CVE-2017-5645

Published Apr 17, 2017

Last updated a month ago

CVSS critical 9.8

Overview

Description
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
Source
security@apache.org
NVD status
Modified
Products
log4j, oncommand_api_services, oncommand_insight, oncommand_workflow_automation, service_level_manager, snapcenter, storage_automation_store, fuse, enterprise_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_server_aus, enterprise_linux_server_eus, enterprise_linux_server_tus, enterprise_linux_workstation, api_gateway, application_testing_suite, autovue_vuelink_integration, banking_platform, bi_publisher, communications_converged_application_server_-_service_controller, communications_instant_messaging_server, communications_interactive_session_recorder, communications_messaging_server, communications_network_integrity, communications_online_mediation_controller, communications_pricing_design_center, communications_service_broker, communications_webrtc_session_controller, configuration_manager, endeca_information_discovery_studio, enterprise_data_quality, enterprise_manager_base_platform, enterprise_manager_for_fusion_middleware, enterprise_manager_for_mysql_database, enterprise_manager_for_oracle_database, enterprise_manager_for_peoplesoft, financial_services_analytical_applications_infrastructure, financial_services_behavior_detection_platform, financial_services_hedge_management_and_ifrs_valuations, financial_services_lending_and_leasing, financial_services_loan_loss_forecasting_and_provisioning, financial_services_profitability_management, financial_services_regulatory_reporting_with_agilereporter, flexcube_investor_servicing, fusion_middleware_mapviewer, goldengate, goldengate_application_adapters, identity_analytics, identity_management_suite, identity_manager_connector, in-memory_performance-driven_planning, instantis_enterprisetrack, insurance_calculation_engine, insurance_policy_administration, insurance_rules_palette, jd_edwards_enterpriseone_tools, jdeveloper, mysql_enterprise_monitor, peoplesoft_enterprise_fin_install, policy_automation, policy_automation_connector_for_siebel, policy_automation_for_mobile_devices, primavera_gateway, rapid_planning, retail_advanced_inventory_planning, retail_clearance_optimization_engine, retail_extract_transform_and_load, retail_integration_bus, retail_open_commerce_platform, retail_predictive_application_server, retail_service_backbone, siebel_ui_framework, soa_suite, tape_library_acsls, timesten_in-memory_database, utilities_advanced_spatial_and_operational_analytics, utilities_work_and_asset_management, weblogic_server

Risk scores

CVSS 3.1

Type
Primary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

CVSS 2.0

Type
Primary
Base score
7.5
Impact score
6.4
Exploitability score
10
Vector string
AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov
CWE-502

Social media

Hype score
Not currently trending

Configurations

Related CVEs

  1. A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share could overwrite a protected file by renaming a newly created file over the existing WORM-protected file.•CVE-2026-2340
  2. A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata through SMB operations even on read-only exports. This could allow modification of SMB-visible file behavior, including converting files into symbolic links or other reparse point types.•CVE-2026-1933
  3. A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service.•CVE-2026-48864
  4. A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.•CVE-2026-4480
  5. A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS).•CVE-2026-9149

References

Sources include official advisories and independent security research.