CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

CVE details

CVE-2013-7108

Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) avail.c, (2) cmd.c, (3) config.c, (4) extinfo.c, (5) histogram.c, (6) notifications.c, (7) outages.c, (8) status.c, (9) statusmap.c, (10) summary.c, and (11) trends.c in cgi/, which triggers a heap-based buffer over-read.

Score
5.5 medium
Published
2014-01-15
Links
NVD · cve.org

Affected ports (2)

PortPackageVersionStatusMaintainer
net-mgmt/nagiosnagios-monplugins3.5.1_12unaddressedports@FreeBSD.org
net-mgmt/nagiosnagios3.5.1_12fixedports@FreeBSD.org

VuXML

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>nagios-monplugins</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier,
	and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2
	allow remote authenticated users to obtain sensitive information from
	process memory or cause a denial of service (crash) via a long string
	in the last key value in the variable list to the process_cgivars
	function in (1) avail.c, (2) cmd.c, (3) config.c, (4) extinfo.c, (5)
	histogram.c, (6) notifications.c, (7) outages.c, (8) status.c, (9)
	statusmap.c, (10) summary.c, and (11) trends.c in cgi/, which triggers
	a heap-based buffer over-read.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2013-7108</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2013-7108</url>
    </references>
    <dates>
      <discovery>2014-01-15</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>