CVE-2017-18359: Input Validation
Published Jan 25, 2019
·Updated
PostGIS 2.x before 2.3.3, as used with PostgreSQL, allows remote attackers to cause a denial of service via crafted STAsX3D function input, as demonstrated by an abnormal server termination for "SELECT STAsX3D('LINESTRING EMPTY');" because empty geometries are mishandled.
Affected Software
3 affected components
PostGIS Postgis Postgresql>=2.0.0<2.3.3
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Remediation
Patch Available
Patch Available
Event History
Jan 25, 2019
CVE Published
via MITRE·05:00 AM
Data Sourced
via MITRE·05:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-18359?
The severity of CVE-2017-18359 is rated as high with a CVSS score of 7.5.
2
What type of vulnerability is CVE-2017-18359?
CVE-2017-18359 is a denial of service vulnerability that affects PostGIS.
3
How does CVE-2017-18359 impact users?
CVE-2017-18359 allows remote attackers to cause a denial of service by inputting crafted ST_AsX3D function data.
4
How do I fix CVE-2017-18359?
CVE-2017-18359 can be fixed by applying the available patch to update PostGIS to version 2.3.3 or later.
5
Which software does CVE-2017-18359 affect?
CVE-2017-18359 affects PostGIS versions 2.x before 2.3.3 when used with PostgreSQL on Debian Linux.