VDB
CVE-2017-14804
CVE-2017-14804
PUBLISHED
CVSS 9.899999618530273 CRITICAL
The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target system,allowing escape out of buildroots.
EPSS 1.71% · 77.1th percentile
Risk Scores
CVSS 3.0
9.899999618530273
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score
1.71%
77.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | obs-build | 0, 20141024-1, 20141024-1.1 |
| Ubuntu:18.04:LTS | obs-build | 20170201-3, 0 |
Timeline
- Dec 8, 2017 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 25, 2021 EPSS Score
- Oct 28, 2021 EPSS Score
- Dec 30, 2021 EPSS Score
- Mar 3, 2022 EPSS Score
- May 5, 2022 EPSS Score
- Jul 7, 2022 EPSS Score
- Nov 12, 2022 EPSS Score
- Jan 14, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2017-14804 third-party-advisory
- https://bugzilla.novell.com/show_bug.cgi?id=1069904 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2017-14804 third-party-advisory