CVE-2017-17820

Publication date 20 December 2017

Last updated 25 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp_list_one_macro in asm/preproc.c that will lead to a remote denial of service attack, related to mishandling of operand-type errors.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
nasm	18.04 LTS bionic	Not affected
	17.10 artful	Fixed 2.13.01-2ubuntu0.1
	16.04 LTS xenial	Fixed 2.11.08-1ubuntu0.1
	14.04 LTS trusty	Fixed 2.10.09-1ubuntu0.1

Notes

mdeslaur

need to investigate which commit fixed this

Severity score breakdown

Parameter	Value
Base score	5.5 · Medium
Attack vector	Local
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H