CVE

CVE-2017-9671

A heap overflow in apk (Alpine Linux's package manager) allows a remote attacker to cause a denial of service, or achieve code execution, by crafting a malicious APKINDEX.tar.gz file with a bad pax header block.

Severity: HIGH
CVSS: 7.8
Published: Jul 17, 2017
Modified: Jun 17, 2026

NVD detail All CVEs

Linked Releases

Distribution	Release	Status	Evidence
Alpine Linux	3.24.0 x86_64 extended	unknown	source
Alpine Linux	3.24.0 x86_64 standard	unknown	source
Alpine Linux	3.24.0 x86_64 virt	unknown	source
Alpine Linux	3.24.0 x86_64 xen	unknown	source
Alpine Linux	3.24.0 x86 extended	unknown	source
Alpine Linux	3.24.0 x86 standard	unknown	source
Alpine Linux	3.24.0 x86 virt	unknown	source
Alpine Linux	3.24.0 aarch64 rpi	unknown	source
Alpine Linux	3.24.0 aarch64 standard	unknown	source
Alpine Linux	3.24.0 aarch64 virt	unknown	source
Alpine Linux	3.24.0 armhf rpi	unknown	source
Alpine Linux	3.24.0 armv7 rpi	unknown	source
Alpine Linux	3.24.0 armv7 standard	unknown	source
Alpine Linux	3.24.0 armv7 virt	unknown	source
Alpine Linux	3.24.0 loongarch64 standard	unknown	source
Alpine Linux	3.24.0 ppc64le standard	unknown	source
Alpine Linux	3.24.0 riscv64 standard	unknown	source
Alpine Linux	3.24.0 s390x standard	unknown	source
Alpine Linux	3.24.1 x86_64 extended	unknown	source
Alpine Linux	3.24.1 x86_64 standard	unknown	source
Alpine Linux	3.24.1 x86_64 virt	unknown	source
Alpine Linux	3.24.1 x86_64 xen	unknown	source
Alpine Linux	3.24.1 x86 extended	unknown	source
Alpine Linux	3.24.1 x86 standard	unknown	source
Alpine Linux	3.24.1 x86 virt	unknown	source
Alpine Linux	3.24.1 aarch64 rpi	unknown	source
Alpine Linux	3.24.1 aarch64 standard	unknown	source
Alpine Linux	3.24.1 aarch64 virt	unknown	source
Alpine Linux	3.24.1 armhf rpi	unknown	source
Alpine Linux	3.24.1 armv7 rpi	unknown	source
Alpine Linux	3.24.1 armv7 standard	unknown	source
Alpine Linux	3.24.1 armv7 virt	unknown	source
Alpine Linux	3.24.1 loongarch64 standard	unknown	source
Alpine Linux	3.24.1 ppc64le standard	unknown	source
Alpine Linux	3.24.1 riscv64 standard	unknown	source
Alpine Linux	3.24.1 s390x standard	unknown	source

CVE-2017-9671

Linked Releases

References