CVE-2017-9765

Опубликовано: 20 июл. 2017

Источник: nvd

CVSS3: 8.1

CVSS2: 6.8

EPSS Средний

Описание

Integer overflow in the soap_get function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48, as used on Axis cameras and other devices, allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow and application crash) via a large XML document, aka Devil's Ivy. NOTE: the large document would be blocked by many common web-server configurations on general-purpose computers.

Ссылки

http://blog.senr.io/blog/devils-ivy-flaw-in-widely-used-third-party-code-impacts-millions
Mitigation
Technical Description
Third Party Advisory
http://blog.senr.io/devilsivy.html
Exploit
Technical Description
Third Party Advisory
http://www.securityfocus.com/bid/99868
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1472807
Issue Tracking
Third Party Advisory
VDB Entry
https://bugzilla.suse.com/show_bug.cgi?id=1049348
Issue Tracking
Third Party Advisory
VDB Entry
https://www.genivia.com/advisory.html#Security_advisory:_CVE-2017-9765_bug_in_certain_versions_of_gSOAP_2.7_up_to_2.8.47_%28June_21%2C_2017%29
https://www.genivia.com/changelog.html#Version_2.8.48_upd_%2806/21/2017%29
Release Notes
Vendor Advisory
http://blog.senr.io/blog/devils-ivy-flaw-in-widely-used-third-party-code-impacts-millions
Mitigation
Technical Description
Third Party Advisory
http://blog.senr.io/devilsivy.html
Exploit
Technical Description
Third Party Advisory
http://www.securityfocus.com/bid/99868
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1472807
Issue Tracking
Third Party Advisory
VDB Entry
https://bugzilla.suse.com/show_bug.cgi?id=1049348
Issue Tracking
Third Party Advisory
VDB Entry
https://www.genivia.com/advisory.html#Security_advisory:_CVE-2017-9765_bug_in_certain_versions_of_gSOAP_2.7_up_to_2.8.47_%28June_21%2C_2017%29
https://www.genivia.com/changelog.html#Version_2.8.48_upd_%2806/21/2017%29
Release Notes
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:genivia:gsoap:2.7.0:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.7.1:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.7.2:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.7.3:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.7.4:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.7.5:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.7.6:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.7.7:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.7.8:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.7.9:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.7.10:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.7.11:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.7.12:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.7.13:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.7.14:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.7.15:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.7.16:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.7.17:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.0:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.1:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.2:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.3:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.4:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.5:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.6:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.7:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.8:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.9:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.10:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.11:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.12:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.13:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.14:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.15:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.16:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.17:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.18:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.19:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.20:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.21:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.22:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.23:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.24:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.25:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.26:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.27:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.28:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.29:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.30:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.31:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.32:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.33:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.34:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.35:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.36:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.37:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.38:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.39:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.40:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.41:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.42:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.43:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.44:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.45:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.46:*:*:*:*:*:*:*

cpe:2.3:a:genivia:gsoap:2.8.47:*:*:*:*:*:*:*

EPSS

Процентиль: 96%

0.2525

Средний

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-190

Связанные уязвимости

CVE-2017-9765

CVSS3: 8.1

ubuntu

больше 8 лет назад

CVE-2017-9765

CVSS3: 8.1

debian

больше 8 лет назад

Integer overflow in the soap_get function in Genivia gSOAP 2.7.x and 2 ...

openSUSE-SU-2017:1957-1

suse-cvrf

больше 8 лет назад

Recommended update for gsoap

GHSA-h3gg-c3fx-2m67

CVSS3: 8.1

github

больше 3 лет назад

EPSS

Процентиль: 96%

0.2525

Средний

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-190