CVE-2017-18284

Severity: high (CVSS 7.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-06-04 · updated 2026-06-17
Weakness: CWE-732

Description

The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL.

Affected products

Burp Project Burp: before 2.1.32 — fixed in 2.1.32

How to fix

Upgrade to a fixed version: Burp Project Burp 2.1.32. Check the vendor advisory for mitigations.

References

https://bugs.gentoo.org/628770
https://security.gentoo.org/glsa/201806-03
https://bugs.gentoo.org/628770
https://security.gentoo.org/glsa/201806-03

Get alerted when CVE-2017-18284 or the next vulnerability affects your stack