CVE-2017-7555

NameCVE-2017-7555
DescriptionAugeas versions up to and including 1.8.0 are vulnerable to heap-based buffer overflow due to improper handling of escaped strings. Attacker could send crafted strings that would cause the application using augeas to copy past the end of a buffer, leading to a crash or possible code execution.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-1067-1, DSA-3949-1
Debian Bugs872400

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
augeas (PTS)bullseye1.12.0-2fixed
bookworm1.14.0-1fixed
sid, trixie1.14.1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
augeassourcewheezy0.10.0-1+deb7u1DLA-1067-1
augeassourcejessie1.2.0-0.2+deb8u2DSA-3949-1
augeassourcestretch1.8.0-1+deb9u1DSA-3949-1
augeassource(unstable)1.8.1-1872400

Notes

https://github.com/hercules-team/augeas/pull/480
https://bugzilla.redhat.com/show_bug.cgi?id=1478373

Search for package or bug name: Reporting problems