CVE-2009-2905
Heap-based buffer overflow in textbox.c in newt 0.51.5, 0.51.6, and 0.52.2 allows local users to...
Heap-based buffer overflow in textbox.c in newt 0.51.5, 0.51.6, and 0.52.2 allows local users to cause a denial of service (application crash) or possibly execute arbitrary code via a request to display a crafted text dialog box.
Exploit likelihood
What each source reports
NVD Score used
Heap-based buffer overflow in textbox.c in newt 0.51.5, 0.51.6, and 0.52.2 allows local users to cause a denial of service (application crash) or possibly execute arbitrary code via a request to display a crafted text dialog box.
- Record
CVE-2009-2905- CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Heap-based buffer overflow in textbox.c in newt 0.51.5, 0.51.6, and 0.52.2 allows local users to cause a denial of service (application crash) or possibly execute arbitrary code via a request to display a crafted text dialog box.
- Record
CVE-2009-2905- Updated
- 2026-11-02
EUVDEUVD-2009-2893 No score
Heap-based buffer overflow in textbox.c in newt 0.51.5, 0.51.6, and 0.52.2 allows local users to cause a denial of service (application crash) or possibly execute arbitrary code via a request to display a crafted text dialog box.
- Record
EUVD-2009-2893- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fgx4-56q6-xxw8 No score
Heap-based buffer overflow in textbox.c in newt 0.51.5, 0.51.6, and 0.52.2 allows local users to...
Heap-based buffer overflow in textbox.c in newt 0.51.5, 0.51.6, and 0.52.2 allows local users to cause a denial of service (application crash) or possibly execute arbitrary code via a request to display a crafted text dialog box.
- Record
GHSA-fgx4-56q6-xxw8- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVAZL-44280 No score
CVE-2009-2905 affecting package perl-Newt 1.08-56
Heap-based buffer overflow in textbox.c in newt 0.51.5, 0.51.6, and 0.52.2 allows local users to cause a denial of service (application crash) or possibly execute arbitrary code via a request to display a crafted text dialog box.
- Record
AZL-44280- Updated
- 2026-11-05
OSV No score
Heap-based buffer overflow in textbox.c in newt 0.51.5, 0.51.6, and 0.52.2 allows local users to cause a denial of service (application crash) or possibly execute arbitrary code via a request to display a crafted text dialog box.
- Record
CVE-2009-2905- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-2905 No score
Heap-based buffer overflow in textbox.c in newt 0.51.5, 0.51.6, and 0.52.2 allows local users to cause a denial of service (application crash) or possibly execute arbitrary code via a request to display a crafted text dialog box.
- Record
DEBIAN-CVE-2009-2905- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10010-1 No score
libnewt0_52-0.52.18-1.9 on GA media
These are all security issues fixed in the libnewt0_52-0.52.18-1.9 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10010-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
perl-NewtAzure Linux:3 |
through 1.08-56 | None known |
newtDebian:12 |
before 0.52.10-4.1 | 0.52.10-4.1 |
newtDebian:13 |
before 0.52.10-4.1 | 0.52.10-4.1 |
newtDebian:14 |
before 0.52.10-4.1 | 0.52.10-4.1 |
newtDebian:4.0 |
before 0.52.2-10+etch1, plus listed versions 0.52.2-10 |
0.52.2-10+etch1 |
newtDebian:5.0 |
before 0.52.2-11.3+lenny1, plus listed versions 0.52.2-11.3 |
0.52.2-11.3+lenny1 |
newtRed Hat:enterprise_linux:3::as |
before 0:0.51.5-2.el3 | 0:0.51.5-2.el3 |
newt-debuginfoRed Hat:enterprise_linux:3::as |
before 0:0.51.5-2.el3 | 0:0.51.5-2.el3 |
newt-develRed Hat:enterprise_linux:3::as |
before 0:0.51.5-2.el3 | 0:0.51.5-2.el3 |
newtRed Hat:enterprise_linux:3::desktop |
before 0:0.51.5-2.el3 | 0:0.51.5-2.el3 |
Show 29 moreShow less
| Package | Affected | Fixed |
|---|---|---|
