p PatchFirst

CVE-2017-2895

CVE-2017-2895

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.

CVSS 8.2 · High · EPSS 1.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • mongoose

    Versions
    • 6.8: Affected

    No fix published

  • smplayer Debian:12

    Affected ranges
    • ECOSYSTEM: < 18.5.0~ds1-1

    Update to 18.5.0~ds1-1

  • smplayer Debian:13

    Affected ranges
    • ECOSYSTEM: < 18.5.0~ds1-1

    Update to 18.5.0~ds1-1

  • smplayer Debian:14

    Affected ranges
    • ECOSYSTEM: < 18.5.0~ds1-1

    Update to 18.5.0~ds1-1

Original sources

Check your server →