CVE-2017-5357 Information

Description

regex.c in GNU ed before 1.14.1 allows attackers to cause a denial of service (crash) via a malformed command which triggers an invalid free.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Reference

http://www.openwall.com/lists/oss-security/2017/01/12/5 http://www.openwall.com/lists/oss-security/2017/01/12/6 http://www.openwall.com/lists/oss-security/2017/01/12/7 http://www.openwall.com/lists/oss-security/2017/01/13/3 http://www.securityfocus.com/bid/95422 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZVH54XNZ77ICNBJTPI2DLJYQTA3SYSFC/ https://lists.gnu.org/archive/html/bug-ed/2017-01/msg00000.html

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

NONE

Base Score

HIGH

Base Severity

7.5