CVE-2017-1000172

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Creolabs Gravity Version: 1.0 Use-After-Free Possible code execution. An example of a Heap-Use-After-Free after the 'sublexer' pointer has been freed. Line 542 of gravity_lexer.c. 'lexer' is being used to access a variable but 'lexer' has already been freed, creating a Heap Use-After-Free condition.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Nov 17, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10001739.8Creolabs Gravity Version: 1.0 Heap Overflow Potential Code Execution. By creating a large loop whiling pushing data to a buffer, we can brea CVE-2017-10001745.5In SWFTools, an address access exception was found in swfdump swf_GetBits().CVE-2017-10001765.5In SWFTools, a memcpy buffer overflow was found in swfc.CVE-2017-10001825.5In SWFTools, a memory leak was found in wav2swf.CVE-2017-10001855.5In SWFTools, a memcpy buffer overflow was found in gif2swf.CVE-2017-10001865.5In SWFTools, a stack overflow was found in pdf2swf.CVE-2017-10001877.8In SWFTools, an address access exception was found in pdf2swf. FoFiTrueType::writeTTF()CVE-2017-10001886.1nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection CVE-2017-10001897.5nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in the ejs.renderFile()CVE-2017-10001909.1SimpleXML (latest version 2.7.1) is vulnerable to an XXE vulnerability resulting SSRF, information disclosure, DoS and so on.CVE-2017-10001917.5Jool 3.5.0-3.5.1 is vulnerable to a kernel crashing packet resulting in a DOS.CVE-2017-10001929.8Cygnux sysPass version 2.1.7 and older is vulnerable to a Local File Inclusion in the functionality of javascript files inclusion. The attac