PT-2017-16829 · Icoutils+3 · Icoutils+3

Op7Ic \\X00 · Published 2017-02-16 · Updated 2021-01-18 · CVE-2017-6010

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions icoutils version 0.31.1

Description A buffer overflow issue was found in the extract icons function, located in the extract.c source file. This issue can be triggered by processing a corrupted ico file, resulting in an icotool crash.

Recommendations For icoutils version 0.31.1, consider avoiding the use of the extract icons function until a patch is available. As a temporary workaround, restrict the processing of ico files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CESA-2017_0837

CVE-2017-6010

DLA-854-1

DSA-3807-1

MGASA-2017-0080

RHSA-2017:0837

RHSA-2017_0837

USN-3226-1

USN-4695-1

Affected Products

Centos

Red Hat

Ubuntu

Icoutils

References · 27

• 🔥 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854054 · Exploit
• https://ubuntu.com/security/CVE-2017-5331 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6010 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3807-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4695-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6011 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0080 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4695-1 · Vendor Advisory
• https://debian.org/security/2017/dsa-3807 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6010 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3226-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5208 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5333 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6009 · Vendor Advisory
• https://security.gentoo.org/glsa/201801-12 · Vendor Advisory