CVE-2008-7159

The silc_asn1_encoder function in lib/silcasn1/silcasn1_encode.c in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.8 allows remote attackers to overwrite a stack location and possibly execute arbitrary code via a crafted OID value, related to incorrect use of a %lu format string.

Link	Resource
http://www.debian.org/security/2009/dsa-1879	Patch
http://silcnet.org/docs/changelog/SILC%20Toolkit%201.1.8	Patch Vendor Advisory
http://www.openwall.com/lists/oss-security/2009/08/31/5	Patch
http://secunia.com/advisories/36625	Vendor Advisory
http://www.securityfocus.com/bid/36192	Patch
http://silcnet.org/general/news/news_toolkit.php	Patch Vendor Advisory
http://www.openwall.com/lists/oss-security/2009/09/03/5
http://secunia.com/advisories/36614	Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
http://www.mandriva.com/security/advisories?name=MDVSA-2009:234
https://exchange.xforce.ibmcloud.com/vulnerabilities/53477

Configuration 1

cpe:2.3:a:silcnet:silc_toolkit:1.1.3:*:*:*:*:*:*:* cpe:2.3:a:silcnet:silc_toolkit:1.1.5:*:*:*:*:*:*:* cpe:2.3:a:silcnet:silc_toolkit:1.1:*:*:*:*:*:*:* cpe:2.3:a:silcnet:silc_toolkit:1.1.1:*:*:*:*:*:*:* cpe:2.3:a:silcnet:silc_toolkit:1.1.4:*:*:*:*:*:*:* cpe:2.3:a:silcnet:silc_toolkit:*:*:*:*:*:*:*:* cpe:2.3:a:silcnet:silc_toolkit:1.1.2:*:*:*:*:*:*:*

---

Published : 2009-09-10 09:30

Updated : 2017-08-17 01:29

---

NVD link : CVE-2008-7159

Mitre link : CVE-2008-7159

Silcnet

CWE-134

Use of Externally-Controlled Format String