CVE-2017-1000375

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

NetBSD maps the run-time link-editor ld.so directly below the stack region, even if ASLR is enabled, this allows attackers to more easily manipulate memory leading to arbitrary code execution. This affects NetBSD 7.1 and possibly earlier versions.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/99257Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/42272/
https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txtExploit, Third Party Advisory
http://www.securityfocus.com/bid/99257Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/42272/
https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txtExploit, Third Party Advisory

Timeline

Published: Jun 19, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10003767.0libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note CVE-2017-10003775.9An issue was discovered in the size of the default stack guard page on PAX Linux (originally from GRSecurity but shipped by other Linux vend CVE-2017-10003789.8The NetBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes CVE-2017-10003797.8The Linux Kernel running on AMD64 systems will sometimes map the contents of PIE executable, the heap or ld.so to where the stack is mapped CVE-2017-10003805.5sound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a data race in the ALSA /dev/snd/timer driver resulting in local users CVE-2017-10003817.5The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the CVE-2017-10003825.5VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file ("[ORIGINAL_FILENAME].swp") resulting in files CVE-2017-10003835.5GNU Emacs version 25.3.1 (and other versions most likely) ignores umask when creating a backup save file ("[ORIGINAL_FILENAME]~") resulting CVE-2017-10003855.9The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. This allows an attacker CVE-2017-10003865.4Jenkins Active Choices plugin version 1.5.3 and earlier allowed users with Job/Configure permission to provide arbitrary HTML to be shown on CVE-2017-10003877.8Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file hudson.plugins.build_publi CVE-2017-10003884.3Jenkins Dependency Graph Viewer plugin 0.12 and earlier did not perform permission checks for the API endpoint that modifies the dependency