CVE-2017-2807
ledger: An exploitable buffer overflow vulnerability exists in the tag parsingfunctionality of Ledger-CLI 3.1.1
CVE-2017-2807 is fixed in 2 products on 1 platform, first by ledger 3.1.2+dfsg1-1, released January 16, 2026. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0197
80th percentile
An exploitable buffer overflow vulnerability exists in the tag parsingfunctionality of Ledger-CLI 3.1.1. A specially crafted journal file cancause an integer underflow resulting in code execution. An attacker canconstruct a malicious journal file to trigger this vulnerability.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| ledger · Ubuntu 24.10 (oracular) | 3.1.2+dfsg1-1 | ledger 3.1.2+dfsg1-1 | Jan 16, 2026 |
| ledger · Ubuntu 25.04 (plucky) | 3.1.2+dfsg1-1 | ledger 3.1.2+dfsg1-1 | Jan 16, 2026 |
| python3-ledger · Ubuntu 24.10 (oracular) | 3.1.2+dfsg1-1 | python3-ledger 3.1.2+dfsg1-1 | Jan 16, 2026 |
| python3-ledger · Ubuntu 25.04 (plucky) | 3.1.2+dfsg1-1 | python3-ledger 3.1.2+dfsg1-1 | Jan 16, 2026 |