Description
mapserv.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 does not properly restrict the use of CGI command-line arguments that were intended for debugging, which allows remote attackers to have an unspecified impact via crafted arguments.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://lists.osgeo.org/pipermail/mapserver-users/2010-July/066052.html ↗
- http://www.securityfocus.com/bid/41855 ↗
- http://trac.osgeo.org/mapserver/ticket/3485 ↗
- http://marc.info/?l=oss-security&m=127973754121922&w=2 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/60852 ↗
- http://marc.info/?l=oss-security&m=127973381215859&w=2 ↗