CVE-2017-1000376
High
Description
libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note that libffi is used by a number of other libraries. It was previously stated that this affects libffi version 3.2.1 but this appears to be incorrect. libffi prior to version 3.1 on 32 bit x86 systems was vulnerable, and upstream is believed to have fixed this issue in version 3.1.
SeverityHigh
CVSS7.0
Exploit probability—
Product
Libffi
PublishedJun 19, 2017
First seenJun 19, 2017
How to fix
Update
- libffi_project libffi3.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| libffi_project libffi | v < 3.2 | 3.2 |
| redhat enterprise_virtualization_server | No range specified | — |
| redhat openshift | 2.0 | — |
| redhat enterprise_linux | 6.0, 7.0 | — |
| debian debian_linux | 8.0, 9.0 | — |
| oracle peopletools | 8.56, 8.57 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.