CVE-2009-2286
Buffer overflow in compface 1.5.2 and earlier allows user-assisted attackers to cause a denial of...
Buffer overflow in compface 1.5.2 and earlier allows user-assisted attackers to cause a denial of service (crash) via a long declaration in a .xbm file. NOTE: this issue only affects compface on distributions that used a certain patch.
Exploit likelihood
What each source reports
NVD Score used
Buffer overflow in compface 1.5.2 and earlier allows user-assisted attackers to cause a denial of service (crash) via a long declaration in a .xbm file. NOTE: this issue only affects compface on distributions that used a certain patch.
- Record
CVE-2009-2286- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Buffer overflow in compface 1.5.2 and earlier allows user-assisted attackers to cause a denial of service (crash) via a long declaration in a .xbm file. NOTE: this issue only affects compface on distributions that used a certain patch.
- Record
CVE-2009-2286- Updated
- 2026-11-02
EUVDEUVD-2009-2282 No score
Buffer overflow in compface 1.5.2 and earlier allows user-assisted attackers to cause a denial of service (crash) via a long declaration in a .xbm file. NOTE: this issue only affects compface on distributions that used a certain patch.
- Record
EUVD-2009-2282- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6crq-w9mv-v5mf No score
Buffer overflow in compface 1.5.2 and earlier allows user-assisted attackers to cause a denial of...
Buffer overflow in compface 1.5.2 and earlier allows user-assisted attackers to cause a denial of service (crash) via a long declaration in a .xbm file. NOTE: this issue only affects compface on distributions that used a certain patch.
- Record
GHSA-6crq-w9mv-v5mf- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Buffer overflow in compface 1.5.2 and earlier allows user-assisted attackers to cause a denial of service (crash) via a long declaration in a .xbm file. NOTE: this issue only affects compface on distributions that used a certain patch.
- Record
CVE-2009-2286- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-2286 No score
Buffer overflow in compface 1.5.2 and earlier allows user-assisted attackers to cause a denial of service (crash) via a long declaration in a .xbm file. NOTE: this issue only affects compface on distributions that used a certain patch.
- Record
DEBIAN-CVE-2009-2286- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libcompfaceDebian:12 |
before 1:1.5.2-5 | 1:1.5.2-5 |
libcompfaceDebian:13 |
before 1:1.5.2-5 | 1:1.5.2-5 |
libcompfaceDebian:14 |
before 1:1.5.2-5 | 1:1.5.2-5 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Compface 1.5.2 - '.xbm' Local Buffer Overflow (PoC) | 2009-06-17 |
| Exploit-DB | Compface 1.1.5 - '.xbm' Local Buffer Overflow | 2009-07-30 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-2286 is a medium vulnerability (CVSS 4.3) in James Ashton Compface, published July 1, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.08%, the 87th percentile. Fixed in libcompface 1:1.5.2-5.
References
openwall.com/lists/oss-security/2009/07/03/1
bugs.debian.org/cgi-bin/bugreport.cgi?bug=534973
securityfocus.com/bid/35863
nvd.nist.gov/vuln/detail/CVE-2009-2286
github.com/advisories/GHSA-6crq-w9mv-v5mf
security-tracker.debian.org/tracker/CVE-2009-2286