CVE-2017-14636 — Integer Overflow or Wraparound in Project Sam2p

CWE-190 — Integer Overflow or Wraparound4 documents4 sources
Severity
9.8CRITICALNVD
EPSS
0.4%
top 40.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Sam2p Project Sam2p
Timeline
PublishedSep 22
Latest updateMay 17

Description

Because of an integer overflow in sam2p 0.49.3, a loop executes 0xffffffff times, ending with an invalid read of size 1 in the Image::Indexed::sortPal function in image.cpp. However, this also causes memory corruption because of an attempted write to the invalid d[0xfffffffe] array element.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶Ubuntusam2p_project/sam2p< 0.49.2-3+deb8u3build0.14.04.1+1

🔴Vulnerability Details

3
GHSA
GHSA-mcv7-hmm4-fr3m: Because of an integer overflow in sam2p 0↗2022-05-17
▶
CVEList
CVE-2017-14636: Because of an integer overflow in sam2p 0↗2017-09-22
▶
OSV
CVE-2017-14636: Because of an integer overflow in sam2p 0↗2017-09-22
▶
CVE-2017-14636 — Integer Overflow or Wraparound | cvebase