PatchTheCVECVE-2017-7555: Augeas versions up to and including 1.8.0 are vulnerable to heap-based buffer overflow due to improper handlin
CVE-2017-7555 is a critical-severity flaw (CVSS 9.8) affecting augeas. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Augeas versions up to and including 1.8.0 are vulnerable to heap-based buffer overflow due to improper handling of escaped strings. Attacker could send crafted strings that would cause the application using augeas to copy past the end of a buffer, leading to a crash or possible code execution.
Why this priority
- Critical severity
- EPSS top 8%: very likely to be exploited
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2017-7555?
augeas: upgrade to newer than 1.8.0. Exact commands for each OS are on this page.
Is CVE-2017-7555 being exploited?
CVE-2017-7555 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2017-7555 affect?
CVE-2017-7555 affects augeas. Severity is critical (CVSS 9.8). Augeas versions up to and including 1.8.0 are vulnerable to heap-based buffer overflow due to improper handling of escaped strings. Attacker could send crafted strings that would cause the application using augeas to copy past the end of a
How urgent is CVE-2017-7555?
Priority 62/100. Critical severity; EPSS top 8%: very likely to be exploited; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2013-6412 MEDIUM 4.6 DOWNGRADE The transform_save function in transform.c in Augeas 1.0.0 through 1.1.0 does not properly calculate the permi
- CVE-2012-6607 LOW 3.3 UPGRADE The transform_save function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary fi
- CVE-2012-0787 LOW 3.7 MITIGATE UPGRADE The clone_file function in transfer.c in Augeas before 1.0.0, when copy_if_rename_fails is set and EXDEV or EB
- CVE-2012-0786 LOW 3.3 UPGRADE The transform_save function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary fi