CVE-2017-5522

{"id": "CVE-2017-5522", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2017-03-15T16:59:00.283", "references": [{"url": "http://www.debian.org/security/2017/dsa-3766", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.mapserver.org/development/changelog/changelog-6-0-6.html#changelog-6-0-6", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "http://www.mapserver.org/development/changelog/changelog-6-2-4.html#changelog-6-2-4", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "http://www.mapserver.org/development/changelog/changelog-6-4.html#changelog-6-4-5", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "http://www.mapserver.org/development/changelog/changelog-7-0.html#changelog-7-0-4", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://github.com/mapserver/mapserver/commit/e52a436c0e1c5e9f7ef13428dba83194a800f4df", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://lists.osgeo.org/pipermail/mapserver-dev/2017-January/015007.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.debian.org/security/2017/dsa-3766", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.mapserver.org/development/changelog/changelog-6-0-6.html#changelog-6-0-6", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.mapserver.org/development/changelog/changelog-6-2-4.html#changelog-6-2-4", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.mapserver.org/development/changelog/changelog-6-4.html#changelog-6-4-5", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.mapserver.org/development/changelog/changelog-7-0.html#changelog-7-0-4", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/mapserver/mapserver/commit/e52a436c0e1c5e9f7ef13428dba83194a800f4df", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.osgeo.org/pipermail/mapserver-dev/2017-January/015007.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-119"}]}], "descriptions": [{"lang": "en", "value": "Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving WFS get feature requests."}, {"lang": "es", "value": "Desbordamiento de b\u00fafer basado en pila en MapServer en versiones anteriores a 6.0.6, 6.2.x en versiones anteriores a 6.2.4, 6.4.x en versiones anteriores a 6.4.5 y 7.0.x en versiones anteriores a 7.0.4 permite a atacantes remotos provocar una denegaci\u00f3n de servicio (ca\u00edda) o ejecutar c\u00f3digo arbitrario a trav\u00e9s de vectores que implican solicitudes WFS de obtenci\u00f3n de funci\u00f3n."}], "lastModified": "2025-04-20T01:37:25.860", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:osgeo:mapserver:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2616104A-15A1-4EE2-B422-F0A0956029B1", "versionEndIncluding": "6.0.5"}, {"criteria": "cpe:2.3:a:osgeo:mapserver:6.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16A7F401-1829-440B-A7D0-08515F73E11A"}, {"criteria": "cpe:2.3:a:osgeo:mapserver:6.2.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EC09B39C-A41A-4024-A5CE-1D8FDFB9C67C"}, {"criteria": "cpe:2.3:a:osgeo:mapserver:6.2.0:beta2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E25092AC-76DD-495D-9FB6-A6D76A08464D"}, {"criteria": "cpe:2.3:a:osgeo:mapserver:6.2.0:beta3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C738E019-D602-4E5C-8FB3-64CC5F11EF83"}, {"criteria": "cpe:2.3:a:osgeo:mapserver:6.2.0:beta4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FFD649DB-1FE8-4973-B329-107A89FD6799"}, {"criteria": "cpe:2.3:a:osgeo:mapserver:6.2.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4E6833DE-045A-4458-A067-CCFA3A8CE016"}, {"criteria": "cpe:2.3:a:osgeo:mapserver:6.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C6A01342-B989-4134-8692-8BD8A42B93D2"}, {"criteria": "cpe:2.3:a:osgeo:mapserver:6.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F52DB9E8-C9B0-4513-B181-05A98404C04F"}, {"criteria": "cpe:2.3:a:osgeo:mapserver:6.2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC5EA648-9431-45F1-93FE-2D60C08634B6"}, {"criteria": "cpe:2.3:a:osgeo:mapserver:6.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "995FF868-DD52-4625-AD2E-74BB63F4BC72"}, {"criteria": "cpe:2.3:a:osgeo:mapserver:6.4.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CA6FB628-5D34-46DF-BF7F-5D277A51F9F0"}, {"criteria": "cpe:2.3:a:osgeo:mapserver:6.4.0:beta2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2EC08735-4E07-45F2-AE1B-56F6B9291FE8"}, {"criteria": "cpe:2.3:a:osgeo:mapserver:6.4.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5BB85B09-03A4-4296-8CDC-40338C7F92EA"}, {"criteria": "cpe:2.3:a:osgeo:mapserver:6.4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A9D9693-6F02-4F21-AD59-A0AEA73D6374"}, {"criteria": "cpe:2.3:a:osgeo:mapserver:6.4.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B8EA460-06CF-4175-999C-5C98E9B0DC78"}, {"criteria": "cpe:2.3:a:osgeo:mapserver:6.4.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3905DE6B-14D9-45E0-9A95-9EE131691658"}, {"criteria": "cpe:2.3:a:osgeo:mapserver:6.4.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DF6DD7AA-AA71-497E-9BCC-7CDD450EA7B7"}, {"criteria": "cpe:2.3:a:osgeo:mapserver:7.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "251BBE27-A977-4725-AFCA-22CF96CBD965"}, {"criteria": "cpe:2.3:a:osgeo:mapserver:7.0.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FB1C2F87-63A3-4D2C-AB84-B7C319058572"}, {"criteria": "cpe:2.3:a:osgeo:mapserver:7.0.0:beta2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "46A22D61-588D-476C-8284-EEE3EDC53EBF"}, {"criteria": "cpe:2.3:a:osgeo:mapserver:7.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BE7043E9-2FE4-441D-AF8E-139AF97387CA"}, {"criteria": "cpe:2.3:a:osgeo:mapserver:7.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "131EA02D-E121-4BED-9381-688A2ED16595"}, {"criteria": "cpe:2.3:a:osgeo:mapserver:7.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C53903F5-D572-4CDA-BEC3-EAA5FDBB5A2C"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}