Heap-buffer-overflow in msSetError in mapserver
Summary
OSV-2022-1026: Heap-buffer-overflow in msSetError. Affects mapserver versions >= 3b0aa0d2757512fdaa72c6856ce4cf58ff57f8b4, < 8cf2023b172b2eafda8ecc4c5e12b0bfe3c5f9d2. Fixed in 8cf2023b172b2eafda8ecc4c5e12b0bfe3c5f9d2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
MapServer is an open-source software for rendering maps and spatial data. It provides a set of tools and libraries for creating and serving maps over the internet. The vulnerability in question affects the msSetError function within the MapServer codebase.
Vulnerability Detail
The vulnerability identified in MapServer is a heap-buffer-overflow issue. It was reported through the OSS-Fuzz project and can lead to a read access violation. The specific crash state occurs in the msSetError function, which is called by the loadColor and loadMapInternal functions. This vulnerability can potentially be exploited by an attacker to execute arbitrary code or cause a denial-of-service condition.
How To Fix
Minimum fixed version
8cf2023b172b2eafda8ecc4c5e12b0bfe3c5f9d2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if updating the MapServer package is not immediately feasible, it is recommended to exercise caution when processing untrusted map data. Limiting access to the affected functionality or implementing additional input validation can help reduce the risk of exploitation.
Conclusion
The heap-buffer-overflow vulnerability in msSetError within the MapServer package can have serious security implications. It is crucial to update to a fixed version or apply the recommended workaround to protect systems from potential exploitation. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for mapserver →
FAQ
MapServer is an open-source software for rendering maps and spatial data. It provides a set of tools and libraries for creating and serving maps over the internet.
A heap-buffer-overflow is a type of memory vulnerability where a program writes data beyond the bounds of a dynamically allocated buffer in the heap. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code or cause a crash.
This vulnerability was discovered through the OSS-Fuzz project, which performs continuous fuzz testing on open-source software to uncover potential vulnerabilities.
Exploiting this vulnerability can allow an attacker to execute arbitrary code or cause a denial-of-service condition. This could lead to unauthorized access, data breaches, or disruption of services.
Yes, a fix has been implemented in the MapServer codebase. It is recommended to update to a version that includes the fix to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for mapserver.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
