Description
Multiple buffer overflows in the httplib_parse_sc_header function in lib/http.c in Streamripper before 1.62.2 allow remote attackers to execute arbitrary code via long (1) Location and (2) Server HTTP headers, a different vulnerability than CVE-2006-3124.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | streamripper | 1.62.2-1 | — |
| Debian 13 | streamripper | 1.62.2-1 | — |
| Debian 12 | streamripper | 1.62.2-1 | — |
| Debian 4.0 | streamripper | 1.61.27-1+etch1 | DSA-1683-1 |
Advisories 1
- DSA-1683-1 streamripper - potential code execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- 1018553 vdb-entry
- 25278 vdb-entry
- http://streamripper.cvs.sourceforge.net/streamripper/sripper_1x/lib/http.c?r1=1.38&r2=1.39
- 33052 third-party-advisory
- 26406 third-party-advisory
- ADV-2007-2858 vdb-entry
- DSA-1683 vendor-advisory
- GLSA-200709-03 vendor-advisory
- http://sourceforge.net/project/shownotes.php?group_id=6172&release_id=531738
- 20070812 Streamripper 1.62.1 - Buffer Overflows mailing-list
- 33061 third-party-advisory
- 39533 vdb-entry
- 26814 third-party-advisory