CVE-2008-2292

Name	CVE-2008-2292
Description	Buffer overflow in the __snprint_value function in snmp_get in Net-SNMP 5.1.4, 5.2.4, and 5.4.1, as used in SNMP.xs for Perl, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large OCTETSTRING in an attribute value pair (AVP).
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-1663-1, DTSA-134-1
Debian Bugs	482333

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
net-snmp (PTS)	bullseye (security), bullseye	5.9+dfsg-4+deb11u1	fixed
	bookworm	5.9.3+dfsg-2	fixed
	forky, sid, trixie	5.9.4+dfsg-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
net-snmp	source	etch	5.2.3-7etch4		DSA-1663-1
net-snmp	source	lenny	5.4.1~dfsg-7+lenny1		DTSA-134-1
net-snmp	source	(unstable)	5.4.1~dfsg-8	medium		482333