Description
Multiple buffer overflows in Cscope before 15.7a allow remote attackers to execute arbitrary code via long strings in input such as (1) source-code tokens and (2) pathnames, related to integer overflows in some cases. NOTE: this issue exists because of an incomplete fix for CVE-2004-2541.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cscope | 15.7a-1 | — |
| Debian 13 | cscope | 15.7a-1 | — |
| Debian 12 | cscope | 15.7a-1 | — |
| Debian 5.0 | cscope | 15.6-6+lenny1 | DSA-1806-1 |
| Debian 4.0 | cscope | 15.6-2+etch1 | DSA-1806-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | cscope | 15.5-15.1.el5_3.1 | RHSA-2009:1102 |
| RHEL 4 | cscope | 15.5-10.RHEL4.3 | RHSA-2009:1101 |
| RHEL 3 | cscope | 15.5-16.RHEL3 | RHSA-2009:1101 |
Advisories 3
- RHSA-2009:1101 Red Hat Security Advisory: cscope security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1102 Red Hat Security Advisory: cscope security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1806-1 cscope - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20090506 Re: Old cscope buffer overflow mailing-list
- 35462 third-party-advisory
- http://support.apple.com/kb/HT3549
- RHSA-2009:1101 vendor-advisory
- [cscope-cvs] 20090410 CVS: cscope/src snprintf.c, NONE, 1.1 build.c, 1.14, 1.15 command.c, 1.32, 1.33 dir.c, 1.30, 1.31 display.c, 1.29, 1.30 edit.c, 1.6, 1.7 exec.c, 1.11, 1.12 find.c, 1.20, 1.21 global.h, 1.36, 1.37 main.c, 1.45, 1.46 Makefile.am, mailing-list
- 35074 third-party-advisory
- APPLE-SA-2009-05-12 vendor-advisory
- ADV-2009-1238 vdb-entry
- 35214 third-party-advisory
- RHSA-2009:1102 vendor-advisory
- GLSA-200905-02 vendor-advisory
- TA09-133A third-party-advisory
- 35213 third-party-advisory
- ADV-2009-1297 vdb-entry
- 34805 vdb-entry
- http://sourceforge.net/forum/forum.php?forum_id=947983
- 1022218 vdb-entry
- DSA-1806 vendor-advisory
- oval:org.mitre.oval:def:9633 vdb-entry signature
- 34978 third-party-advisory
- http://sourceforge.net/project/shownotes.php?group_id=4664&release_id=679527
- https://bugzilla.redhat.com/show_bug.cgi?id=490667