CVE-2017-5208: Integer Overflow
An integer overflow vulnerability was found in icoutils in the wrestool program. A maliciously crafted file could make the application crash or possibly allow code execution.
References:
http://seclists.org/oss-sec/2017/q1/38 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850017
Upstream patches:
http://git.savannah.gnu.org/cgit/icoutils.git/commit/?id=0d569f458f306b88f60156d60c9cf058125cf173 http://git.savannah.gnu.org/cgit/icoutils.git/commit/?id=4fbe9222fd79ee31b7ec031b0be070a9a400d1d3
Other sources
Integer overflow in the wrestool program in icoutils before 0.31.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted executable, which triggers a denial of service (application crash) or the possibility of execution of arbitrary code.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5208?
CVE-2017-5208 is classified as a medium severity integer overflow vulnerability.
How do I fix CVE-2017-5208?
To fix CVE-2017-5208, upgrade icoutils to version 0.31.1 or 0.32.3-3 or 0.32.3-4.
What impact can CVE-2017-5208 have on my system?
CVE-2017-5208 can cause crashes or allow potential code execution if exploited.
Which software versions are affected by CVE-2017-5208?
Affected software versions include icoutils prior to 0.31.1 and specific versions of Debian and Red Hat systems.
Where can I find more information about CVE-2017-5208?
Further details about CVE-2017-5208 can typically be found in public vulnerability databases.