Vulnerability-Lookup

usn-3694-1

Vulnerability from osv_ubuntu

Published

2018-06-28 18:26

Modified

2026-02-10 04:41

Summary

nasm vulnerabilities

Details

It was discovered that NASM incorrectly handled certain source files. If a user or automated system were tricked into processing a specially crafted source file, a remote attacker could use these issues to cause NASM to crash, resulting in a denial of service, or possibly execute arbitrary code.

References

URL

Type

	https://ubuntu.com/security/notices/USN-3694-1	ADVISORY
	https://ubuntu.com/security/CVE-2017-10686	REPORT
	https://ubuntu.com/security/CVE-2017-11111	REPORT
	https://ubuntu.com/security/CVE-2017-14228	REPORT
	https://ubuntu.com/security/CVE-2017-17810	REPORT
	https://ubuntu.com/security/CVE-2017-17811	REPORT
	https://ubuntu.com/security/CVE-2017-17812	REPORT
	https://ubuntu.com/security/CVE-2017-17813	REPORT
	https://ubuntu.com/security/CVE-2017-17814	REPORT
	https://ubuntu.com/security/CVE-2017-17815	REPORT
	https://ubuntu.com/security/CVE-2017-17816	REPORT
	https://ubuntu.com/security/CVE-2017-17817	REPORT
	https://ubuntu.com/security/CVE-2017-17818	REPORT
	https://ubuntu.com/security/CVE-2017-17819	REPORT
	https://ubuntu.com/security/CVE-2017-17820	REPORT
	https://ubuntu.com/security/CVE-2018-8881	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2017-10686",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-11111",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-14228",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-17810",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-17811",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-17812",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-17813",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-17814",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-17815",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-17816",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-17817",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-17818",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-17819",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-17820",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-8881",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "nasm",
            "binary_version": "2.10.09-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "nasm",
        "purl": "pkg:deb/ubuntu/nasm@2.10.09-1ubuntu0.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.10.09-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.10.07-1",
        "2.10.09-1"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that NASM incorrectly handled certain source files. If a\nuser or automated system were tricked into processing a specially crafted\nsource file, a remote attacker could use these issues to cause NASM to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode.\n",
  "id": "USN-3694-1",
  "modified": "2026-02-10T04:41:22Z",
  "published": "2018-06-28T18:26:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3694-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-10686"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-11111"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-14228"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-17810"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-17811"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-17812"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-17813"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-17814"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-17815"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-17816"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-17817"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-17818"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-17819"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-17820"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-8881"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "nasm vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2017-10686",
    "UBUNTU-CVE-2017-11111",
    "UBUNTU-CVE-2017-14228",
    "UBUNTU-CVE-2017-17810",
    "UBUNTU-CVE-2017-17811",
    "UBUNTU-CVE-2017-17812",
    "UBUNTU-CVE-2017-17813",
    "UBUNTU-CVE-2017-17814",
    "UBUNTU-CVE-2017-17815",
    "UBUNTU-CVE-2017-17816",
    "UBUNTU-CVE-2017-17817",
    "UBUNTU-CVE-2017-17818",
    "UBUNTU-CVE-2017-17819",
    "UBUNTU-CVE-2017-17820",
    "UBUNTU-CVE-2018-8881"
  ]
}

ubuntu-cve-2017-10686

Vulnerability from osv_ubuntu

Published

2017-06-29 00:00

Modified

2025-09-08 16:44

Summary

Details

In Netwide Assembler (NASM) 2.14rc0, there are multiple heap use after free vulnerabilities in the tool nasm. The related heap is allocated in the token() function and freed in the detoken() function (called by pp_getline()) - it is used again at multiple positions later that could cause multiple damages. For example, it causes a corrupted double-linked list in detoken(), a double free or corruption in delete_Token(), and an out-of-bounds write in detoken(). It has a high possibility to lead to a remote code execution attack.

