x/vulndb: potential Go vuln in github.com/grpc/grpc: CVE-2017-8359

[tatianab]

CVE-2017-8359 references github.com/grpc/grpc, which may be a Go module.

Description:
Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based use-after-free related to the grpc_call_destroy function in core/lib/surface/call.c.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2017-8359
• report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=726
• web: http://www.securityfocus.com/bid/98280
• fix: Remove call from sibling list when it is not first child. grpc/grpc#10353
• Imported by: https://pkg.go.dev/github.com/grpc/grpc?tab=importedby

Cross references:

• Module github.com/grpc/grpc appears in issue x/vulndb: potential Go vuln in github.com/grpc/grpc: CVE-2023-32731 #1847 NOT_GO_CODE
• Module github.com/grpc/grpc appears in issue x/vulndb: potential Go vuln in github.com/grpc/grpc: CVE-2023-32732 #1848 NOT_GO_CODE
• Module github.com/grpc/grpc appears in issue x/vulndb: potential Go vuln in github.com/grpc/grpc: CVE-2023-4785 #2062 NOT_GO_CODE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/grpc/grpc
      vulnerable_at: 1.59.2
      packages:
        - package: n/a
cves:
    - CVE-2017-8359
references:
    - report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=726
    - web: http://www.securityfocus.com/bid/98280
    - fix: https://github.com/grpc/grpc/pull/10353

[gopherbot]

Change https://go.dev/cl/540721 mentions this issue: data/excluded: batch add 135 excluded reports