CVE-2017-14228: Null Pointer Dereference
In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in the function pastetokens() in preproc.c, aka a NULL pointer dereference. It will lead to remote denial of service.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2017-14228.
What is the severity of CVE-2017-14228?
The severity of CVE-2017-14228 is medium with a severity value of 5.5.
How does the vulnerability in NASM 2.14rc0 manifest?
The vulnerability in NASM 2.14rc0 manifests as an illegal address access in the function paste_tokens() in preproc.c, leading to a NULL pointer dereference and remote denial of service.
Which software versions are affected by CVE-2017-14228?
The affected software versions are NASM 2.14-1, 2.15.05-1, 2.16.01-1, and NASM 2.14rc0 from the Netwide Assembler package in Debian. Additionally, NASM 2.13.01-2ubuntu0.1 in Ubuntu Artful, NASM 2.10.09-1ubuntu0.1 in Ubuntu Trusty, NASM 2.11.08-1ubuntu0.1 in Ubuntu Xenial, and NASM 2.14-rc0 from Nasm Netwide Assembler are also affected.
How can the vulnerability in NASM 2.14rc0 be fixed?
To fix the vulnerability in NASM 2.14rc0, update to NASM version 2.14-1, 2.15.05-1, or 2.16.01-1 for Debian users. For Ubuntu users, update to NASM version 2.13.01-2ubuntu0.1 in Artful, 2.10.09-1ubuntu0.1 in Trusty, or 2.11.08-1ubuntu0.1 in Xenial. Nasm Netwide Assembler users should update to version 2.14-rc0.