CVE-2017-9765

Name	CVE-2017-9765
Description	Integer overflow in the soap_get function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48, as used on Axis cameras and other devices, allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow and application crash) via a large XML document, aka Devil's Ivy. NOTE: the large document would be blocked by many common web-server configurations on general-purpose computers.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1036-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gsoap (PTS)	bullseye	2.8.104-3	fixed
	bookworm	2.8.124-2	fixed
	sid, trixie	2.8.135-2	fixed
r-other-x4r (PTS)	bookworm, bullseye, sid, trixie	1.0.1+git20150806.c6bd9bd-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
gsoap	source	wheezy	2.8.7-2+deb7u1	DLA-1036-1
gsoap	source	jessie	2.8.17-1+deb8u1
gsoap	source	stretch	2.8.35-4+deb9u1
gsoap	source	(unstable)	2.8.48-1
r-other-x4r	source	(unstable)	1.0.1+git20150806.c6bd9bd-2

Notes

http://blog.senr.io/blog/devils-ivy-flaw-in-widely-used-third-party-code-impacts-millions
https://www.genivia.com/changelog.html#Version_2.8.48_upd_(06/21/2017)
SuSE patch: https://bugzilla.suse.com/attachment.cgi?id=733005