{"id":"CVE-2017-1000376","aliases":["BELL-CVE-2017-1000376","DEBIAN-CVE-2017-1000376","DLA-997-1","DSA-3889-1","EUVD-2017-1535","GHSA-8jcm-439f-pj4q","MGASA-2017-0201","SUSE-SU-2018:0300-1","UBUNTU-CVE-2017-1000376","USN-3454-1"],"status":"published","title":"libffi requests an executable stack allowing attackers to more easily trigger arbitrary code...","description":"libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note that libffi is used by a number of other libraries. It was previously stated that this affects libffi version 3.2.1 but this appears to be incorrect. libffi prior to version 3.1 on 32 bit x86 systems was vulnerable, and upstream is believed to have fixed this issue in version 3.1.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00503,"percentile":0.43317,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2017-06-19T00:00:00Z","modified":"2026-10-24T10:30:58Z","fixes":[{"ecosystem":"Debian:12","package":"libffi","fixed_in":["3.2.1-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libffi","fixed_in":["3.2.1-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libffi","fixed_in":["3.2.1-4"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"libffi","fixed_in":["3.0.10-3+deb7u1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"libffi","fixed_in":["3.1-2+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"libffi","fixed_in":["3.1-4.1.mga5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"gcc43","fixed_in":["4.3.4_20091019-37.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"gcc43","fixed_in":["4.3.4_20091019-37.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"gcc43","fixed_in":["4.3.4_20091019-37.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"gcc43","fixed_in":["4.3.4_20091019-37.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"gcc43","fixed_in":["4.3.4_20091019-37.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"gcc43","fixed_in":["4.3.4_20091019-37.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libffi","fixed_in":["3.1~rc1+r3.0.13-12ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-4"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"libffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.10-3+deb7u1"}]}],"versions":["3.0.10-3"]},{"source":"osv","ecosystem":"Debian:8","package":"libffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-2+deb8u1"}]}],"versions":["3.1-2"]},{"source":"osv","ecosystem":"Mageia:5","package":"libffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-4.1.mga5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"gcc43","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4_20091019-37.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"gcc43","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4_20091019-37.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"gcc43","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4_20091019-37.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"gcc43","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4_20091019-37.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"gcc43","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4_20091019-37.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"gcc43","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4_20091019-37.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1~rc1+r3.0.13-12ubuntu0.2"}]}],"versions":["3.0.13-4","3.0.13-5","3.0.13-6","3.0.13-9ubuntu1","3.0.13-10","3.0.13-10build1","3.0.13-11","3.0.13-12","3.1~rc1-2","3.1~rc1+r3.0.13-12","3.1~rc1+r3.0.13-12ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1~rc1+r3.0.13-12ubuntu0.2"}]}],"versions":["3.0.13-4","3.0.13-5","3.0.13-6","3.0.13-9ubuntu1","3.0.13-10","3.0.13-10build1","3.0.13-11","3.0.13-12","3.1~rc1-2","3.1~rc1+r3.0.13-12","3.1~rc1+r3.0.13-12ubuntu0.1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"libffi_project","product":"libffi"},{"vendor":"oracle","product":"peopletools"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_virtualization_server"},{"vendor":"redhat","product":"openshift"}],"references":[{"url":"https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","web","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-1000376","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","report"]},{"url":"http://www.debian.org/security/2017/dsa-3889","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000376"},{"url":"https://github.com/advisories/GHSA-8jcm-439f-pj4q"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2017-1000376","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-1000376","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0201.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21122","tags":["report"]},{"url":"https://github.com/libffi/libffi/commit/978c9540154d320525488db1b7049277122f736d","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180300-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1039513","tags":["report"]},{"url":"https://bugzilla.suse.com/1044016","tags":["report"]},{"url":"https://bugzilla.suse.com/1045091","tags":["report"]},{"url":"https://bugzilla.suse.com/1059075","tags":["report"]},{"url":"https://bugzilla.suse.com/1074621","tags":["report"]},{"url":"https://bugzilla.suse.com/938159","tags":["report"]},{"url":"https://bugzilla.suse.com/977654","tags":["report"]},{"url":"https://bugzilla.suse.com/999596","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000376","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-1000376","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3454-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3454-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-1000376","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-1000376","description":"libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note that libffi is used by a number of other libraries. It was previously stated that this affects libffi version 3.2.1 but this appears to be incorrect. libffi prior to version 3.1 on 32 bit x86 systems was vulnerable, and upstream is believed to have fixed this issue in version 