CVE-2017-8807

State: Published
Severity: Not scored
Published: Nov 16, 2017
Updated: Aug 5, 2024
Reserved: May 7, 2017

Description

vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to obtain sensitive information from process memory because a VFP_GetStorage buffer is larger than intended in certain circumstances involving -sfile Stevedore transient objects.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1n/a	Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1Affected

References

https://bugs.debian.org/881808
http://varnish-cache.org/security/VSV00002.html
https://github.com/varnishcache/varnish-cache/pull/2429
https://github.com/varnishcache/varnish-cache/commit/176f8a075a963ffbfa56f1c460c15f6a1a6af5a7
DSA-4034vendor-advisory
101886vdb-entry

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.