Skip to content

Product

ledger-cli ledger vulnerabilities

4 published CVES affecting ledger-cli ledger, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
4
Critical
0
High
4
Medium
0
Low
0
Unscored
0
CISA KEV
0

Latest ledger-cli ledger CVEs

Newest publication first

  1. CVE-2017-2808 An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI 3.1.1. A specially crafted ledger file can cause a use-after-free vulnerability resulting in arbit...

    Published
    HighCVSS 7.8 EPSS 1.7%

    An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI 3.1.1. A specially crafted ledger file can cause a use-after-free vulnerability resulting in arbitrary code execution. An attacker can convince a user to load a journal file to t...

  2. CVE-2017-2807 An exploitable buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially crafted journal file can cause an integer underflow resulting in code execution. A...

    Published
    HighCVSS 7.8 EPSS 2.0%

    An exploitable buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially crafted journal file can cause an integer underflow resulting in code execution. An attacker can construct a malicious journal file to trigger this vulnerability.

  3. CVE-2017-12482 The ledger::parse_date_mask_routine function in times.cc in Ledger 3.1.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspe...

    Published
    HighCVSS 7.8 EPSS 1.2%

    The ledger::parse_date_mask_routine function in times.cc in Ledger 3.1.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.