Multiple integer overflows in LibThai before 0.1.13 might allow context-dependent attackers to execute arbitrary code via long strings that trigger heap-based buffer overflows, related to (1) thbrk/thbrk.c and (2) thwbrk/thwbrk.c. NOTE: some of these details are obtained from third party information.

Tim Starling discovered that libthai, a set of Thai language support routines, is vulnerable of integer/heap overflow. This vulnerability could allow an attacker to run arbitrary code by sending a very long string.

very long strings could lead to a heap buffer overflow in libthai

Tim Starling discovered that LibThai did not correctly handle long strings. A remote attacker could use specially-formed strings to execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been found and corrected in libthai :

Tim Starling discovered that libthai, a set of Thai language support routines, is vulnerable of integer/heap overflow. This vulnerability could allow an attacker to run arbitrary code by sending a very long string (CVE-2009-4012).

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers.

The updated packages have been patched to correct these issues.

ID	Name	Product	Family	Severity
44836	Debian DSA-1971-1 : libthai - integer overflow	Nessus	Debian Local Security Checks	critical
44372	openSUSE Security Update : libthai (libthai-1808)	Nessus	SuSE Local Security Checks	critical
44368	openSUSE Security Update : libthai (libthai-1808)	Nessus	SuSE Local Security Checks	critical
44362	openSUSE Security Update : libthai (libthai-1808)	Nessus	SuSE Local Security Checks	critical
44058	Ubuntu 8.04 LTS / 8.10 / 9.04 / 9.10 : libthai vulnerability (USN-887-1)	Nessus	Ubuntu Local Security Checks	critical
44042	Mandriva Linux Security Advisory : libthai (MDVSA-2010:010)	Nessus	Mandriva Local Security Checks	critical

Detections

Analytics

CVE-2009-4012

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical