CVE-2017-5332: Buffer Overflow
A vulnerability was found in icoutils in extract.c. It is possible to access unallocated memory via wrestool while parsing maliciously crafted file which would make the application crash or possibly allow code execution.
References:
http://seclists.org/oss-sec/2017/q1/56
Upstream patch:
http://git.savannah.gnu.org/cgit/icoutils.git/commit/?id=1aa9f28f7bcbdfff6a84a15ac8d9a87559b1596a
Other sources
The extractgroupiconcursorresource in wrestool/extract.c in icoutils before 0.31.1 can access unallocated memory, which allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5332?
CVE-2017-5332 has a medium severity level as it can lead to application crashes or even allow code execution.
Which versions of icoutils are affected by CVE-2017-5332?
CVE-2017-5332 affects icoutils versions below 0.31.1.
How do I fix CVE-2017-5332?
To fix CVE-2017-5332, you need to upgrade icoutils to version 0.31.1 or later.
What potential impact does CVE-2017-5332 have on my system?
CVE-2017-5332 can allow unauthorized code execution and cause crashes within applications using the vulnerable icoutils tool.
Is there a workaround for CVE-2017-5332 if I cannot upgrade?
There is no specific workaround for CVE-2017-5332; upgrading to the patched version is the recommended solution.