Description
mapserv.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 does not properly restrict the use of CGI command-line arguments that were intended for debugging, which allows remote attackers to have an unspecified impact via crafted arguments.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mapserver | 5.6.4-1 | — |
| Debian 13 | mapserver | 5.6.4-1 | — |
| Debian 12 | mapserver | 5.6.4-1 | — |
| Debian 5.0 | mapserver | 5.0.3-3+lenny5 | DSA-2079-1 |
Advisories 1
- DSA-2079-1 mapserver - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- [mapserver-users] 20100709 MapServer 5.6.4 and 4.10.6 released with important security fixes mailing-list
- 41855 vdb-entry
- http://trac.osgeo.org/mapserver/ticket/3485
- [oss-security] 20100721 Re: CVE id request: mapserver mailing-list
- mapserver-cgi-code-execution(60852) vdb-entry
- [oss-security] 20100721 CVE id request: mapserver mailing-list