CVE-2004-0109

Description

Buffer overflow in the ISO9660 file system component for Linux kernel 2.4.x, 2.5.x and 2.6.x, allows local users with physical access to overflow kernel memory and execute arbitrary code via a malformed CD containing a long symbolic link entry.

4.6

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 0.16%

Vendor Advisory redhat.com Vendor Advisory sgi.com Vendor Advisory marc.info Vendor Advisory debian.org Vendor Advisory debian.org Vendor Advisory redhat.com Vendor Advisory debian.org Vendor Advisory novell.com Vendor Advisory debian.org Vendor Advisory turbolinux.com Vendor Advisory com.br Vendor Advisory debian.org Vendor Advisory debian.org Vendor Advisory sgi.com Vendor Advisory linuxsecurity.com Vendor Advisory redhat.com Vendor Advisory mandriva.com Vendor Advisory gentoo.org Vendor Advisory redhat.com Vendor Advisory debian.org Vendor Advisory idefense.com

Affected: n/a n/a

References

Link	Tags
https://exchange.xforce.ibmcloud.com/vulnerabilities/15866	vdb entry
http://secunia.com/advisories/11626	third party advisory
http://secunia.com/advisories/11464	third party advisory
http://www.redhat.com/support/errata/RHSA-2004-105.html	vendor advisory
http://www.ciac.org/ciac/bulletins/o-127.shtml	third party advisory government resource
http://secunia.com/advisories/11518	third party advisory
ftp://patches.sgi.com/support/free/security/advisories/20040405-01-U.asc	patch vendor advisory
http://marc.info/?l=bugtraq&m=108213675028441&w=2	vendor advisory
http://www.debian.org/security/2004/dsa-482	vendor advisory
http://secunia.com/advisories/11861	third party advisory
http://secunia.com/advisories/11362	third party advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A940	vdb entry signature
http://www.debian.org/security/2004/dsa-495	vendor advisory
http://www.redhat.com/support/errata/RHSA-2004-183.html	vendor advisory
http://www.debian.org/security/2004/dsa-479	vendor advisory
http://secunia.com/advisories/12003	third party advisory
http://secunia.com/advisories/11891	third party advisory
http://www.novell.com/linux/security/advisories/2004_09_kernel.html	vendor advisory
http://secunia.com/advisories/11469	third party advisory
http://secunia.com/advisories/11486	third party advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10733	vdb entry signature
http://www.debian.org/security/2004/dsa-480	vendor advisory
http://www.turbolinux.com/security/2004/TLSA-2004-14.txt	vendor advisory
http://www.securityfocus.com/bid/10141	vdb entry
http://secunia.com/advisories/11986	third party advisory
http://secunia.com/advisories/11470	third party advisory
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000846	vendor advisory
http://secunia.com/advisories/11361	third party advisory
http://www.debian.org/security/2004/dsa-489	vendor advisory
http://www.debian.org/security/2004/dsa-481	vendor advisory
http://secunia.com/advisories/11373	third party advisory
ftp://patches.sgi.com/support/free/security/advisories/20040504-01-U.asc	vendor advisory
http://www.linuxsecurity.com/advisories/engarde_advisory-4285.html	patch vendor advisory
http://www.redhat.com/support/errata/RHSA-2004-106.html	vendor advisory
http://www.ciac.org/ciac/bulletins/o-121.shtml	third party advisory government resource
http://www.idefense.com/application/poi/display?id=101&type=vulnerabilities	vendor advisory
http://secunia.com/advisories/11429	third party advisory
http://secunia.com/advisories/11494	third party advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2004:029	vendor advisory
http://security.gentoo.org/glsa/glsa-200407-02.xml	vendor advisory
http://rhn.redhat.com/errata/RHSA-2004-166.html	patch vendor advisory
http://www.debian.org/security/2004/dsa-491	vendor advisory

Frequently Asked Questions

What is the severity of CVE-2004-0109?: CVE-2004-0109 has been scored as a medium severity vulnerability.
How to fix CVE-2004-0109?: To fix CVE-2004-0109, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2004-0109 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2004-0109 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.