Security
Security
Cscope is vulnerable to multiple buffer overflows that could lead to the execution of arbitrary code.
| Package | dev-util/cscope on all architectures |
|---|---|
| Affected versions | < 15.5.20060927 |
| Unaffected versions | >= 15.5.20060927 |
Cscope is a developer's tool for browsing source code.
Unchecked use of strcpy() and *scanf() leads to several buffer overflows.
A user could be enticed to open a carefully crafted file which would allow the attacker to execute arbitrary code with the permissions of the user running Cscope.
There is no known workaround at this time.
All Cscope users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-util/cscope-15.5.20060927"
Release date
October 20, 2006
Latest revision
October 20, 2006: 01
Severity
normal
Exploitable
remote
Bugzilla entries