Unscored CVE-2017-8359 EUVD-2017-0058GHSA-j2fw-rfr9-pfrhPYSEC-2017-101

Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based use-after-free related to the grpc_call_destroy function in…

Published Apr 30, 2017 · Updated Aug 5, 2024 · Assigned by mitre

Package: grpc Package: grpc Package: grpcio Ecosystem: Debian Ecosystem: PyPI Ecosystem: Ubuntu

Description

Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based use-after-free related to the grpc_call_destroy function in core/lib/surface/call.c.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	grpc	1.3.2-0.1	—
Debian 13	grpc	1.3.2-0.1	—
Debian 12	grpc	1.3.2-0.1	—

Ubuntu