CVE-2017-10954 - CVE House

Back to Database

Status published High CVE-2017-10954

This vulnerability allows remote attackers to execute arbitrary code on...

8.8 CVSS

Vulnerability Description

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security Internet Security 2018 prior to build 7.72918. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within pdf.xmd. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code under the context of SYSTEM. Was ZDI-CAN-4361.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-10954

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Bitdefender

View All →

Local Privilege Escalation via Arbitrary File Operation in Bitdefender Total Security

Improper access restriction to critical folder in Bitdefender Endpoint Security Tools for Mac

Server Side Request Forgery in GravityZone Update Server Using Null Bytes (VA-12646)

Insecure PHP deserialization issue in GravityZone Console (VA-12634)

SSRF in GravityZone Console via DNS Truncation (VA-12634)

Affected Vendor

Bitdefender

View all reports →

Affected Software

Bitdefender Internet Security

Vulnerable Versions:

Internet Security 2018 prior to build 7.72918

Timeline

Official Publish: October 31st, 2017

Last Modified: August 5th, 2024

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1055 Process Injection

Defense Evasion

T1105 Ingress Tool Transfer

Command and Control

T1499 Endpoint Denial of Service