CVE-2017-2807

High

Published: 05/09/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

A buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially crafted journal file can cause an integer underflow resulting in code execution.

Risk Assessment

An attacker can construct a malicious journal file, potentially leading to unauthorized code execution on the system. This poses a serious threat to the integrity and security of the organization's data.

Recommendation

It is recommended to update Ledger-CLI to the latest version to mitigate this vulnerability. Additionally, monitor and validate journal files before processing them.

Other vulnerabilities in Ledger-CLI 3.1.1

CVE-2017-2808High
A use-after-free vulnerability exists in the account parsing component of Ledger-CLI 3.1.1, which can be exploited by a specially crafted ledger file. This can lead to arbitrary code execution.

Original NVD description (English source)

An exploitable buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially crafted journal file can cause an integer underflow resulting in code execution. An attacker can construct a malicious journal file to trigger this vulnerability.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS