dbcve.org
FlightgearApplication

CVE-2012-2090

HIGH · 9.3 CVSS v2.0 Published 2012-06-17
Fix available
A fix is available. Upgrade to after 2.6.0 or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in certain data chunk values in an aircraft xml model to (1) fgfs/flightgear/src/Cockpit/panel.cxx or (2) fgfs/flightgear/src/Network/generic.cxx, or (3) a scene graph model to simgear/simgear/scene/model/SGText.cxx.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Format string vulnerabilities in FlightGear and SimGear allow malicious aircraft XML model files to inject format specifiers (%s, %n, etc.) into unprotected printf-style functions in panel.cxx, generic.cxx, and SGText.cxx. This enables denial of service via crashes and potentially arbitrary code execution by overwriting memory locations on the stack.

MitigationUpgrade to FlightGear and SimGear versions newer than 2.6, or implement input validation to sanitize format string characters from aircraft XML model data before passing to printf-family functions.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
FlightgearApplication
Affected:<= 2.6.0= 1.9.1= 2.0.0
SimgearApplication
Affected:<= 2.6.0= 1.9.1= 2.0.0

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
M
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete

AV:N/AC:M/Au:N/C:C/I:C/A:C

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Check FlightGear version
    Run 'flightgear --version' or check the application About/Help dialog, or look in the installation directory for version information
    Affected if Version is 1.9.1, 2.0.0, or any version <= 2.6.0
  2. Check SimGear version
    Run 'simgear-config --version' if available, or check library files in the installation (often named libsgutils or similar with version in filename)
    Affected if Version is 1.9.1, 2.0.0, or any version <= 2.6.0
  3. Verify aircraft XML loading capability
    Check if FlightGear is configured to load custom/proprietary aircraft packages or if default aircraft are used. Inspect the $FG_ROOT/Aircraft/ directory for third-party additions
    Affected if User loads aircraft XML model files from sources other than the official FlightGear aircraft repository
  4. Inspect vulnerable source files for unfiltered format strings
    If source code is available, examine panel.cxx, generic.cxx, and SGText.cxx for printf-family calls where the format string comes directly from XML parsing (search for patterns like printf(something) or sprintf(buffer, input) without %s formatting)
    Affected if Code uses printf-style functions with unfiltered XML-derived strings without proper format specifier sanitization

User is affected if FlightGear or SimGear version is 1.9.1, 2.0.0, or any release up to and including 2.6.0, and the system loads aircraft XML model files from untrusted or non-official sources.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to a release after 2.6.0
Interim mitigation

Upgrade to FlightGear and SimGear versions newer than 2.6, or implement input validation to sanitize format string characters from aircraft XML model data before passing to printf-family functions.

Recommended fix High confidence

FlightGear 2.8.0 or later / SimGear 2.8.0 or later

  1. 1. Identify the currently installed FlightGear and SimGear versions using your package manager or by running 'fgfs --version'
  2. 2. Uninstall the vulnerable FlightGear (versions <= 2.6.0, 1.9.1, 2.0.0) and SimGear packages
  3. 3. Download FlightGear 2.8.0 or later from the official FlightGear repository or source
  4. 4. Download the corresponding SimGear 2.8.0 or later version
  5. 5. Install SimGear first, then FlightGear, following the build instructions for your platform
  6. 6. Verify the installed versions are >= 2.8.0 by running 'fgfs --version'
  7. 7. Test that FlightGear launches successfully with your aircraft models
Caveat Minimal; version 2.8.0 includes security fixes with no major API changes from 2.6.0

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Flightgear Scoped from the published advisory
  • Consultation3.0 h
  • Implementation12.0 h
  • Testing6.0 h
  • Review / QA3.0 h
24.0 hours of engineering $4,200
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,720.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2012-2090 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2012-2090 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data