CVE-2017-10671

HIGH

sthttpd < 2.27.1 - Heap-based Buffer Overflow in de_dotdot Function

Title source: llm
STIX 2.1

Description

Heap-based Buffer Overflow in the de_dotdot function in libhttpd.c in sthttpd before 2.27.1 allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a crafted filename.

References (3)

Core 3
Core References
Mailing List, Patch, Third Party Advisory x_refsource_misc
http://www.openwall.com/lists/oss-security/2017/06/15/9
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://github.com/blueness/sthttpd/releases/tag/v2.27.1

Scores

CVSS v3 7.8
EPSS 0.0152
EPSS Percentile 71.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (1)
sthttpd_project/sthttpd < 2.27.1
Published Jun 29, 2017
Tracked Since Feb 18, 2026