CVE-2017-7467

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A buffer overflow flaw was found in the way minicom before version 2.7.1 handled VT100 escape sequences. A malicious terminal device could potentially use this flaw to crash minicom, or execute arbitrary code in the context of the minicom process.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787 CWE-119

Affected software

Vendor	Product	Versions
[UNKNOWN]	minicom	minicom 2.7.1

References

http://www.openwall.com/lists/oss-security/2017/04/18/5Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/97966Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7467Issue Tracking
https://security.gentoo.org/glsa/201706-13Third Party Advisory
http://www.openwall.com/lists/oss-security/2017/04/18/5Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/97966Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7467Issue Tracking
https://security.gentoo.org/glsa/201706-13Third Party Advisory

Timeline

Published: Jul 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-74687.5In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed CVE-2017-74709.8It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect au CVE-2017-74719.0Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System (9pfs) support, is vulnerable to an improper acce CVE-2017-74725.5The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of K CVE-2017-74749.8It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass CVE-2017-74755.5Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an applicatio CVE-2017-74769.8Gnulib before 2017-04-26 has a heap-based buffer overflow with the TZ environment variable. The error is in the save_abbr function in time_r CVE-2017-74777.0Heap-based buffer overflow in drivers/net/macsec.c in the MACsec module in the Linux kernel through 4.10.12 allows attackers to cause a deni CVE-2017-74787.5OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that t CVE-2017-74796.5OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denia CVE-2017-74809.8rkhunter versions before 1.4.4 are vulnerable to file download over insecure channel when doing mirror update resulting into potential remot CVE-2017-74819.8Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results