Ubuntu.comUB:CVE-2017-8804CVE-2017-8804
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.8 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
0.01 Low
EPSS
Percentile
83.4%
DISPUTED The xdr_bytes and xdr_string functions in the GNU C Library
(aka glibc or libc6) 2.25 mishandle failures of buffer deserialization,
which allows remote attackers to cause a denial of service (virtual memory
allocation, or memory consumption if an overcommit setting is not used) via
a crafted UDP packet to port 111, a related issue to CVE-2017-8779. NOTE:
[Information provided from upstream and references]
Bugs
- <https://sourceware.org/bugzilla/show_bug.cgi?id=21461>
- <https://bugzilla.suse.com/show_bug.cgi?id=1037559#c7>
- <https://bugzilla.suse.com/show_bug.cgi?id=1037930>
- <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=862086>
Notes
| Author | Note |
|---|---|
| sbeattie | disputed by glibc upstream, assertion is that it’s an application failure, see CVE-2017-8779 rpc implementations affected |
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.8 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
0.01 Low
EPSS
Percentile
83.4%