Description
Multiple buffer overflows in xymond/xymond.c in xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a long filename, involving handling a "config" command.
References (6)
Core 6
Core References
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/537522/100/0/threaded
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2016/dsa-3495
Vendor Advisory mailing-list
x_refsource_mlist
http://lists.xymon.com/archive/2016-February/042986.html
Patch x_refsource_confirm
https://sourceforge.net/p/xymon/code/7860/
Exploit, Third Party Advisory x_refsource_misc
http://packetstormsecurity.com/files/135758/Xymon-4.3.x-Buffer-Overflow-Code-Execution-Information-Disclosure.html
Patch x_refsource_confirm
https://sourceforge.net/p/xymon/code/7859/
Scores
CVSS v3
9.8
EPSS
0.0563
EPSS Percentile
92.0%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-119
Status
published
Products (33)
debian/debian_linux
8.0
xymon/xymon
4.1.0
xymon/xymon
4.1.1
xymon/xymon
4.1.2 (3 CPE variants)
xymon/xymon
4.2 alfa (3 CPE variants)
xymon/xymon
4.2.0
xymon/xymon
4.2.2 (2 CPE variants)
xymon/xymon
4.2.3 (2 CPE variants)
xymon/xymon
4.3.0 (5 CPE variants)
xymon/xymon
4.3.1
... and 23 more
Published
Apr 13, 2016
Tracked Since
Feb 18, 2026