CVE-2017-2891

EUVD-2017-12032
An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. An ordinary HTTP POST request with a CGI target can cause a reuse of previously freed pointer potentially resulting in remote code execution. An attacker needs to send this HTTP request over the network to trigger this vulnerability.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
talosCNA
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 86%
Affected Products (NVD)
VendorProductVersion
cesantamongoose
6.8
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
smplayer
bookworm
22.7.0~ds0-1
fixed
bullseye
20.6.0~ds0-1
fixed
jessie
not-affected
sid
24.5.0+ds-1
fixed
stretch
not-affected
trixie
24.5.0+ds-1
fixed
wheezy
not-affected
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
smplayer
artful
not-affected
trusty
dne
xenial
not-affected
zesty
not-affected
Common Weakness Enumeration
References
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0398
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0398