MapServer Multiple Security Vulnerabilities

Bugtraq ID:	34306
Class:	Unknown
CVE:	CVE-2009-0839 CVE-2009-0840 CVE-2009-0841 CVE-2009-0843 CVE-2009-0842 CVE-2009-1176 CVE-2009-1177
Remote:	Yes
Local:	Yes
Published:	Mar 30 2009 12:00AM
Updated:	Apr 13 2015 09:24PM
Credit:	Positron Security
Vulnerable:	Regents of the University of Minnesota MapServer 5.2.1 Regents of the University of Minnesota MapServer 4.10.3 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:	Regents of the University of Minnesota MapServer 5.2.2 Regents of the University of Minnesota MapServer 4.10.4

MapServer Multiple Security Vulnerabilities

MapServer is prone to multiple remote vulnerabilities, including buffer-overflow issues, a directory-traversal issue, and information-disclosure issues.

An attacker can exploit these issues to obtain sensitive information, create files in arbitrary locations, run arbitrary code within the context of the affected application, or crash the application, denying service to legitimate users.

Versions prior to MapServer 4.10.4 and 5.2.2 are vulnerable.

UPDATE (June 22, 2009): Fixes for the buffer-overflow vulnerability tracked by CVE-2009-0840 are incomplete; MapServer 4.10.4 and 5.2.2 may still be vulnerable to this issue.

MapServer Multiple Security Vulnerabilities

An attacker can exploit some of these issues via a browser.

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

MapServer Multiple Security Vulnerabilities

Solution:
The vendor has released updates to address these issues. Please see the references for more information.

UPDATE (June 22, 2009): Fixes for the buffer-overflow vulnerable tracked by CVE-2009-0840 are incomplete; MapServer 4.10.4 and 5.2.2 may still be vulnerable to this issue.


Debian Linux 4.0 arm

• Debian cgi-mapserver_4.10.0-5.1+etch4_arm.deb
  http://security.debian.org/pool/updates/main/m/mapserver/cgi-mapserver _4.10.0-5.1+etch4_arm.deb


• Debian mapserver-bin_4.10.0-5.1+etch4_arm.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-bin _4.10.0-5.1+etch4_arm.deb


• Debian mapserver-doc_4.10.0-5.1+etch4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _4.10.0-5.1+etch4_all.deb


• Debian perl-mapscript_4.10.0-5.1+etch4_arm.deb
  http://security.debian.org/pool/updates/main/m/mapserver/perl-mapscrip t_4.10.0-5.1+etch4_arm.deb


• Debian php4-mapscript_4.10.0-5.1+etch4_arm.deb
  http://security.debian.org/pool/updates/main/m/mapserver/php4-mapscrip t_4.10.0-5.1+etch4_arm.deb


• Debian php5-mapscript_4.10.0-5.1+etch4_arm.deb
  http://security.debian.org/pool/updates/main/m/mapserver/php5-mapscrip t_4.10.0-5.1+etch4_arm.deb


• Debian python-mapscript_4.10.0-5.1+etch4_arm.deb
  http://security.debian.org/pool/updates/main/m/mapserver/python-mapscr ipt_4.10.0-5.1+etch4_arm.deb

Debian Linux 5.0 ia-64

• Debian cgi-mapserver_5.0.3-3+lenny4_ia64.deb
  http://security.debian.org/pool/updates/main/m/mapserver/cgi-mapserver _5.0.3-3+lenny4_ia64.deb


• Debian libmapscript-ruby_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby_5.0.3-3+lenny4_all.deb


• Debian libmapscript-ruby1.8_5.0.3-3+lenny4_ia64.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby1.8_5.0.3-3+lenny4_ia64.deb


• Debian libmapscript-ruby1.9_5.0.3-3+lenny4_ia64.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby1.9_5.0.3-3+lenny4_ia64.deb


• Debian mapserver-bin_5.0.3-3+lenny4_ia64.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-bin _5.0.3-3+lenny4_ia64.deb


• Debian mapserver-doc_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _5.0.3-3+lenny4_all.deb


• Debian perl-mapscript_5.0.3-3+lenny4_ia64.deb
  http://security.debian.org/pool/updates/main/m/mapserver/perl-mapscrip t_5.0.3-3+lenny4_ia64.deb


