CVE-2017-7476 Memory corruption in Gnulib before 2017-04-26
A heap-based buffer overflow in Gnulib's time handling allows attackers to execute arbitrary code or cause denial of service via the TZ environment variable.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-7476?
CVE-2017-7476 is a critical memory corruption vulnerability in Gnulib before 2017-04-26, published on 2 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Gnulib before 2017-04-26 has a heap-based buffer overflow with the TZ environment variable. The error is in the save_abbr function in time_rz.c.
Weakness: CWE-119
Which versions are affected by CVE-2017-7476?
It affects 1 product.
Linux distribution packages (1)
coreutils openSUSE:Tumbleweed | All versions | 8.32-8.5 |
Products include Gnulib Gnulib.
How do I fix CVE-2017-7476?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2017-7476 being exploited?
There is no known exploitation of CVE-2017-7476 in the wild and no public exploit code.
Sources
Also known as GHSA-m9rq-c483-gg38, openSUSE-SU-2024:10694-1.