CVE-2008-2357
Stack-based buffer overflow in the split_redraw function in split.c in mtr before 0.73, when...
Stack-based buffer overflow in the split_redraw function in split.c in mtr before 0.73, when invoked with the -p (aka --split) option, allows remote attackers to execute arbitrary code via a crafted DNS PTR record. NOTE: it could be argued that this is a vulnerability in the ns_name_ntop function in resolv/ns_name.c in glibc and the proper fix should be in glibc; if so, then this should not be treated as a vulnerability in mtr.
Exploit likelihood
What each source reports
NVD Score used
Stack-based buffer overflow in the split_redraw function in split.c in mtr before 0.73, when invoked with the -p (aka --split) option, allows remote attackers to execute arbitrary code via a crafted DNS PTR record. NOTE: it could be argued that this is a vulnerability in the ns_name_ntop function in resolv/ns_name.c in glibc and the proper fix should be in glibc; if so, then this should not be treated as a vulnerability in mtr.
- Record
CVE-2008-2357- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Stack-based buffer overflow in the split_redraw function in split.c in mtr before 0.73, when invoked with the -p (aka --split) option, allows remote attackers to execute arbitrary code via a crafted DNS PTR record. NOTE: it could be argued that this is a vulnerability in the ns_name_ntop function in resolv/ns_name.c in glibc and the proper fix should be in glibc; if so, then this should not be treated as a vulnerability in mtr.
- Record
CVE-2008-2357- Updated
- 2026-11-02
EUVDEUVD-2008-2353 No score
Stack-based buffer overflow in the split_redraw function in split.c in mtr before 0.73, when invoked with the -p (aka --split) option, allows remote attackers to execute arbitrary code via a crafted DNS PTR record. NOTE: it could be argued that this is a vulnerability in the ns_name_ntop function in resolv/ns_name.c in glibc and the proper fix should be in glibc; if so, then this should not be treated as a vulnerability in mtr.
- Record
EUVD-2008-2353- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7mph-p784-2x2p No score
Stack-based buffer overflow in the split_redraw function in split.c in mtr before 0.73, when...
Stack-based buffer overflow in the split_redraw function in split.c in mtr before 0.73, when invoked with the -p (aka --split) option, allows remote attackers to execute arbitrary code via a crafted DNS PTR record. NOTE: it could be argued that this is a vulnerability in the ns_name_ntop function in resolv/ns_name.c in glibc and the proper fix should be in glibc; if so, then this should not be treated as a vulnerability in mtr.
- Record
GHSA-7mph-p784-2x2p- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Stack-based buffer overflow in the split_redraw function in split.c in mtr before 0.73, when invoked with the -p (aka --split) option, allows remote attackers to execute arbitrary code via a crafted DNS PTR record. NOTE: it could be argued that this is a vulnerability in the ns_name_ntop function in resolv/ns_name.c in glibc and the proper fix should be in glibc; if so, then this should not be treated as a vulnerability in mtr.
- Record
CVE-2008-2357- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-2357 No score
Stack-based buffer overflow in the split_redraw function in split.c in mtr before 0.73, when invoked with the -p (aka --split) option, allows remote attackers to execute arbitrary code via a crafted DNS PTR record. NOTE: it could be argued that this is a vulnerability in the ns_name_ntop function in resolv/ns_name.c in glibc and the proper fix should be in glibc; if so, then this should not be treated as a vulnerability in mtr.
- Record
DEBIAN-CVE-2008-2357- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-2357 is a medium vulnerability (CVSS 6.8) in Matt Kimball And Roger Wolff Mtr, published May 21, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.71%, the 91st percentile. Fixed in mtr 0.73-1.
References
secunia.com/advisories/30340
securityfocus.com/archive/1/492260/100/0/threaded
mandriva.com/security/advisories?name=MDVSA-2008:176
Show 17 moreShow less
security.gentoo.org/glsa/glsa-200806-01.xml
openwall.com/lists/oss-security/2008/05/21/3
exchange.xforce.ibmcloud.com/vulnerabilities/42535
securityreason.com/securityalert/3903
debian.org/security/2008/dsa-1587
lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html
wiki.rpath.com/wiki/Advisories:rPSA-2008-0175
seclists.org/fulldisclosure/2008/May/0488.html
securitytracker.com/id?1020046
issues.rpath.com/browse/RPL-2558
nvd.nist.gov/vuln/detail/CVE-2008-2357
github.com/advisories/GHSA-7mph-p784-2x2p
security-tracker.debian.org/tracker/CVE-2008-2357