• Debian php5-mapscript_5.0.3-3+lenny4_ia64.deb
  http://security.debian.org/pool/updates/main/m/mapserver/php5-mapscrip t_5.0.3-3+lenny4_ia64.deb


• Debian python-mapscript_5.0.3-3+lenny4_ia64.deb
  http://security.debian.org/pool/updates/main/m/mapserver/python-mapscr ipt_5.0.3-3+lenny4_ia64.deb

Debian Linux 4.0 powerpc

• Debian cgi-mapserver_4.10.0-5.1+etch4_powerpc.deb
  http://security.debian.org/pool/updates/main/m/mapserver/cgi-mapserver _4.10.0-5.1+etch4_powerpc.deb


• Debian mapserver-bin_4.10.0-5.1+etch4_powerpc.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-bin _4.10.0-5.1+etch4_powerpc.deb


• Debian mapserver-doc_4.10.0-5.1+etch4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _4.10.0-5.1+etch4_all.deb


• Debian perl-mapscript_4.10.0-5.1+etch4_powerpc.deb
  http://security.debian.org/pool/updates/main/m/mapserver/perl-mapscrip t_4.10.0-5.1+etch4_powerpc.deb


• Debian php4-mapscript_4.10.0-5.1+etch4_powerpc.deb
  http://security.debian.org/pool/updates/main/m/mapserver/php4-mapscrip t_4.10.0-5.1+etch4_powerpc.deb


• Debian php5-mapscript_4.10.0-5.1+etch4_powerpc.deb
  http://security.debian.org/pool/updates/main/m/mapserver/php5-mapscrip t_4.10.0-5.1+etch4_powerpc.deb


• Debian python-mapscript_4.10.0-5.1+etch4_powerpc.deb
  http://security.debian.org/pool/updates/main/m/mapserver/python-mapscr ipt_4.10.0-5.1+etch4_powerpc.deb

Debian Linux 4.0 m68k

• Debian mapserver-doc_4.10.0-5.1+etch4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _4.10.0-5.1+etch4_all.deb

Debian Linux 5.0 alpha

• Debian cgi-mapserver_5.0.3-3+lenny4_alpha.deb
  http://security.debian.org/pool/updates/main/m/mapserver/cgi-mapserver _5.0.3-3+lenny4_alpha.deb


• Debian libmapscript-ruby_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby_5.0.3-3+lenny4_all.deb


• Debian libmapscript-ruby1.8_5.0.3-3+lenny4_alpha.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby1.8_5.0.3-3+lenny4_alpha.deb


• Debian libmapscript-ruby1.9_5.0.3-3+lenny4_alpha.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby1.9_5.0.3-3+lenny4_alpha.deb


• Debian mapserver-bin_5.0.3-3+lenny4_alpha.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-bin _5.0.3-3+lenny4_alpha.deb


• Debian mapserver-doc_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _5.0.3-3+lenny4_all.deb


• Debian perl-mapscript_5.0.3-3+lenny4_alpha.deb
  http://security.debian.org/pool/updates/main/m/mapserver/perl-mapscrip t_5.0.3-3+lenny4_alpha.deb


• Debian php5-mapscript_5.0.3-3+lenny4_alpha.deb
  http://security.debian.org/pool/updates/main/m/mapserver/php5-mapscrip t_5.0.3-3+lenny4_alpha.deb


• Debian python-mapscript_5.0.3-3+lenny4_alpha.deb
  http://security.debian.org/pool/updates/main/m/mapserver/python-mapscr ipt_5.0.3-3+lenny4_alpha.deb

Debian Linux 5.0 ia-32

• Debian cgi-mapserver_5.0.3-3+lenny4_i386.deb
  http://security.debian.org/pool/updates/main/m/mapserver/cgi-mapserver _5.0.3-3+lenny4_i386.deb


• Debian libmapscript-ruby_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby_5.0.3-3+lenny4_all.deb


• Debian libmapscript-ruby1.8_5.0.3-3+lenny4_i386.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby1.8_5.0.3-3+lenny4_i386.deb


• Debian libmapscript-ruby1.9_5.0.3-3+lenny4_i386.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby1.9_5.0.3-3+lenny4_i386.deb


