{ "id": "CVE-2017-5522", "sourceIdentifier": "cve@mitre.org", "published": "2017-03-15T16:59:00.283", "lastModified": "2021-06-07T15:56:17.010", "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", "value": "Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving WFS get feature requests." }, { "lang": "es", "value": "Desbordamiento de b\u00fafer basado en pila en MapServer en versiones anteriores a 6.0.6, 6.2.x en versiones anteriores a 6.2.4, 6.4.x en versiones anteriores a 6.4.5 y 7.0.x en versiones anteriores a 7.0.4 permite a atacantes remotos provocar una denegaci\u00f3n de servicio (ca\u00edda) o ejecutar c\u00f3digo arbitrario a trav\u00e9s de vectores que implican solicitudes WFS de obtenci\u00f3n de funci\u00f3n." } ], "metrics": { "cvssMetricV30": [ { "source": "nvd@nist.gov", "type": "Primary", "cvssData": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "exploitabilityScore": 3.9, "impactScore": 5.9 } ], "cvssMetricV2": [ { "source": "nvd@nist.gov", "type": "Primary", "cvssData": { "version": "2.0", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "baseScore": 7.5 }, "baseSeverity": "HIGH", "exploitabilityScore": 10.0, "impactScore": 6.4, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false } ] }, "weaknesses": [ { "source": "nvd@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-119" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43" } ] } ] }, { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:osgeo:mapserver:*:*:*:*:*:*:*:*", "versionEndIncluding": "6.0.5", "matchCriteriaId": "2616104A-15A1-4EE2-B422-F0A0956029B1" }, { "vulnerable": true, "criteria": "cpe:2.3:a:osgeo:mapserver:6.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "16A7F401-1829-440B-A7D0-08515F73E11A" }, { "vulnerable": true, "criteria": "cpe:2.3:a:osgeo:mapserver:6.2.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "EC09B39C-A41A-4024-A5CE-1D8FDFB9C67C" }, { "vulnerable": true, "criteria": "cpe:2.3:a:osgeo:mapserver:6.2.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "E25092AC-76DD-495D-9FB6-A6D76A08464D" }, { "vulnerable": true, "criteria": "cpe:2.3:a:osgeo:mapserver:6.2.0:beta3:*:*:*:*:*:*", "matchCriteriaId": "C738E019-D602-4E5C-8FB3-64CC5F11EF83" }, { "vulnerable": true, "criteria": "cpe:2.3:a:osgeo:mapserver:6.2.0:beta4:*:*:*:*:*:*", "matchCriteriaId": "FFD649DB-1FE8-4973-B329-107A89FD6799" }, { "vulnerable": true, "criteria": "cpe:2.3:a:osgeo:mapserver:6.2.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "4E6833DE-045A-4458-A067-CCFA3A8CE016" }, { "vulnerable": true, "criteria": "cpe:2.3:a:osgeo:mapserver:6.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "C6A01342-B989-4134-8692-8BD8A42B93D2" }, { "vulnerable": true, "criteria": "cpe:2.3:a:osgeo:mapserver:6.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "F52DB9E8-C9B0-4513-B181-05A98404C04F" }, { "vulnerable": true, "criteria": "cpe:2.3:a:osgeo:mapserver:6.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "FC5EA648-9431-45F1-93FE-2D60C08634B6" }, { "vulnerable": true, "criteria": "cpe:2.3:a:osgeo:mapserver:6.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "995FF868-DD52-4625-AD2E-74BB63F4BC72" }, { "vulnerable": true, "criteria": "cpe:2.3:a:osgeo:mapserver:6.4.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "CA6FB628-5D34-46DF-BF7F-5D277A51F9F0" }, { "vulnerable": true, "criteria": "cpe:2.3:a:osgeo:mapserver:6.4.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "2EC08735-4E07-45F2-AE1B-56F6B9291FE8" }, { "vulnerable": true, "criteria": "cpe:2.3:a:osgeo:mapserver:6.4.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "5BB85B09-03A4-4296-8CDC-40338C7F92EA" }, { "vulnerable": true, "criteria": "cpe:2.3:a:osgeo:mapserver:6.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "8A9D9693-6F02-4F21-AD59-A0AEA73D6374" }, { "vulnerable": true, "criteria": "cpe:2.3:a:osgeo:mapserver:6.4.2:*:*:*:*:*:*:*", "matchCriteriaId": "7B8EA460-06CF-4175-999C-5C98E9B0DC78" }, { "vulnerable": true, "criteria": "cpe:2.3:a:osgeo:mapserver:6.4.3:*:*:*:*:*:*:*", "matchCriteriaId": "3905DE6B-14D9-45E0-9A95-9EE131691658" }, { "vulnerable": true, "criteria": "cpe:2.3:a:osgeo:mapserver:6.4.4:*:*:*:*:*:*:*", "matchCriteriaId": "DF6DD7AA-AA71-497E-9BCC-7CDD450EA7B7" }, { "vulnerable": true, "criteria": "cpe:2.3:a:osgeo:mapserver:7.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "251BBE27-A977-4725-AFCA-22CF96CBD965" }, { "vulnerable": true, "criteria": "cpe:2.3:a:osgeo:mapserver:7.0.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "FB1C2F87-63A3-4D2C-AB84-B7C319058572" }, { "vulnerable": true, "criteria": "cpe:2.3:a:osgeo:mapserver:7.0.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "46A22D61-588D-476C-8284-EEE3EDC53EBF" }, { "vulnerable": true, "criteria": "cpe:2.3:a:osgeo:mapserver:7.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "BE7043E9-2FE4-441D-AF8E-139AF97387CA" }, { "vulnerable": true, "criteria": "cpe:2.3:a:osgeo:mapserver:7.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "131EA02D-E121-4BED-9381-688A2ED16595" }, { "vulnerable": true, "criteria": "cpe:2.3:a:osgeo:mapserver:7.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "C53903F5-D572-4CDA-BEC3-EAA5FDBB5A2C" } ] } ] } ], "references": [ { "url": "http://www.debian.org/security/2017/dsa-3766", "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ] }, { "url": "http://www.mapserver.org/development/changelog/changelog-6-0-6.html#changelog-6-0-6", "source": "cve@mitre.org", "tags": [ "Release Notes" ] }, { "url": "http://www.mapserver.org/development/changelog/changelog-6-2-4.html#changelog-6-2-4", "source": "cve@mitre.org", "tags": [ "Release Notes" ] }, { "url": "http://www.mapserver.org/development/changelog/changelog-6-4.html#changelog-6-4-5", "source": "cve@mitre.org", "tags": [ "Release Notes" ] }, { "url": "http://www.mapserver.org/development/changelog/changelog-7-0.html#changelog-7-0-4", "source": "cve@mitre.org", "tags": [ "Release Notes" ] }, { "url": "https://github.com/mapserver/mapserver/commit/e52a436c0e1c5e9f7ef13428dba83194a800f4df", "source": "cve@mitre.org", "tags": [ "Patch", "Third Party Advisory" ] }, { "url": "https://lists.osgeo.org/pipermail/mapserver-dev/2017-January/015007.html", "source": "cve@mitre.org", "tags": [ "Mailing List", "Third Party Advisory" ] } ] }