Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

AFFLIB before 2.2.6 can crash or run code

CVE-2007-2053 · published 19 years ago
Summary

The AFFLIB library versions prior to 2.2.6 mishandle overly long values in files or URLs, which can cause the program to stop working or, in some cases, let an attacker run their own code. This problem is triggered by specially crafted data from S3 services or long file paths. Upgrade to version 2.2.6 or later to eliminate the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
afflib afflib <= 2.2.0
cpe:2.3:a:afflib:afflib:*:*:*:*:*:*:*:*
Original advisory text
Multiple stack-based buffer overflows in AFFLIB before 2.2.6 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via (1) a long LastModified value in an S...
Multiple stack-based buffer overflows in AFFLIB before 2.2.6 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via (1) a long LastModified value in an S3 XML response in lib/s3.cpp; (2) a long (a) path or (b) bucket in an S3 URL in lib/vnode_s3.cpp; or (3) a long (c) EFW, (d) AFD, or (c) aimage file path. NOTE: the aimage vector (3c) has since been recalled from the researcher's original advisory, since the code is not called in any version of AFFLIB.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
7% chance of attack within 30 days
Timeline
Published30 Apr 2007
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2007-2053 · NVD
Track software like this
Free during beta