CVE-2012-2090
Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier...
Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in certain data chunk values in an aircraft xml model to (1) fgfs/flightgear/src/Cockpit/panel.cxx or (2) fgfs/flightgear/src/Network/generic.cxx, or (3) a scene graph model to simgear/simgear/scene/model/SGText.cxx.
Exploit likelihood
What each source reports
NVD Score used
Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in certain data chunk values in an aircraft xml model to (1) fgfs/flightgear/src/Cockpit/panel.cxx or (2) fgfs/flightgear/src/Network/generic.cxx, or (3) a scene graph model to simgear/simgear/scene/model/SGText.cxx.
- Record
CVE-2012-2090- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-134
- Updated
- 2026-11-02
CVE List No score
Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in certain data chunk values in an aircraft xml model to (1) fgfs/flightgear/src/Cockpit/panel.cxx or (2) fgfs/flightgear/src/Network/generic.cxx, or (3) a scene graph model to simgear/simgear/scene/model/SGText.cxx.
- Record
CVE-2012-2090- Updated
- 2026-11-02
EUVDEUVD-2012-2096 No score
Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in certain data chunk values in an aircraft xml model to (1) fgfs/flightgear/src/Cockpit/panel.cxx or (2) fgfs/flightgear/src/Network/generic.cxx, or (3) a scene graph model to simgear/simgear/scene/model/SGText.cxx.
- Record
EUVD-2012-2096- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4426-49xv-wxg5 No score
Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier...
Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in certain data chunk values in an aircraft xml model to (1) fgfs/flightgear/src/Cockpit/panel.cxx or (2) fgfs/flightgear/src/Network/generic.cxx, or (3) a scene graph model to simgear/simgear/scene/model/SGText.cxx.
- Record
GHSA-4426-49xv-wxg5- Weakness
- CWE-134
- Updated
- 2026-11-02
OSV No score
Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in certain data chunk values in an aircraft xml model to (1) fgfs/flightgear/src/Cockpit/panel.cxx or (2) fgfs/flightgear/src/Network/generic.cxx, or (3) a scene graph model to simgear/simgear/scene/model/SGText.cxx.
- Record
CVE-2012-2090- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-2090 No score
Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in certain data chunk values in an aircraft xml model to (1) fgfs/flightgear/src/Cockpit/panel.cxx or (2) fgfs/flightgear/src/Network/generic.cxx, or (3) a scene graph model to simgear/simgear/scene/model/SGText.cxx.
- Record
DEBIAN-CVE-2012-2090- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flightgearDebian:12 |
before 2.6.0-1.1 | 2.6.0-1.1 |
flightgearDebian:13 |
before 2.6.0-1.1 | 2.6.0-1.1 |
simgearDebian:12 |
before 2.10.0-2 | 2.10.0-2 |
simgearDebian:13 |
before 2.10.0-2 | 2.10.0-2 |
simgearDebian:14 |
before 2.10.0-2 | 2.10.0-2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-2090 is a high vulnerability (CVSS 9.3) in Flightgear, published June 17, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.93%, the 93rd percentile. Fixed in flightgear 2.6.0-1.1.
References
secunia.com/advisories/48780
exchange.xforce.ibmcloud.com/vulnerabilities/74791
lists.fedoraproject.org/pipermail/package-announce/2012-June/082017.html
openwall.com/lists/oss-security/2012/04/10/13
bugzilla.redhat.com/show_bug.cgi?id=811617
Show 7 moreShow less
security.gentoo.org/glsa/201603-12
sourceforge.net/mailarchive/message.php?msg_id=29012174
nvd.nist.gov/vuln/detail/CVE-2012-2090
github.com/advisories/GHSA-4426-49xv-wxg5
security-tracker.debian.org/tracker/CVE-2012-2090