← Vulnerability feed

Vulnerability record · CVE-2017-7555 · published 17 August 2017

CVE-2017-7555: Augeas heap-based buffer overflow vulnerability

Augeas · Augeas

Augeas versions up to and including 1.8.0 are vulnerable to heap-based buffer overflow due to improper handling of escaped strings. Attacker could send crafted strings that would cause the application using augeas to copy past the end of a buffer, leading to a crash or possible code execution.

9.8 CVSS 3.0 Critical EPSS 5.0% · top 8.1% CWE-122 · Heap-based buffer overflowCWE-119 · Memory buffer overflow
9.8CVSS 3.0 base score, v2 7.5
5.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References
17 Jun 2026Last modified by NVD

Description

Augeas versions up to and including 1.8.0 are vulnerable to heap-based buffer overflow due to improper handling of escaped strings. Attacker could send crafted strings that would cause the application using augeas to copy past the end of a buffer, leading to a crash or possible code execution.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.debian.org/security/2017/dsa-3949
http://www.securityfocus.com/bid/100378 Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2017:2788
https://access.redhat.com/errata/RHSA-2019:2403
https://github.com/hercules-team/augeas/pull/480 Third Party Advisory
https://puppet.com/security/cve/cve-2017-7555
http://www.debian.org/security/2017/dsa-3949
http://www.securityfocus.com/bid/100378 Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2017:2788
https://access.redhat.com/errata/RHSA-2019:2403
https://github.com/hercules-team/augeas/pull/480 Third Party Advisory
https://puppet.com/security/cve/cve-2017-7555

Track CVE-2017-7555 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

4.8CVE-2025-2588Augeas improper resource shutdown vulnerabilityA vulnerability has been found in Hercules Augeas 1.14.1 and classified as problematic. This vulnerability affects the function re_case_expand of the…EPSS 0.27%4.6CVE-2013-6412Augeas permissions and access controls vulnerabilityThe transform_save function in transform.c in Augeas 1.0.0 through 1.1.0 does not properly calculate the permission values when the umask contains a …EPSS 0.37%3.7CVE-2012-0787Redhat enterprise linux vulnerabilityThe clone_file function in transfer.c in Augeas before 1.0.0, when copy_if_rename_fails is set and EXDEV or EBUSY is returned by the rename function,…EPSS 0.41%3.3CVE-2012-0786Augeas link following vulnerabilityThe transform_save function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive information vi…EPSS 0.45%3.3CVE-2012-6607Augeas path traversal vulnerabilityThe transform_save function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive information vi…EPSS 0.37%9.3CVE-2026-94127F5 big-ip access policy manager heap-based buffer overflow vulnerabilityWhen a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution…KEVEPSS 2.2%9.8CVE-2025-25249Fortinet FortiOS and FortiSwitchManager heap buffer overflow via crafted packetsA heap-based buffer overflow (CWE-122/CWE-787) in Fortinet FortiOS 6.4 through 7.6.3 and FortiSwitchManager 7.0 through 7.2.6 lets an unauthenticated…KEVEPSS 3.9%analysed7.8CVE-2026-85880Windows ALPC heap buffer overflow allows local privilege escalationA heap-based buffer overflow in the Windows ALPC subsystem, combined with use of an uninitialized resource, lets an attacker with existing local acce…KEVEPSS 3.6%analysed

Source: NIST National Vulnerability Database (record CVE-2017-7555), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.