Heap-Based Buffer Overflow in GNU Libextractor Affects PNG Extractor Function
CVE-2017-15601

7.5HIGH

Key Information:

Vendor: Gnu
Status: Libextractor
Vendor: CVE Published:; 18 October 2017

What is CVE-2017-15601?

In GNU Libextractor version 1.4, a heap-based buffer overflow exists within the EXTRACTOR_png_extract_method function, specifically linked to the handling of processiTXt and stndup operations. This vulnerability poses a risk as it can allow an attacker to exploit memory corruption, potentially leading to arbitrary code execution or other malicious activities. Users are advised to upgrade to the latest version of Libextractor to mitigate this risk.