Off-by-one error in the process_cgivars function in contrib/daemonchk.c in
Nagios Core 3.5.1, 4.0.2, and earlier allows remote authenticated users to
obtain sensitive information from process memory or cause a denial of
service (crash) via a long string in the last key value in the variable
list, which triggers a heap-based buffer over-read.
mdeslaur> nagios fix had an additional source file, so this CVE was
mdeslaur> split out from CVE-2013-7108. (contrib/daemonchk.c)
Updated: 2017-04-14 08:19:56 UTC (commit 12390)