CVE-2008-4933

Linux Kernel < 2.6.28 - Memory Corruption

Title source: rule

Description

Buffer overflow in the hfsplus_find_cat function in fs/hfsplus/catalog.c in the Linux kernel before 2.6.28-rc1 allows attackers to cause a denial of service (memory corruption or system crash) via an hfsplus filesystem image with an invalid catalog namelength field, related to the hfsplus_cat_build_key_uni function.

References (22)

[Patch] http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.27.y.git%3Ba=commit%3Bh=efc7ffcb4237f8cb9938909041c4ed38f6e1bf40

[Various Sources] http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.28-rc1

[Mailing List] http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00006.html

[Mailing List] http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00010.html

[Vendor Advisory] http://rhn.redhat.com/errata/RHSA-2009-0264.html

[Vendor Advisory] http://secunia.com/advisories/32510

[Third Party Advisory] http://secunia.com/advisories/32918

[Third Party Advisory] http://secunia.com/advisories/32998

[Third Party Advisory] http://secunia.com/advisories/33180

[Third Party Advisory] http://secunia.com/advisories/33556

[Third Party Advisory] http://secunia.com/advisories/33641

[Third Party Advisory] http://secunia.com/advisories/33704

[Vendor Advisory] http://www.mandriva.com/security/advisories?name=MDVSA-2008:234

[Vendor Advisory] http://www.redhat.com/support/errata/RHSA-2009-0014.html

[Patch] http://www.securityfocus.com/bid/32093

[Vendor Advisory] http://www.ubuntu.com/usn/usn-679-1

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/46405

[Third Party Advisory, VDB Entry] https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11061

[Third Party Advisory] http://www.debian.org/security/2008/dsa-1681

[Third Party Advisory] http://www.debian.org/security/2008/dsa-1687

... and 2 more

Scores

EPSS 0.0117

EPSS Percentile 78.5%

Classification

CWE

CWE-119

Status draft

Affected Products (50)

linux/linux_kernel < 2.6.28

linux/linux_kernel

linux/linux_kernel

linux/linux_kernel

linux/linux_kernel

linux/linux_kernel

linux/linux_kernel

linux/linux_kernel

linux/linux_kernel

linux/linux_kernel

linux/linux_kernel

linux/linux_kernel

linux/linux_kernel

linux/linux_kernel

linux/linux_kernel

... and 35 more

Timeline

Published Nov 05, 2008

Tracked Since Feb 18, 2026