CVE-2017-5331: Integer Overflow
First published: Wed Jan 11 2017(Updated: )
An integer overflow vulnerability was found in icoutils in the wrestool program. A maliciously crafted file could make the application crash or possibly allow code execution. This is a CVE for an insufficient patch for <a href="https://access.redhat.com/security/cve/CVE-2017-5208">CVE-2017-5208</a>. References: <a href="http://seclists.org/oss-sec/2017/q1/56">http://seclists.org/oss-sec/2017/q1/56</a> Upstream patch: <a href="http://git.savannah.gnu.org/cgit/icoutils.git/commit/?id=4fbe9222fd79ee31b7ec031b0be070a9a400d1d3">http://git.savannah.gnu.org/cgit/icoutils.git/commit/?id=4fbe9222fd79ee31b7ec031b0be070a9a400d1d3</a>
Credit: security@debian.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Icoutils Project Icoutils | <0.31.1 | |
| Canonical Ubuntu Linux | =12.04 | |
| Debian Debian Linux | =8.0 | |
| Debian Debian Linux | =9.0 | |
| openSUSE Leap | =42.1 | |
| openSUSE Leap | =42.2 | |
| openSUSE openSUSE | =13.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2017-5208
- http://seclists.org/oss-sec/2017/q1/56
- http://git.savannah.gnu.org/cgit/icoutils.git/commit/?id=4fbe9222fd79ee31b7ec031b0be070a9a400d1d3
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1412265
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1412266
- https://bugzilla.redhat.com/show_bug.cgi?id=1412248
- http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00024.html
- http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00026.html
- http://www.debian.org/security/2017/dsa-3765
- http://www.openwall.com/lists/oss-security/2017/01/11/3
- http://www.securityfocus.com/bid/95378
- http://www.ubuntu.com/usn/USN-3178-1
Frequently Asked Questions
What is CVE-2017-5331?
CVE-2017-5331 is an integer overflow vulnerability in icoutils before version 0.31.1.
What is the severity of CVE-2017-5331?
The severity of CVE-2017-5331 is high with a CVSS score of 7.8.
Which software are affected by CVE-2017-5331?
Icoutils Project Icoutils, Canonical Ubuntu Linux 12.04, Debian Debian Linux 8.0, Debian Debian Linux 9.0, openSUSE Leap 42.1, openSUSE Leap 42.2, and Opensuse Opensuse 13.2 are affected by CVE-2017-5331.
How can an attacker exploit CVE-2017-5331?
An attacker can exploit CVE-2017-5331 by crafting a malicious executable that triggers an integer overflow, leading to a denial of service (process crash) and potential execution of arbitrary code.
Is there a fix for CVE-2017-5331 available?
Yes, a fix for CVE-2017-5331 is available in icoutils version 0.31.1 and later.
- agent/type
- agent/remedy
- agent/first-publish-date
- agent/severity
- agent/references
- agent/author
- agent/weakness
- agent/description
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/tags
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2017-5331
- vendor/icoutils project
- canonical/icoutils project icoutils
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/12.04
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/8.0
- version/debian debian linux/9.0
- vendor/opensuse
- canonical/opensuse leap
- version/opensuse leap/42.1
- version/opensuse leap/42.2
- canonical/opensuse opensuse
- version/opensuse opensuse/13.2