CVE catalog

CVE-2012-2090

flightgear: CVE-2012-2090

Severity: Low
Published: Jun 17, 2012, 3:41:40 AM UTC
Source: [NVD] · [CVE record]
EPSS: 5.93% · Oct 25, 2026

Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in certain data chunk values in an aircraft xml model to (1) fgfs/flightgear/src/Cockpit/panel.cxx or (2) fgfs/flightgear/src/Network/generic.cxx, or (3) a scene graph model to simgear/simgear/scene/model/SGText.cxx.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	simgear	sid	`1:2024.1.5+dfsg-1`	fixed
Debian	simgear	forky	`1:2024.1.5+dfsg-1`	fixed
Debian	simgear	trixie	`1:2020.3.19+dfsg-1`	fixed
Debian	simgear	bookworm	`1:2020.3.16+dfsg-1+deb12u1`	fixed
Debian	flightgear	sid	`1:2024.1.5+dfsg-1`	fixed
Debian	flightgear	trixie	`1:2020.3.19+dfsg-1`	fixed
Debian	flightgear	bookworm	`1:2020.3.16+dfsg-1+deb12u1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	simgear	source	sid	`2.10.0-2`	unimportant	Not reported	[669024]
Debian	simgear	source	forky	`2.10.0-2`	unimportant	Not reported	[669024]
Debian	simgear	source	trixie	`2.10.0-2`	unimportant	Not reported	[669024]
Debian	simgear	source	bookworm	`2.10.0-2`	unimportant	Not reported	[669024]
Debian	flightgear	source	sid	`2.6.0-1.1`	unimportant	Not reported	[669025]
Debian	flightgear	source	trixie	`2.6.0-1.1`	unimportant	Not reported	[669025]
Debian	flightgear	source	bookworm	`2.6.0-1.1`	unimportant	Not reported	[669025]

[Debian bug #669024][Debian bug #669025]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[flightgear]Fixed
Details (2)
- 1:2020.3.16+dfsg-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 2.6.0-1.1
  dsa · flightgear · debian · bookworm; dsa · flightgear · debian · 12
- 1:2020.3.16+dfsg-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 2.6.0-1.1
  dsa · flightgear · debian · bookworm; dsa · flightgear · debian · 12
[libsimgear-dev]Fixed
Source package: [simgear]
Details (2)
- 1:2020.3.16+dfsg-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 2.10.0-2
  dsa · simgear · debian · bookworm; dsa · simgear · debian · 12
- 1:2020.3.16+dfsg-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 2.10.0-2
  dsa · simgear · debian · bookworm; dsa · simgear · debian · 12

[Debian 13 (Trixie)]

[flightgear]Fixed
Details (2)
- 1:2020.3.19+dfsg-1 · amd64 · trixie
  Fixed · Fixed: 2.6.0-1.1
  dsa · flightgear · debian · 13
- 1:2020.3.19+dfsg-1 · arm64 · trixie
  Fixed · Fixed: 2.6.0-1.1
  dsa · flightgear · debian · 13
[libsimgear-dev]Fixed
Source package: [simgear]
Details (2)
- 1:2020.3.19+dfsg-1 · amd64 · trixie
  Fixed · Fixed: 2.10.0-2
  dsa · simgear · debian · 13
- 1:2020.3.19+dfsg-1 · arm64 · trixie
  Fixed · Fixed: 2.10.0-2
  dsa · simgear · debian · 13

Observed: Oct 23, 2026, 5:05:59 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]