CVE-2017-17819: Null Pointer Dereference
In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in the function findcc() in asm/preproc.c that will cause a remote denial of service attack, because pointers associated with skipwhite calls are not validated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/nasmto a version that resolves this vulnerability.Fixed in 2.15.05-1Fixed in 2.16.01-1Fixed in 2.16.03-1Fixed in 3.01-1 - Upgrade
Upgrade
Netwide Assembler (NASM)to a version that resolves this vulnerability.Fixed in 2.14rc0
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2017-17819.
What is the severity level of CVE-2017-17819?
The severity level of CVE-2017-17819 is medium, with a severity value of 5.5.
Which function is affected by CVE-2017-17819?
The function find_cc() in asm/preproc.c is affected by CVE-2017-17819.
How can the vulnerability in Netwide Assembler (NASM) 2.14rc0 be exploited?
The vulnerability in Netwide Assembler (NASM) 2.14rc0 can be exploited by causing a remote denial of service attack through an illegal address access in the function find_cc().
Are there any known fixes for the vulnerability in Netwide Assembler (NASM) 2.14rc0?
Yes, there are fixes available. For Ubuntu, the version 2.13.02 is a known fix. For Debian, versions 2.14-1, 2.15.05-1, and 2.16.01-1 are known fixes.