Vulnerability Description
libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note that libffi is used by a number of other libraries. It was previously stated that this affects libffi version 3.2.1 but this appears to be incorrect. libffi prior to version 3.1 on 32 bit x86 systems was vulnerable, and upstream is believed to have fixed this issue in version 3.1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Enterprise Virtualization Server | - |
| Redhat | Openshift | 2.0 |
| Redhat | Enterprise Linux | 6.0 |
| Debian | Debian Linux | 8.0 |
| Libffi Project | Libffi | < 3.2 |
| Oracle | Peopletools | 8.56 |
Related Weaknesses (CWE)
References
- http://www.debian.org/security/2017/dsa-3889Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2017-1000376Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2020.htmlThird Party Advisory
- https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txtMailing ListThird Party Advisory
- http://www.debian.org/security/2017/dsa-3889Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2017-1000376Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2020.htmlThird Party Advisory
- https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txtMailing ListThird Party Advisory
FAQ
What is CVE-2017-1000376?
CVE-2017-1000376 is a vulnerability with a CVSS score of 7.0 (HIGH). libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note that libffi is used by a number of other libraries. It was ...
How severe is CVE-2017-1000376?
CVE-2017-1000376 has been rated HIGH with a CVSS base score of 7.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-1000376?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Enterprise Virtualization Server, Redhat Openshift, Redhat Enterprise Linux, Debian Debian Linux, Libffi Project Libffi.