Every CVE Search/ Get API key

CVE-2009-0148

Multiple buffer overflows in Cscope before 15.7a allow remote attackers to execute arbitrary code...

9.3 HighFix available

CVE-2009-0148 is a high vulnerability (CVSS 9.3) in Cscope, published May 5, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.77%, the 93rd percentile. Fixed in cscope 15.7a-1.

Multiple buffer overflows in Cscope before 15.7a allow remote attackers to execute arbitrary code via long strings in input such as (1) source-code tokens and (2) pathnames, related to integer overflows in some cases. NOTE: this issue exists because of an incomplete fix for CVE-2004-2541.

Exploit likelihood

6.77%Down 3.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.3

Multiple buffer overflows in Cscope before 15.7a allow remote attackers to execute arbitrary code via long strings in input such as (1) source-code tokens and (2) pathnames, related to integer overflows in some cases. NOTE: this issue exists because of an incomplete fix for CVE-2004-2541.

Record
CVE-2009-0148
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Multiple buffer overflows in Cscope before 15.7a allow remote attackers to execute arbitrary code via long strings in input such as (1) source-code tokens and (2) pathnames, related to integer overflows in some cases. NOTE: this issue exists because of an incomplete fix for CVE-2004-2541.

Record
CVE-2009-0148
Updated
2026-11-02
EUVDEUVD-2009-0157 No score

Multiple buffer overflows in Cscope before 15.7a allow remote attackers to execute arbitrary code via long strings in input such as (1) source-code tokens and (2) pathnames, related to integer overflows in some cases. NOTE: this issue exists because of an incomplete fix for CVE-2004-2541.

Record
EUVD-2009-0157
Updated
2026-11-03
GitHub AdvisoriesGHSA-vfq3-6prq-j8hp No score

Multiple buffer overflows in Cscope before 15.7a allow remote attackers to execute arbitrary code...

Multiple buffer overflows in Cscope before 15.7a allow remote attackers to execute arbitrary code via long strings in input such as (1) source-code tokens and (2) pathnames, related to integer overflows in some cases. NOTE: this issue exists because of an incomplete fix for CVE-2004-2541.

Record
GHSA-vfq3-6prq-j8hp
Weakness
CWE-119
Updated
2026-11-02
OSV No score

Multiple buffer overflows in Cscope before 15.7a allow remote attackers to execute arbitrary code via long strings in input such as (1) source-code tokens and (2) pathnames, related to integer overflows in some cases. NOTE: this issue exists because of an incomplete fix for CVE-2004-2541.

Record
CVE-2009-0148
Updated
2026-11-02
OSVDEBIAN-CVE-2009-0148 No score

Multiple buffer overflows in Cscope before 15.7a allow remote attackers to execute arbitrary code via long strings in input such as (1) source-code tokens and (2) pathnames, related to integer overflows in some cases. NOTE: this issue exists because of an incomplete fix for CVE-2004-2541.

Record
DEBIAN-CVE-2009-0148
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cscope
Debian:12
 before 15.7a-1
15.7a-1
cscope
Debian:13
 before 15.7a-1
15.7a-1
cscope
Debian:14
 before 15.7a-1
15.7a-1
cscope
Debian:5.0
 before 15.6-6+lenny1, plus listed versions
15.6-6
15.6-6+lenny1
cscope
Debian:4.0
 before 15.6-2+etch1, plus listed versions
15.6-2
15.6-2+etch1
cscope
Red Hat:enterprise_linux:3::as
 before 0:15.5-16.RHEL3
0:15.5-16.RHEL3
cscope-debuginfo
Red Hat:enterprise_linux:3::as
 before 0:15.5-16.RHEL3
0:15.5-16.RHEL3
cscope
Red Hat:enterprise_linux:3::desktop
 before 0:15.5-16.RHEL3
0:15.5-16.RHEL3
cscope-debuginfo
Red Hat:enterprise_linux:3::desktop
 before 0:15.5-16.RHEL3
0:15.5-16.RHEL3
cscope
Red Hat:enterprise_linux:3::es
 before 0:15.5-16.RHEL3
0:15.5-16.RHEL3
Show 15 moreShow less
Affected packages
PackageAffectedFixed
cscope-debuginfo
Red Hat:enterprise_linux:3::es
 before 0:15.5-16.RHEL3
0:15.5-16.RHEL3
cscope
Red Hat:enterprise_linux:3::ws
 before 0:15.5-16.RHEL3
0:15.5-16.RHEL3
cscope-debuginfo
Red Hat:enterprise_linux:3::ws
 before 0:15.5-16.RHEL3
0:15.5-16.RHEL3
cscope
Red Hat:enterprise_linux:4::as
 before 0:15.5-10.RHEL4.3
0:15.5-10.RHEL4.3
cscope-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:15.5-10.RHEL4.3
0:15.5-10.RHEL4.3
cscope
Red Hat:enterprise_linux:4::desktop
 before 0:15.5-10.RHEL4.3
0:15.5-10.RHEL4.3
cscope-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:15.5-10.RHEL4.3
0:15.5-10.RHEL4.3
cscope
Red Hat:enterprise_linux:4::es
 before 0:15.5-10.RHEL4.3
0:15.5-10.RHEL4.3
cscope-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:15.5-10.RHEL4.3
0:15.5-10.RHEL4.3
cscope
Red Hat:enterprise_linux:4::ws
 before 0:15.5-10.RHEL4.3
0:15.5-10.RHEL4.3
cscope-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:15.5-10.RHEL4.3
0:15.5-10.RHEL4.3
cscope
Red Hat:enterprise_linux:5::client_workstation
 before 0:15.5-15.1.el5_3.1
0:15.5-15.1.el5_3.1
cscope-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:15.5-15.1.el5_3.1
0:15.5-15.1.el5_3.1
cscope
Red Hat:enterprise_linux:5::server
 before 0:15.5-15.1.el5_3.1
0:15.5-15.1.el5_3.1
cscope-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:15.5-15.1.el5_3.1
0:15.5-15.1.el5_3.1

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 37 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open