CVE-2012-2090
Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier...
CVE-2012-2090 is a high vulnerability (CVSS 9.3) in Flightgear, published June 17, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.93%, the 93rd percentile. Fixed in flightgear 2.6.0-1.1.
- Severity
- 9.3 HighCVSS 2.0, NVD
- Exploit chance
- 5.93%EPSS, 93rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.6.0-1.1flightgear +4 more
Description
Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in certain data chunk values in an aircraft xml model to (1) fgfs/flightgear/src/Cockpit/panel.cxx or (2) fgfs/flightgear/src/Network/generic.cxx, or (3) a scene graph model to simgear/simgear/scene/model/SGText.cxx.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flightgearDebian:12 | before 2.6.0-1.1 | 2.6.0-1.1 |
flightgearDebian:13 | before 2.6.0-1.1 | 2.6.0-1.1 |
simgearDebian:12 | before 2.10.0-2 | 2.10.0-2 |
simgearDebian:13 | before 2.10.0-2 | 2.10.0-2 |
simgearDebian:14 | before 2.10.0-2 | 2.10.0-2 |
What each source reports
NVD Score used
Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in certain data chunk values in an aircraft xml model to (1) fgfs/flightgear/src/Cockpit/panel.cxx or (2) fgfs/flightgear/src/Network/generic.cxx, or (3) a scene graph model to simgear/simgear/scene/model/SGText.cxx.
- Record
CVE-2012-2090- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-134
- Updated
- 2026-11-02
CVE ListNo score
Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in certain data chunk values in an aircraft xml model to (1) fgfs/flightgear/src/Cockpit/panel.cxx or (2) fgfs/flightgear/src/Network/generic.cxx, or (3) a scene graph model to simgear/simgear/scene/model/SGText.cxx.
- Record
CVE-2012-2090- Updated
- 2026-11-02
EUVDEUVD-2012-2096No score
Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in certain data chunk values in an aircraft xml model to (1) fgfs/flightgear/src/Cockpit/panel.cxx or (2) fgfs/flightgear/src/Network/generic.cxx, or (3) a scene graph model to simgear/simgear/scene/model/SGText.cxx.
- Record
EUVD-2012-2096- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4426-49xv-wxg5No score
Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier...
Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in certain data chunk values in an aircraft xml model to (1) fgfs/flightgear/src/Cockpit/panel.cxx or (2) fgfs/flightgear/src/Network/generic.cxx, or (3) a scene graph model to simgear/simgear/scene/model/SGText.cxx.
- Record
GHSA-4426-49xv-wxg5- Weakness
- CWE-134
- Updated
- 2026-11-02
OSVNo score
Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in certain data chunk values in an aircraft xml model to (1) fgfs/flightgear/src/Cockpit/panel.cxx or (2) fgfs/flightgear/src/Network/generic.cxx, or (3) a scene graph model to simgear/simgear/scene/model/SGText.cxx.
- Record
CVE-2012-2090- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-2090No score
Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in certain data chunk values in an aircraft xml model to (1) fgfs/flightgear/src/Cockpit/panel.cxx or (2) fgfs/flightgear/src/Network/generic.cxx, or (3) a scene graph model to simgear/simgear/scene/model/SGText.cxx.
- Record
DEBIAN-CVE-2012-2090- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
secunia.com/advisories/48780
exchange.xforce.ibmcloud.com/vulnerabilities/74791
lists.fedoraproject.org/pipermail/package-announce/2012-June/082017.html
openwall.com/lists/oss-security/2012/04/10/13
bugzilla.redhat.com/show_bug.cgi?id=811617
Show 7 moreShow less
security.gentoo.org/glsa/201603-12
sourceforge.net/mailarchive/message.php?msg_id=29012174
nvd.nist.gov/vuln/detail/CVE-2012-2090
github.com/advisories/GHSA-4426-49xv-wxg5
security-tracker.debian.org/tracker/CVE-2012-2090