CVE-2017-5789

CRITICAL

HPE LoadRunner and Performance Center < 12.53 - Remote Code Execution via mxdr_string Heap Overflow

Title source: llm

Description

HPE LoadRunner before 12.53 Patch 4 and HPE Performance Center before 12.53 Patch 4 allow remote attackers to execute arbitrary code via unspecified vectors. At least in LoadRunner, this is a libxdrutil.dll mxdr_string heap-based buffer overflow.

References (7)

Core 7

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/101224

Third Party Advisory x_refsource_misc

https://www.tenable.com/security/research/tra-2017-13

Third Party Advisory, VDB Entry x_refsource_misc

http://www.zerodayinitiative.com/advisories/ZDI-17-160/

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1038029

Vendor Advisory x_refsource_confirm

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03712en_us

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/96774

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1038028

Scores

CVSS v3 9.8

EPSS 0.3385

EPSS Percentile 97.0%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-119

Status published

Products (3)

hp/loadrunner < 12.53

hp/performance_center < 12.53

n/a/HPE LoadRunner and Performance Center HPE LoadRunner and Performance Center

Published Oct 11, 2017

Tracked Since Feb 18, 2026