CVE-2017-2885

An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
talosCNA
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 92%
VendorProductVersion
gnomelibsoup
2.58
debiandebian_linux
8.0
debiandebian_linux
9.0
redhatenterprise_linux_desktop
7.0
redhatenterprise_linux_server
7.0
redhatenterprise_linux_server_aus
7.4
redhatenterprise_linux_server_eus
7.4
redhatenterprise_linux_server_eus
7.5
redhatenterprise_linux_server_tus
7.4
redhatenterprise_linux_workstation
7.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libsoup2.4
bullseye
2.72.0-2
fixed
wheezy
not-affected
bookworm
2.74.3-1
fixed
sid
2.74.3-8
fixed
trixie
2.74.3-8
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libsoup2.4
zesty
Fixed 2.56.0-2ubuntu0.1
released
xenial
Fixed 2.52.2-1ubuntu0.2
released
trusty
Fixed 2.44.2-1ubuntu2.2
released
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/160388/ProCaster-LE-32F430-GStreamer-souphttpsrc-libsoup-2.51.3-Stack-Overflow.html
http://seclists.org/fulldisclosure/2020/Dec/3
http://www.securityfocus.com/bid/100258
https://access.redhat.com/errata/RHSA-2017:2459
https://www.debian.org/security/2017/dsa-3929
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0392
http://packetstormsecurity.com/files/160388/ProCaster-LE-32F430-GStreamer-souphttpsrc-libsoup-2.51.3-Stack-Overflow.html
http://seclists.org/fulldisclosure/2020/Dec/3
http://www.securityfocus.com/bid/100258
https://access.redhat.com/errata/RHSA-2017:2459
https://www.debian.org/security/2017/dsa-3929
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0392