CVE catalog

CVE-2017-2807

ledger: CVE-2017-2807

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.97% · Oct 25, 2026

An exploitable buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially crafted journal file can cause an integer underflow resulting in code execution. An attacker can construct a malicious journal file to trigger this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianledgersid3.4.1-3fixed
Debianledgerforky3.4.1-3fixed
Debianledgertrixie3.3.2-1fixed
Debianledgerbookworm3.3.0-3fixed
Ubuntuledger16.043.1+dfsg1-5vulnerable
Ubuntuledger16.043.1+dfsg1-6vulnerable
Ubuntuledger16.043.1+dfsg1-7vulnerable
Ubuntuledger16.043.1.1+dfsg1-1vulnerable
Ubuntuledger18.043.1.2~pre1+g3a00e1c+dfsg1-5vulnerable
Ubuntuledger18.043.1.2~pre1+g3a00e1c+dfsg1-5build1vulnerable
Ubuntuledger18.043.1.2~pre1+g3a00e1c+dfsg1-5build2vulnerable
Ubuntuledger18.043.1.2~pre1+g3a00e1c+dfsg1-5build3vulnerable
Ubuntuledger18.043.1.2~pre1+g3a00e1c+dfsg1-5build4vulnerable
Ubuntuledger18.043.1.2~pre1+g3a00e1c+dfsg1-5build5vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianledgersourcesid3.1.2+dfsg1-1lowNot reported[876660]
Debianledgersourceforky3.1.2+dfsg1-1lowNot reported[876660]
Debianledgersourcetrixie3.1.2+dfsg1-1lowNot reported[876660]
Debianledgersourcebookworm3.1.2+dfsg1-1lowNot reported[876660]

[Debian bug #876660]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ledger]Fixed
    Details (2)

    • 3.3.0-3 · amd64 · bookworm

      Fixed · Fixed: 3.1.2+dfsg1-1

      dsa · ledger · debian · bookworm; dsa · ledger · debian · 12

    • 3.3.0-3 · arm64 · bookworm

      Fixed · Fixed: 3.1.2+dfsg1-1

      dsa · ledger · debian · bookworm; dsa · ledger · debian · 12

  • [python3-ledger]Fixed

    Source package: [ledger]

    Details (2)

    • 3.3.0-3 · amd64 · bookworm

      Fixed · Fixed: 3.1.2+dfsg1-1

      dsa · ledger · debian · bookworm; dsa · ledger · debian · 12

    • 3.3.0-3 · arm64 · bookworm

      Fixed · Fixed: 3.1.2+dfsg1-1

      dsa · ledger · debian · bookworm; dsa · ledger · debian · 12

[Debian 13 (Trixie)]

  • [ledger]Fixed

    Source package: [ledger]

    Details (2)

    • 3.3.2-1+b4 · amd64 · trixie

      Fixed · Fixed: 3.1.2+dfsg1-1

      dsa · ledger · debian · 13

    • 3.3.2-1+b5 · arm64 · trixie

      Fixed · Fixed: 3.1.2+dfsg1-1

      dsa · ledger · debian · 13

  • [python3-ledger]Fixed

    Source package: [ledger]

    Details (2)

    • 3.3.2-1+b4 · amd64 · trixie

      Fixed · Fixed: 3.1.2+dfsg1-1

      dsa · ledger · debian · 13

    • 3.3.2-1+b5 · arm64 · trixie

      Fixed · Fixed: 3.1.2+dfsg1-1

      dsa · ledger · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]