlaf854a3a-2127-422b-91ae-364da2661108
N/A
http://secunia.com/advisories/29574af854a3a-2127-422b-91ae-364da2661108
N/A
http://secunia.com/advisories/33179af854a3a-2127-422b-91ae-364da2661108
N/A
http://securityreason.com/achievement_securityalert/53af854a3a-2127-422b-91ae-364da2661108
Exploit
http://securityreason.com/securityalert/3770af854a3a-2127-422b-91ae-364da2661108
Exploit
http://support.apple.com/kb/HT3338af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.debian.org/security/2010/dsa-2058af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.securityfocus.com/archive/1/490158/100/0/threadedaf854a3a-2127-422b-91ae-364da2661108
N/A
http://www.securityfocus.com/bid/28479af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.securitytracker.com/id?1019722af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.us-cert.gov/cas/techalerts/TA08-350A.htmlaf854a3a-2127-422b-91ae-364da2661108
US Government Resource
http://www.vupen.com/english/advisories/2008/3444af854a3a-2127-422b-91ae-364da2661108
N/A
https://exchange.xforce.ibmcloud.com/vulnerabilities/41504af854a3a-2127-422b-91ae-364da2661108
N/A
https://lists.opensuse.org/opensuse-security-announce/2010-10/msg00007.htmlaf854a3a-2127-422b-91ae-364da2661108
N/A
Hyperlink: http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/stdlib/strfmon.c
Source: cve@mitre.org
Resource: N/A
Hyperlink: http://lists.apple.com/archives/security-announce//2008//Dec/msg00000.html
Source: cve@mitre.org
Resource: N/A
Hyperlink: http://secunia.com/advisories/29574
Source: cve@mitre.org
Resource: N/A
Hyperlink: http://secunia.com/advisories/33179
Source: cve@mitre.org
Resource: N/A
Hyperlink: http://securityreason.com/achievement_securityalert/53
Source: cve@mitre.org
Resource:
Exploit
Hyperlink: http://securityreason.com/securityalert/3770
Source: cve@mitre.org
Resource:
Exploit
Hyperlink: http://support.apple.com/kb/HT3338
Source: cve@mitre.org
Resource: N/A
Hyperlink: http://www.debian.org/security/2010/dsa-2058
Source: cve@mitre.org
Resource: N/A
Hyperlink: http://www.securityfocus.com/archive/1/490158/100/0/threaded
Source: cve@mitre.org
Resource: N/A
Hyperlink: http://www.securityfocus.com/bid/28479
Source: cve@mitre.org
Resource: N/A
Hyperlink: http://www.securitytracker.com/id?1019722
Source: cve@mitre.org
Resource: N/A
Hyperlink: http://www.us-cert.gov/cas/techalerts/TA08-350A.html
Source: cve@mitre.org
Resource:
US Government Resource
Hyperlink: http://www.vupen.com/english/advisories/2008/3444
Source: cve@mitre.org
Resource: N/A
Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/41504
Source: cve@mitre.org
Resource: N/A
Hyperlink: https://lists.opensuse.org/opensuse-security-announce/2010-10/msg00007.html
Source: cve@mitre.org
Resource: N/A
Hyperlink: http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/stdlib/strfmon.c
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://lists.apple.com/archives/security-announce//2008//Dec/msg00000.html
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://secunia.com/advisories/29574
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://secunia.com/advisories/33179
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://securityreason.com/achievement_securityalert/53
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Exploit
Hyperlink: http://securityreason.com/securityalert/3770
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Exploit
Hyperlink: http://support.apple.com/kb/HT3338
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.debian.org/security/2010/dsa-2058
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.securityfocus.com/archive/1/490158/100/0/threaded
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.securityfocus.com/bid/28479
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.securitytracker.com/id?1019722
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.us-cert.gov/cas/techalerts/TA08-350A.html
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
US Government Resource
Hyperlink: http://www.vupen.com/english/advisories/2008/3444
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/41504
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://lists.opensuse.org/opensuse-security-announce/2010-10/msg00007.html
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Change History
0Changes found
Details not found