CVE-2006-4262

Severity: medium (CVSS 5.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-08-23 · updated 2026-06-16
Weakness: CWE-119

Description

Multiple buffer overflows in cscope 15.5 and earlier allow user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via multiple vectors including (1) a long pathname that is not properly handled during file list parsing, (2) long pathnames that result from path variable expansion such as tilde expansion for the HOME environment variable, and (3) a long -f (aka reffile) command line argument.

Affected products

Cscope: through 15.5

References

http://secunia.com/advisories/21601
http://secunia.com/advisories/22239
http://secunia.com/advisories/22515
http://security.gentoo.org/glsa/glsa-200610-08.xml
http://sourceforge.net/mailarchive/forum.php?thread_id=30266760&forum_id=33500
http://sourceforge.net/mailarchive/forum.php?thread_id=30266761&forum_id=33500
http://www.debian.org/security/2006/dsa-1186
http://www.osvdb.org/28135
http://www.osvdb.org/28136
http://www.redhat.com/support/errata/RHSA-2009-1101.html
http://www.securityfocus.com/bid/19686
http://www.securityfocus.com/bid/19687

Get alerted when CVE-2006-4262 or the next vulnerability affects your stack