CVE-2017-18359: Input Validation

Q: What is the severity of CVE-2017-18359?

The severity of CVE-2017-18359 is rated as high with a CVSS score of 7.5.

Q: What type of vulnerability is CVE-2017-18359?

CVE-2017-18359 is a denial of service vulnerability that affects PostGIS.

Q: How does CVE-2017-18359 impact users?

CVE-2017-18359 allows remote attackers to cause a denial of service by inputting crafted ST_AsX3D function data.

Q: How do I fix CVE-2017-18359?

CVE-2017-18359 can be fixed by applying the available patch to update PostGIS to version 2.3.3 or later.

Q: Which software does CVE-2017-18359 affect?

CVE-2017-18359 affects PostGIS versions 2.x before 2.3.3 when used with PostgreSQL on Debian Linux.

Published Jan 25, 2019

Updated

PostGIS 2.x before 2.3.3, as used with PostgreSQL, allows remote attackers to cause a denial of service via crafted STAsX3D function input, as demonstrated by an abnormal server termination for "SELECT STAsX3D('LINESTRING EMPTY');" because empty geometries are mishandled.

Affected Software

3 affected components

PostGIS Postgis Postgresql>=2.0.0<2.3.3

Debian Debian Linux=8.0

Debian Debian Linux=9.0

Remediation

Patch Available

https://trac.osgeo.org/postgis/changeset/15444

Patch Available

https://trac.osgeo.org/postgis/changeset/15445

Event History

Jan 25, 2019

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2017-18359?

The severity of CVE-2017-18359 is rated as high with a CVSS score of 7.5.

What type of vulnerability is CVE-2017-18359?

CVE-2017-18359 is a denial of service vulnerability that affects PostGIS.

How does CVE-2017-18359 impact users?

CVE-2017-18359 allows remote attackers to cause a denial of service by inputting crafted ST_AsX3D function data.

How do I fix CVE-2017-18359?

CVE-2017-18359 can be fixed by applying the available patch to update PostGIS to version 2.3.3 or later.

Which software does CVE-2017-18359 affect?

CVE-2017-18359 affects PostGIS versions 2.x before 2.3.3 when used with PostgreSQL on Debian Linux.

CVE-2017-18359: Input Validation

Affected Software

Remediation

Patch Available

Patch Available

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2017-18359?

What type of vulnerability is CVE-2017-18359?

How does CVE-2017-18359 impact users?

How do I fix CVE-2017-18359?

Which software does CVE-2017-18359 affect?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2017-18359?

What type of vulnerability is CVE-2017-18359?

How does CVE-2017-18359 impact users?

How do I fix CVE-2017-18359?

Which software does CVE-2017-18359 affect?