CVE catalog

CVE-2017-8779

libtirpc: CVE-2017-8779

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
81.23% · Oct 25, 2026

rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory consumption with no subsequent free) via a crafted UDP packet to port 111, aka rpcbomb.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianntirpcsid15.2-3fixed
Debianntirpcforky15.2-3fixed
Debianntirpctrixie6.3-2fixed
Debianntirpcbookworm4.3-2fixed
Debianrpcbindsid1.2.7-1fixed
Debianrpcbindforky1.2.7-1fixed
Debianrpcbindtrixie1.2.7-1fixed
Debianrpcbindbookworm1.2.6-6fixed
Debianlibtirpcsid1.3.7+ds-1fixed
Debianlibtirpcforky1.3.7+ds-1fixed
Debianlibtirpctrixie1.3.6+ds-1fixed
Debianlibtirpcbookworm1.3.3+ds-1fixed
Ubunturpcbindpro0.2.1-6ubuntu4vulnerable
Ubunturpcbindpro0.2.3-0.2vulnerable
Ubunturpcbindpro0.2.3-0.2ubuntu0.1vulnerable
Ubunturpcbindpro0.2.3-0.2ubuntu0.16.04.1vulnerable
Ubunturpcbindpro0.2.3-0.2ubuntu0.16.04.1+esm1fixed
Alpinerpcbind3.100.2.4-r0fixed
Alpinerpcbind3.110.2.4-r0fixed
Alpinerpcbind3.120.2.4-r0fixed
Alpinerpcbind3.130.2.4-r0fixed
Alpinerpcbind3.140.2.4-r0fixed
Alpinerpcbind3.150.2.4-r0fixed
Alpinerpcbind3.160.2.4-r0fixed
Alpinerpcbind3.170.2.4-r0fixed
Alpinerpcbind3.180.2.4-r0fixed
Alpinerpcbind3.190.2.4-r0fixed
Alpinerpcbind3.200.2.4-r0fixed
Alpinerpcbind3.210.2.4-r0fixed
Alpinerpcbind3.220.2.4-r0fixed
Alpinerpcbind3.230.2.4-r0fixed
Alpinerpcbind3.240.2.4-r0fixed
Alpinerpcbind3.70.2.4-r0fixed
Alpinerpcbind3.80.2.4-r0fixed
Alpinerpcbind3.90.2.4-r0fixed
Ubunturpcbind18.040.2.3-0.6vulnerable
Ubunturpcbind18.040.2.3-0.6ubuntu0.18.04.1vulnerable
Ubunturpcbind18.040.2.3-0.6ubuntu0.18.04.2fixed
Ubuntulibtirpc14.040.2.2-5ubuntu1vulnerable
Ubuntulibtirpc14.040.2.2-5ubuntu2vulnerable
Ubuntulibtirpc14.040.2.2-5ubuntu2.1fixed
Ubunturpcbindpro0.2.1-6ubuntu4vulnerable
Ubunturpcbindpro0.2.3-0.2vulnerable
Ubunturpcbindpro0.2.3-0.2ubuntu0.1vulnerable
Ubunturpcbindpro0.2.3-0.2ubuntu0.16.04.1vulnerable
Ubunturpcbindpro0.2.3-0.2ubuntu0.16.04.1+esm1fixed
Ubuntulibtirpc16.040.2.5-1vulnerable
Ubuntulibtirpc16.040.2.5-1ubuntu0.1fixed
Ubuntuntirpc16.041.3.1-1vulnerable
Ubunturpcbind18.040.2.3-0.6vulnerable
Ubunturpcbind18.040.2.3-0.6ubuntu0.18.04.1vulnerable
Ubunturpcbind18.040.2.3-0.6ubuntu0.18.04.2fixed
Suserpcbindlinux enterprise desktop 12 sp10.2.1_rc4-17.3.1fixed
Suserpcbindlinux enterprise server 12 sp10.2.1_rc4-17.3.1fixed
Suserpcbindlinux enterprise server for sap applications 12 sp10.2.1_rc4-17.3.1fixed
Opensuserpcbindtumbleweed1.2.6-2.2fixed
Suselibtirpclinux enterprise desktop 12 sp10.2.3-13.3.1fixed
Suselibtirpclinux enterprise software development kit 12 sp10.2.3-13.3.1fixed
Suselibtirpclinux enterprise server 12 sp10.2.3-13.3.1fixed
Suselibtirpclinux enterprise server for sap applications 12 sp10.2.3-13.3.1fixed
Suselibtirpclinux enterprise software development kit 11 sp40.2.1-1.12.3fixed
Suselibtirpclinux enterprise point of sale 11 sp30.2.1-1.12.3fixed
Suserpcbindlinux enterprise point of sale 11 sp30.1.6+git20080930-6.27.2fixed
Suselibtirpclinux enterprise server 11 sp3-ltss0.2.1-1.12.3fixed
Suserpcbindlinux enterprise server 11 sp3-ltss0.1.6+git20080930-6.27.2fixed
Suselibtirpclinux enterprise server 11 sp3-teradata0.2.1-1.12.3fixed
Suserpcbindlinux enterprise server 11 sp3-teradata0.1.6+git20080930-6.27.2fixed
Suselibtirpclinux enterprise server 11 sp40.2.1-1.12.3fixed
Suserpcbindlinux enterprise server 11 sp40.1.6+git20080930-6.27.2fixed
Suselibtirpclinux enterprise server for sap applications 11 sp40.2.1-1.12.3fixed
Suserpcbindlinux enterprise server for sap applications 11 sp40.1.6+git20080930-6.27.2fixed
Suserpcbindlinux enterprise desktop 12 sp20.2.3-23.1fixed
Suserpcbindlinux enterprise server for raspberry pi 12 sp20.2.3-23.1fixed
Suserpcbindlinux enterprise server 12 sp20.2.3-23.1fixed
Suserpcbindlinux enterprise server for sap applications 12 sp20.2.3-23.1fixed
Suselibtirpclinux enterprise desktop 12 sp21.0.1-16.1fixed
Suselibtirpclinux enterprise server for raspberry pi 12 sp21.0.1-16.1fixed
Suselibtirpclinux enterprise software development kit 12 sp21.0.1-16.1fixed
Suselibtirpclinux enterprise server 12 sp21.0.1-16.1fixed
Suselibtirpclinux enterprise server for sap applications 12 sp21.0.1-16.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianntirpcsourcesid1.4.4-1not yet assignedNot reported[861836]
Debianntirpcsourceforky1.4.4-1not yet assignedNot reported[861836]
Debianntirpcsourcetrixie1.4.4-1not yet assignedNot reported[861836]
Debianntirpcsourcebookworm1.4.4-1not yet assignedNot reported[861836]
Debianrpcbindsourcesid0.2.3-0.6not yet assignedNot reported[861835]
Debianrpcbindsourceforky0.2.3-0.6not yet assignedNot reported[861835]
Debianrpcbindsourcetrixie0.2.3-0.6not yet assignedNot reported[861835]
Debianrpcbindsourcebookworm0.2.3-0.6not yet assignedNot reported[861835]
Debianlibtirpcsourcesid0.2.5-1.2not yet assignedNot reported[861834]
Debianlibtirpcsourceforky0.2.5-1.2not yet assignedNot reported[861834]
Debianlibtirpcsourcetrixie0.2.5-1.2not yet assignedNot reported[861834]
Debianlibtirpcsourcebookworm0.2.5-1.2not yet assignedNot reported[861834]
Ubunturpcbinddebpro0.2.3-0.2ubuntu0.16.04.1+esm1Not reportedUSN-4986-2Not reported
Alpinerpcbindapk3.100.2.4-r0Not reportedALPINE-CVE-2017-8779Not reported
Alpinerpcbindapk3.110.2.4-r0Not reportedALPINE-CVE-2017-8779Not reported
Alpinerpcbindapk3.120.2.4-r0Not reportedALPINE-CVE-2017-8779Not reported
Alpinerpcbindapk3.130.2.4-r0Not reportedALPINE-CVE-2017-8779Not reported
Alpinerpcbindapk3.140.2.4-r0Not reportedALPINE-CVE-2017-8779Not reported
Alpinerpcbindapk3.150.2.4-r0Not reportedALPINE-CVE-2017-8779Not reported
Alpinerpcbindapk3.160.2.4-r0Not reportedALPINE-CVE-2017-8779Not reported
Alpinerpcbindapk3.170.2.4-r0Not reportedALPINE-CVE-2017-8779Not reported
Alpinerpcbindapk3.180.2.4-r0Not reportedALPINE-CVE-2017-8779Not reported
Alpinerpcbindapk3.190.2.4-r0Not reportedALPINE-CVE-2017-8779Not reported
Alpinerpcbindapk3.200.2.4-r0Not reportedALPINE-CVE-2017-8779Not reported
Alpinerpcbindapk3.210.2.4-r0Not reportedALPINE-CVE-2017-8779Not reported
Alpinerpcbindapk3.220.2.4-r0Not reportedALPINE-CVE-2017-8779Not reported
Alpinerpcbindapk3.230.2.4-r0Not reportedALPINE-CVE-2017-8779Not reported
Alpinerpcbindapk3.240.2.4-r0Not reportedALPINE-CVE-2017-8779Not reported
Alpinerpcbindapk3.70.2.4-r0Not reportedALPINE-CVE-2017-8779Not reported
Alpinerpcbindapk3.80.2.4-r0Not reportedALPINE-CVE-2017-8779Not reported
Alpinerpcbindapk3.90.2.4-r0Not reportedALPINE-CVE-2017-8779Not reported
Ubunturpcbinddeb18.040.2.3-0.6ubuntu0.18.04.2Not reportedUSN-4986-1Not reported
Ubuntulibtirpcdeb14.040.2.2-5ubuntu2.1Not reportedUBUNTU-CVE-2017-8779Not reported
Ubunturpcbinddebpro0.2.3-0.2ubuntu0.16.04.1+esm1Not reportedUBUNTU-CVE-2017-8779Not reported
Ubuntulibtirpcdeb16.040.2.5-1ubuntu0.1Not reportedUBUNTU-CVE-2017-8779Not reported
Ubunturpcbinddeb18.040.2.3-0.6ubuntu0.18.04.2Not reportedUBUNTU-CVE-2017-8779Not reported
Suserpcbindrpmlinux enterprise desktop 12 sp10.2.1_rc4-17.3.1Not reportedSUSE-SU-2017:1336-1Not reported
Suserpcbindrpmlinux enterprise server 12 sp10.2.1_rc4-17.3.1Not reportedSUSE-SU-2017:1336-1Not reported
Suserpcbindrpmlinux enterprise server for sap applications 12 sp10.2.1_rc4-17.3.1Not reportedSUSE-SU-2017:1336-1Not reported
Opensuserpcbindrpmtumbleweed1.2.6-2.2Not reportedOPENSUSE-SU-2024:11304-1Not reported
Suselibtirpcrpmlinux enterprise desktop 12 sp10.2.3-13.3.1Not reportedSUSE-SU-2017:1306-1Not reported
Suselibtirpcrpmlinux enterprise software development kit 12 sp10.2.3-13.3.1Not reportedSUSE-SU-2017:1306-1Not reported
Suselibtirpcrpmlinux enterprise server 12 sp10.2.3-13.3.1Not reportedSUSE-SU-2017:1306-1Not reported
Suselibtirpcrpmlinux enterprise server for sap applications 12 sp10.2.3-13.3.1Not reportedSUSE-SU-2017:1306-1Not reported
Suselibtirpcrpmlinux enterprise software development kit 11 sp40.2.1-1.12.3Not reportedSUSE-SU-2017:1468-1Not reported
Suselibtirpcrpmlinux enterprise point of sale 11 sp30.2.1-1.12.3Not reportedSUSE-SU-2017:1468-1Not reported
Suserpcbindrpmlinux enterprise point of sale 11 sp30.1.6+git20080930-6.27.2Not reportedSUSE-SU-2017:1468-1Not reported
Suselibtirpcrpmlinux enterprise server 11 sp3-ltss0.2.1-1.12.3Not reportedSUSE-SU-2017:1468-1Not reported
Suserpcbindrpmlinux enterprise server 11 sp3-ltss0.1.6+git20080930-6.27.2Not reportedSUSE-SU-2017:1468-1Not reported
Suselibtirpcrpmlinux enterprise server 11 sp3-teradata0.2.1-1.12.3Not reportedSUSE-SU-2017:1468-1Not reported
Suserpcbindrpmlinux enterprise server 11 sp3-teradata0.1.6+git20080930-6.27.2Not reportedSUSE-SU-2017:1468-1Not reported
Suselibtirpcrpmlinux enterprise server 11 sp40.2.1-1.12.3Not reportedSUSE-SU-2017:1468-1Not reported
Suserpcbindrpmlinux enterprise server 11 sp40.1.6+git20080930-6.27.2Not reportedSUSE-SU-2017:1468-1Not reported
Suselibtirpcrpmlinux enterprise server for sap applications 11 sp40.2.1-1.12.3Not reportedSUSE-SU-2017:1468-1Not reported
Suserpcbindrpmlinux enterprise server for sap applications 11 sp40.1.6+git20080930-6.27.2Not reportedSUSE-SU-2017:1468-1Not reported
Suserpcbindrpmlinux enterprise desktop 12 sp20.2.3-23.1Not reportedSUSE-SU-2017:1328-1Not reported
Suserpcbindrpmlinux enterprise server for raspberry pi 12 sp20.2.3-23.1Not reportedSUSE-SU-2017:1328-1Not reported
Suserpcbindrpmlinux enterprise server 12 sp20.2.3-23.1Not reportedSUSE-SU-2017:1328-1Not reported
Suserpcbindrpmlinux enterprise server for sap applications 12 sp20.2.3-23.1Not reportedSUSE-SU-2017:1328-1Not reported
Suselibtirpcrpmlinux enterprise desktop 12 sp21.0.1-16.1Not reportedSUSE-SU-2017:1314-1Not reported
Suselibtirpcrpmlinux enterprise server for raspberry pi 12 sp21.0.1-16.1Not reportedSUSE-SU-2017:1314-1Not reported
Suselibtirpcrpmlinux enterprise software development kit 12 sp21.0.1-16.1Not reportedSUSE-SU-2017:1314-1Not reported
Suselibtirpcrpmlinux enterprise server 12 sp21.0.1-16.1Not reportedSUSE-SU-2017:1314-1Not reported
Suselibtirpcrpmlinux enterprise server for sap applications 12 sp21.0.1-16.1Not reportedSUSE-SU-2017:1314-1Not reported

