1. CVE-Search
  2. CVE-2017-2885
ID CVE-2017-2885
Summary An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability.
References
Vulnerable Configurations
  • cpe:2.3:a:gnome:libsoup:2.58:*:*:*:*:*:*:*
    cpe:2.3:a:gnome:libsoup:2.58:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 07-06-2022 - 17:25)
Impact:
Exploitability:
CWE CWE-787
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
redhat via4
advisories
bugzilla
id 1479281
title CVE-2017-2885 libsoup: Stack based buffer overflow with HTTP Chunked Encoding
oval
OR
  • comment Red Hat Enterprise Linux must be installed
    oval oval:com.redhat.rhba:tst:20070304026
  • AND
    • comment Red Hat Enterprise Linux 7 is installed
      oval oval:com.redhat.rhba:tst:20150364027
    • OR
      • AND
        • comment libsoup is earlier than 0:2.56.0-4.el7_4
          oval oval:com.redhat.rhsa:tst:20172459001
        • comment libsoup is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20111102002
      • AND
        • comment libsoup-devel is earlier than 0:2.56.0-4.el7_4
          oval oval:com.redhat.rhsa:tst:20172459003
        • comment libsoup-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20111102004
rhsa
id RHSA-2017:2459
released 2017-08-10
severity Important
title RHSA-2017:2459: libsoup security update (Important)
rpms
  • libsoup-0:2.56.0-4.el7_4
  • libsoup-debuginfo-0:2.56.0-4.el7_4
  • libsoup-devel-0:2.56.0-4.el7_4
refmap via4
bid 100258
debian DSA-3929
fulldisc 20201204 ProCaster LE-32F430 SmartTV RCE via libsoup/2.51.3 stack overflow (CVE-2017-2885)
misc
Last major update 07-06-2022 - 17:25
Published 24-04-2018 - 19:29
Last modified 07-06-2022 - 17:25
Back to Top