Cscope is a source-code analysis and navigation tool, a niche but widely referenced utility in developer and security-audit workflows. Observed vulnerabilities center on its core codebase and manifest as memory-buffer handling issues, reflecting the low-level code-parsing demands of static analysis. Current exploitation activity and severity counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Cscope over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2009-0148HIGH Multiple buffer overflows in Cscope before 15.7a allow remote attackers to execute arbitrary code via long strings in input such as (1) source-code tokens and (2) pathnames, relate | May 5, 2009 | 9.3 | 32 | NO | NO |
CVE-2009-1577HIGH Multiple stack-based buffer overflows in the putstring function in find.c in Cscope before 15.6 allow user-assisted remote attackers to execute arbitrary code via a long (1) functi | May 7, 2009 | 9.3 | 30 | NO | NO |
main.c in cscope 15-4 and 15-5 creates temporary files with predictable filenames, which allows local users to overwrite arbitrary files via a symlink attack. | Jan 10, 2005 | 2.1 | 21 | NO | YES |
CVE-2004-2541MEDIUM Buffer overflow in Cscope 15.5, and possibly multiple overflows, allows remote attackers to execute arbitrary code via a C file with a long #include line that is later browsed by t | Dec 31, 2004 | 6.9 | 18 | NO | NO |
CVE-2006-4262MEDIUM Multiple buffer overflows in cscope 15.5 and earlier allow user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via multiple vectors inc | Aug 23, 2006 | 5.1 | 16 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Cscope.
Media articles that mention a CVE ID that affects a product developed by Cscope — matched by CVE ID, not by vendor name.