[Debian bug #861836][Debian bug #861835][Debian bug #861834]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • Source package: [ntirpc]

    Details (2)
    • 4.3-2 · amd64 · bookworm

      Fixed · Fixed: 1.4.4-1

      dsa · ntirpc · debian · bookworm; dsa · ntirpc · debian · 12

    • 4.3-2 · arm64 · bookworm

      Fixed · Fixed: 1.4.4-1

      dsa · ntirpc · debian · bookworm; dsa · ntirpc · debian · 12

  • Source package: [ntirpc]

    Details (2)
    • 5.8-2~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 1.4.4-1

      dsa · ntirpc · debian · bookworm; dsa · ntirpc · debian · 12

    • 5.8-2~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 1.4.4-1

      dsa · ntirpc · debian · bookworm; dsa · ntirpc · debian · 12

  • Source package: [ntirpc]

    Details (4)
    • 4.3-2 · amd64 · bookworm

      Fixed · Fixed: 1.4.4-1

      dsa · ntirpc · debian · bookworm; dsa · ntirpc · debian · 12

    • 4.3-2 · arm64 · bookworm

      Fixed · Fixed: 1.4.4-1

      dsa · ntirpc · debian · bookworm; dsa · ntirpc · debian · 12

    • 5.8-2~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 1.4.4-1

      dsa · ntirpc · debian · bookworm; dsa · ntirpc · debian · 12

    • 5.8-2~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 1.4.4-1

      dsa · ntirpc · debian · bookworm; dsa · ntirpc · debian · 12

  • [libtirpc3]Fixed

    Source package: [libtirpc]

    Details (2)
    • 1.3.3+ds-1 · amd64 · bookworm

      Fixed · Fixed: 0.2.5-1.2

      dsa · libtirpc · debian · bookworm; dsa · libtirpc · debian · 12

    • 1.3.3+ds-1 · arm64 · bookworm

      Fixed · Fixed: 0.2.5-1.2

      dsa · libtirpc · debian · bookworm; dsa · libtirpc · debian · 12

  • Source package: [libtirpc]

