CVEvulnerability
CVE-2017-9765
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-07-20
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.1 HIGH — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-190
Description
Integer overflow in the soap_get function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48, as used on Axis cameras and other devices, allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow and application crash) via a large XML document, aka Devil's Ivy. NOTE: the large document would be blocked by many common web-server configurations on general-purpose computers.
Affected configurations
• genivia gsoap 2.7.0
• genivia gsoap 2.7.1
• genivia gsoap 2.7.2
• genivia gsoap 2.7.3
• genivia gsoap 2.7.4
• genivia gsoap 2.7.5
• genivia gsoap 2.7.6
• genivia gsoap 2.7.7
• genivia gsoap 2.7.8
• genivia gsoap 2.7.9
• genivia gsoap 2.7.10
• genivia gsoap 2.7.11
• genivia gsoap 2.7.12
• genivia gsoap 2.7.13
• genivia gsoap 2.7.14
• genivia gsoap 2.7.15
• genivia gsoap 2.7.16
• genivia gsoap 2.7.17
• genivia gsoap 2.8.0
• genivia gsoap 2.8.1
• genivia gsoap 2.8.2
• genivia gsoap 2.8.3
• genivia gsoap 2.8.4
• genivia gsoap 2.8.5
• genivia gsoap 2.8.6
• genivia gsoap 2.8.7
• genivia gsoap 2.8.8
• genivia gsoap 2.8.9
• genivia gsoap 2.8.10
• genivia gsoap 2.8.11
• genivia gsoap 2.8.12
• genivia gsoap 2.8.13
• genivia gsoap 2.8.14
• genivia gsoap 2.8.15
• genivia gsoap 2.8.16
• genivia gsoap 2.8.17
• genivia gsoap 2.8.18
• genivia gsoap 2.8.19
• genivia gsoap 2.8.20
• genivia gsoap 2.8.21
• genivia gsoap 2.8.22
• genivia gsoap 2.8.23
• genivia gsoap 2.8.24
• genivia gsoap 2.8.25
• genivia gsoap 2.8.26
• genivia gsoap 2.8.27
• genivia gsoap 2.8.28
• genivia gsoap 2.8.29
• genivia gsoap 2.8.30
• genivia gsoap 2.8.31
• genivia gsoap 2.8.32
• genivia gsoap 2.8.33
• genivia gsoap 2.8.34
• genivia gsoap 2.8.35
• genivia gsoap 2.8.36
• genivia gsoap 2.8.37
• genivia gsoap 2.8.38
• genivia gsoap 2.8.39
• genivia gsoap 2.8.40
• genivia gsoap 2.8.41
… and 6 more
Related
Weakness · CWE (1)
- CWE-190 Integer Overflow or Wraparound weakness
References
- http://blog.senr.io/blog/devils-ivy-flaw-in-widely-used-third-party-code-impacts-millions Mitigation, Technical Description, Third Party Advisory
- http://blog.senr.io/devilsivy.html Exploit, Technical Description, Third Party Advisory
- http://www.securityfocus.com/bid/99868 Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1472807 Issue Tracking, Third Party Advisory, VDB Entry
- https://bugzilla.suse.com/show_bug.cgi?id=1049348 Issue Tracking, Third Party Advisory, VDB Entry
- https://www.genivia.com/advisory.html#Security_advisory:_CVE-2017-9765_bug_in_certain_versions_of_gSOAP_2.7_up_to_2.8.47_%28June_21%2C_2017%29 www.genivia.com
- https://www.genivia.com/changelog.html#Version_2.8.48_upd_%2806/21/2017%29 Release Notes, Vendor Advisory
- http://blog.senr.io/blog/devils-ivy-flaw-in-widely-used-third-party-code-impacts-millions Mitigation, Technical Description, Third Party Advisory
- http://blog.senr.io/devilsivy.html Exploit, Technical Description, Third Party Advisory
- http://www.securityfocus.com/bid/99868 Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1472807 Issue Tracking, Third Party Advisory, VDB Entry
- https://bugzilla.suse.com/show_bug.cgi?id=1049348 Issue Tracking, Third Party Advisory, VDB Entry
- https://www.genivia.com/advisory.html#Security_advisory:_CVE-2017-9765_bug_in_certain_versions_of_gSOAP_2.7_up_to_2.8.47_%28June_21%2C_2017%29 www.genivia.com
- https://www.genivia.com/changelog.html#Version_2.8.48_upd_%2806/21/2017%29 Release Notes, Vendor Advisory