PT-2017-13591 · Sam2P · Sam2P

Ghost · Publicado 2017-09-21 · Atualizado 2020-12-17 · CVE-2017-14629

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions sam2p version 0.49.3

Description The issue is caused by an integer signedness error in the in xpm reader function, located in in xpm.cpp. This error results in a crash when attempting to write to an out-of-bounds array element.

Recommendations For sam2p version 0.49.3, consider applying a patch to fix the integer signedness error in the in xpm reader function as a permanent solution. As a temporary workaround, restrict the input to prevent out-of-bounds array access until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

CVE-2017-14629

DLA-1127-1

MGASA-2020-0459

Produtos afetados

Sam2P

Referências · 13

• 🔥 https://github.com/pts/sam2p/issues/14 · Exploit
• https://bugs.mageia.org/show_bug.cgi?id=27746 · Nota
• https://debian.org/lts/security/2018/dla-1463 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2020-0459.html · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2017-14629 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-14629 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2020-0459 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-14629 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-14629 · Nota de Segurança
• https://debian.org/lts/security/2018/dla-1340 · Aviso do Fabricante
• https://debian.org/lts/security/2017/dla-1127 · Aviso do Fabricante
• https://debian.org/lts/security/2017/dla-1185 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-14629 · Aviso do Fabricante