| From the Red Hat bugzilla:
Stack-based buffer overflow in mapserv.c in mapserv in MapServer 4.x
before 4.10.4 and 5.x before 5.2.2, when the server has a map with a
long IMAGEPATH or NAME attribute, allows remote attackers to execute
arbitrary code via a crafted id parameter in a query action. CVE-2009-0839
Heap-based buffer underflow in the readPostBody function in cgiutil.c
in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows
remote attackers to have an unknown impact via a negative value in the
Content-Length HTTP header. CVE-2009-0840
Directory traversal vulnerability in mapserv.c in mapserv in MapServer
4.x before 4.10.4 and 5.x before 5.2.2, when running on Windows with
Cygwin, allows remote attackers to create arbitrary files via a ..
(dot dot) in the id parameter. CVE-2009-0841
mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows
remote attackers to read arbitrary invalid .map files via a full
pathname in the map parameter, which triggers the display of partial
file contents within an error message, as demonstrated by a
/tmp/sekrut.map symlink. CVE-2009-0842
The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and
5.x before 5.2.2 allows remote attackers to determine the existence of
arbitrary files via a full pathname in the queryfile parameter, which
triggers different error messages depending on whether this pathname
exists. CVE-2009-0843
mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before
5.2.2 does not ensure that the string holding the id parameter ends in
a '\0' character, which allows remote attackers to conduct
buffer-overflow attacks or have unspecified other impact via a long id
parameter in a query action. CVE-2009-1176
Multiple stack-based buffer overflows in maptemplate.c in mapserv in
MapServer 4.x before 4.10.4 and 5.x before 5.2.2 have unknown impact
and remote attack vectors. CVE-2009-1177
| 