CVE-2017-18926: debian debian_linux Out-of-bounds Write
CVSS: 7.1v3.1HighModified
AliasesSUSE-SU-2020:3350-1SUSE-SU-2020:3351-1SUSE-SU-2020:3352-1UBUNTU-CVE-2017-18926USN-4630-1DEBIAN-CVE-2017-18926DLA-2438-1DSA-4785-1openSUSE-SU-2020:1949-1openSUSE-SU-2020:1959-1
Published 06-11-2020Last modified 05-08-2024
Vulnerability summary
CVE-2017-18926 is a high (CVSS 7.1) Out-of-bounds Write vulnerability in debian debian_linux. EPSS estimates a 3.12% chance of exploitation in the next 30 days, higher than 87.6% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.1/10
010
High · v3.1 (NVD)EPSS score
3.12%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 06-11-2020PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
raptor_xml_writer_start_element_common in raptor_xml_writer.c in Raptor RDF Syntax Library 2.0.15 miscalculates the maximum nspace declarations for the XML writer, leading to heap-based buffer overflows (sometimes seen in raptor_qname_format_as_xml).
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 7.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Medium 5.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:P/A:PSourcesSingle source
EPSS trend
Probability
3.12%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
0.00 pp
From 3.12% on 20-09-2026
20-09-202620-10-2026
EPSS score3.12%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Suse21 products
- raptor&distro=HPE Helion OpenStack 8< 2.0.15-5.3.1
- raptor&distro=SUSE Enterprise Storage 5< 2.0.15-5.3.1
- raptor&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP1< 2.0.15-3.3.1
- raptor&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP2< 2.0.15-9.3.1
- raptor&distro=SUSE Linux Enterprise Server 12 SP2-BCL< 2.0.15-5.3.1
Debian2 products
- raptor2< 2.0.14-1.1 | < 2.0.14-1.1~deb10u1 | < 2.0.14-1+deb9u1
- debian_linuxEOL9.0 | 10.0
Opensuse2 products
- raptor&distro=openSUSE Leap 15.1< 2.0.15-lp151.3.3.1
- raptor&distro=openSUSE Leap 15.2< 2.0.15-lp152.4.3.1
Ubuntu2 products
- raptor< 1.4.21-11ubuntu0.1~esm1
- raptor2< 2.0.15-0ubuntu2 | < 2.0.14-1ubuntu0.16.04.1 | < 2.0.14-1ubuntu0.18.04.1 | < 2.0.15-0ubuntu1.20.04.1
Fedoraproject1 product
- fedoraEOL31 | 32 | 33
Librdf1 product
6 vendors · 29 products
References
24 links- www.openwall.com/lists/oss-security/2017/06/07/1X Refsource MISCExploitMailing ListPatchThird Party AdvisoryREPORT
lists.debian.org/debian-lts-announce/2020/11/msg00012.htmlMailing ListX Refsource MLISTThird Party AdvisoryREPORT
Show all 24 references
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory