CVE-2012-3291 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	7.8 UNKNOWN	NETWORK	LOW		AV:N/AC:L/Au:N/C:N/I:N/A:C
mitre	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 77%

Vendor	Product	Version
infradead	openconnect	𝑥 ≤ 3.17
infradead	openconnect	1.00
infradead	openconnect	1.10
infradead	openconnect	1.20
infradead	openconnect	1.30
infradead	openconnect	1.40
infradead	openconnect	2.00
infradead	openconnect	2.01
infradead	openconnect	2.10
infradead	openconnect	2.11
infradead	openconnect	2.12
infradead	openconnect	2.20
infradead	openconnect	2.21
infradead	openconnect	2.22
infradead	openconnect	2.23
infradead	openconnect	2.24
infradead	openconnect	2.25
infradead	openconnect	2.26
infradead	openconnect	3.00
infradead	openconnect	3.01
infradead	openconnect	3.02
infradead	openconnect	3.11
infradead	openconnect	3.12
infradead	openconnect	3.13
infradead	openconnect	3.14
infradead	openconnect	3.15
infradead	openconnect	3.16

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

openconnect

bullseye	8.10-2 fixed
bookworm	9.01-3 fixed
sid	9.12-3 fixed
trixie	9.12-3 fixed

Ubuntu Releases

Ubuntu Product

Codename

openconnect

zesty	not-affected
yakkety	not-affected
xenial	not-affected
wily	not-affected
vivid	not-affected
utopic	not-affected
trusty	dne
saucy	not-affected
raring	not-affected
quantal	not-affected
precise	ignored
oneiric	ignored
natty	Fixed 2.25-0.1+squeeze1build0.11.04.1 released
lucid	ignored
hardy	dne

Common Weakness Enumeration

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

References

http://git.infradead.org/users/dwmw2/openconnect.git/commitdiff/14cae65318d3ef1f7d449e463b72b6934e82f1c2

http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079747.html

http://lists.opensuse.org/opensuse-updates/2013-06/msg00186.html

http://www.debian.org/security/2012/dsa-2495

http://www.infradead.org/openconnect/changelog.html

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17242

http://git.infradead.org/users/dwmw2/openconnect.git/commitdiff/14cae65318d3ef1f7d449e463b72b6934e82f1c2

http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079747.html

http://lists.opensuse.org/opensuse-updates/2013-06/msg00186.html

http://www.debian.org/security/2012/dsa-2495

http://www.infradead.org/openconnect/changelog.html

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17242