Vulnerability Details : CVE-2017-9434
Crypto++ (aka cryptopp) through 5.6.5 contains an out-of-bounds read vulnerability in zinflate.cpp in the Inflator filter.
Products affected by CVE-2017-9434
- cpe:2.3:a:cryptopp:crypto\+\+:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-9434
0.19%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 56 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-9434
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST | |
5.3
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
3.9
|
1.4
|
NIST |
CWE ids for CVE-2017-9434
-
The product reads data past the end, or before the beginning, of the intended buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-9434
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7IL5A6465IEPW5GAWGXB2ENJPFYVWTJM/
[SECURITY] Fedora 30 Update: cryptopp-8.2.0-1.fc30 - package-announce - Fedora Mailing-Lists
-
http://www.securityfocus.com/bid/99007
Crypto++ CVE-2017-9434 Out-Of-Bounds Read Information Disclosure Vulnerability
-
http://openwall.com/lists/oss-security/2017/06/06/2
oss-security - Crypto++ and invalid read in decompressor classMailing List;Third Party Advisory
-
https://github.com/weidai11/cryptopp/issues/414
Zinflate and AddressSanitizer finding · Issue #414 · weidai11/cryptopp · GitHubThird Party Advisory
-
https://github.com/weidai11/cryptopp/commit/07dbcc3d9644b18e05c1776db2a57fe04d780965
Add Inflator::BadDistanceErr exception (Issue 414) · weidai11/cryptopp@07dbcc3 · GitHubThird Party Advisory
Jump to