From Red Hat Security Advisory 2009:1102 :

An updated cscope package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

cscope is a mature, ncurses-based, C source-code tree browsing tool.

Multiple buffer overflow flaws were found in cscope. An attacker could create a specially crafted source code file that could cause cscope to crash or, possibly, execute arbitrary code when browsed with cscope.
(CVE-2004-2541, CVE-2009-0148)

All users of cscope are advised to upgrade to this updated package, which contains backported patches to fix these issues. All running instances of cscope must be restarted for this update to take effect.

Jason Duell discovered that cscope, a source code browsing tool, does not verify the length of file names sourced in include statements, which may potentially lead to the execution of arbitrary code through specially crafted source code files.

An updated cscope package that fixes multiple security issues is now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

cscope is a mature, ncurses-based, C source-code tree browsing tool.

Multiple buffer overflow flaws were found in cscope. An attacker could create a specially crafted source code file that could cause cscope to crash or, possibly, execute arbitrary code when browsed with cscope.
(CVE-2004-2541, CVE-2006-4262, CVE-2009-0148, CVE-2009-1577)

All users of cscope are advised to upgrade to this updated package, which contains backported patches to fix these issues. All running instances of cscope must be restarted for this update to take effect.

An updated cscope package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

cscope is a mature, ncurses-based, C source-code tree browsing tool.

Multiple buffer overflow flaws were found in cscope. An attacker could create a specially crafted source code file that could cause cscope to crash or, possibly, execute arbitrary code when browsed with cscope.
(CVE-2004-2541, CVE-2009-0148)

All users of cscope are advised to upgrade to this updated package, which contains backported patches to fix these issues. All running instances of cscope must be restarted for this update to take effect.

The remote host is running a version of Mac OS X 10.4 or 10.3 which does not have the security update 2007-007 applied. 

This update contains several security fixes for the following programs :

 - bzip2
 - CFNetwork
 - CoreAudio
 - cscope
 - gnuzip
 - iChat
 - Kerberos
 - mDNSResponder
 - PDFKit
 - PHP
 - Quartz Composer
 - Samba
 - SquirrelMail
 - Tomcat
 - WebCore
 - WebKit

Jason Duell reports :

Cscope contains an alarming number of buffer overflow vulnerabilities.
By a rough count, there are at least 48 places where we blindly sprintf() a file name into a fixed-length buffer of size PATHLEN without checking to see if the file's name is <= PATHLEN. We do similar things with environment variable values.

Multiple buffer overflow flaws were found in cscope. An attacker could create a specially crafted source code file that could cause cscope to crash or, possibly, execute arbitrary code when browsed with cscope.
(CVE-2004-2541, CVE-2006-4262, CVE-2009-0148, CVE-2009-1577)

All running instances of cscope must be restarted for this update to take effect.

From Red Hat Security Advisory 2009:1101 :

An updated cscope package that fixes multiple security issues is now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

cscope is a mature, ncurses-based, C source-code tree browsing tool.

Multiple buffer overflow flaws were found in cscope. An attacker could create a specially crafted source code file that could cause cscope to crash or, possibly, execute arbitrary code when browsed with cscope.
(CVE-2004-2541, CVE-2006-4262, CVE-2009-0148, CVE-2009-1577)

All users of cscope are advised to upgrade to this updated package, which contains backported patches to fix these issues. All running instances of cscope must be restarted for this update to take effect.

The remote host is affected by the vulnerability described in GLSA-200606-10 (Cscope: Many buffer overflows)

    Cscope does not verify the length of file names sourced in     #include statements.
  Impact :

    A user could be enticed to source a carefully crafted file which     will allow the attacker to execute arbitrary code with the permissions     of the user running Cscope.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Published	Updated	Severity
67873	Oracle Linux 5 : cscope (ELSA-2009-1102)	Nessus	Oracle Linux Local Security Checks	7/12/2013	1/14/2021	high
22606	Debian DSA-1064-1 : cscope - buffer overflows	Nessus	Debian Local Security Checks	10/14/2006	1/4/2021	medium
39412	RHEL 3 / 4 : cscope (RHSA-2009:1101)	Nessus	Red Hat Local Security Checks	6/16/2009	1/14/2021	high
39413	RHEL 5 : cscope (RHSA-2009:1102)	Nessus	Red Hat Local Security Checks	6/16/2009	1/14/2021	high
25830	Mac OS X Multiple Vulnerabilities (Security Update 2007-007)	Nessus	MacOS X Local Security Checks	8/2/2007	7/14/2018	critical
21590	FreeBSD : cscope -- buffer overflow vulnerabilities (72d8df84-ea6d-11da-8a53-00123ffe8333)	Nessus	FreeBSD Local Security Checks	5/24/2006	1/6/2021	medium
60595	Scientific Linux Security Update : cscope on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	high
67872	Oracle Linux 3 / 4 : cscope (ELSA-2009-1101)	Nessus	Oracle Linux Local Security Checks	7/12/2013	1/14/2021	high
21703	GLSA-200606-10 : Cscope: Many buffer overflows	Nessus	Gentoo Local Security Checks	6/16/2006	1/6/2021	medium
39424	CentOS 3 : cscope (CESA-2009:1101)	Nessus	CentOS Local Security Checks	6/17/2009	1/4/2021	high
43756	CentOS 5 : cscope (CESA-2009:1102)	Nessus	CentOS Local Security Checks	1/6/2010	1/4/2021	high

Detections

Analytics

Plugins Search

high

medium

high

high

critical

medium

high

high

medium

high

high