CVE-2017-11120

On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor report frame to trigger an internal buffer overflow in the Wi-Fi firmware, aka B-V2017061204.

• CWE-119

• http://packetstormsecurity.com/files/144328/Broadcom-802.11k-Neighbor-Report-Response-Out-Of-Bounds-Write.htmlExploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/100984Third Party Advisory, VDB Entry
• https://bugs.chromium.org/p/project-zero/issues/detail?id=1289Exploit, Issue Tracking, Third Party Advisory
• https://lists.apple.com/archives/security-announce/2017/Sep/msg00007.htmlMailing List, Third Party Advisory
• https://lists.apple.com/archives/security-announce/2017/Sep/msg00009.htmlMailing List, Third Party Advisory
• https://source.android.com/security/bulletin/2017-09-01Third Party Advisory
• https://support.apple.com/HT208112Third Party Advisory
• https://support.apple.com/HT208113Third Party Advisory
• https://support.apple.com/en-us/HT208112Third Party Advisory
• https://support.apple.com/en-us/HT208113Third Party Advisory
• https://www.exploit-db.com/exploits/42784/Exploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/144328/Broadcom-802.11k-Neighbor-Report-Response-Out-Of-Bounds-Write.htmlExploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/100984Third Party Advisory, VDB Entry
• https://bugs.chromium.org/p/project-zero/issues/detail?id=1289Exploit, Issue Tracking, Third Party Advisory
• https://lists.apple.com/archives/security-announce/2017/Sep/msg00007.htmlMailing List, Third Party Advisory
• https://lists.apple.com/archives/security-announce/2017/Sep/msg00009.htmlMailing List, Third Party Advisory
• https://source.android.com/security/bulletin/2017-09-01Third Party Advisory
• https://support.apple.com/HT208112Third Party Advisory
• https://support.apple.com/HT208113Third Party Advisory
• https://support.apple.com/en-us/HT208112Third Party Advisory
• https://support.apple.com/en-us/HT208113Third Party Advisory
• https://www.exploit-db.com/exploits/42784/Exploit, Third Party Advisory, VDB Entry

Published

Sep 28, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-11114The put_chars function in html_r.c in Twibright Links 2.14 a…
• CVE-2017-11115The ExifJpegHUFFTable::deriveTable function in ExifHuffmanTa…
• CVE-2017-11116The ExifImageFile::readDQT function in ExifImageFileRead.cpp…
• CVE-2017-11117The ExifImageFile::readDHT function in ExifImageFileRead.cpp…
• CVE-2017-11118The ExifImageFile::readImage function in ExifImageFileRead.c…
• CVE-2017-11119The chk_mem_access function in cpu/nes6502/nes6502.c in libn…
• CVE-2017-11121On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and othe…
• CVE-2017-11122On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56, an atta…
• CVE-2017-11124libxar.so in xar 1.6.1 has a NULL pointer dereference in the…
• CVE-2017-11125libxar.so in xar 1.6.1 has a NULL pointer dereference in the…
• CVE-2017-11126The III_i_stereo function in libmpg123/layer3.c in mpg123 th…
• CVE-2017-11127Bolt CMS 3.2.14 allows stored XSS by uploading an SVG docume…