CVE-2017-8807: Buffer Overflow
vbfstperror in bin/varnishd/cache/cachefetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to obtain sensitive information from process memory because a VFPGetStorage buffer is larger than intended in certain circumstances involving -sfile Stevedore transient objects.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2017-8807?
CVE-2017-8807 is a vulnerability in Varnish HTTP Cache that allows remote attackers to obtain sensitive information from process memory.
How does CVE-2017-8807 work?
CVE-2017-8807 works by exploiting a larger buffer than intended in certain circumstances involving Stevedore tran..
What is the severity of CVE-2017-8807?
The severity of CVE-2017-8807 is critical, with a severity value of 9.1.
Which software versions are affected by CVE-2017-8807?
Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1, as well as certain versions of Debian Debian Linux and Microsoft .NET 6.0 are affected by CVE-2017-8807.
How can I fix CVE-2017-8807?
To fix CVE-2017-8807, update Varnish HTTP Cache to version 4.1.9 or higher for 4.1.x, or version 5.2.1 or higher for 5.x. If using Debian Debian Linux or Microsoft .NET 6.0, apply the relevant security patches.