CVE-2017-11343

NameCVE-2017-11343
DescriptionDue to an incomplete fix for CVE-2012-6125, all versions of CHICKEN Scheme up to and including 4.12.0 are vulnerable to an algorithmic complexity attack. An attacker can provide crafted input which, when inserted into the symbol table, will result in O(n) lookup time.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium (attack range: remote)
Debian Bugs870266

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
chicken (PTS)wheezy4.7.0-1vulnerable
wheezy (security)4.7.0-1+deb7u2vulnerable
jessie4.9.0.1-1vulnerable
buster, sid, stretch4.11.0-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
chickensource(unstable)(unfixed)medium870266

Notes

[stretch] - chicken <no-dsa> (Minor issue)
[jessie] - chicken <no-dsa> (Minor issue)
[wheezy] - chicken <no-dsa> (Minor issue)
http://lists.nongnu.org/archive/html/chicken-announce/2017-07/msg00000.html

Search for package or bug name: Reporting problems