• Debian mapserver-bin_5.0.3-3+lenny4_i386.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-bin _5.0.3-3+lenny4_i386.deb


• Debian mapserver-doc_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _5.0.3-3+lenny4_all.deb


• Debian perl-mapscript_5.0.3-3+lenny4_i386.deb
  http://security.debian.org/pool/updates/main/m/mapserver/perl-mapscrip t_5.0.3-3+lenny4_i386.deb


• Debian php5-mapscript_5.0.3-3+lenny4_i386.deb
  http://security.debian.org/pool/updates/main/m/mapserver/php5-mapscrip t_5.0.3-3+lenny4_i386.deb


• Debian python-mapscript_5.0.3-3+lenny4_i386.deb
  http://security.debian.org/pool/updates/main/m/mapserver/python-mapscr ipt_5.0.3-3+lenny4_i386.deb

Debian Linux 5.0 s/390

• Debian libmapscript-ruby_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby_5.0.3-3+lenny4_all.deb


• Debian mapserver-doc_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _5.0.3-3+lenny4_all.deb

Debian Linux 5.0 mipsel

• Debian cgi-mapserver_5.0.3-3+lenny4_mipsel.deb
  http://security.debian.org/pool/updates/main/m/mapserver/cgi-mapserver _5.0.3-3+lenny4_mipsel.deb


• Debian libmapscript-ruby_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby_5.0.3-3+lenny4_all.deb


• Debian libmapscript-ruby1.8_5.0.3-3+lenny4_mipsel.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby1.8_5.0.3-3+lenny4_mipsel.deb


• Debian libmapscript-ruby1.9_5.0.3-3+lenny4_mipsel.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby1.9_5.0.3-3+lenny4_mipsel.deb


• Debian mapserver-bin_5.0.3-3+lenny4_mipsel.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-bin _5.0.3-3+lenny4_mipsel.deb


• Debian mapserver-doc_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _5.0.3-3+lenny4_all.deb


• Debian perl-mapscript_5.0.3-3+lenny4_mipsel.deb
  http://security.debian.org/pool/updates/main/m/mapserver/perl-mapscrip t_5.0.3-3+lenny4_mipsel.deb


• Debian php5-mapscript_5.0.3-3+lenny4_mipsel.deb
  http://security.debian.org/pool/updates/main/m/mapserver/php5-mapscrip t_5.0.3-3+lenny4_mipsel.deb


• Debian python-mapscript_5.0.3-3+lenny4_mipsel.deb
  http://security.debian.org/pool/updates/main/m/mapserver/python-mapscr ipt_5.0.3-3+lenny4_mipsel.deb

Debian Linux 4.0 amd64

• Debian mapserver-doc_4.10.0-5.1+etch4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _4.10.0-5.1+etch4_all.deb

Debian Linux 4.0 ia-32

• Debian cgi-mapserver_4.10.0-5.1+etch4_i386.deb
  http://security.debian.org/pool/updates/main/m/mapserver/cgi-mapserver _4.10.0-5.1+etch4_i386.deb


• Debian mapserver-bin_4.10.0-5.1+etch4_i386.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-bin _4.10.0-5.1+etch4_i386.deb


• Debian mapserver-doc_4.10.0-5.1+etch4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _4.10.0-5.1+etch4_all.deb


• Debian perl-mapscript_4.10.0-5.1+etch4_i386.deb
  http://security.debian.org/pool/updates/main/m/mapserver/perl-mapscrip t_4.10.0-5.1+etch4_i386.deb


• Debian php4-mapscript_4.10.0-5.1+etch4_i386.deb
  http://security.debian.org/pool/updates/main/m/mapserver/php4-mapscrip t_4.10.0-5.1+etch4_i386.deb


• Debian php5-mapscript_4.10.0-5.1+etch4_i386.deb
  http://security.debian.org/pool/updates/main/m/mapserver/php5-mapscrip t_4.10.0-5.1+etch4_i386.deb


• Debian python-mapscript_4.10.0-5.1+etch4_i386.deb
  http://security.debian.org/pool/updates/main/m/mapserver/python-mapscr ipt_4.10.0-5.1+etch4_i386.deb

Debian Linux 5.0 hppa

• Debian libmapscript-ruby_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby_5.0.3-3+lenny4_all.deb


