CVE-2015-8212

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

CGI handling flaw in bozohttpd in NetBSD 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows remote attackers to execute arbitrary code via crafted arguments, which are handled by a non-CGI aware program.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2016-005.txt.ascVendor Advisory
http://www.securitytracker.com/id/1035673Third Party Advisory, VDB Entry
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2016-005.txt.ascVendor Advisory
http://www.securitytracker.com/id/1035673Third Party Advisory, VDB Entry

Timeline

Published: Jan 19, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-82135.0The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow re CVE-2015-82149.7A vulnerability has been identified in SIMATIC NET CP 342-5 (incl. SIPLUS variants) (All versions), SIMATIC NET CP 343-1 Advanced (incl. SIP CVE-2015-82155.0net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel before 4.0 does not validate attempted changes to the MTU value, which allows cont CVE-2015-82167.5The ljpeg_decode_yuv_scan function in libavcodec/mjpegdec.c in FFmpeg before 2.8.2 omits certain width and height checks, which allows remot CVE-2015-82177.5The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in FFmpeg before 2.8.2 does not validate the Chroma Format Indicator, which allows re CVE-2015-82186.8The decode_uncompressed function in libavcodec/faxcompr.c in FFmpeg before 2.8.2 does not validate uncompressed runs, which allows remote at CVE-2015-82197.5The init_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.2 does not enforce minimum-value and maximum-value constraints on ti CVE-2015-82207.5Stack-based buffer overflow in the URI handler in DWRCC.exe in SolarWinds DameWare Mini Remote Control before 12.0 HotFix 1 allows remote at CVE-2015-822110.0Integer overflow in Google Picasa before 3.9.140 Build 259 allows remote attackers to execute arbitrary code via the CAMF section in a FOVb CVE-2015-82224.6The lxd-unix.socket systemd unit file in the Ubuntu lxd package before 0.20-0ubuntu4.1 uses world-readable permissions for /var/lib/lxd/unix CVE-2015-82235.5Huawei P7 before P7-L00C17B851, P7-L05C00B851, and P7-L09C92B85, and P8 ALE-UL00 before ALE-UL00B211 allows local users to cause a denial of CVE-2015-82243.7Huawei P8 before GRA-CL00C92B210, before GRA-L09C432B200, before GRA-TL00C01B210, and before GRA-UL00C00B210 allows remote attackers to obta