newt-debuginfoRed Hat:enterprise_linux:3::desktop |
before 0:0.51.5-2.el3 | 0:0.51.5-2.el3 |
newt-develRed Hat:enterprise_linux:3::desktop |
before 0:0.51.5-2.el3 | 0:0.51.5-2.el3 |
newtRed Hat:enterprise_linux:3::es |
before 0:0.51.5-2.el3 | 0:0.51.5-2.el3 |
newt-debuginfoRed Hat:enterprise_linux:3::es |
before 0:0.51.5-2.el3 | 0:0.51.5-2.el3 |
newt-develRed Hat:enterprise_linux:3::es |
before 0:0.51.5-2.el3 | 0:0.51.5-2.el3 |
newtRed Hat:enterprise_linux:3::ws |
before 0:0.51.5-2.el3 | 0:0.51.5-2.el3 |
newt-debuginfoRed Hat:enterprise_linux:3::ws |
before 0:0.51.5-2.el3 | 0:0.51.5-2.el3 |
newt-develRed Hat:enterprise_linux:3::ws |
before 0:0.51.5-2.el3 | 0:0.51.5-2.el3 |
newtRed Hat:enterprise_linux:4::as |
before 0:0.51.6-10.el4_8.1 | 0:0.51.6-10.el4_8.1 |
newt-debuginfoRed Hat:enterprise_linux:4::as |
before 0:0.51.6-10.el4_8.1 | 0:0.51.6-10.el4_8.1 |
newt-develRed Hat:enterprise_linux:4::as |
before 0:0.51.6-10.el4_8.1 | 0:0.51.6-10.el4_8.1 |
newtRed Hat:enterprise_linux:4::desktop |
before 0:0.51.6-10.el4_8.1 | 0:0.51.6-10.el4_8.1 |
newt-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:0.51.6-10.el4_8.1 | 0:0.51.6-10.el4_8.1 |
newt-develRed Hat:enterprise_linux:4::desktop |
before 0:0.51.6-10.el4_8.1 | 0:0.51.6-10.el4_8.1 |
newtRed Hat:enterprise_linux:4::es |
before 0:0.51.6-10.el4_8.1 | 0:0.51.6-10.el4_8.1 |
newt-debuginfoRed Hat:enterprise_linux:4::es |
before 0:0.51.6-10.el4_8.1 | 0:0.51.6-10.el4_8.1 |
newt-develRed Hat:enterprise_linux:4::es |
before 0:0.51.6-10.el4_8.1 | 0:0.51.6-10.el4_8.1 |
newtRed Hat:enterprise_linux:4::ws |
before 0:0.51.6-10.el4_8.1 | 0:0.51.6-10.el4_8.1 |
newt-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:0.51.6-10.el4_8.1 | 0:0.51.6-10.el4_8.1 |
newt-develRed Hat:enterprise_linux:4::ws |
before 0:0.51.6-10.el4_8.1 | 0:0.51.6-10.el4_8.1 |
newtRed Hat:enterprise_linux:5::client_workstation |
before 0:0.52.2-12.el5_4.1 | 0:0.52.2-12.el5_4.1 |
newt-debuginfoRed Hat:enterprise_linux:5::client_workstation |
before 0:0.52.2-12.el5_4.1 | 0:0.52.2-12.el5_4.1 |
newt-develRed Hat:enterprise_linux:5::client_workstation |
before 0:0.52.2-12.el5_4.1 | 0:0.52.2-12.el5_4.1 |
newtRed Hat:enterprise_linux:5::client |
before 0:0.52.2-12.el5_4.1 | 0:0.52.2-12.el5_4.1 |
newt-debuginfoRed Hat:enterprise_linux:5::client |
before 0:0.52.2-12.el5_4.1 | 0:0.52.2-12.el5_4.1 |
newtRed Hat:enterprise_linux:5::server |
before 0:0.52.2-12.el5_4.1 | 0:0.52.2-12.el5_4.1 |
newt-debuginfoRed Hat:enterprise_linux:5::server |
before 0:0.52.2-12.el5_4.1 | 0:0.52.2-12.el5_4.1 |
newt-develRed Hat:enterprise_linux:5::server |
before 0:0.52.2-12.el5_4.1 | 0:0.52.2-12.el5_4.1 |
newtopenSUSE:Tumbleweed |
before 0.52.18-1.9 | 0.52.18-1.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-2905 is a medium vulnerability (CVSS 4.6) in Fedorahosted Newt, published September 24, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 42nd percentile. Fixed in newt 0.52.10-4.1.
References
secunia.com/advisories/38794
lists.vmware.com/pipermail/security-announce/2010/000082.html
debian.org/security/2009/dsa-1894
bugzilla.redhat.com/show_bug.cgi?id=523955
rhn.redhat.com/errata/RHSA-2009-1463.html
support.avaya.com/css/P8/documents/100067251
Show 19 moreShow less
securityfocus.com/bid/36515
security.debian.org/pool/updates/main/n/newt/newt_0.52.2-10+etch1.diff.gz
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8556
ubuntu.com/usn/USN-837-1
kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
vupen.com/english/advisories/2010/0528
nvd.nist.gov/vuln/detail/CVE-2009-2905
github.com/advisories/GHSA-fgx4-56q6-xxw8
security-tracker.debian.org/tracker/CVE-2009-2905
access.redhat.com/errata/RHSA-2009:1463
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1463.json
cve.org/CVERecord?id=CVE-2009-2905
suse.com/security/cve/CVE-2009-2905