Cloudanix VulnDB

CVE-2017-9765

High · 8.1

CVSS

8.1

EPSS

42.1%

Published

Jul 20, 2017

CISA due date

—

The record

Integer overflow in the soap_get function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48, as used on Axis cameras and other devices, allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow and application crash) via a large XML document, aka Devil's Ivy. NOTE: the large document would be blocked by many common web-server configurations on general-purpose computers.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 gsoap 0 2.8.48-1
Debian:11 r-other-x4r 0 1.0.1+git20150806.c6bd9bd-2
Debian:12 gsoap 0 2.8.48-1
Debian:12 r-other-x4r 0 1.0.1+git20150806.c6bd9bd-2
Debian:13 gsoap 0 2.8.48-1
Debian:13 r-other-x4r 0 1.0.1+git20150806.c6bd9bd-2
Debian:14 gsoap 0 2.8.48-1
Debian:14 r-other-x4r 0 1.0.1+git20150806.c6bd9bd-2
Debian:7 gsoap 0 2.8.7-2+deb7u1
Mageia:5 gsoap 0 2.8.49-1.mga5
Mageia:6 gsoap 0 2.8.49-1.mga6
Ubuntu:16.04:LTS gsoap 0 No fix
Ubuntu:18.04:LTS gsoap 0 2.8.60-2build1
Ubuntu:Pro:16.04:LTS gsoap 0 No fix
openSUSE:Tumbleweed gsoap 0 2.8.117-1.2

Related vulnerabilities