CVE-2007-2053 Memory corruption in n/a

Critical 10.0 Published 30 Apr 2007 Updated 7 Aug 2024

Remote attackers can cause denial of service or execute arbitrary code via stack-based buffer overflows in AFFLIB library functions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2007-2053?

CVE-2007-2053 is a critical memory corruption vulnerability in n/a, published on 30 Apr 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Multiple stack-based buffer overflows in AFFLIB before 2.2.6 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via (1) a long LastModified value in an S3 XML response in lib/s3.cpp; (2) a long (a) path or (b) bucket in an S3 URL in lib/vnode_s3.cpp; or (3) a long (c) EFW, (d) AFD, or (c) aimage file path. NOTE: the aimage vector (3c) has since been recalled from the researcher's original advisory, since the code is not called in any version of AFFLIB.

Which versions are affected by CVE-2007-2053?

It affects 1 product.

Products include Afflib Afflib.

How do I fix CVE-2007-2053?

No fix has been published for CVE-2007-2053 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2007-2053 being exploited?

There is no known exploitation of CVE-2007-2053 in the wild and no public exploit code.

Sources

Also known as GHSA-p766-86xm-7h4p.