CVE-2017-7523 Cygwin versions 1.7.2 up to and including 1.8.0 are vulnerable to buffer overflow vulnerability in wcsxfrm/wcsxfrm_l functions resulting into denial-of-service by crashing the process or potential hij...
HighCVSS 7.5
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cygwin versions 1.7.2 up to and including 1.8.0 are vulnerable to buffer overflow vulnerability in wcsxfrm/wcsxfrm_l functions resulting into denial-of-service by crashing the process or potential hijack of the process running with administrative privileges triggered by specially crafted input string.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cygwin | = 1.7.2 | No fix listed |
| cygwin | = 1.7.3 | No fix listed |
| cygwin | = 1.7.5 | No fix listed |
| cygwin | = 1.7.6 | No fix listed |
| cygwin | = 1.7.7 | No fix listed |
| cygwin | = 1.7.8 | No fix listed |
| cygwin | = 1.7.9 | No fix listed |
| cygwin | = 1.7.10 | No fix listed |
| cygwin | = 1.7.11 | No fix listed |
| cygwin | = 1.7.12 | No fix listed |
| cygwin | = 1.7.13 | No fix listed |
| cygwin | = 1.7.14 | No fix listed |
| cygwin | = 1.7.15 | No fix listed |
| cygwin | = 1.7.16 | No fix listed |
| cygwin | = 1.7.17 | No fix listed |
| cygwin | = 1.7.18 | No fix listed |
| cygwin | = 1.7.19 | No fix listed |
| cygwin | = 1.7.21 | No fix listed |
| cygwin | = 1.7.22 | No fix listed |
| cygwin | = 1.7.23 | No fix listed |
| cygwin | = 1.7.24 | No fix listed |
| cygwin | = 1.7.25 | No fix listed |
| cygwin | = 1.7.26 | No fix listed |
| cygwin | = 1.7.27 | No fix listed |
| cygwin | = 1.7.28 | No fix listed |
Show 8 more
| Product | Affected versions | Fixed in |
|---|---|---|
| cygwin | = 1.7.29 | No fix listed |
| cygwin | = 1.7.31 | No fix listed |
| cygwin | = 1.7.32 | No fix listed |
| cygwin | = 1.7.33 | No fix listed |
| cygwin | = 1.7.34 | No fix listed |
| cygwin | = 1.7.35 | No fix listed |
| cygwin | = 1.8.0 | No fix listed |
| redhat cygwin | = since 1.7.2 up to 2.8.0 | No fix listed |
References
- cygwin.com exploit mailing-list vendor-advisory