CVE-2017-1000173
CriticalSummary
In Creolabs Gravity version 1.0, there is a heap buffer overflow vulnerability that may lead to code execution. By creating a large loop while pushing data to a buffer, the bounds checking of that buffer can be bypassed.
Risk Assessment
An attacker could exploit this vulnerability to execute malicious code within the application's context, potentially leading to serious security implications.
Recommendation
It is recommended to update to the latest version of the software to mitigate this vulnerability and to monitor the application for any unusual activities.
Other vulnerabilities in Creolabs Gravity
See all- CVE-2026-40504Critical
A heap buffer overflow vulnerability exists in Creolabs Gravity before version 0.9.6 in the gravity_vm_exec function. Attackers can exploit scripts with many string literals at global scope to write out-of-bounds memory.
- CVE-2017-1000075Critical
Creolabs Gravity version 1.0 is vulnerable to a stack overflow in the memcmp function.
- CVE-2017-1000074Critical
Creolabs Gravity version 1.0 is vulnerable to a stack overflow in the string_repeat() function.
- CVE-2017-1000073Critical
Creolabs Gravity version 1.0 is vulnerable to a heap overflow in an undisclosed component that can result in arbitrary code execution.
Original NVD description (English source)
Creolabs Gravity Version: 1.0 Heap Overflow Potential Code Execution. By creating a large loop whiling pushing data to a buffer, we can break out of the bounds checking of that buffer. When list.join is called on the data it will read past a buffer resulting in a Heap-Buffer-Overflow.