CVE-2017-5522

Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving WFS get feature requests.

• CWE-119

• http://www.debian.org/security/2017/dsa-3766Third Party Advisory
• http://www.mapserver.org/development/changelog/changelog-6-0-6.html#changelog-6-0-6Release Notes
• http://www.mapserver.org/development/changelog/changelog-6-2-4.html#changelog-6-2-4Release Notes
• http://www.mapserver.org/development/changelog/changelog-6-4.html#changelog-6-4-5Release Notes
• http://www.mapserver.org/development/changelog/changelog-7-0.html#changelog-7-0-4Release Notes
• https://github.com/mapserver/mapserver/commit/e52a436c0e1c5e9f7ef13428dba83194a800f4dfPatch, Third Party Advisory
• https://lists.osgeo.org/pipermail/mapserver-dev/2017-January/015007.htmlMailing List, Third Party Advisory
• http://www.debian.org/security/2017/dsa-3766Third Party Advisory
• http://www.mapserver.org/development/changelog/changelog-6-0-6.html#changelog-6-0-6Release Notes
• http://www.mapserver.org/development/changelog/changelog-6-2-4.html#changelog-6-2-4Release Notes
• http://www.mapserver.org/development/changelog/changelog-6-4.html#changelog-6-4-5Release Notes
• http://www.mapserver.org/development/changelog/changelog-7-0.html#changelog-7-0-4Release Notes
• https://github.com/mapserver/mapserver/commit/e52a436c0e1c5e9f7ef13428dba83194a800f4dfPatch, Third Party Advisory
• https://lists.osgeo.org/pipermail/mapserver-dev/2017-January/015007.htmlMailing List, Third Party Advisory

Published

Mar 15, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-5516Multiple cross-site scripting (XSS) vulnerabilities in the u…
• CVE-2017-5517SQL injection vulnerability in author.control.php in GeniXCM…
• CVE-2017-5518The media-file upload feature in GeniXCMS through 0.0.8 allo…
• CVE-2017-5519SQL injection vulnerability in Posts.class.php in GeniXCMS t…
• CVE-2017-5520The media rename feature in GeniXCMS through 0.0.8 does not …
• CVE-2017-5521An issue was discovered on NETGEAR R8500, R8300, R7000, R640…8.1
• CVE-2017-5524Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote …
• CVE-2017-5525Memory leak in hw/audio/ac97.c in QEMU (aka Quick Emulator) …6.5
• CVE-2017-5526Memory leak in hw/audio/es1370.c in QEMU (aka Quick Emulator…6.5
• CVE-2017-5527TIBCO Spotfire Server 7.0.X before 7.0.2, 7.5.x before 7.5.1…4.3
• CVE-2017-5528Multiple JasperReports Server components contain vulnerabili…8.8
• CVE-2017-5529JasperReports library components contain an information disc…4.1