CVE-2007-2352
Multiple format string vulnerabilities in AFFLIB 2.2.6 allow remote attackers to execute arbitrary code via certain command line parameters…
Published 19 y ago · modified 4 mo ago · JSON
Summary
Multiple format string vulnerabilities in AFFLIB 2.2.6 allow remote attackers to execute arbitrary code via certain command line parameters, which are used in (1) warn and (2) err calls, possibly involving (a) lib/s3.cpp, (b) tools/afconvert.cpp, (c) tools/afcopy.cpp, (d) tools/afinfo.cpp, (e) aimage/imager.cpp, and (f) tools/afxml.cpp. NOTE: this identifier is intended to address the vectors that were not fixed in CVE-2007-2054, but the unfixed vectors were not explicitly listed.
Exploit prediction (EPSS)
5.13% probability of exploitation in the next 30 days, higher than 92% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
References
- securityreason.com /securityalert/2657 · third-party-advisory, x_refsource_SREASON, x_transferred
- securityfocus.com /archive/1/467040/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
- vsecurity.com /bulletins/advisories/2007/afflib-fmtstr.txt · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2007-2352
- NVD: CVE-2007-2352
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.