What’s Vulnerable › Vulnerabilities
CVE-2017-17833
- Severity: critical (CVSS 9.8 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 3.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2018-04-23 · updated 2026-06-17
- Weakness: CWE-119
Description
OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest itself as a denial-of-service or a remote code-execution vulnerability.
Affected products
- Canonical Ubuntu Linux: 14.04, 16.04
- Debian Linux: 7.0
- Lenovo Bm Nextscale Fan Power Controller: before 24p-2.15 — fixed in 24p-2.15
- Lenovo Cmm: before 1.8.0 — fixed in 1.8.0
- Lenovo Fan Power Controller: before 30r-1.13 — fixed in 30r-1.13
- Lenovo Flex System Fc3171 8Gb San Switch Firmware: before 9.1.13.02.00 — fixed in 9.1.13.02.00
- Lenovo Imm1: before 1.55 — fixed in 1.55
- Lenovo Group Ltd. IMM2: before 4.70 — fixed in 4.70
- Lenovo Storage N3310 Firmware: before 4.53.351 — fixed in 4.53.351
- Lenovo Storage N4610 Firmware: before 4.53.351 — fixed in 4.53.351
- Lenovo Thinkserver Rd340 Firmware: before 50.00 — fixed in 50.00
- Lenovo Thinkserver Rd350 Firmware: before 4.53.351 — fixed in 4.53.351
- Lenovo Thinkserver Rd350G Firmware: all versions
- Lenovo Thinkserver Rd350X Firmware: all versions
- Lenovo Thinkserver Rd440 Firmware: through 50.00
- Lenovo Thinkserver Rd450 Firmware: before 4.53.351 — fixed in 4.53.351
- Lenovo Thinkserver Rd450X Firmware: all versions
- Lenovo Thinkserver Rd540 Firmware: before 50.00 — fixed in 50.00
- Lenovo Thinkserver Rd550 Firmware: before 4.53.351 — fixed in 4.53.351
- Lenovo Thinkserver Rd640 Firmware: before 50.00 — fixed in 50.00
- Lenovo Thinkserver Rd650 Firmware: before 4.53.351 — fixed in 4.53.351
- Lenovo Thinkserver Rq750 Firmware: before 1.40 — fixed in 1.40
- Lenovo Thinkserver Rs160 Firmware: before 2.32 — fixed in 2.32
- Lenovo Thinkserver Sd350 Firmware: all versions
- Lenovo Thinkserver Td340 Firmware: before 46.00 — fixed in 46.00
- Lenovo Thinkserver Td350 Firmware: before 4.53.351 — fixed in 4.53.351
- Lenovo Thinkserver Ts460 Firmware: before 2.32 — fixed in 2.32
- Lenovo Thinksystem Hr630X Firmware: all versions
- Lenovo Thinksystem Hr650X Firmware: all versions
- Lenovo Thinksystem Sr630 Firmware: all versions
How to fix
Upgrade to a fixed version: Lenovo Bm Nextscale Fan Power Controller 24p-2.15; Lenovo Cmm 1.8.0; Lenovo Fan Power Controller 30r-1.13; Lenovo Flex System Fc3171 8Gb San Switch Firmware 9.1.13.02.00; Lenovo Imm1 1.55; Lenovo Group Ltd. IMM2 4.70; Lenovo Storage N3310 Firmware 4.53.351; Lenovo Storage N4610 Firmware 4.53.351; Lenovo Thinkserver Rd340 Firmware 50.00; Lenovo Thinkserver Rd350 Firmware 4.53.351; Lenovo Thinkserver Rd450 Firmware 4.53.351; Lenovo Thinkserver Rd540 Firmware 50.00. Check the vendor advisory for mitigations.
References
- http://support.lenovo.com/us/en/solutions/LEN-18247
- https://access.redhat.com/errata/RHSA-2018:2240
- https://access.redhat.com/errata/RHSA-2018:2308
- https://lists.debian.org/debian-lts-announce/2018/04/msg00029.html
- https://security.gentoo.org/glsa/202005-12
- https://sourceforge.net/p/openslp/mercurial/ci/151f07745901cbdba6e00e4889561b4083250da1/
- https://usn.ubuntu.com/3708-1/
- http://support.lenovo.com/us/en/solutions/LEN-18247
- https://access.redhat.com/errata/RHSA-2018:2240
- https://access.redhat.com/errata/RHSA-2018:2308
- https://lists.debian.org/debian-lts-announce/2018/04/msg00029.html
- https://security.gentoo.org/glsa/202005-12
Get alerted when CVE-2017-17833 or the next vulnerability affects your stack