3.1.","status":"published","published":"2017-06-19T16:00:00Z","modified":"2024-08-05T22:00:41.083Z","updated_at":"2026-11-02T14:33:20.843976Z"}],"euvd":[{"id":"EUVD-2017-1535","description":"libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note that libffi is used by a number of other libraries. It was previously stated that this affects libffi version 3.2.1 but this appears to be incorrect. libffi prior to version 3.1 on 32 bit x86 systems was vulnerable, and upstream is believed to have fixed this issue in version 3.1.","status":"published","published":"2017-06-19T16:00:00Z","modified":"2024-08-05T22:00:41Z","updated_at":"2026-11-03T02:23:03.159581Z"}],"ghsa":[{"id":"GHSA-8jcm-439f-pj4q","title":"libffi requests an executable stack allowing attackers to more easily trigger arbitrary code...","description":"libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note that libffi is used by a number of other libraries. It was previously stated that this affects libffi version 3.2.1 but this appears to be incorrect. libffi prior to version 3.1 on 32 bit x86 systems was vulnerable, and upstream is believed to have fixed this issue in version 3.1.","status":"published","published":"2022-05-13T01:28:55Z","modified":"2023-02-01T05:08:05Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:50:40.636216Z"}],"nvd":[{"id":"CVE-2017-1000376","description":"libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note that libffi is used by a number of other libraries. It was previously stated that this affects libffi version 3.2.1 but this appears to be incorrect. libffi prior to version 3.1 on 32 bit x86 systems was vulnerable, and upstream is believed to have fixed this issue in version 3.1.","status":"published","published":"2017-06-19T16:29:00.577Z","modified":"2026-06-17T00:59:03.57Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.9,"vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:50.782497Z"}],"osv":[{"id":"BELL-CVE-2017-1000376","title":"CVE-2017-1000376 does not affect BellSoft software","status":"withdrawn","published":"2017-06-19T16:29:00Z","modified":"2026-01-26T09:46:50.12651Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2017-1000376","description":"libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note that libffi is used by a number of other libraries. It was previously stated that this affects libffi version 3.2.1 but this appears to be incorrect. libffi prior to version 3.1 on 32 bit x86 systems was vulnerable, and upstream is believed to have fixed this issue in version 3.1.","status":"published","published":"2017-06-19T16:29:00.577Z","modified":"2026-11-03T02:30:26.337438412Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:05:56.635441Z"},{"id":"DEBIAN-CVE-2017-1000376","description":"libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note that libffi is used by a number of other libraries. It was previously stated that this affects libffi version 3.2.1 but this appears to be incorrect. libffi prior to version 3.1 on 32 bit x86 systems was vulnerable, and upstream is believed to have fixed this issue in version 3.1.","status":"published","published":"2017-06-19T16:29:00.577Z","modified":"2026-09-01T20:03:41.407639643Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.207321Z"},{"id":"UBUNTU-CVE-2017-1000376","description":"libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note that libffi is used by a number of other libraries. It was previously stated that this affects libffi version 3.2.1 but this appears to be incorrect. libffi prior to version 3.1 on 32 bit x86 systems was vulnerable, and upstream is believed to have fixed this issue in version 3.1.","status":"published","published":"2017-06-19T00:00:00Z","modified":"2026-04-22T11:08:42.082164Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:13.729565Z"},{"id":"DLA-997-1","title":"libffi - security update","status":"published","published":"2017-06-20T00:00:00Z","modified":"2026-03-09T02:10:24.567871Z","updated_at":"2026-11-02T15:46:13.584509Z"},{"id":"DSA-3889-1","title":"libffi - security update","status":"published","published":"2017-06-19T00:00:00Z","modified":"2026-03-09T01:22:09.639695Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0201","title":"Updated libffi packages fix security vulnerability","description":"libffi, a library used to call code written in one language from code\nwritten  in a different language, was enforcing an executable stack on the\ni386 architecture. While this might not be considered a vulnerability by\nitself, this could be leveraged when exploiting other vulnerabilities,\nsuch as the \"stack clash\" class of vulnerabilities discovered by Qualys\nResearch Labs.\n","status":"published","published":"2017-07-07T09:17:28Z","modified":"2026-04-16T06:22:29.551583066Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"SUSE-SU-2018:0300-1","title":"Security update for gcc43","description":"\n  \nThis update for gcc43 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2017-1000376: Don't request excutable stack from libffi.  [bnc#1045091]\n\nNew features:\n\n- Add support for retpolines to mitigate the Spectre Variant 2 attack. [bnc#1074621]\n- Add support for zero-sized VLAs and allocas with -fstack-clash-protection.  [bnc#1059075]\n- Add support for -fstack-clash-protection to mitigate the Stack Clash attack.  [bnc#1039513]\n\nNon security bugs fixed:\n\n- Fixed build of 32bit libgcov.a with LFS support.  [bsc#1044016]\n- Fixed issue with libstdc++ functional when an exception is thrown during construction.  [bsc#999596]\n- Fixed issue with using gcov and #pragma pack.  [bsc#977654]\n- Fixed ICE compiling AFS modules for the s390x kernel.  [bsc#938159]\n- Backport large file support from GCC 4.6.\n\n","status":"published","published":"2018-01-30T12:05:23Z","modified":"2026-02-04T03:20:34.891891Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"USN-3454-1","title":"libffi vulnerability","description":"It was discovered that libffi incorrectly enforced an executable stack. An\nattacker could possibly use this issue, in combination with another\nvulnerability, to facilitate executing arbitrary code.\n","status":"published","published":"2017-10-12T18:08:32Z","modified":"2026-04-22T09:40:28.627958Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}