p PatchFirst

CVE-2017-2891

CVE-2017-2891

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. An ordinary HTTP POST request with a CGI target can cause a reuse of previously freed pointer potentially resulting in remote code execution. An attacker needs to send this HTTP request over the network to trigger this vulnerability.

CVSS 9.8 · Critical · EPSS 2.8% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • mongoose

    Versions
    • 6.8: Affected

    No fix published

  • smplayer Debian:12

    Affected ranges
    • ECOSYSTEM: < 18.5.0~ds1-1

    Update to 18.5.0~ds1-1

  • smplayer Debian:13

    Affected ranges
    • ECOSYSTEM: < 18.5.0~ds1-1

    Update to 18.5.0~ds1-1

  • smplayer Debian:14

    Affected ranges
    • ECOSYSTEM: < 18.5.0~ds1-1

    Update to 18.5.0~ds1-1

Original sources

Check your server →