CVE-2017-2779
HIGHLabVIEW 2014-2017 - Out-of-bounds Write in RSRC Segment Parsing
Title source: llmDescription
An exploitable memory corruption vulnerability exists in the RSRC segment parsing functionality of LabVIEW 2017, LabVIEW 2016, LabVIEW 2015, and LabVIEW 2014. A specially crafted Virtual Instrument (VI) file can cause an attacker controlled looping condition resulting in an arbitrary null write. An attacker controlled VI file can be used to trigger this vulnerability and can potentially result in code execution.
References (4)
Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/100519
Exploit, Patch, Third Party Advisory x_refsource_misc
https://0patch.blogspot.com/2017/09/0patching-rsrc-arbitrary-null-write.html
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0273
Mitigation, Vendor Advisory x_refsource_confirm
http://www.ni.com/product-documentation/54099/en/
Scores
CVSS v3
7.5
EPSS
0.0217
EPSS Percentile
80.2%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-787
Status
published
Products (5)
National Instruments/LabVIEW 2016
16.0
ni/labview
2014
ni/labview
2015
ni/labview
2016
ni/labview
2017
Published
Sep 05, 2017
Tracked Since
Feb 18, 2026