https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 01:50:16 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-12860 bdu:2026-12860 https://cve.radiocsirt.org/vuln/bdu:2026-12860 https://cve.radiocsirt.org/vuln/euvd-2026-323531 EUVD-2026-323531 https://cve.radiocsirt.org/vuln/euvd-2026-323531 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45104 <p>MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls _SLDApplyRuleValues(psRule, psLayer, 1); for any &lt;Rule&gt; carrying &lt;ElseFilter/&gt; — it assumes msSLDParseRule added one class. When the rule has no symbolizer (a structurally valid SLD), msSLDParseRule adds zero, and _SLDApplyRuleValues ends up indexing _class[-1], resulting in a NULL pointer dereference. A 200-byte well-formed SLD via the WMS SLD_BODY= parameter is enough to trigger this, no auth required. This vulnerability is fixed in 8.6.3.</p> <p>MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls _SLDApplyRuleValues(psRule, psLayer, 1); for any &lt;Rule&gt; carrying &lt;ElseFilter/&gt; — it assumes msSLDParseRule added one class. When the rule has no symbolizer (a structurally valid SLD), msSLDParseRule adds zero, and _SLDApplyRuleValues ends up indexing _class[-1], resulting in a NULL pointer dereference. A 200-byte well-formed SLD via the WMS SLD_BODY= parameter is enough to trigger this, no auth required. This vulnerability is fixed in 8.6.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-45104 https://cve.radiocsirt.org/vuln/opensuse-su-2026:20857-1 <p>Security update for mapserver</p> <p>Security update for mapserver</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:20857-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-45104 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: mapserver, Ubuntu:18.04:LTS: mapserver, Ubuntu:20.04:LTS: mapserver, Ubuntu:22.04:LTS: mapserver, Ubuntu:24.04:LTS: mapserver, Ubuntu:25.10: mapserver, Ubuntu:26.04:LTS: mapserver</p> <p>MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls _SLDApplyRuleValues(psRule, psLayer, 1); for any &lt;Rule&gt; carrying &lt;ElseFilter/&gt; — it assumes msSLDParseRule added one class. When the rule has no symbolizer (a structurally valid SLD), msSLDParseRule adds zero, and _SLDApplyRuleValues ends up indexing _class[-1], resulting in a NULL pointer dereference. A 200-byte well-formed SLD via the WMS SLD_BODY= parameter is enough to trigger this, no auth required. This vulnerability is fixed in 8.6.3.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: mapserver, Ubuntu:18.04:LTS: mapserver, Ubuntu:20.04:LTS: mapserver, Ubuntu:22.04:LTS: mapserver, Ubuntu:24.04:LTS: mapserver, Ubuntu:25.10: mapserver, Ubuntu:26.04:LTS: mapserver</p> <p>MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls _SLDApplyRuleValues(psRule, psLayer, 1); for any &lt;Rule&gt; carrying &lt;ElseFilter/&gt; — it assumes msSLDParseRule added one class. When the rule has no symbolizer (a structurally valid SLD), msSLDParseRule adds zero, and _SLDApplyRuleValues ends up indexing _class[-1], resulting in a NULL pointer dereference. A 200-byte well-formed SLD via the WMS SLD_BODY= parameter is enough to trigger this, no auth required. This vulnerability is fixed in 8.6.3.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-45104