High severity · published Jun 1, 2017
CVE-2017-9334
An incorrect "pair?" check in the Scheme "length" procedure results in an unsafe pointer dereference in all CHICKEN Scheme versions prior to 4.13, which allows an attacker to…
7.5
CVSS
1.5%
EPSS
No
On KEV
Description
An incorrect "pair?" check in the Scheme "length" procedure results in an unsafe pointer dereference in all CHICKEN Scheme versions prior to 4.13, which allows an attacker to cause a denial of service by passing an improper list to an application that calls "length" on it.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
Chicken · Call-cc
through 4.12.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-9334
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-9334
Patch
http://lists.nongnu.org/archive/html/chicken-announce/2017-05/msg00000.html
Patch
http://lists.nongnu.org/archive/html/chicken-hackers/2017-05/msg00099.html
More from Chicken
9.8
CVE-2022-45145
egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file
9.8
CVE-2014-6310
Buffer overflow in CHICKEN 4.9.0 and 4.9.0.1 may allow remote attackers to execute arbitrary code via the 'select' function
9.8
CVE-2012-6125
Chicken before 4.8.0 is susceptible to algorithmic complexity attacks related to hash table collisions
9.8
CVE-2016-6830
The "process-execute" and "process-spawn" procedures in CHICKEN Scheme used fixed-size buffers for holding the arguments and environment variables to use in its execve() call
8.8
CVE-2013-2075
Multiple buffer overflows in the (1) R5RS char-ready, (2) tcp-accept-ready, and (3) file-select procedures in Chicken through 4.8.0.3 allows attackers to cause a denial of service…