FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2009-3051

This CVE name corresponds to:

Entered	Topic
2009-09-08	silc-toolkit -- Format string vulnerabilities
2009-08-04	silc-client -- Format string vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2009-3051 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2009-3051
Phase	Assigned(20090903)

Description

Multiple format string vulnerabilities in lib/silcclient/client_entry.c in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.10, and SILC Client before 1.1.8, allow remote attackers to execute arbitrary code via format string specifiers in a nickname field, related to the (1) silc_client_add_client, (2) silc_client_update_client, and (3) silc_client_nickname_format functions.

References

Source	Reference
MLIST	[oss-security] 20090831 CVE id request: silc-toolkit
MLIST	[oss-security] 20090903 Re: CVE id request: silc-toolkit
CONFIRM	http://silcnet.org/docs/changelog/SILC%20Client%201.1.8
CONFIRM	http://silcnet.org/docs/changelog/SILC%20Toolkit%201.1.10
CONFIRM	http://silcnet.org/docs/release/SILC%20Client%201.1.8
CONFIRM	http://silcnet.org/general/news/news_client.php
CONFIRM	http://silcnet.org/general/news/news_toolkit.php
DEBIAN	DSA-1879
MANDRIVA	MDVSA-2009:234
MANDRIVA	MDVSA-2009:235
SUSE	SUSE-SR:2009:016
BID	35940
SECUNIA	36134
SECUNIA	36614
VUPEN	ADV-2009-2150