Vulnerability Details : CVE-2017-17810
In Netwide Assembler (NASM) 2.14rc0, there is a "SEGV on unknown address" that will cause a remote denial of service attack, because asm/preproc.c mishandles macro calls that have the wrong number of arguments.
Vulnerability category: Input validationDenial of service
Products affected by CVE-2017-17810
- cpe:2.3:a:nasm:netwide_assembler:2.14:rc0:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-17810
0.48%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 76 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-17810
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:N/A:P |
8.6
|
2.9
|
NIST | |
|
5.5
|
MEDIUM | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
1.8
|
3.6
|
NIST |
CWE ids for CVE-2017-17810
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-17810
-
https://bugzilla.nasm.us/show_bug.cgi?id=3392431
3392431 – There is a SEGV on unknown address 0x000000000018 in nasm.Exploit;Issue Tracking;Vendor Advisory
-
https://usn.ubuntu.com/3694-1/
USN-3694-1: NASM vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://repo.or.cz/nasm.git/commit/59ce1c67b16967c652765e62aa130b7e43f21dd4
Public Git Hosting - nasm.git/commitPatch;Vendor Advisory
Jump to