CVE-2009-1577

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-05-07 · updated 2026-06-16
Weakness: CWE-119

Description

Multiple stack-based buffer overflows in the putstring function in find.c in Cscope before 15.6 allow user-assisted remote attackers to execute arbitrary code via a long (1) function name or (2) symbol in a source-code file.

Affected products

Cscope: through 15.5; 13.0, 15.0bl2, 15.1, 15.3, 15.4

References

http://cscope.cvs.sourceforge.net/viewvc/cscope/cscope/src/find.c?r1=1.18&r2=1.19
http://cscope.cvs.sourceforge.net/viewvc/cscope/cscope/src/find.c?view=log#rev1.19
http://cvs.fedoraproject.org/viewvc/rpms/cscope/devel/cscope-15.5-putstring-overflow.patch
http://secunia.com/advisories/35213
http://security.gentoo.org/glsa/glsa-200905-02.xml
http://www.openwall.com/lists/oss-security/2009/05/05/1
http://www.openwall.com/lists/oss-security/2009/05/06/10
http://www.openwall.com/lists/oss-security/2009/05/06/9
http://www.redhat.com/support/errata/RHSA-2009-1101.html
https://bugzilla.redhat.com/show_bug.cgi?id=189666
https://bugzilla.redhat.com/show_bug.cgi?id=499174
https://exchange.xforce.ibmcloud.com/vulnerabilities/50366

Get alerted when CVE-2009-1577 or the next vulnerability affects your stack