CVE-2017-9171
published 2017-05-23CVE-2017-9171: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-bmp.c:492:24.
PriorityP434critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
2.17%
80.3th percentile
libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-bmp.c:492:24.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| autotrace_project | autotrace | — | — |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
autotrace: Multiple security issues
vendor_redhat·2017-05-20·CVSS 9.8
CVE-2017-9171 [CRITICAL] autotrace: Multiple security issues
autotrace: Multiple security issues
libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-bmp.c:492:24.
Statement: Red Hat Product Security has rated these issues as having Low security impact. These issues are not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Package: autotrace (Red Hat Enterprise Linux 6) - Will not fix
Package: autotrace (Red Hat Enterprise Linux 7) - Will not fix
GHSA
GHSA-j4qg-3qj2-qqfv: libautotrace
ghsa_unreviewed·2022-05-13
CVE-2017-9171 [CRITICAL] CWE-125 GHSA-j4qg-3qj2-qqfv: libautotrace
libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-bmp.c:492:24.
OSV
CVE-2017-9171: libautotrace
osv·2017-05-23·CVSS 9.8
CVE-2017-9171 [CRITICAL] CVE-2017-9171: libautotrace
libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-bmp.c:492:24.
No detection rules found.
No public exploits indexed.
arXiv
Path-wise Vulnerability Mitigation
arxiv_fulltext·2024-05-25
Path-wise Vulnerability Mitigation
Path-wise Vulnerability Mitigation
Zhen Huang1 Hiristina Dokic2
DePaul University, Chicago IL, USA \ [email protected]
DePaul University, Chicago IL, USA \ @depaul.edu
0
First Author10000-1111-2222-3333
Second Author2,31111-2222-3333-4444
Third Author32222--3333-4444-5555
F. Author et al.
Princeton University, Princeton NJ 08544, USA
Springer Heidelberg, Tiergartenstr. 17, 69121 Heidelberg, Germany
[email protected]
http://www.springer.com/gp/computer-science/lncs
ABC Institute, Rupert-Karls-University Heidelberg, Heidelberg, Germany
\abc,lncs\@uni-heidelberg.de
## Abstract
Software vulnerabilities are prevalent but fixing software vulnerabilities is not trivial. Studies have shown that a considerable pre-patch window exists because it often takes weeks or months for software vendo
Bugzilla
CVE-2017-9151..CVE-2017-9200 autotrace: Multiple security issues
bugzilla·2017-05-23·CVSS 9.8
CVE-2017-9151 [CRITICAL] CVE-2017-9151..CVE-2017-9200 autotrace: Multiple security issues
CVE-2017-9151..CVE-2017-9200 autotrace: Multiple security issues
Multiple vulnerabilities were found in autotrace.
CVE-2017-9200: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:528:63.
CVE-2017-9199: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:192:19.
CVE-2017-9198: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:508:18.
CVE-2017-9197: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:498:55.
CVE-2017-9196: libautotrace.a in AutoTrace 0.31.1 has a "negative-size-param" issue in the ReadImage function in input-tga.c:528:7.
CVE-2017-9195: libautotrace.a in AutoTrace 0.31.1 has a heap-based
2017-05-23
Published