CVE-2012-3291 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.8 UNKNOWN	NETWORK	LOW		AV:N/AC:L/Au:N/C:N/I:N/A:C

Base Score

CVSS 3.x

EPSS Score

Percentile: 78%

Affected Products (NVD)

Vendor	Product	Version
infradead	openconnect	𝑥 ≤ 3.17
infradead	openconnect	1.00
infradead	openconnect	1.10
infradead	openconnect	1.20
infradead	openconnect	1.30
infradead	openconnect	1.40
infradead	openconnect	2.00
infradead	openconnect	2.01
infradead	openconnect	2.10
infradead	openconnect	2.11
infradead	openconnect	2.12
infradead	openconnect	2.20
infradead	openconnect	2.21
infradead	openconnect	2.22
infradead	openconnect	2.23
infradead	openconnect	2.24
infradead	openconnect	2.25
infradead	openconnect	2.26
infradead	openconnect	3.00
infradead	openconnect	3.01
infradead	openconnect	3.02
infradead	openconnect	3.11
infradead	openconnect	3.12
infradead	openconnect	3.13
infradead	openconnect	3.14
infradead	openconnect	3.15
infradead	openconnect	3.16

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

openconnect

bookworm	9.01-3 fixed
bullseye	8.10-2 fixed
sid	9.12-3 fixed
trixie	9.12-3 fixed

Ubuntu Releases

Ubuntu Product

Codename

openconnect

hardy	dne
lucid	ignored
natty	Fixed 2.25-0.1+squeeze1build0.11.04.1 released
oneiric	ignored
precise	ignored
quantal	not-affected
raring	not-affected
saucy	not-affected
trusty	dne
utopic	not-affected
vivid	not-affected
wily	not-affected
xenial	not-affected
yakkety	not-affected
zesty	not-affected

Common Weakness Enumeration

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

References

http://git.infradead.org/users/dwmw2/openconnect.git/commitdiff/14cae65318d3ef1f7d449e463b72b6934e82f1c2

http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079747.html

http://lists.opensuse.org/opensuse-updates/2013-06/msg00186.html

http://www.debian.org/security/2012/dsa-2495

http://www.infradead.org/openconnect/changelog.html

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17242

http://git.infradead.org/users/dwmw2/openconnect.git/commitdiff/14cae65318d3ef1f7d449e463b72b6934e82f1c2

http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079747.html

http://lists.opensuse.org/opensuse-updates/2013-06/msg00186.html

http://www.debian.org/security/2012/dsa-2495

http://www.infradead.org/openconnect/changelog.html

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17242