CVE-2017-6009: Buffer Overflow
An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "decodeneresourceid" function in the "restable.c" source file. This is happening because the "len" parameter for memcpy is not checked for size and thus becomes a negative integer in the process, resulting in a failed memcpy. This affects wrestool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/icoutilsto a version that resolves this vulnerability.Fixed in 0.31.2-1 - Upgrade
Upgrade
debian/icoutilsto a version that resolves this vulnerability.Fixed in 0.32.3-3Fixed in 0.32.3-4Fixed in 0.32.3-6
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6009?
CVE-2017-6009 is classified as a medium severity vulnerability due to the potential for buffer overflow attacks.
How do I fix CVE-2017-6009?
To fix CVE-2017-6009, upgrade to icoutils version 0.31.2-1 or higher.
Which versions of icoutils are affected by CVE-2017-6009?
CVE-2017-6009 affects icoutils version 0.31.1 and prior.
What kind of vulnerability is CVE-2017-6009?
CVE-2017-6009 is a buffer overflow vulnerability affecting the "decode_ne_resource_id" function.
Is CVE-2017-6009 exploitable?
Yes, CVE-2017-6009 is exploitable, allowing malicious actors to potentially execute arbitrary code.