CVE-2017-5332
CWE-119 — Buffer OverflowCWE-190 — Integer OverflowCWE-125 — Out-of-bounds Read12 documents8 sources
Severity
7.8HIGH
EPSS
0.2%
top 53.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedNov 4
Latest updateMay 24
Description
The extract_group_icon_cursor_resource in wrestool/extract.c in icoutils before 0.31.1 can access unallocated memory, which allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages8 packages
Also affects: Debian Linux 10.0, 8.0, 9.0, Ubuntu Linux 12.04, Enterprise Linux 7.0, 7.3, 7.4, 7.6, 7.7, 7.5