Published: 17/07/2017 Updated: 03/10/2019

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

The try_read_command function in memcached.c in memcached prior to 1.4.39 allows remote malicious users to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8705.

Vulnerable Product	Search on Vulmon	Subscribe to Product
memcached memcached

Several security issues were fixed in Memcached ...

Debian Bug report logs - #868701 memcached: CVE-2017-9951: Heap-based buffer over-read in try_read_command function Package: src:memcached; Maintainer for src:memcached is Guillaume Delacour <gui@iroqwaorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 17 Jul 2017 20:39:02 UTC Severity: important ...

Debian Bug report logs - #894404 memcached: CVE-2018-1000127 Package: memcached; Maintainer for memcached is Guillaume Delacour <gui@iroqwaorg>; Source for memcached is src:memcached (PTS, buildd, popcon) Reported by: Antoine Beaupre <anarcat@orangeseedsorg> Date: Thu, 29 Mar 2018 21:33:02 UTC Severity: grave Tags ...

Several vulnerabilities were discovered in memcached, a high-performance memory object caching system The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2017-9951 Daniel Shapira reported a heap-based buffer over-read in memcached (resulting from an incomplete fix for CVE-2016-8705) triggered by spe ...

The try_read_command function in memcachedc in memcached before 1439 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read NOTE: this vulnerability exists because of an incomplete fix for CVE-20 ...

NVD-CWE-noinfo https://www.twistlock.com/2017/07/13/cve-2017-9951-heap-overflow-memcached-server-1-4-38-twistlock-vulnerability-report/https://groups.google.com/forum/message/raw?msg=memcached/ubGWrkmrr4E/nrm1SeVJAQAJ https://github.com/memcached/memcached/wiki/ReleaseNotes1439 https://usn.ubuntu.com/3588-1/http://www.securityfocus.com/bid/99874 https://www.debian.org/security/2018/dsa-4218 https://nvd.nist.gov https://usn.ubuntu.com/3588-1/

CVE-2017-9951

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect