CVE search · CVE-2017-8807
CVE-2017-8807
critical 9.1
vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to obtain sensitive information from process memory because a VFP_GetStorage buffer is larger than intended in certain circumstances involving -sfile Stevedore transient objects.
Details
- Status
- Modified
- Published
- Last changed
- Source
- security@debian.org
- Weakness
- CWE-119
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | critical 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
nvd@nist.govPrimary |
| CVSS 2.0 | medium 6.4 | AV:N/AC:L/Au:N/C:P/I:N/A:P |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- varnish-cache · varnish
- varnish_cache_project · varnish_cache
- debian · debian_linux
References
- http://varnish-cache.org/security/VSV00002.htmlPatchVendor Advisory
- http://www.securityfocus.com/bid/101886Third Party AdvisoryVDB Entry
- https://bugs.debian.org/881808Issue TrackingThird Party Advisory
- https://github.com/varnishcache/varnish-cache/commit/176f8a075a963ffbfa56f1c460c15f6a1a6af5a7PatchVendor Advisory
- https://github.com/varnishcache/varnish-cache/pull/2429Issue TrackingVendor Advisory
- https://www.debian.org/security/2017/dsa-4034Third Party Advisory
- http://varnish-cache.org/security/VSV00002.htmlPatchVendor Advisory
- http://www.securityfocus.com/bid/101886Third Party AdvisoryVDB Entry
- https://bugs.debian.org/881808Issue TrackingThird Party Advisory
- https://github.com/varnishcache/varnish-cache/commit/176f8a075a963ffbfa56f1c460c15f6a1a6af5a7PatchVendor Advisory
- https://github.com/varnishcache/varnish-cache/pull/2429Issue TrackingVendor Advisory
- https://www.debian.org/security/2017/dsa-4034Third Party Advisory