nfdump 1.6.17 and earlier is affected by an integer overflow in the function Processipfixtemplate_withdraw in ipfix.c that can be abused in order to crash the process remotely (denial of service).
{
"unresolved_ranges": [
{
"cpe": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "9.0"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "29"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "30"
}
],
"source": "CPE_FIELD"
}
]
}{
"cpe": "cpe:2.3:a:nfdump_project:nfdump:*:*:*:*:*:*:*:*",
"extracted_events": [
{
"introduced": "0"
},
{
"last_affected": "1.6.17"
}
],
"source": "CPE_FIELD"
}