VU#203203 - midnight_commander
- From: CERT Coordination Center <cert cert org>
- To: Midnight Commander Developer List <mc-devel gnome org>
- Cc: CERT Coordination Center <cert cert org>
- Subject: VU#203203 - midnight_commander
- Date: Tue, 29 Jan 2002 16:11:39 -0500
-----BEGIN PGP SIGNED MESSAGE-----
We have received report regarding a vulnerability in one of your
products. We would appreciate greatly your help in reviewing this
issue so that we can document it in our public database.
Please review the following vulnerability note for accuracy and
answer these questions:
1. Have you verified the existence of this vulnerability?
2. Has it been corrected in a released update or new version of the
product? If yes, please provide links to more information, including
how users can obtain the update or new version.
3. If not yet released, when do you plan on releasing an update to
fix this vulnerability? What should users do in the meantime to limit
exposure to this vulnerability?
CERT/CC Vulnerability Note Draft:
VU#203203 - Buffer-overflow vulnerability in Midnight Commander
KEYWORDS: Midnight Commander, /usr/bin/mcedit, mcedit, buffer overflow
The mcedit component of some versions of Midnight Commander contains
a buffer-overflow vulnerability.
Midnight Commander is a file manager for free operating systems,
distributed under the GNU General Public License (GPL). In version
4.5.1 of Midnight Commander, the mcedit text editor component is
susceptible to segmentation fault by buffer overflow.
The complete impact of this vulnerability is not yet known. Attackers
can cause mcedit to end with a segmentation fault.
The CERT/CC is currently unaware of a practical solution to this
If there are any mistakes or inaccuracies in the above vulnerability
note, please let me know so they can be corrected before publication.
Shawn Van Ittersum
CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
-----BEGIN PGP SIGNATURE-----
-----END PGP SIGNATURE-----
] [Thread Prev