• Debian mapserver-doc_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _5.0.3-3+lenny4_all.deb

Debian Linux 4.0 hppa

• Debian mapserver-doc_4.10.0-5.1+etch4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _4.10.0-5.1+etch4_all.deb

Debian Linux 4.0 sparc

• Debian cgi-mapserver_4.10.0-5.1+etch4_sparc.deb
  http://security.debian.org/pool/updates/main/m/mapserver/cgi-mapserver _4.10.0-5.1+etch4_sparc.deb


• Debian mapserver-bin_4.10.0-5.1+etch4_sparc.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-bin _4.10.0-5.1+etch4_sparc.deb


• Debian mapserver-doc_4.10.0-5.1+etch4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _4.10.0-5.1+etch4_all.deb


• Debian perl-mapscript_4.10.0-5.1+etch4_sparc.deb
  http://security.debian.org/pool/updates/main/m/mapserver/perl-mapscrip t_4.10.0-5.1+etch4_sparc.deb


• Debian php4-mapscript_4.10.0-5.1+etch4_sparc.deb
  http://security.debian.org/pool/updates/main/m/mapserver/php4-mapscrip t_4.10.0-5.1+etch4_sparc.deb


• Debian php5-mapscript_4.10.0-5.1+etch4_sparc.deb
  http://security.debian.org/pool/updates/main/m/mapserver/php5-mapscrip t_4.10.0-5.1+etch4_sparc.deb


• Debian python-mapscript_4.10.0-5.1+etch4_sparc.deb
  http://security.debian.org/pool/updates/main/m/mapserver/python-mapscr ipt_4.10.0-5.1+etch4_sparc.deb

Debian Linux 4.0 s/390

• Debian cgi-mapserver_4.10.0-5.1+etch4_s390.deb
  http://security.debian.org/pool/updates/main/m/mapserver/cgi-mapserver _4.10.0-5.1+etch4_s390.deb


• Debian mapserver-bin_4.10.0-5.1+etch4_s390.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-bin _4.10.0-5.1+etch4_s390.deb


• Debian mapserver-doc_4.10.0-5.1+etch4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _4.10.0-5.1+etch4_all.deb


• Debian perl-mapscript_4.10.0-5.1+etch4_s390.deb
  http://security.debian.org/pool/updates/main/m/mapserver/perl-mapscrip t_4.10.0-5.1+etch4_s390.deb


• Debian php4-mapscript_4.10.0-5.1+etch4_s390.deb
  http://security.debian.org/pool/updates/main/m/mapserver/php4-mapscrip t_4.10.0-5.1+etch4_s390.deb


• Debian php5-mapscript_4.10.0-5.1+etch4_s390.deb
  http://security.debian.org/pool/updates/main/m/mapserver/php5-mapscrip t_4.10.0-5.1+etch4_s390.deb


• Debian python-mapscript_4.10.0-5.1+etch4_s390.deb
  http://security.debian.org/pool/updates/main/m/mapserver/python-mapscr ipt_4.10.0-5.1+etch4_s390.deb

Debian Linux 5.0 m68k

• Debian libmapscript-ruby_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby_5.0.3-3+lenny4_all.deb


• Debian mapserver-doc_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _5.0.3-3+lenny4_all.deb

Debian Linux 5.0 arm

• Debian cgi-mapserver_5.0.3-3+lenny4_arm.deb
  http://security.debian.org/pool/updates/main/m/mapserver/cgi-mapserver _5.0.3-3+lenny4_arm.deb


• Debian libmapscript-ruby_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby_5.0.3-3+lenny4_all.deb


• Debian libmapscript-ruby1.8_5.0.3-3+lenny4_arm.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby1.8_5.0.3-3+lenny4_arm.deb


• Debian libmapscript-ruby1.9_5.0.3-3+lenny4_arm.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby1.9_5.0.3-3+lenny4_arm.deb


• Debian mapserver-bin_5.0.3-3+lenny4_arm.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-bin _5.0.3-3+lenny4_arm.deb


• Debian mapserver-doc_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _5.0.3-3+lenny4_all.deb


• Debian perl-mapscript_5.0.3-3+lenny4_arm.deb
  http://security.debian.org/pool/updates/main/m/mapserver/perl-mapscrip t_5.0.3-3+lenny4_arm.deb


• Debian php5-mapscript_5.0.3-3+lenny4_arm.deb
  http://security.debian.org/pool/updates/main/m/mapserver/php5-mapscrip t_5.0.3-3+lenny4_arm.deb


• Debian python-mapscript_5.0.3-3+lenny4_arm.deb
  http://security.debian.org/pool/updates/main/m/mapserver/python-mapscr ipt_5.0.3-3+lenny4_arm.deb

Debian Linux 4.0 armel

• Debian mapserver-doc_4.10.0-5.1+etch4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _4.10.0-5.1+etch4_all.deb

Debian Linux 4.0 alpha

• Debian cgi-mapserver_4.10.0-5.1+etch4_alpha.deb
  http://security.debian.org/pool/updates/main/m/mapserver/cgi-mapserver _4.10.0-5.1+etch4_alpha.deb


• Debian mapserver-bin_4.10.0-5.1+etch4_alpha.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-bin _4.10.0-5.1+etch4_alpha.deb


• Debian mapserver-doc_4.10.0-5.1+etch4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _4.10.0-5.1+etch4_all.deb


• Debian perl-mapscript_4.10.0-5.1+etch4_alpha.deb
  http://security.debian.org/pool/updates/main/m/mapserver/perl-mapscrip t_4.10.0-5.1+etch4_alpha.deb


• Debian php4-mapscript_4.10.0-5.1+etch4_alpha.deb
  http://security.debian.org/pool/updates/main/m/mapserver/php4-mapscrip t_4.10.0-5.1+etch4_alpha.deb


• Debian php5-mapscript_4.10.0-5.1+etch4_alpha.deb
  http://security.debian.org/pool/updates/main/m/mapserver/php5-mapscrip t_4.10.0-5.1+etch4_alpha.deb


• Debian python-mapscript_4.10.0-5.1+etch4_alpha.deb
  http://security.debian.org/pool/updates/main/m/mapserver/python-mapscr ipt_4.10.0-5.1+etch4_alpha.deb

Debian Linux 5.0 armel

• Debian cgi-mapserver_5.0.3-3+lenny4_armel.deb
  http://security.debian.org/pool/updates/main/m/mapserver/cgi-mapserver _5.0.3-3+lenny4_armel.deb


• Debian libmapscript-ruby_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby_5.0.3-3+lenny4_all.deb


• Debian libmapscript-ruby1.8_5.0.3-3+lenny4_armel.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby1.8_5.0.3-3+lenny4_armel.deb


• Debian libmapscript-ruby1.9_5.0.3-3+lenny4_armel.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby1.9_5.0.3-3+lenny4_armel.deb


• Debian mapserver-bin_5.0.3-3+lenny4_armel.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-bin _5.0.3-3+lenny4_armel.deb


• Debian mapserver-doc_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _5.0.3-3+lenny4_all.deb


• Debian perl-mapscript_5.0.3-3+lenny4_armel.deb
  http://security.debian.org/pool/updates/main/m/mapserver/perl-mapscrip t_5.0.3-3+lenny4_armel.deb


• Debian php5-mapscript_5.0.3-3+lenny4_armel.deb
  http://security.debian.org/pool/updates/main/m/mapserver/php5-mapscrip t_5.0.3-3+lenny4_armel.deb


• Debian python-mapscript_5.0.3-3+lenny4_armel.deb
  http://security.debian.org/pool/updates/main/m/mapserver/python-mapscr ipt_5.0.3-3+lenny4_armel.deb

Debian Linux 5.0

• Debian libmapscript-ruby_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby_5.0.3-3+lenny4_all.deb


• Debian mapserver-doc_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _5.0.3-3+lenny4_all.deb

Debian Linux 4.0

• Debian mapserver-doc_4.10.0-5.1+etch4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _4.10.0-5.1+etch4_all.deb

Debian Linux 5.0 amd64

• Debian libmapscript-ruby_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby_5.0.3-3+lenny4_all.deb


• Debian mapserver-doc_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _5.0.3-3+lenny4_all.deb

Debian Linux 4.0 mipsel

• Debian cgi-mapserver_4.10.0-5.1+etch4_mipsel.deb
  http://security.debian.org/pool/updates/main/m/mapserver/cgi-mapserver _4.10.0-5.1+etch4_mipsel.deb


