CVE-2017-5331: Integer Overflow
An integer overflow vulnerability was found in icoutils in the wrestool program. A maliciously crafted file could make the application crash or possibly allow code execution. This is a CVE for an insufficient patch for CVE-2017-5208.
References:
http://seclists.org/oss-sec/2017/q1/56
Upstream patch:
http://git.savannah.gnu.org/cgit/icoutils.git/commit/?id=4fbe9222fd79ee31b7ec031b0be070a9a400d1d3
Other sources
Integer overflow in the checkoffset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2017-5331?
CVE-2017-5331 is an integer overflow vulnerability in icoutils before version 0.31.1.
What is the severity of CVE-2017-5331?
The severity of CVE-2017-5331 is high with a CVSS score of 7.8.
Which software are affected by CVE-2017-5331?
Icoutils Project Icoutils, Canonical Ubuntu Linux 12.04, Debian Debian Linux 8.0, Debian Debian Linux 9.0, openSUSE Leap 42.1, openSUSE Leap 42.2, and Opensuse Opensuse 13.2 are affected by CVE-2017-5331.
How can an attacker exploit CVE-2017-5331?
An attacker can exploit CVE-2017-5331 by crafting a malicious executable that triggers an integer overflow, leading to a denial of service (process crash) and potential execution of arbitrary code.
Is there a fix for CVE-2017-5331 available?
Yes, a fix for CVE-2017-5331 is available in icoutils version 0.31.1 and later.