« Volver al listado

CVE-2017-8773

Estado: ModificadaCrítica (9.8)—

Quick Heal Internet Security 10.1.0.316, Quick Heal Total Security 10.1.0.316, and Quick Heal AntiVirus Pro 10.1.0.316 are vulnerable to Out of Bounds Write on a Heap Buffer due to improper validation of dwCompressionSize of Microsoft WIM Header WIMHEADER_V1_PACKED. This vulnerability can be exploited to gain Remote Code Execution as well as Privilege Escalation.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Quickheal — Antivirus PROQuickheal — Internet SecurityQuickheal — Total Security

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-8773",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-05-04T04:59:00.240",
  "references": [
    {
      "url": "http://payatu.com/oob-write-heap-buffer-dwcompressionsize-ms-wim/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://payatu.com/oob-write-heap-buffer-dwcompressionsize-ms-wim/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Quick Heal Internet Security 10.1.0.316, Quick Heal Total Security 10.1.0.316, and Quick Heal AntiVirus Pro 10.1.0.316 are vulnerable to Out of Bounds Write on a Heap Buffer due to improper validation of dwCompressionSize of Microsoft WIM Header WIMHEADER_V1_PACKED. This vulnerability can be exploited to gain Remote Code Execution as well as Privilege Escalation."
    },
    {
      "lang": "es",
      "value": "Quick Heal Internet Security 10.1.0.316, Quick Heal Total Security 10.1.0.316 y Quick Heal AntiVirus Pro 10.1.0.316 son vulnerables a una escritura fuera de límites en el búfer de memoria dinámica (heap) debido a una validación incorrecta de dwCompressionSize de Microsoft WIM Header WIMHEADER_V1_PACKED. Esta vulnerabilidad puede explotarse para obtener la ejecución remota de código, así como para escalar de privilegios."
    }
  ],
  "lastModified": "2026-06-17T01:26:56.123",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:quickheal:antivirus_pro:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7CD45E1D-9336-41B1-8D24-9946FCAEB898",
              "versionEndIncluding": "10.1.0.316"
            },
            {
              "criteria": "cpe:2.3:a:quickheal:internet_security:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F551FB1D-0142-41AD-8404-744F8DDF4E3C",
              "versionEndIncluding": "10.1.0.316"
            },
            {
              "criteria": "cpe:2.3:a:quickheal:total_security:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7627A0E4-682B-4918-9A2B-F35269620A7F",
              "versionEndIncluding": "10.1.0.316"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}