Upstream information

CVE-2007-0157 at MITRE

Description

Array index error in the uri_lookup function in the URI parser for neon 0.26.0 to 0.26.2, possibly only on 64-bit platforms, allows remote malicious servers to cause a denial of service (crash) via a URI with non-ASCII characters, which triggers a buffer under-read due to a type conversion error that generates a negative index.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having important severity.

CVSS v2 Scores
  National Vulnerability Database
Base Score 7.8
Vector AV:N/AC:L/Au:N/C:N/I:N/A:C
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
SUSE Bugzilla entry: 235083 [RESOLVED / FIXED]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Linux Enterprise Server 11 SP1
  • libneon27 >= 0.28.3-2.12.1
  • libneon27-32bit >= 0.28.3-2.12.1
  • libneon27-x86 >= 0.28.3-2.12.1
  • neon >= 0.28.3-2.12.1
Patchnames:
SUSE Linux Enterprise Server 11 SP1 GA libneon27
SUSE Linux Enterprise Server 11 SP2
  • libneon27 >= 0.29.6-6.7.1
  • libneon27-32bit >= 0.29.6-6.7.1
  • libneon27-x86 >= 0.29.6-6.7.1
Patchnames:
SUSE Linux Enterprise Server 11 SP2 GA libneon27
SUSE Linux Enterprise Server 11 SP3
  • libneon27 >= 0.29.6-6.7.1
  • libneon27-32bit >= 0.29.6-6.7.1
  • libneon27-x86 >= 0.29.6-6.7.1
Patchnames:
SUSE Linux Enterprise Server 11 SP3 GA libneon27
SUSE Linux Enterprise Server 11 SP4
  • libneon27 >= 0.29.6-6.7.1
  • libneon27-32bit >= 0.29.6-6.7.1
  • libneon27-x86 >= 0.29.6-6.7.1
Patchnames:
SUSE Linux Enterprise Server 11 SP4 GA libneon27
SUSE Linux Enterprise Software Development Kit 11 SP4
  • libneon-devel >= 0.29.6-6.7.1
  • libneon27-32bit >= 0.29.6-6.7.1
Patchnames:
SUSE Linux Enterprise Software Development Kit 11 SP4 GA libneon-devel