Vulnerability Details : CVE-2017-2816
Potential exploit
An exploitable buffer overflow vulnerability exists in the tag parsing functionality of LibOFX 0.9.11. A specially crafted OFX file can cause a write out of bounds resulting in a buffer overflow on the stack. An attacker can construct a malicious OFX file to trigger this vulnerability.
Vulnerability category: Overflow
Products affected by CVE-2017-2816
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:libofx_project:libofx:0.9.11:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-2816
1.00%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 83 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-2816
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
8.8
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
Talos | |
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2017-2816
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-2816
-
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0317
TALOS-2017-0317 || Cisco Talos Intelligence Group - Comprehensive Threat IntelligenceExploit;Technical Description;Third Party Advisory
-
https://security.gentoo.org/glsa/201908-26
libofx: Multiple vulnerabilities (GLSA 201908-26) — Gentoo securityThird Party Advisory
-
http://www.securityfocus.com/bid/100828
LibOFX CVE-2017-2816 Stack Based Buffer Overflow VulnerabilityBroken Link;Third Party Advisory;VDB Entry
-
https://lists.debian.org/debian-lts-announce/2017/11/msg00038.html
[SECURITY] [DLA 1192-1] libofx security updateMailing List;Third Party Advisory
Jump to