Severity

7.8 (High)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2017-10686	REPORT
	https://ubuntu.com/security/notices/USN-3694-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2017-10686	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "nasm",
            "binary_version": "2.10.09-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "nasm",
        "purl": "pkg:deb/ubuntu/nasm@2.10.09-1ubuntu0.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.10.09-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.10.07-1",
        "2.10.09-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "nasm",
            "binary_version": "2.11.08-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "nasm",
        "purl": "pkg:deb/ubuntu/nasm@2.11.08-1ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.08-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.11.06-1really2.11.05-1",
        "2.11.08-1"
      ]
    }
  ],
  "aliases": [],
  "details": "In Netwide Assembler (NASM) 2.14rc0, there are multiple heap use after free vulnerabilities in the tool nasm. The related heap is allocated in the token() function and freed in the detoken() function (called by pp_getline()) - it is used again at multiple positions later that could cause multiple damages. For example, it causes a corrupted double-linked list in detoken(), a double free or corruption in delete_Token(), and an out-of-bounds write in detoken(). It has a high possibility to lead to a remote code execution attack.",
  "id": "UBUNTU-CVE-2017-10686",
  "modified": "2025-09-08T16:44:18Z",
  "published": "2017-06-29T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-10686"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3694-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-10686"
    }
  ],
  "related": [
    "USN-3694-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2017-10686"
  ]
}

ubuntu-cve-2017-11111

Vulnerability from osv_ubuntu

Published

2017-07-08 00:00

Modified

2025-09-08 16:44

Summary

Details

In Netwide Assembler (NASM) 2.14rc0, preproc.c allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.

Severity

7.8 (High)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2017-11111	REPORT
	https://ubuntu.com/security/notices/USN-3694-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2017-11111	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "nasm",
            "binary_version": "2.10.09-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "nasm",
        "purl": "pkg:deb/ubuntu/nasm@2.10.09-1ubuntu0.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.10.09-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.10.07-1",
        "2.10.09-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "nasm",
            "binary_version": "2.11.08-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "nasm",
        "purl": "pkg:deb/ubuntu/nasm@2.11.08-1ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.08-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.11.06-1really2.11.05-1",
        "2.11.08-1"
      ]
    }
  ],
  "aliases": [],
  "details": "In Netwide Assembler (NASM) 2.14rc0, preproc.c allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.",
  "id": "UBUNTU-CVE-2017-11111",
  "modified": "2025-09-08T16:44:19Z",
  "published": "2017-07-08T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-11111"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3694-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-11111"
    }
  ],
  "related": [
    "USN-3694-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2017-11111"
  ]
}

ubuntu-cve-2017-14228

Vulnerability from osv_ubuntu

Published

2017-09-09 00:00

Modified

2025-09-08 16:44

Summary

Details

In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in the function paste_tokens() in preproc.c, aka a NULL pointer dereference. It will lead to remote denial of service.

Severity

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2017-14228	REPORT
	https://ubuntu.com/security/notices/USN-3694-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2017-14228	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "nasm",
            "binary_version": "2.10.09-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "nasm",
        "purl": "pkg:deb/ubuntu/nasm@2.10.09-1ubuntu0.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.10.09-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.10.07-1",
        "2.10.09-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "nasm",
            "binary_version": "2.11.08-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "nasm",
        "purl": "pkg:deb/ubuntu/nasm@2.11.08-1ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.08-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.11.06-1really2.11.05-1",
        "2.11.08-1"
      ]
    }
  ],
  "aliases": [],
  "details": "In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in the function paste_tokens() in preproc.c, aka a NULL pointer dereference. It will lead to remote denial of service.",
  "id": "UBUNTU-CVE-2017-14228",
  "modified": "2025-09-08T16:44:26Z",
  "published": "2017-09-09T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-14228"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3694-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-14228"
    }
  ],
  "related": [
    "USN-3694-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2017-14228"
  ]
}

ubuntu-cve-2017-17810

Vulnerability from osv_ubuntu

Published

2017-12-20 00:00

Modified

2025-09-08 16:44

Summary

Details

In Netwide Assembler (NASM) 2.14rc0, there is a "SEGV on unknown address" that will cause a remote denial of service attack, because asm/preproc.c mishandles macro calls that have the wrong number of arguments.

