CVE-2017-5357 Use after free in n/a
Attackers can cause a denial of service via a crash in GNU ed triggered by an invalid free when processing malformed commands.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-5357?
CVE-2017-5357 is a high-severity use after free vulnerability in Fedoraproject Fedora, published on 16 Feb 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
regex.c in GNU ed before 1.14.1 allows attackers to cause a denial of service (crash) via a malformed command, which triggers an invalid free.
Weakness: CWE-416
Which versions are affected by CVE-2017-5357?
It affects 2 products.
Linux distribution packages (6)
ed SUSE:Linux Enterprise Server 11 SP4 | All versions | 0.2-1001.30.3.4 |
ed SUSE:Linux Enterprise Server 12 SP4 | All versions | 1.9-4.4.5 |
ed SUSE:Linux Enterprise Server 12 SP5 | All versions | 1.9-4.4.5 |
ed SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | All versions | 0.2-1001.30.3.4 |
ed SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 1.9-4.4.5 |
ed SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 1.9-4.4.5 |
Products include Fedoraproject Fedora, Gnu Ed.
How do I fix CVE-2017-5357?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2017-5357 being exploited?
There is no known exploitation of CVE-2017-5357 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as GHSA-3vq6-cwx3-x994, SUSE-SU-2019:14005-1, SUSE-SU-2020:1608-1.