CVE-2017-17440
published 2017-12-06CVE-2017-17440: GNU Libextractor 1.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted GIF, IT (Impulse…
medium6.5CVSS 3.0
AVNACLPRNUIRSUCNINAH
GNU Libextractor 1.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted GIF, IT (Impulse Tracker), NSFE, S3M (Scream Tracker 3), SID, or XM (eXtended Module) file, as demonstrated by the EXTRACTOR_xm_extract_method function in plugins/xm_extractor.c.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libextractor | < libextractor 1:1.6-2 (bookworm) | libextractor 1:1.6-2 (bookworm) |
| gnu | libextractor | — | — |
| gnu | libextractor | >= 0 < 1:1.6-2 | 1:1.6-2 |
| gnu | libextractor | >= 0 < 1:1.6-2 | 1:1.6-2 |
| gnu | libextractor | >= 0 < 1:1.6-2 | 1:1.6-2 |
| gnu | libextractor | >= 0 < 1:1.6-2 | 1:1.6-2 |
| gnu | libextractor | >= 0 < 1:1.3-4+deb9u3build0.16.04.1 | 1:1.3-4+deb9u3build0.16.04.1 |
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv6.5MEDIUM