CVE-2009-1577

Multiple stack-based buffer overflows in the putstring function in find.c in Cscope before 15.6...

9.3 HighFix available

CVE-2009-1577 is a high vulnerability (CVSS 9.3) in Cscope, published May 7, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.50%, the 94th percentile. Fixed in cscope 15.6-1.

Multiple stack-based buffer overflows in the putstring function in find.c in Cscope before 15.6 allow user-assisted remote attackers to execute arbitrary code via a long (1) function name or (2) symbol in a source-code file.

Exploit likelihood

7.50%Down 2.4 points since Feb 4, 2022

What each source reports

NVD Score used 9.3

Record: CVE-2009-1577
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2009-1577
Updated: 2026-11-02

EUVDEUVD-2009-1573 No score

Record: EUVD-2009-1573
Updated: 2026-11-03

GitHub AdvisoriesGHSA-p3pr-m5x9-h46h No score

Multiple stack-based buffer overflows in the putstring function in find.c in Cscope before 15.6...

Record: GHSA-p3pr-m5x9-h46h
Weakness: CWE-119
Updated: 2026-11-02

OSV No score

Record: CVE-2009-1577
Updated: 2026-11-02

OSVDEBIAN-CVE-2009-1577 No score

Record: DEBIAN-CVE-2009-1577
Updated: 2026-11-02

Affected products

cscope

Affected packages

Affected packages
Package	Affected	Fixed
`cscope` Debian:12	before 15.6-1	15.6-1
`cscope` Debian:13	before 15.6-1	15.6-1
`cscope` Debian:14	before 15.6-1	15.6-1
`cscope` Red Hat:enterprise_linux:3::as	before 0:15.5-16.RHEL3	0:15.5-16.RHEL3
`cscope-debuginfo` Red Hat:enterprise_linux:3::as	before 0:15.5-16.RHEL3	0:15.5-16.RHEL3
`cscope` Red Hat:enterprise_linux:3::desktop	before 0:15.5-16.RHEL3	0:15.5-16.RHEL3
`cscope-debuginfo` Red Hat:enterprise_linux:3::desktop	before 0:15.5-16.RHEL3	0:15.5-16.RHEL3
`cscope` Red Hat:enterprise_linux:3::es	before 0:15.5-16.RHEL3	0:15.5-16.RHEL3
`cscope-debuginfo` Red Hat:enterprise_linux:3::es	before 0:15.5-16.RHEL3	0:15.5-16.RHEL3
`cscope` Red Hat:enterprise_linux:3::ws	before 0:15.5-16.RHEL3	0:15.5-16.RHEL3

Show 9 moreShow less

Affected packages
Package	Affected	Fixed
`cscope-debuginfo` Red Hat:enterprise_linux:3::ws	before 0:15.5-16.RHEL3	0:15.5-16.RHEL3
`cscope` Red Hat:enterprise_linux:4::as	before 0:15.5-10.RHEL4.3	0:15.5-10.RHEL4.3
`cscope-debuginfo` Red Hat:enterprise_linux:4::as	before 0:15.5-10.RHEL4.3	0:15.5-10.RHEL4.3
`cscope` Red Hat:enterprise_linux:4::desktop	before 0:15.5-10.RHEL4.3	0:15.5-10.RHEL4.3
`cscope-debuginfo` Red Hat:enterprise_linux:4::desktop	before 0:15.5-10.RHEL4.3	0:15.5-10.RHEL4.3
`cscope` Red Hat:enterprise_linux:4::es	before 0:15.5-10.RHEL4.3	0:15.5-10.RHEL4.3
`cscope-debuginfo` Red Hat:enterprise_linux:4::es	before 0:15.5-10.RHEL4.3	0:15.5-10.RHEL4.3
`cscope` Red Hat:enterprise_linux:4::ws	before 0:15.5-10.RHEL4.3	0:15.5-10.RHEL4.3
`cscope-debuginfo` Red Hat:enterprise_linux:4::ws	before 0:15.5-10.RHEL4.3	0:15.5-10.RHEL4.3

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 26 moreShow less