What’s Vulnerable › Vulnerabilities

CVE-2017-0359: diffoscope writes to arbitrary locations on disk based on the contents of an untrusted archive

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-04-13 · updated 2026-06-17

Description

diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive.

Affected products

• Debian Linux: 9.0
• Reproducible Builds Diffoscope: before 77 — fixed in 77

How to fix

Upgrade to a fixed version: Reproducible Builds Diffoscope 77. Check the vendor advisory for mitigations.

References

• https://bugs.debian.org/854723
• https://security-tracker.debian.org/tracker/CVE-2017-0359
• https://bugs.debian.org/854723
• https://security-tracker.debian.org/tracker/CVE-2017-0359

Get alerted when CVE-2017-0359 or the next vulnerability affects your stack