Osgeo Mapserver vulnerabilities

• mapserver MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY` CVE-2026-45104 Fix available 7.5 HighMay 27, 2026
• mapserver MapServer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in OpenLayers viewer CVE-2026-42030 Fix available 6.1 MediumMay 8, 2026
• mapserver MapServer has heap buffer overflow in SLD `Categorize` Threshold parsing CVE-2026-33721 Fix available 5.3 MediumMarch 27, 2026
• mapserver MapServer - WFS XML Filter Query SQL injection CVE-2025-59431 Fix available 8.9 HighSeptember 19, 2025
• osgeo mapserver, fedoraproject fedora +1 more MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and... CVE-2021-32062 Fix available 5.3 MediumMay 5, 2021
• osgeo mapserver Mapserver 5.2, 5.4 and 5.6 before 5.6.5-2 improperly validates symbol index values during Mapfile... CVE-2010-1678 Fix available 7.5 HighOctober 29, 2019
• osgeo mapserver, debian linux +1 more Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5,... CVE-2017-5522 Fix available 9.8 CriticalJanuary 19, 2017
• osgeo mapserver In MapServer before 7.0.3, OGR driver error messages are too verbose and may leak sensitive... CVE-2016-9839 Fix available 7.5 HighDecember 7, 2016
• osgeo mapserver SQL injection vulnerability in the msPostGISLayerSetTimeFilter function in mappostgis.c in... CVE-2013-7262 Fix available 6.8 MediumJanuary 5, 2014
• osgeo mapserver Double free vulnerability in the msAddImageSymbol function in mapsymbol.c in MapServer before 6.0... CVE-2011-2975 Public exploitFix available 6.8 MediumAugust 1, 2011
• osgeo mapserver Stack-based buffer overflow in MapServer before 4.10.7 and 5.x before 5.6.7 allows remote... CVE-2011-2704 Fix available 7.5 HighJuly 26, 2011
• osgeo mapserver Multiple SQL injection vulnerabilities in MapServer before 4.10.7, 5.x before 5.6.7, and 6.x... CVE-2011-2703 Fix available 7.5 HighJuly 26, 2011
• osgeo mapserver mapserv.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 does not properly restrict... CVE-2010-2540 Fix available 10.0 HighJuly 31, 2010
• osgeo mapserver Buffer overflow in the msTmpFile function in maputil.c in mapserv in MapServer before 4.10.6 and... CVE-2010-2539 Fix available 2.1 LowJuly 31, 2010
• osgeo mapserver Multiple heap-based buffer underflows in the readPostBody function in cgiutil.c in mapserv in... CVE-2009-2281 Fix available 10.0 HighOctober 22, 2009
• osgeo mapserver Multiple stack-based buffer overflows in maptemplate.c in mapserv in MapServer 4.x before 4.10.4... CVE-2009-1177 Fix available 10.0 HighMarch 31, 2009
• osgeo mapserver mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 does not ensure that the... CVE-2009-1176 Fix available 10.0 HighMarch 31, 2009
• osgeo mapserver The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows... CVE-2009-0843 Fix available 7.8 HighMarch 31, 2009
• osgeo mapserver mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to read... CVE-2009-0842 Fix available 4.3 MediumMarch 31, 2009
• osgeo mapserver Directory traversal vulnerability in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x... CVE-2009-0841 Fix available 10.0 HighMarch 31, 2009
• osgeo mapserver Heap-based buffer underflow in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x... CVE-2009-0840 Fix available 10.0 HighMarch 31, 2009
• osgeo mapserver Stack-based buffer overflow in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before... CVE-2009-0839 Fix available 10.0 HighMarch 31, 2009