PT-2017-14125 · Gnu+2 · Gnu Libextractor+2

Leon Zhao · Publicado 2017-10-17 · Atualizado 2020-11-23 · CVE-2017-15601

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GNU Libextractor version 1.4

Description The issue is related to a heap-based buffer overflow in the EXTRACTOR png extract method function, specifically in the processing of TXt and the use of stndup.

Recommendations For GNU Libextractor version 1.4, consider disabling the EXTRACTOR png extract method function in plugins/png extractor.c until a patch is available.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2017-2450

CVE-2017-15601

DLA-1198-1

USN-4641-1

Produtos afetados

Alt Linux

Gnu Libextractor

Ubuntu

Referências · 23

• 🔥 http://lists.gnu.org/archive/html/bug-libextractor/2017-10/msg00006.html · Exploit
• https://cve.org/CVERecord?id=CVE-2017-15601 · Nota de Segurança
• https://ubuntu.com/security/CVE-2017-17440 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2017/12/msg00000.html · Nota
• https://ubuntu.com/security/CVE-2017-15266 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-15601 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-15267 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-16430 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-15601 · Nota de Segurança
• https://ubuntu.com/security/CVE-2017-15602 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2017-15601 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-14346 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-4641-1 · Aviso do Fabricante
• https://ftp.gnu.org/gnu/libextractor/libextractor-1.6.tar.gz · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-15601 · Aviso do Fabricante