cbcvebase.
CVE-2017-15048
published 2017-12-19

CVE-2017-15048: Stack-based buffer overflow in the ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 allows remote attackers to execute arbitrary code by…

PriorityP266high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EXPLOIT
EPSS
10.16%
95.1th percentile
Stack-based buffer overflow in the ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 allows remote attackers to execute arbitrary code by leveraging the zoommtg:// scheme handler.

Affected

1 ranges
VendorProductVersion rangeFixed in
zoomzoom< 2.0.115900.12012.0.115900.1201

Detection & IOCsextracted from sources · hover to see the quote

path/opt/zoom/ZoomLauncher↗
otherzoommtg://↗
filenamezoom_amd64.deb↗
  • →Monitor for process execution of ZoomLauncher with excessively long command-line arguments (>1048 bytes), which is indicative of a buffer overflow exploitation attempt. ↗
  • →Alert on zoommtg:// URI scheme handler invocations originating from remote/web content, as this is the remote attack vector for triggering the buffer overflow in ZoomLauncher. ↗
  • →The vulnerable ZoomLauncher binary lacks stack canary protection, making exploitation straightforward; flag any crash or abnormal termination of /opt/zoom/ZoomLauncher with a corrupted saved RIP (e.g., 0x4242424242424242). ↗
  • →Detect Zoom Linux client versions prior to 2.0.115900.1201 on hosts, as all earlier versions including 2.0.106600.0904 are confirmed vulnerable. ↗
  • ·NX is enabled on the vulnerable binary, meaning shellcode injection on the stack is mitigated; exploitation likely requires ROP chain techniques rather than direct shellcode. ↗
  • ·PIE is disabled on ZoomLauncher, meaning binary base addresses are fixed and gadget addresses for ROP exploitation are static/predictable. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.