{"id":"CVE-2017-9434","aliases":["DEBIAN-CVE-2017-9434","EUVD-2017-18369","GHSA-2c95-vmhq-43cg","MGASA-2017-0175","UBUNTU-CVE-2017-9434","USN-4827-1"],"status":"published","title":"Crypto++ (aka cryptopp) through 5.6.5 contains an out-of-bounds read vulnerability in zinflate...","description":"Crypto++ (aka cryptopp) through 5.6.5 contains an out-of-bounds read vulnerability in zinflate.cpp in the Inflator filter.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01723,"percentile":0.77654,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2017-06-05T14:00:00Z","modified":"2026-10-20T13:26:22Z","fixes":[{"ecosystem":"Debian:12","package":"libcrypto++","fixed_in":["5.6.4-7"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libcrypto++","fixed_in":["5.6.4-7"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libcrypto++","fixed_in":["5.6.4-7"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"libcryptopp","fixed_in":["5.6.3-1.4.mga5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libcrypto++","fixed_in":["5.6.1-6+deb8u3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libcrypto++","fixed_in":["5.6.1-9ubuntu0.1+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libcrypto++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.4-7"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libcrypto++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.4-7"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libcrypto++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.4-7"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"libcryptopp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.3-1.4.mga5"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libcrypto++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-6+deb8u3ubuntu0.1~esm1"}]}],"versions":["5.6.1-6","5.6.1-6+deb8u1build0.14.04.1","5.6.1-6+deb8u3build0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libcrypto++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-9ubuntu0.1+esm1"}]}],"versions":["5.6.1-8","5.6.1-9","5.6.1-9ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libcrypto++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-6+deb8u3ubuntu0.1~esm1"}]}],"versions":["5.6.1-6","5.6.1-6+deb8u1build0.14.04.1","5.6.1-6+deb8u3build0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libcrypto++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-9ubuntu0.1+esm1"}]}],"versions":["5.6.1-8","5.6.1-9","5.6.1-9ubuntu0.1"]}],"products":[{"vendor":"cryptopp","product":"crypto\\+\\+"}],"references":[{"url":"http://openwall.com/lists/oss-security/2017/06/06/2","tags":["x_refsource_CONFIRM","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://github.com/weidai11/cryptopp/issues/414","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://github.com/weidai11/cryptopp/commit/07dbcc3d9644b18e05c1776db2a57fe04d780965","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","report"]},{"url":"http://www.securityfocus.com/bid/99007","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7IL5A6465IEPW5GAWGXB2ENJPFYVWTJM/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9434"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7IL5A6465IEPW5GAWGXB2ENJPFYVWTJM"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7IL5A6465IEPW5GAWGXB2ENJPFYVWTJM"},{"url":"https://github.com/advisories/GHSA-2c95-vmhq-43cg"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-9434","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0175.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21029","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9434","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9434","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4827-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-9434","description":"Crypto++ (aka cryptopp) through 5.6.5 contains an out-of-bounds read vulnerability in zinflate.cpp in the Inflator filter.","status":"published","published":"2017-06-05T14:00:00Z","modified":"2024-08-05T17:11:00.383Z","updated_at":"2026-11-02T14:33:13.606903Z"}],"euvd":[{"id":"EUVD-2017-18369","description":"Crypto++ (aka cryptopp) through 5.6.5 contains an out-of-bounds read vulnerability in zinflate.cpp in the Inflator filter.","status":"published","published":"2017-06-05T14:00:00Z","modified":"2024-08-05T17:11:00Z","updated_at":"2026-11-03T02:23:28.210565Z"}],"ghsa":[{"id":"GHSA-2c95-vmhq-43cg","title":"Crypto++ (aka cryptopp) through 5.6.5 contains an out-of-bounds read vulnerability in zinflate...","description":"Crypto++ (aka cryptopp) through 5.6.5 contains an out-of-bounds read vulnerability in zinflate.cpp in the Inflator filter.","status":"published","published":"2022-05-14T00:59:46Z","modified":"2025-04-20T03:39:31Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:01:47.375435Z"}],"nvd":[{"id":"CVE-2017-9434","description":"Crypto++ (aka cryptopp) through 5.6.5 contains an out-of-bounds read vulnerability in zinflate.cpp in the Inflator filter.","status":"published","published":"2017-06-05T14:29:00.653Z","modified":"2026-06-17T01:28:05.72Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:03:49.449157Z"}],"osv":[{"id":"CVE-2017-9434","description":"Crypto++ (aka cryptopp) through 5.6.5 contains an out-of-bounds read vulnerability in zinflate.cpp in the Inflator filter.","status":"published","published":"2017-06-05T14:29:00.653Z","modified":"2026-10-20T13:26:22.956846297Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:06.868403Z"},{"id":"DEBIAN-CVE-2017-9434","description":"Crypto++ (aka cryptopp) through 5.6.5 contains an out-of-bounds read vulnerability in zinflate.cpp in the Inflator filter.","status":"published","published":"2017-06-05T14:29:00.653Z","modified":"2026-09-01T20:03:51.77522764Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:29.698576Z"},{"id":"UBUNTU-CVE-2017-9434","description":"Crypto++ (aka cryptopp) through 5.6.5 contains an out-of-bounds read vulnerability in zinflate.cpp in the Inflator filter.","status":"published","published":"2017-06-05T14:29:00Z","modified":"2026-04-22T11:37:43.215155Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:16.154988Z"},{"id":"MGASA-2017-0175","title":"Updated libcryptopp packages fix security vulnerability","description":"Crypto++'s Zinflate class, used by classes like Gunzip and Inflator, could\nperform an out-of-bounds read when decompressing data (CVE-2017-9434).\n","status":"published","published":"2017-06-14T15:52:21Z","modified":"2026-04-16T06:22:25.835668759Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"USN-4827-1","title":"libcrypto++ vulnerability","description":"It was discovered that Crypto++ mishandled certain input. An attacker could\nuse this vulnerability to leak potentially sensitive information.","status":"published","published":"2021-03-15T22:10:03Z","modified":"2026-06-29T13:47:51.747249973Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}