CVE-2017-6658 json
Cisco Sourcefire Snort 3.0 before build 233 has a Buffer Overread related to use of a decoder array.
published 2017-05-16 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-15712
- cvss
- 7.5
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 64%
- public exploits
- 0
- none known
Summary
Cisco Sourcefire Snort 3.0 before build 233 has a Buffer Overread related to use of a decoder array. The size was off by one making it possible to read past the end of the array with an ether type of 0xFFFF. Increasing the array size solves this problem.
Exploit prediction
1.06% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Affected products
- n/a Snort 3.0 All versions prior to build 233.
Classification
- Weakness
-
- CWE-125 Out-of-bounds Read
References
-
tools.cisco.com
/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170515-snort
vendor-advisory
-
securitytracker.com
/id/1038483
vdb-entry
-
blog.snort.org
/2017/05/snort-vulnerabilities-found.html
third-party-advisory
Sources
- CVE List CVE-2017-6658
- NVD CVE-2017-6658
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.