• Debian mapserver-bin_4.10.0-5.1+etch4_mipsel.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-bin _4.10.0-5.1+etch4_mipsel.deb


• Debian mapserver-doc_4.10.0-5.1+etch4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _4.10.0-5.1+etch4_all.deb


• Debian perl-mapscript_4.10.0-5.1+etch4_mipsel.deb
  http://security.debian.org/pool/updates/main/m/mapserver/perl-mapscrip t_4.10.0-5.1+etch4_mipsel.deb


• Debian php4-mapscript_4.10.0-5.1+etch4_mipsel.deb
  http://security.debian.org/pool/updates/main/m/mapserver/php4-mapscrip t_4.10.0-5.1+etch4_mipsel.deb


• Debian php5-mapscript_4.10.0-5.1+etch4_mipsel.deb
  http://security.debian.org/pool/updates/main/m/mapserver/php5-mapscrip t_4.10.0-5.1+etch4_mipsel.deb


• Debian python-mapscript_4.10.0-5.1+etch4_mipsel.deb
  http://security.debian.org/pool/updates/main/m/mapserver/python-mapscr ipt_4.10.0-5.1+etch4_mipsel.deb

Debian Linux 5.0 mips

• Debian cgi-mapserver_5.0.3-3+lenny4_mips.deb
  http://security.debian.org/pool/updates/main/m/mapserver/cgi-mapserver _5.0.3-3+lenny4_mips.deb


• Debian libmapscript-ruby_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby_5.0.3-3+lenny4_all.deb


• Debian libmapscript-ruby1.8_5.0.3-3+lenny4_mips.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby1.8_5.0.3-3+lenny4_mips.deb


• Debian libmapscript-ruby1.9_5.0.3-3+lenny4_mips.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby1.9_5.0.3-3+lenny4_mips.deb


• Debian mapserver-bin_5.0.3-3+lenny4_mips.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-bin _5.0.3-3+lenny4_mips.deb


• Debian mapserver-doc_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _5.0.3-3+lenny4_all.deb


• Debian perl-mapscript_5.0.3-3+lenny4_mips.deb
  http://security.debian.org/pool/updates/main/m/mapserver/perl-mapscrip t_5.0.3-3+lenny4_mips.deb


• Debian php5-mapscript_5.0.3-3+lenny4_mips.deb
  http://security.debian.org/pool/updates/main/m/mapserver/php5-mapscrip t_5.0.3-3+lenny4_mips.deb


• Debian python-mapscript_5.0.3-3+lenny4_mips.deb
  http://security.debian.org/pool/updates/main/m/mapserver/python-mapscr ipt_5.0.3-3+lenny4_mips.deb

Debian Linux 5.0 powerpc

• Debian cgi-mapserver_5.0.3-3+lenny4_powerpc.deb
  http://security.debian.org/pool/updates/main/m/mapserver/cgi-mapserver _5.0.3-3+lenny4_powerpc.deb


• Debian libmapscript-ruby_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby_5.0.3-3+lenny4_all.deb


• Debian libmapscript-ruby1.8_5.0.3-3+lenny4_powerpc.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby1.8_5.0.3-3+lenny4_powerpc.deb


• Debian libmapscript-ruby1.9_5.0.3-3+lenny4_powerpc.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby1.9_5.0.3-3+lenny4_powerpc.deb


• Debian mapserver-bin_5.0.3-3+lenny4_powerpc.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-bin _5.0.3-3+lenny4_powerpc.deb


• Debian mapserver-doc_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _5.0.3-3+lenny4_all.deb


• Debian perl-mapscript_5.0.3-3+lenny4_powerpc.deb
  http://security.debian.org/pool/updates/main/m/mapserver/perl-mapscrip t_5.0.3-3+lenny4_powerpc.deb


• Debian php5-mapscript_5.0.3-3+lenny4_powerpc.deb
  http://security.debian.org/pool/updates/main/m/mapserver/php5-mapscrip t_5.0.3-3+lenny4_powerpc.deb


• Debian python-mapscript_5.0.3-3+lenny4_powerpc.deb
  http://security.debian.org/pool/updates/main/m/mapserver/python-mapscr ipt_5.0.3-3+lenny4_powerpc.deb

