CVE-2017-18359: debian debian_linux Improper Input Validation
Vulnerability summary
CVE-2017-18359 is a high (CVSS 7.5) Improper Input Validation vulnerability in debian debian_linux. EPSS estimates a 3.05% chance of exploitation in the next 30 days, higher than 87.3% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 25-01-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
PostGIS 2.x before 2.3.3, as used with PostgreSQL, allows remote attackers to cause a denial of service via crafted ST_AsX3D function input, as demonstrated by an abnormal server termination for "SELECT ST_AsX3D('LINESTRING EMPTY');" because empty geometries are mishandled.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
3.05%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
0.00 pp
From 3.05% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (trac.osgeo.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian2 products
- postgis< 2.3.3+dfsg-1 | < 2.3.1+dfsg-2+deb9u1 | < 2.1.4+dfsg-3+deb8u1
- debian_linuxEOL8.0 | 9.0
Opensuse1 product
- librttopo&distro=openSUSE Leap 15.4< 1.1.0-bp154.2.3.1
Postgis1 product
- postgis≥ 2.0.0, < 2.3.3
Suse1 product
- librttopo&distro=SUSE Package Hub 15 SP4< 1.1.0-bp154.2.3.1
Ubuntu1 product
- postgis< 2.1.2+dfsg-2ubuntu0.2 | < 2.2.1+dfsg-2ubuntu0.1
5 vendors · 6 products
References
11 links
lists.debian.org/debian-lts-announce/2019/01/msg00030.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.debian.org/debian-lts-announce/2021/12/msg00020.htmlMailing ListX Refsource MLISTThird Party Advisory
- lists.opensuse.org/archives/…Advisory