CVE-2017-5522 Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary....
CriticalCVSS 9.8
EPSS 4.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving WFS get feature requests.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/mapserver(Debian:12) | < 7.0.4-1 | 7.0.4-1 |
| debian/mapserver(Debian:13) | < 7.0.4-1 | 7.0.4-1 |
| debian/mapserver(Debian:14) | < 7.0.4-1 | 7.0.4-1 |
| debian linux | = 8.0 | No fix listed |
| osgeo mapserver | <= 6.0.5 | No fix listed |
| osgeo mapserver | = 6.2.0 | No fix listed |
| osgeo mapserver | = 6.2.0-beta1 | No fix listed |
| osgeo mapserver | = 6.2.0-beta2 | No fix listed |
| osgeo mapserver | = 6.2.0-beta3 | No fix listed |
| osgeo mapserver | = 6.2.0-beta4 | No fix listed |
| osgeo mapserver | = 6.2.0-rc1 | No fix listed |
| osgeo mapserver | = 6.2.1 | No fix listed |
| osgeo mapserver | = 6.2.2 | No fix listed |
| osgeo mapserver | = 6.2.3 | No fix listed |
| osgeo mapserver | = 6.4.0 | No fix listed |
| osgeo mapserver | = 6.4.0-beta1 | No fix listed |
| osgeo mapserver | = 6.4.0-beta2 | No fix listed |
| osgeo mapserver | = 6.4.0-rc1 | No fix listed |
| osgeo mapserver | = 6.4.1 | No fix listed |
| osgeo mapserver | = 6.4.2 | No fix listed |
| osgeo mapserver | = 6.4.3 | No fix listed |
| osgeo mapserver | = 6.4.4 | No fix listed |
| osgeo mapserver | = 7.0.0 | No fix listed |
| osgeo mapserver | = 7.0.0-beta1 | No fix listed |
| osgeo mapserver | = 7.0.0-beta2 | No fix listed |
Show 3 more
| Product | Affected versions | Fixed in |
|---|---|---|
| osgeo mapserver | = 7.0.1 | No fix listed |
| osgeo mapserver | = 7.0.2 | No fix listed |
| osgeo mapserver | = 7.0.3 | No fix listed |
References
- Debian Security Tracker CVE-2017-5522 vendor-advisory
- DSA-3766 third-party-advisory vendor-advisory
- www.mapserver.org release-notes
- www.mapserver.org release-notes
- www.mapserver.org release-notes
- www.mapserver.org release-notes
- github.com patch third-party-advisory
- [mapserver-dev] 20170118 MapServer 6.0.6, 6.2.4, 6.4.5 and 7.0.4 are released mailing-list third-party-advisory