CVE-2017-5333: Integer Overflow
An integer overflow vulnerability was found in extract.c while transferring resources into file memory. A maliciously crafted file could make the application crash or possibly allow code execution.
References:
http://seclists.org/oss-sec/2017/q1/56
Upstream patch:
http://git.savannah.gnu.org/cgit/icoutils.git/commit/?id=1a108713ac26215c7568353f6e02e727e6d4b24a
Other sources
Integer overflow in the extractgroupiconcursorresource function in b/wrestool/extract.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) or execute arbitrary code via a crafted executable file.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5333?
The severity of CVE-2017-5333 is high.
How does CVE-2017-5333 impact icoutils before version 0.31.1?
CVE-2017-5333 allows local users to cause a denial of service (process crash) or execute arbitrary code via a crafted executable file.
Which software is affected by CVE-2017-5333?
CVE-2017-5333 affects icoutils before version 0.31.1.
How do I fix CVE-2017-5333?
To fix CVE-2017-5333, update icoutils to version 0.31.1.
Where can I find more information about CVE-2017-5333?
You can find more information about CVE-2017-5333 at the following references: [Link 1](http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00024.html), [Link 2](http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00025.html), [Link 3](http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00026.html).