CVE-2017-11343

NameCVE-2017-11343
DescriptionDue to an incomplete fix for CVE-2012-6125, all versions of CHICKEN Scheme up to and including 4.12.0 are vulnerable to an algorithmic complexity attack. An attacker can provide crafted input which, when inserted into the symbol table, will result in O(n) lookup time.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
chicken (PTS)wheezy4.7.0-1vulnerable
wheezy (security)4.7.0-1+deb7u2vulnerable
jessie4.9.0.1-1vulnerable
stretch, buster, sid4.11.0-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
chickensource(unstable)(unfixed)

Notes

[stretch] - chicken <no-dsa> (Minor issue)
[jessie] - chicken <no-dsa> (Minor issue)
[wheezy] - chicken <no-dsa> (Minor issue)
http://lists.nongnu.org/archive/html/chicken-announce/2017-07/msg00000.html

Search for package or bug name: Reporting problems