PT-2017-12363 · Ytn+1 · Ytnef+1

Publicado 2017-08-02 · Atualizado 2019-05-18 · CVE-2017-12142

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ytnef version 1.9.2

Description A denial of service issue was discovered, allowing attackers to cause a denial of service via a crafted file. This issue is related to an invalid memory read vulnerability in the SwapDWord function in ytnef.c.

Recommendations For ytnef version 1.9.2, consider avoiding the use of crafted files that may trigger the denial of service issue until a patch is available. As a temporary workaround, restricting access to files from untrusted sources may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

ALT-PU-2018-2051

CVE-2017-12142

Produtos afetados

Alt Linux

Ytnef

Referências · 28

• https://github.com/Yeraze/ytnef/issues/47 · Nota
• https://github.com/Yeraze/ytnef/issues/49 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9473 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-12142 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9146 · Nota de Segurança
• https://blogs.gentoo.org/ago/2017/05/24/ytnef-heap-based-buffer-overflow-in-swapword-ytnef-c · Nota
• https://ubuntu.com/security/CVE-2017-12142 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9470 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9472 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12141 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2017-12142 · Aviso do Fabricante
• https://blogs.gentoo.org/ago/2017/05/24/ytnef-heap-based-buffer-overflow-in-decompressrtf-ytnef-c · Nota
• https://blogs.gentoo.org/ago/2017/05/24/ytnef-heap-based-buffer-overflow-in-swapdword-ytnef-c · Nota
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LFJWMUEUC4ILH2HEOCYVVLQT654ZMCGQ · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-12142 · Nota de Segurança