CVE-2017-7555

NameCVE-2017-7555
DescriptionAugeas versions up to and including 1.8.0 are vulnerable to heap-based buffer overflow due to improper handling of escaped strings. Attacker could send crafted strings that would cause the application using augeas to copy past the end of a buffer, leading to a crash or possible code execution.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1067-1, DSA-3949-1
NVD severityhigh (attack range: remote)
Debian Bugs872400

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
augeas (PTS)wheezy0.10.0-1vulnerable
wheezy (security)0.10.0-1+deb7u1fixed
jessie (security), jessie1.2.0-0.2+deb8u2fixed
stretch (security), stretch1.8.0-1+deb9u1fixed
buster, sid1.9.0-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
augeassource(unstable)1.8.1-1high872400
augeassourcejessie1.2.0-0.2+deb8u2highDSA-3949-1
augeassourcestretch1.8.0-1+deb9u1highDSA-3949-1
augeassourcewheezy0.10.0-1+deb7u1highDLA-1067-1

Notes

https://github.com/hercules-team/augeas/pull/480
https://bugzilla.redhat.com/show_bug.cgi?id=1478373

Search for package or bug name: Reporting problems