CHICKEN Scheme vulnerabilities
4 known CVE vulnerabilities in CHICKEN Scheme, translated and rated.
- CVE-2017-11343High
All versions of CHICKEN Scheme up to and including 4.12.0 are vulnerable to an algorithmic complexity attack due to an incomplete fix for CVE-2012-6125. An attacker can provide crafted input that will result in O(n) lookup time in the symbol table.
- CVE-2017-9334High
An incorrect 'pair?' check in the 'length' procedure in CHICKEN Scheme leads to an unsafe pointer dereference. This allows an attacker to cause a denial of service by passing an improper list to an application that calls 'length'.
- CVE-2017-6949High
An issue was discovered in CHICKEN Scheme through version 4.12.0 related to allocating an SRFI-4 vector in unmanaged memory. The vector size was used in unsanitised form as an argument to malloc(), which could lead to segfaults or buffer overflows.
- CVE-2016-6830Critical
The 'process-execute' and 'process-spawn' procedures in CHICKEN Scheme use fixed-size buffers for holding arguments and environment variables for the execve() call. This can lead to buffer overrun when user-supplied argument/environment variable lists are provided.