Description
Heap-based buffer overflow in the ne_rfc1036_parse date parsing function for the neon library (libneon) 0.24.5 and earlier, as used by cadaver before 0.22, allows remote WebDAV servers to execute arbitrary code on the client.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 2
- DSA-506 neon - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-507 cadaver - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- 11638 third-party-advisory
- 11673 third-party-advisory
- 6302 vdb-entry
- 20040519 Advisory 06/2004: libneon date parsing vulnerability mailing-list
- 11650 third-party-advisory
- 20040519 [OpenPKG-SA-2004.024] OpenPKG Security Advisory (neon) mailing-list
- GLSA-200405-13 vendor-advisory
- O-148 third-party-advisory government-resource
- GLSA-200405-15 vendor-advisory
- MDKSA-2004:049 vendor-advisory
- 10385 vdb-entry
- DSA-506 vendor-advisory
- FEDORA-2004-1552 vendor-advisory
- neon-library-nerfc1036parse-bo(16192) vdb-entry
- DSA-507 vendor-advisory
- CLA-2004:841 vendor-advisory
- 20040519 Advisory 06/2004: libneon date parsing vulnerability mailing-list
- RHSA-2004:191 vendor-advisory