CVE-2009-2905

Heap-based buffer overflow in textbox.c in newt 0.51.5, 0.51.6, and 0.52.2 allows local users to cause a denial of service (application crash) or possibly execute arbitrary code via a request to display a crafted text dialog box.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.6 UNKNOWN
LOCAL
LOW
AV:L/AC:L/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 23%
Affected Products (NVD)
VendorProductVersion
fedorahostednewt
0.51.5
fedorahostednewt
0.51.6
fedorahostednewt
0.52.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
newt
bookworm
0.52.23-1
fixed
bullseye
0.52.21-4
fixed
sid
0.52.24-3
fixed
trixie
0.52.24-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
newt
dapper
Fixed 0.51.6-31ubuntu1.1
released
hardy
Fixed 0.52.2-11.2ubuntu1.1
released
intrepid
Fixed 0.52.2-11.3ubuntu1.1
released
jaunty
Fixed 0.52.2-11.3ubuntu3.1
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libnewt0_52
suse enterprise desktop 15
0.52.20-5.35
fixed
suse enterprise desktop 15 SP1
0.52.20-5.35
fixed
suse enterprise desktop 15 SP2
0.52.20-5.35
fixed
suse enterprise desktop 15 SP3
0.52.20-5.35
fixed
suse enterprise desktop 15 SP4
0.52.20-5.35
fixed
suse enterprise sap 15
0.52.20-5.35
fixed
suse enterprise sap 15 SP1
0.52.20-5.35
fixed
suse enterprise sap 15 SP2
0.52.20-5.35
fixed
suse enterprise sap 15 SP3
0.52.20-5.35
fixed
suse enterprise sap 15 SP4
0.52.20-5.35
fixed
suse enterprise server 15
0.52.20-5.35
fixed
suse enterprise server 15 SP1
0.52.20-5.35
fixed
suse enterprise server 15 SP2
0.52.20-5.35
fixed
suse enterprise server 15 SP3
0.52.20-5.35
fixed
suse enterprise server 15 SP4
0.52.20-5.35
fixed
newt
suse enterprise desktop 15
0.52.20-5.35
fixed
suse enterprise desktop 15 SP1
0.52.20-5.35
fixed
suse enterprise desktop 15 SP2
0.52.20-5.35
fixed
suse enterprise desktop 15 SP3
0.52.20-5.35
fixed
suse enterprise desktop 15 SP4
0.52.20-5.35
fixed
suse enterprise sap 15
0.52.20-5.35
fixed
suse enterprise sap 15 SP1
0.52.20-5.35
fixed
suse enterprise sap 15 SP2
0.52.20-5.35
fixed
suse enterprise sap 15 SP3
0.52.20-5.35
fixed
suse enterprise sap 15 SP4
0.52.20-5.35
fixed
suse enterprise server 15
0.52.20-5.35
fixed
suse enterprise server 15 SP1
0.52.20-5.35
fixed
suse enterprise server 15 SP2
0.52.20-5.35
fixed
suse enterprise server 15 SP3
0.52.20-5.35
fixed
suse enterprise server 15 SP4
0.52.20-5.35
fixed
python3-newt
suse enterprise desktop 15
0.52.20-5.35
fixed
suse enterprise desktop 15 SP1
0.52.20-5.35
fixed
suse enterprise desktop 15 SP2
0.52.20-5.35
fixed
suse enterprise desktop 15 SP3
0.52.20-5.35
fixed
suse enterprise desktop 15 SP4
0.52.20-5.35
fixed
suse enterprise sap 15
0.52.20-5.35
fixed
suse enterprise sap 15 SP1
0.52.20-5.35
fixed
suse enterprise sap 15 SP2
0.52.20-5.35
fixed
suse enterprise sap 15 SP3
0.52.20-5.35
fixed
suse enterprise sap 15 SP4
0.52.20-5.35
fixed
suse enterprise server 15
0.52.20-5.35
fixed
suse enterprise server 15 SP1
0.52.20-5.35
fixed
suse enterprise server 15 SP2
0.52.20-5.35
fixed
suse enterprise server 15 SP3
0.52.20-5.35
fixed
suse enterprise server 15 SP4
0.52.20-5.35
fixed
Common Weakness Enumeration
References
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
http://lists.vmware.com/pipermail/security-announce/2010/000082.html
http://secunia.com/advisories/37922
http://secunia.com/advisories/38794
http://secunia.com/advisories/38833
http://security.debian.org/pool/updates/main/n/newt/newt_0.52.2-10+etch1.diff.gz
http://support.avaya.com/css/P8/documents/100067251
http://www.debian.org/security/2009/dsa-1894
http://www.securityfocus.com/bid/36515
http://www.ubuntu.com/usn/USN-837-1
http://www.vupen.com/english/advisories/2010/0528
https://bugzilla.redhat.com/show_bug.cgi?id=523955
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8556
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9664
https://rhn.redhat.com/errata/RHSA-2009-1463.html
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
http://lists.vmware.com/pipermail/security-announce/2010/000082.html
http://secunia.com/advisories/37922
http://secunia.com/advisories/38794
http://secunia.com/advisories/38833
http://security.debian.org/pool/updates/main/n/newt/newt_0.52.2-10+etch1.diff.gz
http://support.avaya.com/css/P8/documents/100067251
http://www.debian.org/security/2009/dsa-1894
http://www.securityfocus.com/bid/36515
http://www.ubuntu.com/usn/USN-837-1
http://www.vupen.com/english/advisories/2010/0528
https://bugzilla.redhat.com/show_bug.cgi?id=523955
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8556
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9664
https://rhn.redhat.com/errata/RHSA-2009-1463.html