CVE-2017-0359

diffoscope writes to arbitrary locations on disk based on the contents of an untrusted archive

9.8 CriticalFix available

CVE-2017-0359 is a critical vulnerability (CVSS 9.8) in Debian Diffoscope, published April 13, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.25%, the 82nd percentile. Fixed in diffoscope 76.

diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.25%Up 1.6 points since Aug 1, 2021

What each source reports

NVD Score used 9.8

diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive.

Record: CVE-2017-0359
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Updated: 2026-11-02

CVE List No score

diffoscope writes to arbitrary locations on disk based on the contents of an untrusted archive

diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive.

Record: CVE-2017-0359
Updated: 2026-11-02

EUVDEUVD-2018-0032 No score

diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive.

Record: EUVD-2018-0032
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8p5c-f328-9fvv 9.3

Diffoscope may write to arbitrary locations due to an untrusted archive

diffoscope before 76 writes to arbitrary locations on disk based on the contents of an untrusted archive.

Record: GHSA-8p5c-f328-9fvv
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

OSV 9.8

diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive.

Record: CVE-2017-0359
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2017-0359 9.8

diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive.

Record: DEBIAN-CVE-2017-0359
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 4 moreShow less

OSVGHSA-8p5c-f328-9fvv 9.3

Diffoscope may write to arbitrary locations due to an untrusted archive

diffoscope before 76 writes to arbitrary locations on disk based on the contents of an untrusted archive.

Record: GHSA-8p5c-f328-9fvv
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

OSVUBUNTU-CVE-2017-0359 9.8

diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive.

Record: UBUNTU-CVE-2017-0359
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10717-1 No score

diffoscope-183-1.2 on GA media

These are all security issues fixed in the diffoscope-183-1.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10717-1
Updated: 2026-11-02

OSVPYSEC-2018-83 No score

diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive.

Record: PYSEC-2018-83
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`diffoscope` PyPI	before 76	76
`diffoscope` Debian:12	before 77	77
`diffoscope` Debian:13	before 77	77
`diffoscope` Debian:14	before 77	77
`diffoscope` PyPI	before 76, plus listed versions 3940414243 Show 28 moreShow less 44454647484951525455565960616263646566676869707172737475	76
`diffoscope` PyPI	before 77, plus listed versions 3940414243 Show 29 moreShow less 4445464748495152545556596061626364656667686970717273747576	77
`diffoscope` Ubuntu:16.04:LTS	All versions, plus listed versions 33384142484951	None known
`diffoscope` openSUSE:Tumbleweed	before 183-1.2	183-1.2

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 6 moreShow less