Debian Linux 4.0 ia-64

• Debian cgi-mapserver_4.10.0-5.1+etch4_ia64.deb
  http://security.debian.org/pool/updates/main/m/mapserver/cgi-mapserver _4.10.0-5.1+etch4_ia64.deb


• Debian mapserver-bin_4.10.0-5.1+etch4_ia64.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-bin _4.10.0-5.1+etch4_ia64.deb


• Debian mapserver-doc_4.10.0-5.1+etch4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _4.10.0-5.1+etch4_all.deb


• Debian perl-mapscript_4.10.0-5.1+etch4_ia64.deb
  http://security.debian.org/pool/updates/main/m/mapserver/perl-mapscrip t_4.10.0-5.1+etch4_ia64.deb


• Debian php4-mapscript_4.10.0-5.1+etch4_ia64.deb
  http://security.debian.org/pool/updates/main/m/mapserver/php4-mapscrip t_4.10.0-5.1+etch4_ia64.deb


• Debian php5-mapscript_4.10.0-5.1+etch4_ia64.deb
  http://security.debian.org/pool/updates/main/m/mapserver/php5-mapscrip t_4.10.0-5.1+etch4_ia64.deb


• Debian python-mapscript_4.10.0-5.1+etch4_ia64.deb
  http://security.debian.org/pool/updates/main/m/mapserver/python-mapscr ipt_4.10.0-5.1+etch4_ia64.deb

Debian Linux 4.0 mips

• Debian mapserver-doc_4.10.0-5.1+etch4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _4.10.0-5.1+etch4_all.deb

Debian Linux 5.0 sparc

• Debian cgi-mapserver_5.0.3-3+lenny4_sparc.deb
  http://security.debian.org/pool/updates/main/m/mapserver/cgi-mapserver _5.0.3-3+lenny4_sparc.deb


• Debian libmapscript-ruby_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby_5.0.3-3+lenny4_all.deb


• Debian libmapscript-ruby1.8_5.0.3-3+lenny4_sparc.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby1.8_5.0.3-3+lenny4_sparc.deb


• Debian libmapscript-ruby1.9_5.0.3-3+lenny4_sparc.deb
  http://security.debian.org/pool/updates/main/m/mapserver/libmapscript- ruby1.9_5.0.3-3+lenny4_sparc.deb


• Debian mapserver-bin_5.0.3-3+lenny4_sparc.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-bin _5.0.3-3+lenny4_sparc.deb


• Debian mapserver-doc_5.0.3-3+lenny4_all.deb
  http://security.debian.org/pool/updates/main/m/mapserver/mapserver-doc _5.0.3-3+lenny4_all.deb


• Debian perl-mapscript_5.0.3-3+lenny4_sparc.deb
  http://security.debian.org/pool/updates/main/m/mapserver/perl-mapscrip t_5.0.3-3+lenny4_sparc.deb


• Debian php5-mapscript_5.0.3-3+lenny4_sparc.deb
  http://security.debian.org/pool/updates/main/m/mapserver/php5-mapscrip t_5.0.3-3+lenny4_sparc.deb


• Debian python-mapscript_5.0.3-3+lenny4_sparc.deb
  http://security.debian.org/pool/updates/main/m/mapserver/python-mapscr ipt_5.0.3-3+lenny4_sparc.deb

Regents of the University of Minnesota MapServer 4.10.3

• Regents of the University of Minnesota mapserver-4.10.4.tar.gz
  http://download.osgeo.org/mapserver/mapserver-4.10.4.tar.gz

Regents of the University of Minnesota MapServer 5.2.1

• Regents of the University of Minnesota mapserver-5.2.2.tar.gz
  http://download.osgeo.org/mapserver/mapserver-5.2.2.tar.gz

MapServer Multiple Security Vulnerabilities

References:

• incorrect upstream fix for CVE-2009-0840 (mapserver) (Nico Golde)
  
• MapServer Homepage (Regents of the University of Minneso)
  
• Positron Security Advisory #2009-000: Multiple Vulnerabilities in MapServer v5.2 (Positron Security)
  
• Re: incorrect upstream fix for CVE-2009-0840 (mapserver) (Nico Golde)