Description
Multiple buffer overflows in Princeton WordNet (wn) 3.0 allow context-dependent attackers to execute arbitrary code via (1) a long argument on the command line; a long (2) WNSEARCHDIR, (3) WNHOME, or (4) WNDBVERSION environment variable; or (5) a user-supplied dictionary (aka data file). NOTE: since WordNet itself does not run with special privileges, this issue only crosses privilege boundaries when WordNet is invoked as a third party component.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wordnet | 1:3.0-12 | — |
| Debian 13 | wordnet | 1:3.0-12 | — |
| Debian 12 | wordnet | 1:3.0-12 | — |
| Debian 5.0 | wordnet | 3.0-11+lenny1 | DTSA-163-1 |
| Debian 4.0 | wordnet | 1:2.1-4+etch1 | DSA-1634-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | wordnet | 3.0-43 | — |
| Azure Linux 2 (CBL-Mariner) | wordnet | 3.0-38 | — |
Advisories 2
- DSA-1634-1 wordnet - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-163-1 wordnet - several overflows Debian Security (DSA / DLA) · Mar 9, 2026
References
- 30958 vdb-entry
- 32184 third-party-advisory
- http://www.ocert.org/analysis/2008-014/wordnet.patch
- wordnet-binsrch-search-bo(44851) vdb-entry
- 20080901 [oCERT-2008-014] WordNet stack and heap overflows mailing-list
- http://www.ocert.org/advisories/ocert-2008-014.html
- wordnet-wninit-bo(44850) vdb-entry
- http://www.ocert.org/analysis/2008-014/analysis.txt
- 4217 third-party-advisory
- GLSA-200810-01 vendor-advisory
- wordnet-morphinit-bo(44849) vdb-entry
- wordnet-morph-search-bo(44848) vdb-entry