CVE-2017-15101 Memory corruption in liblouis
A stack-based buffer overflow in liblouis allows attackers to cause denial of service or execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-15101?
CVE-2017-15101 is a high-severity memory corruption vulnerability in Redhat Enterprise Linux Desktop, published on 27 Jul 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A missing patch for a stack-based buffer overflow in findTable() was found in Red Hat version of liblouis before 2.5.4. An attacker could cause a denial of service condition or potentially even arbitrary code execution.
Which versions are affected by CVE-2017-15101?
It affects 6 products.
Linux distribution packages (18)
liblouis Red Hat:enterprise_linux:7::client | All versions | 0:2.5.2-12.el7_4 |
liblouis-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:2.5.2-12.el7_4 |
liblouis-devel Red Hat:enterprise_linux:7::client | All versions | 0:2.5.2-12.el7_4 |
liblouis-doc Red Hat:enterprise_linux:7::client | All versions | 0:2.5.2-12.el7_4 |
liblouis-python Red Hat:enterprise_linux:7::client | All versions | 0:2.5.2-12.el7_4 |
liblouis-utils Red Hat:enterprise_linux:7::client | All versions | 0:2.5.2-12.el7_4 |
liblouis Red Hat:enterprise_linux:7::server | All versions | 0:2.5.2-12.el7_4 |
liblouis-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:2.5.2-12.el7_4 |
liblouis-devel Red Hat:enterprise_linux:7::server | All versions | 0:2.5.2-12.el7_4 |
liblouis-doc Red Hat:enterprise_linux:7::server | All versions | 0:2.5.2-12.el7_4 |
liblouis-python Red Hat:enterprise_linux:7::server | All versions | 0:2.5.2-12.el7_4 |
liblouis-utils Red Hat:enterprise_linux:7::server | All versions | 0:2.5.2-12.el7_4 |
liblouis Red Hat:enterprise_linux:7::workstation | All versions | 0:2.5.2-12.el7_4 |
liblouis-debuginfo Red Hat:enterprise_linux:7::workstation | All versions | 0:2.5.2-12.el7_4 |
liblouis-devel Red Hat:enterprise_linux:7::workstation | All versions | 0:2.5.2-12.el7_4 |
liblouis-doc Red Hat:enterprise_linux:7::workstation | All versions | 0:2.5.2-12.el7_4 |
liblouis-python Red Hat:enterprise_linux:7::workstation | All versions | 0:2.5.2-12.el7_4 |
liblouis-utils Red Hat:enterprise_linux:7::workstation | All versions | 0:2.5.2-12.el7_4 |
Products include Liblouis Liblouis, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus, Redhat Enterprise Linux Server Eus, Redhat Enterprise Linux Workstation.
How do I fix CVE-2017-15101?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2017-15101 being exploited?
There is no known exploitation of CVE-2017-15101 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux Desktop
Sources
Also known as GHSA-hxf5-6w8g-jf87, RHSA-2017:3384, UBUNTU-CVE-2017-15101.