CVE-2017-1000206: Buffer Overflow
Published Nov 17, 2017
·Updated
samtools htslib library version 1.4.0 and earlier is vulnerable to buffer overflow in the CRAM rANS codec resulting in potential arbitrary code execution
Affected Software
1 affected component
HTSlib HTSlib<=1.4.0
Event History
Nov 17, 2017
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
Who can exploit this issue?
The CVSS vector indicates that exploitation is network-reachable, requires no privileges or user interaction, and has low attack complexity. A successful exploit could compromise confidentiality, integrity, and availability.
2
Which releases are affected?
HTSlib version 1.4.0 and earlier are affected. The referenced HTSlib NEWS file is for version 1.4.1, indicating that release should be reviewed as the remediation update.
3
What component is vulnerable?
The buffer overflow is in the CRAM rANS codec. Environments that process CRAM data using an affected HTSlib release are the relevant exposure area.