Description
Multiple cross-site scripting (XSS) vulnerabilities in MapServer before 4.10.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the (1) processLine function in maptemplate.c and the (2) writeError function in mapserv.c in the mapserv CGI program.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mapserver | 4.10.3-1 | — |
| Debian 13 | mapserver | 4.10.3-1 | — |
| Debian 12 | mapserver | 4.10.3-1 | — |
| Debian 4.0 | mapserver | 4.10.0-5.1+etch2 | DSA-1539-1 |
Advisories 1
- DSA-1539-1 mapserver - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://trac.osgeo.org/mapserver/attachment/ticket/2256/ms-bug-2256-4.8.patch
- 29688 third-party-advisory
- http://mapserver.gis.umn.edu/download/current/HISTORY.TXT/
- http://trac.osgeo.org/mapserver/ticket/2256
- 26561 third-party-advisory
- 26718 third-party-advisory
- FEDORA-2007-2018 vendor-advisory
- ADV-2007-2974 vdb-entry
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=439346
- 25582 vdb-entry
- DSA-1539 vendor-advisory