Severity

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2017-17810	REPORT
	https://ubuntu.com/security/notices/USN-3694-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2017-17810	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "nasm",
            "binary_version": "2.10.09-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "nasm",
        "purl": "pkg:deb/ubuntu/nasm@2.10.09-1ubuntu0.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.10.09-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.10.07-1",
        "2.10.09-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "nasm",
            "binary_version": "2.11.08-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "nasm",
        "purl": "pkg:deb/ubuntu/nasm@2.11.08-1ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.08-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.11.06-1really2.11.05-1",
        "2.11.08-1"
      ]
    }
  ],
  "aliases": [],
  "details": "In Netwide Assembler (NASM) 2.14rc0, there is a \"SEGV on unknown address\" that will cause a remote denial of service attack, because asm/preproc.c mishandles macro calls that have the wrong number of arguments.",
  "id": "UBUNTU-CVE-2017-17810",
  "modified": "2025-09-08T16:44:33Z",
  "published": "2017-12-20T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-17810"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3694-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-17810"
    }
  ],
  "related": [
    "USN-3694-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2017-17810"
  ]
}

ubuntu-cve-2017-17811

Vulnerability from osv_ubuntu

Published

2017-12-20 00:00

Modified

2025-09-08 16:44

Summary

Details

In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer overflow that will cause a remote denial of service attack, related to a strcpy in paste_tokens in asm/preproc.c, a similar issue to CVE-2017-11111.

Severity

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2017-17811	REPORT
	https://ubuntu.com/security/notices/USN-3694-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2017-17811	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "nasm",
            "binary_version": "2.10.09-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "nasm",
        "purl": "pkg:deb/ubuntu/nasm@2.10.09-1ubuntu0.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.10.09-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.10.07-1",
        "2.10.09-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "nasm",
            "binary_version": "2.11.08-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "nasm",
        "purl": "pkg:deb/ubuntu/nasm@2.11.08-1ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.08-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.11.06-1really2.11.05-1",
        "2.11.08-1"
      ]
    }
  ],
  "aliases": [],
  "details": "In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer overflow that will cause a remote denial of service attack, related to a strcpy in paste_tokens in asm/preproc.c, a similar issue to CVE-2017-11111.",
  "id": "UBUNTU-CVE-2017-17811",
  "modified": "2025-09-08T16:44:33Z",
  "published": "2017-12-20T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-17811"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3694-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-17811"
    }
  ],
  "related": [
    "USN-3694-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2017-17811"
  ]
}

ubuntu-cve-2017-17812

Vulnerability from osv_ubuntu

Published

2017-12-20 00:00

Modified

2025-09-08 16:44

Summary

Details

In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer over-read in the function detoken() in asm/preproc.c that will cause a remote denial of service attack.

Severity

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2017-17812	REPORT
	https://ubuntu.com/security/notices/USN-3694-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2017-17812	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "nasm",
            "binary_version": "2.10.09-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "nasm",
        "purl": "pkg:deb/ubuntu/nasm@2.10.09-1ubuntu0.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.10.09-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.10.07-1",
        "2.10.09-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "nasm",
            "binary_version": "2.11.08-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "nasm",
        "purl": "pkg:deb/ubuntu/nasm@2.11.08-1ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.08-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.11.06-1really2.11.05-1",
        "2.11.08-1"
      ]
    }
  ],
  "aliases": [],
  "details": "In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer over-read in the function detoken() in asm/preproc.c that will cause a remote denial of service attack.",
  "id": "UBUNTU-CVE-2017-17812",
  "modified": "2025-09-08T16:44:33Z",
  "published": "2017-12-20T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-17812"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3694-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-17812"
    }
  ],
  "related": [
    "USN-3694-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2017-17812"
  ]
}

ubuntu-cve-2017-17813

Vulnerability from osv_ubuntu

Published

2017-12-20 00:00

Modified

2025-09-08 16:44

Summary

Details

In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in the pp_list_one_macro function in asm/preproc.c that will cause a remote denial of service attack, related to mishandling of line-syntax errors.

