CVE-2017-9334 An incorrect "pair?" check in the Scheme "length" procedure results in an unsafe pointer dereference in all CHICKEN Scheme versions prior to 4.13, which allows an attacker to cause a denial of service...
HighCVSS 7.5
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An incorrect "pair?" check in the Scheme "length" procedure results in an unsafe pointer dereference in all CHICKEN Scheme versions prior to 4.13, which allows an attacker to cause a denial of service by passing an improper list to an application that calls "length" on it.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/chicken(Debian:12) | < 4.12.0-0.2 | 4.12.0-0.2 |
| debian/chicken(Debian:13) | < 4.12.0-0.2 | 4.12.0-0.2 |
| debian/chicken(Debian:14) | < 4.12.0-0.2 | 4.12.0-0.2 |
| call-cc chicken | <= 4.12.0 | No fix listed |
| alpine/chicken(Alpine:v3.10) | < 4.12.0-r2 | 4.12.0-r2 |
| alpine/chicken(Alpine:v3.11) | < 4.12.0-r2 | 4.12.0-r2 |
| alpine/chicken(Alpine:v3.12) | < 4.12.0-r2 | 4.12.0-r2 |
| alpine/chicken(Alpine:v3.13) | < 4.12.0-r2 | 4.12.0-r2 |
| alpine/chicken(Alpine:v3.14) | < 4.12.0-r2 | 4.12.0-r2 |
| alpine/chicken(Alpine:v3.15) | < 4.12.0-r2 | 4.12.0-r2 |
| alpine/chicken(Alpine:v3.16) | < 4.12.0-r2 | 4.12.0-r2 |
| alpine/chicken(Alpine:v3.17) | < 4.12.0-r2 | 4.12.0-r2 |
| alpine/chicken(Alpine:v3.18) | < 4.12.0-r2 | 4.12.0-r2 |
| alpine/chicken(Alpine:v3.19) | < 4.12.0-r2 | 4.12.0-r2 |
| alpine/chicken(Alpine:v3.20) | < 4.12.0-r2 | 4.12.0-r2 |
| alpine/chicken(Alpine:v3.21) | < 4.12.0-r2 | 4.12.0-r2 |
| alpine/chicken(Alpine:v3.22) | < 4.12.0-r2 | 4.12.0-r2 |
| alpine/chicken(Alpine:v3.23) | < 4.12.0-r2 | 4.12.0-r2 |
| alpine/chicken(Alpine:v3.24) | < 4.12.0-r2 | 4.12.0-r2 |
| alpine/chicken(Alpine:v3.6) | < 4.12.0-r2 | 4.12.0-r2 |
| alpine/chicken(Alpine:v3.7) | < 4.12.0-r2 | 4.12.0-r2 |
| alpine/chicken(Alpine:v3.8) | < 4.12.0-r2 | 4.12.0-r2 |
| alpine/chicken(Alpine:v3.9) | < 4.12.0-r2 | 4.12.0-r2 |
References
- Debian Security Tracker CVE-2017-9334 vendor-advisory
- lists.nongnu.org patch third-party-advisory
- lists.nongnu.org patch third-party-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking