Every CVE Search/ Get API key

CVE-2008-3916

Heap-based buffer overflow in the strip_escapes function in signal.c in GNU ed before 1.0 allows...

9.3 HighFix available

Heap-based buffer overflow in the strip_escapes function in signal.c in GNU ed before 1.0 allows context-dependent or user-assisted attackers to execute arbitrary code via a long filename. NOTE: since ed itself does not typically run with special privileges, this issue only crosses privilege boundaries when ed is invoked as a third-party component.

Exploit likelihood

3.60%Up 0.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.3

Heap-based buffer overflow in the strip_escapes function in signal.c in GNU ed before 1.0 allows context-dependent or user-assisted attackers to execute arbitrary code via a long filename. NOTE: since ed itself does not typically run with special privileges, this issue only crosses privilege boundaries when ed is invoked as a third-party component.

Record
CVE-2008-3916
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Heap-based buffer overflow in the strip_escapes function in signal.c in GNU ed before 1.0 allows context-dependent or user-assisted attackers to execute arbitrary code via a long filename. NOTE: since ed itself does not typically run with special privileges, this issue only crosses privilege boundaries when ed is invoked as a third-party component.

Record
CVE-2008-3916
Updated
2026-11-02
EUVDEUVD-2008-3901 No score

Heap-based buffer overflow in the strip_escapes function in signal.c in GNU ed before 1.0 allows context-dependent or user-assisted attackers to execute arbitrary code via a long filename. NOTE: since ed itself does not typically run with special privileges, this issue only crosses privilege boundaries when ed is invoked as a third-party component.

Record
EUVD-2008-3901
Updated
2026-11-03
GitHub AdvisoriesGHSA-j55v-8789-5phj No score

Heap-based buffer overflow in the strip_escapes function in signal.c in GNU ed before 1.0 allows...

Heap-based buffer overflow in the strip_escapes function in signal.c in GNU ed before 1.0 allows context-dependent or user-assisted attackers to execute arbitrary code via a long filename. NOTE: since ed itself does not typically run with special privileges, this issue only crosses privilege boundaries when ed is invoked as a third-party component.

Record
GHSA-j55v-8789-5phj
Weakness
CWE-119
Updated
2026-11-02
OSV No score

Heap-based buffer overflow in the strip_escapes function in signal.c in GNU ed before 1.0 allows context-dependent or user-assisted attackers to execute arbitrary code via a long filename. NOTE: since ed itself does not typically run with special privileges, this issue only crosses privilege boundaries when ed is invoked as a third-party component.

Record
CVE-2008-3916
Updated
2026-11-02
OSVDEBIAN-CVE-2008-3916 No score

Heap-based buffer overflow in the strip_escapes function in signal.c in GNU ed before 1.0 allows context-dependent or user-assisted attackers to execute arbitrary code via a long filename. NOTE: since ed itself does not typically run with special privileges, this issue only crosses privilege boundaries when ed is invoked as a third-party component.

Record
DEBIAN-CVE-2008-3916
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ed
Debian:12
 before 0.7-2
0.7-2
ed
Debian:13
 before 0.7-2
0.7-2
ed
Debian:14
 before 0.7-2
0.7-2
ed
Red Hat:enterprise_linux:2.1::as
 before 0:0.2-21.1
0:0.2-21.1
ed
Red Hat:enterprise_linux:2.1::aw
 before 0:0.2-21.1
0:0.2-21.1
ed
Red Hat:enterprise_linux:2.1::es
 before 0:0.2-21.1
0:0.2-21.1
ed
Red Hat:enterprise_linux:2.1::ws
 before 0:0.2-21.1
0:0.2-21.1
ed
Red Hat:enterprise_linux:3::as
 before 0:0.2-33.30E.1
0:0.2-33.30E.1
ed-debuginfo
Red Hat:enterprise_linux:3::as
 before 0:0.2-33.30E.1
0:0.2-33.30E.1
ed
Red Hat:enterprise_linux:3::desktop
 before 0:0.2-33.30E.1
0:0.2-33.30E.1
Show 17 moreShow less
Affected packages
PackageAffectedFixed
ed-debuginfo
Red Hat:enterprise_linux:3::desktop
 before 0:0.2-33.30E.1
0:0.2-33.30E.1
ed
Red Hat:enterprise_linux:3::es
 before 0:0.2-33.30E.1
0:0.2-33.30E.1
ed-debuginfo
Red Hat:enterprise_linux:3::es
 before 0:0.2-33.30E.1
0:0.2-33.30E.1
ed
Red Hat:enterprise_linux:3::ws
 before 0:0.2-33.30E.1
0:0.2-33.30E.1
ed-debuginfo
Red Hat:enterprise_linux:3::ws
 before 0:0.2-33.30E.1
0:0.2-33.30E.1
ed
Red Hat:enterprise_linux:4::as
 before 0:0.2-36.el4_7.1
0:0.2-36.el4_7.1
ed-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:0.2-36.el4_7.1
0:0.2-36.el4_7.1
ed
Red Hat:enterprise_linux:4::desktop
 before 0:0.2-36.el4_7.1
0:0.2-36.el4_7.1
ed-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:0.2-36.el4_7.1
0:0.2-36.el4_7.1
ed
Red Hat:enterprise_linux:4::es
 before 0:0.2-36.el4_7.1
0:0.2-36.el4_7.1
ed-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:0.2-36.el4_7.1
0:0.2-36.el4_7.1
ed
Red Hat:enterprise_linux:4::ws
 before 0:0.2-36.el4_7.1
0:0.2-36.el4_7.1
ed-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:0.2-36.el4_7.1
0:0.2-36.el4_7.1
ed
Red Hat:enterprise_linux:5::client
 before 0:0.2-39.el5_2
0:0.2-39.el5_2
ed-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:0.2-39.el5_2
0:0.2-39.el5_2
ed
Red Hat:enterprise_linux:5::server
 before 0:0.2-39.el5_2
0:0.2-39.el5_2
ed-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:0.2-39.el5_2
0:0.2-39.el5_2

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-3916 is a high vulnerability (CVSS 9.3) in Gnu Ed, published September 4, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.60%, the 89th percentile. Fixed in ed 0.7-2.

References

Show 27 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open