CVE-2017-2808

High

Published: 05/09/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

A use-after-free vulnerability exists in the account parsing component of Ledger-CLI 3.1.1, which can be exploited by a specially crafted ledger file. This can lead to arbitrary code execution.

Risk Assessment

An attacker can convince a user to load a malicious journal file, potentially resulting in unauthorized access to the system or its resources.

Recommendation

It is recommended to update to the latest version of Ledger-CLI and avoid opening unknown journal files.

Other vulnerabilities in Ledger-CLI 3.1.1

CVE-2017-2807High
A buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially crafted journal file can cause an integer underflow resulting in code execution.

Original NVD description (English source)

An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI 3.1.1. A specially crafted ledger file can cause a use-after-free vulnerability resulting in arbitrary code execution. An attacker can convince a user to load a journal file to trigger this vulnerability.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS