Integer Overflow Vulnerability in icoutils Affects Local Users
CVE-2017-5333

7.8HIGH

Key Information:

Vendor

Debian
Status
Icoutils
Vendor
CVE Published:
4 November 2019

What is CVE-2017-5333?

An integer overflow vulnerability exists in the extract_group_icon_cursor_resource function of the icoutils tool prior to version 0.31.1. This flaw allows local users to craft malicious executable files that can crash processes or potentially lead to arbitrary code execution. Systems using vulnerable versions of icoutils are at risk, making it critical for users to update to safe versions to mitigate such threats.

Affected Version(s)

icoutils before 0.31.1

References

http://rhn.redhat.com/errata/RHSA-2017-0837.html
vendor-advisoryx_refsource_REDHAT
http://lists.opensuse.org/opensuse-security-announce/2017...
vendor-advisoryx_refsource_SUSE
http://www.securityfocus.com/bid/95678
vdb-entryx_refsource_BID

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.