CVE-2017-2893
High · 7.5CVSS
7.5
EPSS
24.9%
Published
Nov 7, 2017
CISA due date
—
The record
An exploitable NULL pointer dereference vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. An MQTT SUBSCRIBE packet can cause a NULL pointer dereference leading to server crash and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | smplayer | 0 | 18.5.0~ds1-1 |
| Debian:12 | smplayer | 0 | 18.5.0~ds1-1 |
| Debian:13 | smplayer | 0 | 18.5.0~ds1-1 |
| Debian:14 | smplayer | 0 | 18.5.0~ds1-1 |
Related vulnerabilities
- CVE-2017-2894 An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing… Also affects smplayer
- CVE-2026-112405 Pillow is a Python imaging library. CWE-476
- CVE-2026-112392 Pillow is a Python imaging library. CWE-476
- CVE-2026-100348 kin-openapi is a Go project for handling OpenAPI files. CWE-476
- CVE-2026-100349 kin-openapi is a Go project for handling OpenAPI files. CWE-476
- CVE-2026-109280 ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx… CWE-476
- CVE-2026-109272 ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the… CWE-476
- CVE-2026-109258 ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the… CWE-476