CVE-2017-11343
HighSummary
All versions of CHICKEN Scheme up to and including 4.12.0 are vulnerable to an algorithmic complexity attack due to an incomplete fix for CVE-2012-6125. An attacker can provide crafted input that will result in O(n) lookup time in the symbol table.
Risk Assessment
This vulnerability may lead to significant performance degradation, potentially affecting the availability of services within the organization.
Recommendation
It is recommended to upgrade to a version of CHICKEN Scheme above 4.12.0 to mitigate the risks associated with this vulnerability.
Other vulnerabilities in CHICKEN Scheme
See all- CVE-2017-9334High
An incorrect 'pair?' check in the 'length' procedure in CHICKEN Scheme leads to an unsafe pointer dereference. This allows an attacker to cause a denial of service by passing an improper list to an application that calls 'length'.
- CVE-2017-6949High
An issue was discovered in CHICKEN Scheme through version 4.12.0 related to allocating an SRFI-4 vector in unmanaged memory. The vector size was used in unsanitised form as an argument to malloc(), which could lead to segfaults or buffer overflows.
- CVE-2016-6830Critical
The 'process-execute' and 'process-spawn' procedures in CHICKEN Scheme use fixed-size buffers for holding arguments and environment variables for the execve() call. This can lead to buffer overrun when user-supplied argument/environment variable lists are provided.
Original NVD description (English source)
Due to an incomplete fix for CVE-2012-6125, all versions of CHICKEN Scheme up to and including 4.12.0 are vulnerable to an algorithmic complexity attack. An attacker can provide crafted input which, when inserted into the symbol table, will result in O(n) lookup time.