CVE-2017-2885

CRITICAL

libsoup 2.58 - Stack-based Buffer Overflow via HTTP Request

Title source: llm
STIX 2.1

Description

An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability.

References (6)

Core 6
Core References
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2017:2459
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2017/dsa-3929
Broken Link vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/100258
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2020/Dec/3
Exploit, Technical Description, Third Party Advisory x_refsource_misc
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0392

Scores

CVSS v3 9.8
EPSS 0.0581
EPSS Percentile 90.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (10)
debian/debian_linux 8.0
debian/debian_linux 9.0
gnome/libsoup 2.58
redhat/enterprise_linux_desktop 7.0
redhat/enterprise_linux_server 7.0
redhat/enterprise_linux_server_aus 7.4
redhat/enterprise_linux_server_eus 7.4
redhat/enterprise_linux_server_eus 7.5
redhat/enterprise_linux_server_tus 7.4
redhat/enterprise_linux_workstation 7.0
Published Apr 24, 2018
Tracked Since Feb 18, 2026