CVE-2017-9177
published 2017-05-23CVE-2017-9177: libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid read and SEGV), related to the ReadImage function in…
PriorityP432high7.5CVSS 3.0
AVNACLPRNUINSUCNINAH
EPSS
2.00%
78.5th percentile
libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid read and SEGV), related to the ReadImage function in input-bmp.c:390:12.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| autotrace_project | autotrace | — | — |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-964j-968w-5vjg: libautotrace
ghsa_unreviewed·2022-05-17
CVE-2017-9177 [HIGH] CWE-125 GHSA-964j-968w-5vjg: libautotrace
libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid read and SEGV), related to the ReadImage function in input-bmp.c:390:12.
OSV
CVE-2017-9177: libautotrace
osv·2017-05-23·CVSS 7.5
CVE-2017-9177 [HIGH] CVE-2017-9177: libautotrace
libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid read and SEGV), related to the ReadImage function in input-bmp.c:390:12.
Red Hat
autotrace: Multiple security issues
vendor_redhat·2017-05-20·CVSS 7.5
CVE-2017-9177 [HIGH] autotrace: Multiple security issues
autotrace: Multiple security issues
libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid read and SEGV), related to the ReadImage function in input-bmp.c:390:12.
Statement: Red Hat Product Security has rated these issues as having Low security impact. These issues are not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Package: autotrace (Red Hat Enterprise Linux 6) - Will not fix
Package: autotrace (Red Hat Enterprise Linux 7) - Will not fix
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-9151..CVE-2017-9200 autotrace: Multiple security issues
bugzilla·2017-05-23·CVSS 9.8
CVE-2017-9151 [CRITICAL] CVE-2017-9151..CVE-2017-9200 autotrace: Multiple security issues
CVE-2017-9151..CVE-2017-9200 autotrace: Multiple security issues
Multiple vulnerabilities were found in autotrace.
CVE-2017-9200: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:528:63.
CVE-2017-9199: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:192:19.
CVE-2017-9198: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:508:18.
CVE-2017-9197: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:498:55.
CVE-2017-9196: libautotrace.a in AutoTrace 0.31.1 has a "negative-size-param" issue in the ReadImage function in input-tga.c:528:7.
CVE-2017-9195: libautotrace.a in AutoTrace 0.31.1 has a heap-based
Bugzilla
CVE-2016-9177 Spark: Directory traversal vulnerability in version 2.5
bugzilla·2016-11-10·CVSS 7.5
CVE-2016-9177 [HIGH] CVE-2016-9177 Spark: Directory traversal vulnerability in version 2.5
CVE-2016-9177 Spark: Directory traversal vulnerability in version 2.5
A path traversal issue was found in Spark version 2.5 and potentially earlier versions. The vulnerability resides in the functionality to serve static files where there's no protection against directory traversal attacks. This could allow attackers access to private files including sensitive data.
External References:
http://seclists.org/fulldisclosure/2016/Nov/13
Discussion:
This issue has been addressed in the following products:
Via RHSA-2017:0868 https://access.redhat.com/errata/RHSA-2017:0868
---
This issue has been addressed in the following products:
Red Hat JBoss Fuse
Via RHSA-2017:0868 https://access.redhat.com/errata/RHSA-2017:0868
2017-05-23
Published