CVE-2011-2900
Stack-based buffer overflow in the (1) put_dir function in mongoose.c in Mongoose 3.0, (2) put_dir function in yasslEWS.c in yaSSL Embedded Web Server (yasslEWS) 0.2, and (3) _shttpd_put_dir function in io_dir.c in Simple HTTPD (shttpd) 1.42 allows remote attackers to execute arbitrary code via an HTTP PUT request, as exploited in the wild in 2011.
- EPSS
- 13% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
- CWE
- CWE-119
- Published
- Modified
- Record from
- the NVD, synced
Affected
- shttpd:shttpd
- valenok:mongoose
- yassl:yasslews
References
- http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065273.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065505.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065537.html
- http://secunia.com/advisories/45464
- http://secunia.com/advisories/45902