CVE-2010-2947
Heap-based buffer overflow in the HX_split function in string.c in libHX before 3.6 allows remote...
Heap-based buffer overflow in the HX_split function in string.c in libHX before 3.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a string that is inconsistent with the expected number of fields.
Exploit likelihood
What each source reports
NVD Score used
Heap-based buffer overflow in the HX_split function in string.c in libHX before 3.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a string that is inconsistent with the expected number of fields.
- Record
CVE-2010-2947- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Heap-based buffer overflow in the HX_split function in string.c in libHX before 3.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a string that is inconsistent with the expected number of fields.
- Record
CVE-2010-2947- Updated
- 2026-11-02
EUVDEUVD-2010-2951 No score
Heap-based buffer overflow in the HX_split function in string.c in libHX before 3.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a string that is inconsistent with the expected number of fields.
- Record
EUVD-2010-2951- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r6wf-w69j-7xp6 No score
Heap-based buffer overflow in the HX_split function in string.c in libHX before 3.6 allows remote...
Heap-based buffer overflow in the HX_split function in string.c in libHX before 3.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a string that is inconsistent with the expected number of fields.
- Record
GHSA-r6wf-w69j-7xp6- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Heap-based buffer overflow in the HX_split function in string.c in libHX before 3.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a string that is inconsistent with the expected number of fields.
- Record
CVE-2010-2947- Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-2947 No score
Heap-based buffer overflow in the HX_split function in string.c in libHX before 3.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a string that is inconsistent with the expected number of fields.
- Record
DEBIAN-CVE-2010-2947- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10005-1 No score
libHX-devel-3.22-2.8 on GA media
These are all security issues fixed in the libHX-devel-3.22-2.8 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10005-1- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-2947 is a high vulnerability (CVSS 10.0) in Jan Engelhardt Libhx, published August 24, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.51%, the 92nd percentile. Fixed in libhx 3.5-2.
References
securityfocus.com/bid/42592
mandriva.com/security/advisories?name=MDVSA-2010:165
vupen.com/english/advisories/2010/2232
openwall.com/lists/oss-security/2010/08/20/5
libhx.git.sourceforge.net/git/gitweb.cgi?p=libhx/libhx%3Ba=commit%3Bh=904a46f90dd3f046bfac0b64a5e813d7cd4fca59
Show 7 moreShow less
lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html
bugzilla.redhat.com/show_bug.cgi?id=625866
nvd.nist.gov/vuln/detail/CVE-2010-2947
github.com/advisories/GHSA-r6wf-w69j-7xp6
security-tracker.debian.org/tracker/CVE-2010-2947
suse.com/security/cve/CVE-2010-2947