CVE-2017-15101

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A missing patch for a stack-based buffer overflow in findTable() was found in Red Hat version of liblouis before 2.5.4. An attacker could cause a denial of service condition or potentially even arbitrary code execution.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-119

Affected software

Vendor	Product	Versions
Liblouis	liblouis	2.5.4

References

https://access.redhat.com/errata/RHSA-2017:3384Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15101Issue Tracking, Patch, Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3384Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15101Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Jul 27, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-151026.3The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local users (who are physically proximat CVE-2017-151038.8A security-check flaw was found in the way the Heketi 5 server API handled user requests. An authenticated Heketi user could send specially CVE-2017-151047.8An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable. An attacker having local access to the He CVE-2017-151055.3A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record c CVE-2017-151077.5A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSEC records could be im CVE-2017-151087.8spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with acces CVE-2017-151104.3In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students c CVE-2017-151115.5keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via sy CVE-2017-151127.8keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command histo CVE-2017-151136.6ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can CVE-2017-151148.1When libvirtd is configured by OSP director (tripleo-heat-templates) to use the TLS transport it defaults to the same certificate authority CVE-2017-151157.8The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether the intended netns is used in a pee