Severity

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2017-17813	REPORT
	https://ubuntu.com/security/notices/USN-3694-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2017-17813	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "nasm",
            "binary_version": "2.10.09-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "nasm",
        "purl": "pkg:deb/ubuntu/nasm@2.10.09-1ubuntu0.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.10.09-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.10.07-1",
        "2.10.09-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "nasm",
            "binary_version": "2.11.08-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "nasm",
        "purl": "pkg:deb/ubuntu/nasm@2.11.08-1ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.08-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.11.06-1really2.11.05-1",
        "2.11.08-1"
      ]
    }
  ],
  "aliases": [],
  "details": "In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in the pp_list_one_macro function in asm/preproc.c that will cause a remote denial of service attack, related to mishandling of line-syntax errors.",
  "id": "UBUNTU-CVE-2017-17813",
  "modified": "2025-09-08T16:44:33Z",
  "published": "2017-12-20T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-17813"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3694-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-17813"
    }
  ],
  "related": [
    "USN-3694-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2017-17813"
  ]
}

ubuntu-cve-2017-17814

Vulnerability from osv_ubuntu

Published

2017-12-20 00:00

Modified

2025-09-08 16:44

Summary

Details

In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in do_directive in asm/preproc.c that will cause a remote denial of service attack.

Severity

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2017-17814	REPORT
	https://ubuntu.com/security/notices/USN-3694-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2017-17814	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "nasm",
            "binary_version": "2.10.09-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "nasm",
        "purl": "pkg:deb/ubuntu/nasm@2.10.09-1ubuntu0.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.10.09-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.10.07-1",
        "2.10.09-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "nasm",
            "binary_version": "2.11.08-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "nasm",
        "purl": "pkg:deb/ubuntu/nasm@2.11.08-1ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.08-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.11.06-1really2.11.05-1",
        "2.11.08-1"
      ]
    }
  ],
  "aliases": [],
  "details": "In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in do_directive in asm/preproc.c that will cause a remote denial of service attack.",
  "id": "UBUNTU-CVE-2017-17814",
  "modified": "2025-09-08T16:44:33Z",
  "published": "2017-12-20T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-17814"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3694-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-17814"
    }
  ],
  "related": [
    "USN-3694-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2017-17814"
  ]
}

ubuntu-cve-2017-17815

Vulnerability from osv_ubuntu

Published

2017-12-20 00:00

Modified

2025-09-08 16:44

Summary

Details

In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in is_mmacro() in asm/preproc.c that will cause a remote denial of service attack, because of a missing check for the relationship between minimum and maximum parameter counts.

Severity

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2017-17815	REPORT
	https://ubuntu.com/security/notices/USN-3694-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2017-17815	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "nasm",
            "binary_version": "2.10.09-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "nasm",
        "purl": "pkg:deb/ubuntu/nasm@2.10.09-1ubuntu0.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.10.09-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.10.07-1",
        "2.10.09-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "nasm",
            "binary_version": "2.11.08-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "nasm",
        "purl": "pkg:deb/ubuntu/nasm@2.11.08-1ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.08-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.11.06-1really2.11.05-1",
        "2.11.08-1"
      ]
    }
  ],
  "aliases": [],
  "details": "In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in is_mmacro() in asm/preproc.c that will cause a remote denial of service attack, because of a missing check for the relationship between minimum and maximum parameter counts.",
  "id": "UBUNTU-CVE-2017-17815",
  "modified": "2025-09-08T16:44:33Z",
  "published": "2017-12-20T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-17815"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3694-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-17815"
    }
  ],
  "related": [
    "USN-3694-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2017-17815"
  ]
}

ubuntu-cve-2017-17816

Vulnerability from osv_ubuntu

Published

2017-12-20 00:00

Modified

2025-09-08 16:44

Summary

Details

In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp_getline in asm/preproc.c that will cause a remote denial of service attack.

Severity

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2017-17816	REPORT
	https://ubuntu.com/security/notices/USN-3694-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2017-17816	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "nasm",
            "binary_version": "2.10.09-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "nasm",
        "purl": "pkg:deb/ubuntu/nasm@2.10.09-1ubuntu0.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.10.09-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.10.07-1",
        "2.10.09-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "nasm",
            "binary_version": "2.11.08-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "nasm",
        "purl": "pkg:deb/ubuntu/nasm@2.11.08-1ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.08-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.11.06-1really2.11.05-1",
        "2.11.08-1"
      ]
    }
  ],
  "aliases": [],
  "details": "In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp_getline in asm/preproc.c that will cause a remote denial of service attack.",
  "id": "UBUNTU-CVE-2017-17816",
  "modified": "2025-09-08T16:44:33Z",
  "published": "2017-12-20T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-17816"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3694-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-17816"
    }
  ],
  "related": [
    "USN-3694-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2017-17816"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature