PT-2017-12363 · Ytn+1 · Ytnef+1

Published 2017-08-02 · Updated 2019-05-18 · CVE-2017-12142

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ytnef version 1.9.2

Description A denial of service issue was discovered, allowing attackers to cause a denial of service via a crafted file. This issue is related to an invalid memory read vulnerability in the SwapDWord function in ytnef.c.

Recommendations For ytnef version 1.9.2, consider avoiding the use of crafted files that may trigger the denial of service issue until a patch is available. As a temporary workaround, restricting access to files from untrusted sources may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2018-2051

CVE-2017-12142

Affected Products

Alt Linux

Ytnef

References · 28

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9473 · Security Note
• https://osv.dev/vulnerability/CVE-2017-12142 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9146 · Security Note
• https://ubuntu.com/security/CVE-2017-12142 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9470 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9472 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12141 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-12142 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LFJWMUEUC4ILH2HEOCYVVLQT654ZMCGQ · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12142 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9474 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-12142 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-12142 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-12142 · Security Note
• https://errata.altlinux.org/ALT-PU-2018-2051 · Vendor Advisory