PT-2017-15549 · Ledger+1 · Ledger-Cli+1

Publicado

2017-09-05

·

Atualizado

2024-06-15

·

CVE-2017-2807

CVSS v3.1

7.8

Alta

VetorAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Ledger-CLI version 3.1.1
Description A buffer overflow vulnerability exists in the tag parsing functionality. This issue can be triggered by a specially crafted journal file, causing an integer underflow that results in code execution. An attacker can construct a malicious journal file to exploit this issue.
Recommendations For Ledger-CLI version 3.1.1, consider avoiding the use of potentially malicious journal files until a patch is available. As a temporary workaround, restrict access to the tag parsing functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2017-2807
OPENSUSE-SU-2019:1779-1
OPENSUSE-SU-2019:1895-1
OPENSUSE-SU-2019_1779-1
OPENSUSE-SU-2024:10913-1

Produtos afetados

Ledger-Cli
Suse