{"id":"CVE-2017-7523","details":"Cygwin versions 1.7.2 up to and including 1.8.0 are vulnerable to buffer overflow vulnerability in wcsxfrm/wcsxfrm_l functions resulting into denial-of-service by crashing the process or potential hijack of the process running with administrative privileges triggered by specially crafted input string.","modified":"2026-10-24T10:30:49.679740875Z","published":"2017-07-21T22:29:00.283Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"source":"CPE_STRING","range":[{"introduced":"1.7.6"},{"last_affected":"1.7.6"},{"introduced":"1.7.13"},{"last_affected":"1.7.13"},{"introduced":"1.8.0"},{"last_affected":"1.8.0"}]}],"vendor_product":"cygwin:cygwin","cpes":["cpe:2.3:a:cygwin:cygwin:1.7.13:*:*:*:*:*:*:*","cpe:2.3:a:cygwin:cygwin:1.7.6:*:*:*:*:*:*:*","cpe:2.3:a:cygwin:cygwin:1.8.0:*:*:*:*:*:*:*"]}]},"references":[{"type":"EVIDENCE","url":"https://cygwin.com/ml/cygwin/2017-05/msg00149.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/cygwin/cygwin","events":[{"introduced":"d355bcd31dbdcd283c490b77652d5d9eac717e3c"},{"last_affected":"d3fc6b7cd4bc784ef8ca4b1cb13b2540ff545d30"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:cygwin:cygwin:1.7.2:*:*:*:*:*:*:*","range":[{"introduced":"1.7.2"},{"last_affected":"1.7.2"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:cygwin:cygwin:1.7.3:*:*:*:*:*:*:*","range":[{"introduced":"1.7.3"},{"last_affected":"1.7.3"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:cygwin:cygwin:1.7.5:*:*:*:*:*:*:*","range":[{"introduced":"1.7.5"},{"last_affected":"1.7.5"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:cygwin:cygwin:1.7.7:*:*:*:*:*:*:*","range":[{"introduced":"1.7.7"},{"last_affected":"1.7.7"}]},{"range":[{"introduced":"1.7.8"},{"last_affected":"1.7.8"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:cygwin:cygwin:1.7.8:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:cygwin:cygwin:1.7.9:*:*:*:*:*:*:*","range":[{"introduced":"1.7.9"},{"last_affected":"1.7.9"}]},{"range":[{"introduced":"1.7.10"},{"last_affected":"1.7.10"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:cygwin:cygwin:1.7.10:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:cygwin:cygwin:1.7.11:*:*:*:*:*:*:*","range":[{"introduced":"1.7.11"},{"last_affected":"1.7.11"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.7.12"},{"last_affected":"1.7.12"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:cygwin:cygwin:1.7.12:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:cygwin:cygwin:1.7.14:*:*:*:*:*:*:*","range":[{"introduced":"1.7.14"},{"last_affected":"1.7.14"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:cygwin:cygwin:1.7.15:*:*:*:*:*:*:*","range":[{"introduced":"1.7.15"},{"last_affected":"1.7.15"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.7.16"},{"last_affected":"1.7.16"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:cygwin:cygwin:1.7.16:*:*:*:*:*:*:*"},{"range":[{"introduced":"1.7.17"},{"last_affected":"1.7.17"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:cygwin:cygwin:1.7.17:*:*:*:*:*:*:*"},{"range":[{"introduced":"1.7.18"},{"last_affected":"1.7.18"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:cygwin:cygwin:1.7.18:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:cygwin:cygwin:1.7.19:*:*:*:*:*:*:*","range":[{"introduced":"1.7.19"},{"last_affected":"1.7.19"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.7.21"},{"last_affected":"1.7.21"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:cygwin:cygwin:1.7.21:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:cygwin:cygwin:1.7.22:*:*:*:*:*:*:*","range":[{"introduced":"1.7.22"},{"last_affected":"1.7.22"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:cygwin:cygwin:1.7.23:*:*:*:*:*:*:*","range":[{"introduced":"1.7.23"},{"last_affected":"1.7.23"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:cygwin:cygwin:1.7.24:*:*:*:*:*:*:*","range":[{"introduced":"1.7.24"},{"last_affected":"1.7.24"}]},{"cpe":"cpe:2.3:a:cygwin:cygwin:1.7.25:*:*:*:*:*:*:*","range":[{"introduced":"1.7.25"},{"last_affected":"1.7.25"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:cygwin:cygwin:1.7.26:*:*:*:*:*:*:*","range":[{"introduced":"1.7.26"},{"last_affected":"1.7.26"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:cygwin:cygwin:1.7.27:*:*:*:*:*:*:*","range":[{"introduced":"1.7.27"},{"last_affected":"1.7.27"}]},{"range":[{"introduced":"1.7.28"},{"last_affected":"1.7.28"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:cygwin:cygwin:1.7.28:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:cygwin:cygwin:1.7.29:*:*:*:*:*:*:*","range":[{"introduced":"1.7.29"},{"last_affected":"1.7.29"}]},{"range":[{"introduced":"1.7.31"},{"last_affected":"1.7.31"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:cygwin:cygwin:1.7.31:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:cygwin:cygwin:1.7.32:*:*:*:*:*:*:*","range":[{"introduced":"1.7.32"},{"last_affected":"1.7.32"}]},{"range":[{"introduced":"1.7.33"},{"last_affected":"1.7.33"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:cygwin:cygwin:1.7.33:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:cygwin:cygwin:1.7.34:*:*:*:*:*:*:*","range":[{"introduced":"1.7.34"},{"last_affected":"1.7.34"}]},{"range":[{"introduced":"1.7.35"},{"last_affected":"1.7.35"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:cygwin:cygwin:1.7.35:*:*:*:*:*:*:*"}]}}],"versions":["1.7.10","1.7.11","1.7.12","1.7.14","1.7.15","1.7.16","1.7.17","1.7.18","1.7.19","1.7.2","1.7.21","1.7.22","1.7.23","1.7.24","1.7.25","1.7.26","1.7.27","1.7.28","1.7.29","1.7.3","1.7.31","1.7.32","1.7.33","1.7.34","1.7.35","1.7.5","1.7.7","1.7.8","1.7.9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-7523.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}