CVE-2009-2281

https://notcve.org/view.php?id=CVE-2009-2281

23 Oct 2009 — Multiple heap-based buffer underflows in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x through 4.10.4 and 5.x before 5.4.2 allow remote attackers to execute arbitrary code via (1) a crafted Content-Length HTTP header or (2) a large HTTP request, related to an integer overflow that triggers a heap-based buffer overflow. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-0840. Múltiples desbordamiento de búfer basados en memoria dinámica en la función readPostBod... • http://security.debian.org/pool/updates/main/m/mapserver/mapserver_4.10.0-5.1+etch4.diff.gz • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •