PT-2017-16437 · Icoutils+5 · Icoutils+5

Published 2017-01-11 · Updated 2024-08-19 · CVE-2017-5332

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions icoutils versions prior to 0.31.1

Description The issue allows local users to cause a denial of service and execute arbitrary code via a crafted executable. This is due to the extract group icon cursor resource function in wrestool/extract.c accessing unallocated memory.

Recommendations For versions prior to 0.31.1, update to version 0.31.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the extract group icon cursor resource function in wrestool/extract.c to minimize the risk of exploitation.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2020-3528

ALT-PU-2020-3548

ALT-PU-2024-11162

CESA-2017_0837

CVE-2017-5332

DLA-789-1

DSA-3765-1

MGASA-2017-0044

OPENSUSE-SU-2017_0166-1

OPENSUSE-SU-2017_0167-1

OPENSUSE-SU-2017_0168-1

RHSA-2017:0837

RHSA-2017_0837

USN-3178-1

USN-4695-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Icoutils

References · 33

• https://ubuntu.com/security/CVE-2017-5331 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0044 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-5332 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4695-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6010 · Vendor Advisory
• http://openwall.com/lists/oss-security/2017/01/11/3 · Patch
• https://ubuntu.com/security/CVE-2017-5333 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6009 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3765-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5332 · Vendor Advisory
• https://git.savannah.gnu.org/cgit/icoutils.git/commit/?id=1aa9f28f7bcbdfff6a84a15ac8d9a87559b1596a · Patch
• http://rhn.redhat.com/errata/RHSA-2017-0837.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-5332 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00024.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00026.html · Vendor Advisory