CVE-2017-1000376

HOCH 7.0CVE-2017-1000376 · Published 19/06/2017 · updated 17/06/2026

Kurz gesagt

CVE-2017-1000376 ist eine Schwachstelle (HOCH (CVSS 7.0)) in libffi (libffi project), peopletools (oracle), openshift (redhat).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.50%, höher als bei 43.1% aller Schwachstellen.
Abhilfe: auf 3.2 oder neuer aktualisieren.

Package	Affected versions	Patched versions
libffi libffi_project	`< 3.2`	`3.2`
peopletools oracle	`= 8.56= 8.57`	No fix yet
openshift redhat	`= 2.0`	No fix yet

Description

libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note that libffi is used by a number of other libraries. It was previously stated that this affects libffi version 3.2.1 but this appears to be incorrect. libffi prior to version 3.1 on 32 bit x86 systems was vulnerable, and upstream is believed to have fixed this issue in version 3.1.

References

debian.org/security/2017/dsa-3889 · Third Party Advisory
access.redhat.com/security/cve/CVE-2017-1000376 · Third Party Advisory
oracle.com/security-alerts/cpujan2020.html · Third Party Advisory
qualys.com/2017/06/19/stack-clash/stack-clash.txt · Mailing List

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free