CVE Feed

    Dashboard / CVE / CVE-2017-3893

    CVE-2017-3893

    In BlackBerry QNX Software Development Platform (SDP) 6.6.0, the default configuration of the QNX SDP system did not in all circumstances prevent attackers from modifying the GOT or PLT tables with buffer overflow attacks.

    Published:Nov 14, 2017
    Last Modified:Jul 22, 2025
    EPS:Nov 14, 2017
    EPSS Score:0.00205
    CVSS Score:1.9

    Affected Products

    Vendor
    Blackberry
    Product
    Qnx Software Development Platform

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs
    CAPEC-10 Buffer Overflow via Environment Variables
    CAPEC-100 Overflow Buffers
    CAPEC-107 Cross Site Tracing
    CAPEC-123 Buffer Manipulation
    CAPEC-127 Directory Indexing
    CAPEC-14 Client-side Injection-induced Buffer Overflow
    CAPEC-17 Using Malicious Files
    CAPEC-20 Encryption Brute Forcing
    CAPEC-22 Exploiting Trust in Client
    CAPEC-237 Escaping a Sandbox by Calling Code in Another Language
    CAPEC-24 Filter Failure through Buffer Overflow
    CAPEC-36 Using Unpublished Interfaces or Functionality
    CAPEC-42 MIME Conversion
    CAPEC-44 Overflow Binary Resource File
    CAPEC-45 Buffer Overflow via Symbolic Links
    CAPEC-46 Overflow Variables and Tags
    CAPEC-47 Buffer Overflow via Parameter Expansion
    CAPEC-477 Signature Spoofing by Mixing Signed and Unsigned Content
    CAPEC-480 Escaping Virtualization
    CAPEC-51 Poison Web Service Registry
    CAPEC-57 Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
    CAPEC-59 Session Credential Falsification through Prediction
    CAPEC-65 Sniff Application Code
    CAPEC-668 Key Negotiation of Bluetooth Attack (KNOB)
    CAPEC-74 Manipulating State
    CAPEC-8 Buffer Overflow in an API Call
    CAPEC-87 Forceful Browsing
    CAPEC-9 Buffer Overflow in Local Command-Line Utilities

    Related CVEs

    CVE-2026-40272 (CVSS 7) — Improper Input Validation in the decode() function of the traceparser library could allow an attacker with a c…
    CVE-2026-4018 (CVSS 6.4) — TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with …
    CVE-2026-4017 (CVSS 7.4) — Buffer Overflow in the entry handler of the TraceEvent() system call could allow an attacker with local access…
    CVE-2026-0515 (CVSS 6.2) — Insufficient Parameter Validation in the SchedGet() system call could allow an attacker with local access to c…
    CVE-2025-8090 (CVSS 6.2) — Null pointer dereference in the MsgRegisterEvent() system call could allow an attacker with local access and c…
    CVE-2025-2474 (CVSS 9.8) — Out-of-bounds write in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated…
    CVE-2024-48858 (CVSS 7.5) — Improper input validation in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthent…
    CVE-2024-48857 (CVSS 7.5) — NULL pointer dereference in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenti…
    CVE-2024-48856 (CVSS 9.8) — Out-of-bounds write in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated…
    CVE-2024-48855 (CVSS 5.3) — Out-of-bounds read in the TIFF image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High