CVE-2017-9078

The server in Dropbear before 2017.75 might allow post-authentication root remote code execution because of a double free in cleanup of TCP listeners when the -a option is enabled.
Configurations

Configuration 1 (hide)

cpe:2.3:a:dropbear_ssh_project:dropbear_ssh:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*

History

11 Jul 2022, 17:11

Type Values Removed Values Added
CVSS v2 : 9.3
v3 : 8.1
v2 : 8.5
v3 : 8.8
CPE cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*
References (CONFIRM) https://security.netapp.com/advisory/ntap-20191004-0006/ - (CONFIRM) https://security.netapp.com/advisory/ntap-20191004-0006/ - Third Party Advisory

Information

Published : 2017-05-19 14:29

Updated : 2024-02-04 19:11


NVD link : CVE-2017-9078

Mitre link : CVE-2017-9078

CVE.ORG link : CVE-2017-9078


JSON object : View

Products Affected

netapp

  • h410c_firmware
  • h410c

debian

  • debian_linux

dropbear_ssh_project

  • dropbear_ssh
CWE
CWE-415

Double Free