CVE-2017-10671

Heap-based Buffer Overflow in the de_dotdot function in libhttpd.c in sthttpd before 2.27.1 allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a crafted filename.

• CWE-787

• http://www.openwall.com/lists/oss-security/2017/06/15/9Mailing List, Patch, Third Party Advisory
• https://github.com/blueness/sthttpd/commit/c0dc63a49d8605649f1d8e4a96c9b468b0bff660Issue Tracking, Patch, Third Party Advisory
• https://github.com/blueness/sthttpd/releases/tag/v2.27.1Issue Tracking, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2017/06/15/9Mailing List, Patch, Third Party Advisory
• https://github.com/blueness/sthttpd/commit/c0dc63a49d8605649f1d8e4a96c9b468b0bff660Issue Tracking, Patch, Third Party Advisory
• https://github.com/blueness/sthttpd/releases/tag/v2.27.1Issue Tracking, Patch, Third Party Advisory

Published

Jun 29, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-10665Directory traversal vulnerability in ajaxfileupload.php in K…
• CVE-2017-10667In index.php in Zen Cart 1.6.0, the products_id parameter ca…
• CVE-2017-10668A Padding Oracle exists in OSCI-Transport 1.2 as used in OSC…
• CVE-2017-10669Signature Wrapping exists in OSCI-Transport 1.2 as used in O…
• CVE-2017-1067Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-10670An XML External Entity (XXE) issue exists in OSCI-Transport …
• CVE-2017-10672Use-after-free in the XML-LibXML module through 2.0129 for P…9.8
• CVE-2017-10673admin/profile.php in GetSimple CMS 3.x has XSS in a name fie…6.1
• CVE-2017-10674Antiy Antivirus Engine 5.0.0.06281654 allows local users to …
• CVE-2017-10676On D-Link DIR-600M devices before C1_v3.05ENB01_beta_2017030…
• CVE-2017-10677Cross-Site Request Forgery (CSRF) exists on Linksys EA4500 d…
• CVE-2017-10678Cross-site request forgery (CSRF) vulnerability in Piwigo th…