GCVE - cpe:2.3:a:umn:mapserver:4.0:beta2:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:umn:mapserver:4.0:beta2:*:*:*:*:*:*

part: a version: 4.0 update: beta2

Vendor	Umn (`cabcfa69-6e24-528d-a922-481871986c92`)
Product	Mapserver (`bd5848bf-e753-5574-8bc7-f7da54afff76`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/mapserver`	purl2cpe	2026-06-01 10:16:02.174054
`pkg:deb/ubuntu/mapserver`	purl2cpe	2026-06-01 10:16:02.174056
`pkg:github/mapserver/mapserver`	purl2cpe	2026-06-01 10:16:02.174057
`pkg:rpm/fedora/mapserver`	purl2cpe	2026-06-01 10:16:02.174058
`pkg:rpm/opensuse/mapserver`	purl2cpe	2026-06-01 10:16:02.174060

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2009-2281`	vulnerable	2026-06-08 04:51:27.504427	Details available Multiple heap-based buffer underflows in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x through 4.10.4 and 5.x before 5.4.2 allow remote attackers to execute arbitrary code via (1) a crafted Content-Length HTTP header or (2) a large HTTP request, related to an integer overflow that triggers a heap-based buffer overflow. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-0840. Published: 2009-10-23T18:00:00.000Z Updated: 2024-09-16T16:23:42.293Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2009/07/01/6 http://security.debian.org/pool/updates/main/m/mapserver/mapserver_4.10.0-5.1+etch4.diff.gz http://trac.osgeo.org/mapserver/browser/tags/rel-5-4-2/mapserver/HISTORY.TXT http://www.openwall.com/lists/oss-security/2009/07/01/1 http://www.debian.org/security/2009/dsa-1914	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-1177`	vulnerable	2026-06-08 04:51:13.386638	Details available Multiple stack-based buffer overflows in maptemplate.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 have unknown impact and remote attack vectors. Published: 2009-03-31T18:00:00.000Z Updated: 2024-08-07T05:04:49.006Z Open on db.gcve.eu Reference links http://www.positronsecurity.com/advisories/2009-000.html http://www.securitytracker.com/id?1021952 http://www.securityfocus.com/archive/1/502271/100/0/threaded http://trac.osgeo.org/mapserver/ticket/2944 http://secunia.com/advisories/34603	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-1176`	vulnerable	2026-06-08 04:51:13.385293	Details available mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 does not ensure that the string holding the id parameter ends in a '\0' character, which allows remote attackers to conduct buffer-overflow attacks or have unspecified other impact via a long id parameter in a query action. Published: 2009-03-31T18:00:00.000Z Updated: 2024-08-07T05:04:48.786Z Open on db.gcve.eu Reference links http://www.positronsecurity.com/advisories/2009-000.html http://www.securitytracker.com/id?1021952 http://www.securityfocus.com/archive/1/502271/100/0/threaded http://secunia.com/advisories/34603 https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00170.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-0843`	vulnerable	2026-06-08 04:51:11.613325	Details available The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists. Published: 2009-03-31T18:00:00.000Z Updated: 2024-08-07T04:48:52.455Z Open on db.gcve.eu Reference links http://www.positronsecurity.com/advisories/2009-000.html http://trac.osgeo.org/mapserver/ticket/2939 http://www.securitytracker.com/id?1021952 http://www.securityfocus.com/archive/1/502271/100/0/threaded http://secunia.com/advisories/34603	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-0842`	vulnerable	2026-06-08 04:51:11.612049	Details available mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to read arbitrary invalid .map files via a full pathname in the map parameter, which triggers the display of partial file contents within an error message, as demonstrated by a /tmp/sekrut.map symlink. Published: 2009-03-31T18:00:00.000Z Updated: 2024-08-07T04:48:52.573Z Open on db.gcve.eu Reference links http://trac.osgeo.org/mapserver/ticket/2941 http://www.positronsecurity.com/advisories/2009-000.html http://www.securitytracker.com/id?1021952 http://www.securityfocus.com/archive/1/502271/100/0/threaded http://secunia.com/advisories/34603	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-0841`	vulnerable	2026-06-08 04:51:11.610694	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-0840`	vulnerable	2026-06-08 04:51:11.609310	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-0839`	vulnerable	2026-06-08 04:51:11.607889	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Mapserver

Notes

PURL mappings

Vulnerability references

Contribute