    Details (2)
    • 1.3.3+ds-1 · all · bookworm

      Fixed · Fixed: 0.2.5-1.2

      dsa · libtirpc · debian · bookworm; dsa · libtirpc · debian · 12

    • 1.3.3+ds-1 · all · bookworm

      Fixed · Fixed: 0.2.5-1.2

      dsa · libtirpc · debian · bookworm; dsa · libtirpc · debian · 12

  • Source package: [libtirpc]

    Details (2)
    • 1.3.3+ds-1 · amd64 · bookworm

      Fixed · Fixed: 0.2.5-1.2

      dsa · libtirpc · debian · bookworm; dsa · libtirpc · debian · 12

    • 1.3.3+ds-1 · arm64 · bookworm

      Fixed · Fixed: 0.2.5-1.2

      dsa · libtirpc · debian · bookworm; dsa · libtirpc · debian · 12

  • [rpcbind]Fixed

    Source package: [rpcbind]

    Details (2)
    • 1.2.6-6+b1 · amd64 · bookworm

      Fixed · Fixed: 0.2.3-0.6

      dsa · rpcbind · debian · bookworm; dsa · rpcbind · debian · 12

    • 1.2.6-6+b1 · arm64 · bookworm

      Fixed · Fixed: 0.2.3-0.6

      dsa · rpcbind · debian · bookworm; dsa · rpcbind · debian · 12

[Debian 13 (Trixie)]

  • Source package: [ntirpc]

    Details (4)
    • 6.3-2 · amd64 · trixie

      Fixed · Fixed: 1.4.4-1

      dsa · ntirpc · debian · 13

    • 6.3-2 · arm64 · trixie

      Fixed · Fixed: 1.4.4-1

      dsa · ntirpc · debian · 13

    • 6.3-4~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 1.4.4-1

      dsa · ntirpc · debian · 13

    • 6.3-4~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 1.4.4-1

      dsa · ntirpc · debian · 13

  • Source package: [ntirpc]

    Details (2)
    • 7.2-2~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 1.4.4-1

      dsa · ntirpc · debian · 13

    • 7.2-2~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 1.4.4-1

      dsa · ntirpc · debian · 13

  • Source package: [ntirpc]

    Details (4)
    • 6.3-2 · amd64 · trixie

      Fixed · Fixed: 1.4.4-1

      dsa · ntirpc · debian · 13

    • 6.3-2 · arm64 · trixie

      Fixed · Fixed: 1.4.4-1

      dsa · ntirpc · debian · 13

    • 7.2-2~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 1.4.4-1

      dsa · ntirpc · debian · 13

    • 7.2-2~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 1.4.4-1

      dsa · ntirpc · debian · 13

  • Source package: [libtirpc]

    Details (2)
    • 1.3.6+ds-1 · amd64 · trixie

      Fixed · Fixed: 0.2.5-1.2

      dsa · libtirpc · debian · 13

    • 1.3.6+ds-1 · arm64 · trixie

      Fixed · Fixed: 0.2.5-1.2

      dsa · libtirpc · debian · 13

  • Source package: [libtirpc]

    Details (2)
    • 1.3.6+ds-1 · all · trixie

      Fixed · Fixed: 0.2.5-1.2

      dsa · libtirpc · debian · 13

    • 1.3.6+ds-1 · all · trixie

      Fixed · Fixed: 0.2.5-1.2

      dsa · libtirpc · debian · 13

  • Source package: [libtirpc]

    Details (2)
    • 1.3.6+ds-1 · amd64 · trixie

      Fixed · Fixed: 0.2.5-1.2

      dsa · libtirpc · debian · 13

    • 1.3.6+ds-1 · arm64 · trixie

      Fixed · Fixed: 0.2.5-1.2

      dsa · libtirpc · debian · 13

  • [rpcbind]Fixed
    Details (2)
    • 1.2.7-1 · amd64 · trixie

      Fixed · Fixed: 0.2.3-0.6

      dsa · rpcbind · debian · 13

    • 1.2.7-1 · arm64 · trixie

      Fixed · Fixed: 0.2.3-0.6

      dsa · rpcbind · debian · 13

[openSUSE Tumbleweed]

  • [rpcbind]Fixed

    Source package: [rpcbind]

    Details (1)
    • 1.2.9-1.3 · x86_64 · tumbleweed

      Fixed · Fixed: 1.2.6-2.2

      dsa · rpcbind · opensuse · tumbleweed

Observed:

References