CVE-2017-6952

HIGH8.8EPSS 0.35%

Capstone Integer overflow

發布日:2022/5/17修改日:2024/11/21

也稱為:GHSA-3v99-hpv7-9hh9PYSEC-2017-113

描述

Integer overflow in the cs_winkernel_malloc function in winkernel_mm.c in Capstone 3.0.4 and earlier allows attackers to cause a denial of service (heap-based buffer overflow in a kernel driver) or possibly have unspecified other impact via a large value.

受影響套件(2)

PyPI/capstonefrom 0, < 3.0.5rc2
PyPI/capstonefrom 0, < 6fe86eef621b9849f51a5e1e5d73258a93440403 | from 0, < 3.0.5rc2

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH8.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

參考連結(5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2017-6952
PATCHhttps://github.com/capstone-engine/capstone
WEBhttps://github.com/aquynh/capstone/commit/6fe86eef621b9849f51a5e1e5d73258a93440403
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/capstone/PYSEC-2017-113.yaml
WEBhttp://www.securityfocus.com/bid/97323