Incomplete vulnerability mitigations

published 2017-11-14 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-13010

cvss: 1.9; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 43%
public exploits: 0; none known

In BlackBerry QNX Software Development Platform (SDP) 6.6.0, the default configuration of the QNX SDP system did not in all circumstances prevent attackers from modifying the GOT or PLT tables with buffer overflow attacks.

Exploit prediction

0.50% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CNA	3.1	1.9	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
NVD	3.0	7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD	2.0	6.4	AV:N/AC:L/Au:N/C:N/I:P/A:P

Affected products

BlackBerry QNX Software Development Platform (QNX SDP)

Classification

Weakness

CWE-693 Protection Mechanism Failure
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

support.blackberry.com /kb/articleDetail?articleNumber=000046674
vendor-advisory

Sources

CVE List CVE-2017-3893
NVD CVE-2017-3893

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary