Vulnerability Details : CVE-2012-4459
Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (crash) via a crafted message, which triggers an out-of-bounds read.
Vulnerability category: OverflowDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2012-4459
Probability of exploitation activity in the next 30 days: 1.14%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 84 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2012-4459
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2012-4459
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-4459
-
https://bugzilla.redhat.com/show_bug.cgi?id=861241
861241 – (CVE-2012-4459) CVE-2012-4459 qpid-cpp: crash due to qpid::framing::Buffer::checkAvailable() wraparound
-
http://rhn.redhat.com/errata/RHSA-2013-0561.html
RHSA-2013:0561 - Security Advisory - Red Hat Customer Portal
-
https://issues.apache.org/jira/issues/?jql=fixVersion%20%3D%20%220.21%22%20AND%20project%20%3D%20QPID
[QPID-4673] [Java Broker AMQP 1.0] Potential for deadlock when draining AMQP 1.0 subscriptions - ASF JIRA
-
http://rhn.redhat.com/errata/RHSA-2013-0562.html
RHSA-2013:0562 - Security Advisory - Red Hat Customer Portal
-
https://issues.apache.org/jira/browse/QPID-4629
[QPID-4629] Improve validation of received amqp 0-10 frames - ASF JIRA
-
http://svn.apache.org/viewvc?view=revision&revision=1453031
[Apache-SVN] Revision 1453031Patch
Products affected by CVE-2012-4459
- cpe:2.3:a:apache:qpid:*:*:*:*:*:*:*:*
- cpe:2.3:a:apache:qpid:0.6:*:*:*:*:*:*:*
- cpe:2.3:a:apache:qpid:0.5:*:*:*:*:*:*:*
- cpe:2.3:a:apache:qpid:0.12:*:*:*:*:*:*:*
- cpe:2.3:a:apache:qpid:0.8:*:*:*:*:*:*:*
- cpe:2.3:a:apache:qpid:0.7:*:*:*:*:*:*:*
- cpe:2.3:a:apache:qpid:0.14:*:*:*:*:*:*:*
- cpe:2.3:a:apache:qpid:0.16:*:*:*:*:*:*:*
- cpe:2.3:a:apache:qpid:0.9:*:*:*:*:*:*:*
- cpe:2.3:a:apache:qpid:0.10:*:*:*:*:*:*:*
- cpe:2.3:a:apache:qpid:0.15:*:*:*:*:*:*:*
- cpe:2.3:a:apache:qpid:0.13:*:*:*:*:*:*:*
- cpe:2.3:a:apache:qpid:0.19:*:*:*:*:*:*:*
- cpe:2.3:a:apache:qpid:0.17:*:*:*:*:*:*:*
- cpe:2.3:a:apache:qpid:0.18:*:*:*:*:*:*:*
- cpe:2.3:a:apache:qpid:0.11:*:*:*:*:*:*:*