PT-2017-16437 · Icoutils+5 · Icoutils+5

CVE-2017-5332 · Publicado 2017-01-11 · Atualizado 2024-08-19

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions icoutils versions prior to 0.31.1

Description The issue allows local users to cause a denial of service and execute arbitrary code via a crafted executable. This is due to the extract group icon cursor resource function in wrestool/extract.c accessing unallocated memory.

Recommendations For versions prior to 0.31.1, update to version 0.31.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the extract group icon cursor resource function in wrestool/extract.c to minimize the risk of exploitation.

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2020-3528

ALT-PU-2020-3548

ALT-PU-2024-11162

CESA-2017_0837

CVE-2017-5332

DLA-789-1

DSA-3765-1

MGASA-2017-0044

OPENSUSE-SU-2017_0166-1

OPENSUSE-SU-2017_0167-1

OPENSUSE-SU-2017_0168-1

RHSA-2017:0837

RHSA-2017_0837

USN-3178-1

USN-4695-1

Produtos afetados

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Icoutils

Referências · 33

• https://ubuntu.com/security/CVE-2017-5331 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2017-0044 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-5332 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2017/01/10/4 · Nota
• https://ubuntu.com/security/notices/USN-4695-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-6010 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2017/01/11/3 · Correção
• https://ubuntu.com/security/CVE-2017-5333 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-6009 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-3765-1 · Aviso do Fabricante
• http://securityfocus.com/bid/95380 · Nota
• https://ubuntu.com/security/CVE-2017-5332 · Aviso do Fabricante
• https://git.savannah.gnu.org/cgit/icoutils.git/commit/?id=1aa9f28f7bcbdfff6a84a15ac8d9a87559b1596a · Correção
• http://rhn.redhat.com/errata/RHSA-2017-0837.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-5332 · Aviso do Fabricante