Bug 2452690 (CVE-2017-20229)

Summary: CVE-2017-20229 MAWK: MAWK: Arbitrary Code Execution via Stack-based Buffer Overflow
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: crizzo, jmitchel, kaycoth, kshier, pbohmill, teagle
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in MAWK. Attackers can exploit a stack-based buffer overflow vulnerability by crafting malicious input that bypasses inadequate boundary checks. This allows them to overwrite memory on the program's call stack, leading to the execution of arbitrary code. Successful exploitation can result in an attacker gaining control over the affected system with the privileges of the MAWK application.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-03-28 13:02:54 UTC 
MAWK 1.3.3-17 and prior contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary code by exploiting inadequate boundary checks on user-supplied input. Attackers can craft malicious input that overflows the stack buffer and execute a return-oriented programming chain to spawn a shell with application privileges.