Vulnerabilities > CVE-2017-12959 - Reachable Assertion vulnerability in GNU Pspp 0.11.0
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
PARTIAL Summary
There is a reachable assertion abort in the function dict_add_mrset() in data/dictionary.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to a remote denial of service attack.
Common Weakness Enumeration (CWE)
Nessus
NASL family SuSE Local Security Checks NASL id OPENSUSE-2017-996.NASL description This update for pspp fixes the following issues : - CVE-2017-12958: Illegal address access in function output_hex() could lead to denial of service or unexpected state (boo#1054585) - CVE-2017-12959: Assertion in function dict_add_mrset() could lead to denial of service (boo#1054588) - CVE-2017-12960: Assertion in function dict_rename_var() could lead to denial of service (boo#1054587) - CVE-2017-12961: Assertion in function parse_attributes() could lead to denial of service (boo#1054586) last seen 2020-06-05 modified 2017-09-05 plugin id 102949 published 2017-09-05 reporter This script is Copyright (C) 2017-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/102949 title openSUSE Security Update : pspp (openSUSE-2017-996) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_6876B163870811E78568E8E0B747A45A.NASL description CVE Details reports : - There is an Integer overflow in the hash_int function of the libpspp library in GNU PSPP 0.10.5-pre2 (CVE-2017-10791). - There is a NULL pointer Dereference in the function ll_insert() of the libpspp library in GNU PSPP 0.10.5-pre2 (CVE-2017-10792). - There is an illegal address access in the function output_hex() in data/data-out.c of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12958). - There is a reachable assertion abort in the function dict_add_mrset() in data/dictionary.c of the libpspp library in GNU PSPP 0.11.0 that will lead to a remote denial of service attack (CVE-2017-12959). - There is a reachable assertion abort in the function dict_rename_var() in data/dictionary.c of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12960). - There is an assertion abort in the function parse_attributes() in data/sys-file-reader.c of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12961). last seen 2020-06-01 modified 2020-06-02 plugin id 102690 published 2017-08-23 reporter This script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/102690 title FreeBSD : pspp -- multiple vulnerabilities (6876b163-8708-11e7-8568-e8e0b747a45a)