CVE-2017-7555: Buffer Overflow
Augeas versions up to and including 1.8.0 are vulnerable to heap-based buffer overflow due to improper handling of escaped strings. Attacker could send crafted strings that would cause the application using augeas to copy past the end of a buffer, leading to a crash or possible code execution.
Other sources
It was found that augeas does incorrect escaping in augescapename() function causing denial-of-service.
Product bug:
https://bugzilla.redhat.com/showbug.cgi?id=1475621
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7555?
CVE-2017-7555 is classified as a high severity vulnerability due to its potential for code execution and application crashes.
How do I fix CVE-2017-7555?
To fix CVE-2017-7555, upgrade Augeas to version 1.8.1 or later.
What types of systems are affected by CVE-2017-7555?
CVE-2017-7555 affects Augeas versions up to and including 1.8.0.
Can CVE-2017-7555 lead to remote code execution?
Yes, CVE-2017-7555 can potentially allow an attacker to execute arbitrary code remotely.
What causes the vulnerability in CVE-2017-7555?
CVE-2017-7555 is caused by a heap-based buffer overflow due to improper handling of escaped strings.