CVE-2017-6952

HIGH8.8EPSS 0.35%

Capstone Integer overflow

Published: 5/17/2022Modified: 11/21/2024

Also known as:GHSA-3v99-hpv7-9hh9PYSEC-2017-113

Description

Integer overflow in the cs_winkernel_malloc function in winkernel_mm.c in Capstone 3.0.4 and earlier allows attackers to cause a denial of service (heap-based buffer overflow in a kernel driver) or possibly have unspecified other impact via a large value.

Affected packages (2)

PyPI/capstonefrom 0, < 3.0.5rc2
PyPI/capstonefrom 0, < 6fe86eef621b9849f51a5e1e5d73258a93440403 | from 0, < 3.0.5rc2

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References (5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2017-6952
PATCHhttps://github.com/capstone-engine/capstone
WEBhttps://github.com/aquynh/capstone/commit/6fe86eef621b9849f51a5e1e5d73258a93440403
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/capstone/PYSEC-2017-113.yaml
WEBhttp://www.securityfocus.com/bid/97323