Incomplete vulnerability mitigations

Published 8 y ago 2017-11-14 · modified 4 mo ago 2026-06-17 · JSON

CVSS

1.9

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.5%

percentile 43%

Public exploits

none known

In BlackBerry QNX Software Development Platform (SDP) 6.6.0, the default configuration of the QNX SDP system did not in all circumstances prevent attackers from modifying the GOT or PLT tables with buffer overflow attacks.

Exploit prediction (EPSS)

0.50% probability of exploitation in the next 30 days, higher than 43% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.1	1.9	`CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N`
CNA	3.1	1.9	`CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N`
NVD	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`
NVD	2.0	6.4	`AV:N/AC:L/Au:N/C:N/I:P/A:P`

Affected products

BlackBerry QNX Software Development Platform (QNX SDP)

Classification

Weakness

CWE-693 Protection Mechanism Failure
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

support.blackberry.com /kb/articleDetail?articleNumber=000046674 · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2017-3893
NVD: CVE-2017-3893

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.