CVE-2017-3893

In BlackBerry QNX Software Development Platform (SDP) 6.6.0, the default configuration of the QNX SDP system did not in all circumstances prevent attackers from modifying the GOT or PLT tables with buffer overflow attacks.

CVSS v3 1.9 LOW
CVSS v2.0 6.4 MEDIUM

1.9^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.5 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:P

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://support.blackberry.com/kb/articleDetail?articleNumber=000046674	Vendor Advisory
http://support.blackberry.com/kb/articleDetail?articleNumber=000046674	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:blackberry:qnx_software_development_platform:6.6.0:*:*:*:*:*:*:*

History

22 Jul 2025, 16:15

Type	Values Removed	Values Added
CVSS	v2 : ~~6.4~~ v3 : ~~7.5~~	v2 : 6.4 v3 : 1.9
CWE		CWE-693

Information

Published : 2017-11-14 21:29

Updated : 2025-07-22 16:15

NVD link : CVE-2017-3893

Mitre link : CVE-2017-3893

CVE.ORG link : CVE-2017-3893

JSON object : View

Products Affected

blackberry

qnx_software_development_platform

CWE

CWE-693

Protection Mechanism Failure

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

{"id": "CVE-2017-3893", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Secondary", "source": "secure@blackberry.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 1.9, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 0.5}]}, "published": "2017-11-14T21:29:00.747", "references": [{"url": "http://support.blackberry.com/kb/articleDetail?articleNumber=000046674", "tags": ["Vendor Advisory"], "source": "secure@blackberry.com"}, {"url": "http://support.blackberry.com/kb/articleDetail?articleNumber=000046674", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "secure@blackberry.com", "description": [{"lang": "en", "value": "CWE-693"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-119"}]}], "descriptions": [{"lang": "en", "value": "In BlackBerry QNX Software Development Platform (SDP) 6.6.0, the default configuration of the QNX SDP system did not in all circumstances prevent attackers from modifying the GOT or PLT tables with buffer overflow attacks."}, {"lang": "es", "value": "En BlackBerry QNX Software Development Platform (SDP) 6.6.0, la configuraci\u00f3n por defecto del sistema QNX SDP no evitaba en todas las circunstancias que los atacantes modificase las tablas GOT o PLT con ataques de desbordamiento de b\u00fafer."}], "lastModified": "2025-07-22T16:15:24.910", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:blackberry:qnx_software_development_platform:6.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF1D7FB0-C40B-4DD6-B3C5-D90FBCCBAF23"}], "operator": "OR"}]}], "sourceIdentifier": "secure@blackberry.com"}