CVE-2017-15954

NameCVE-2017-15954
Descriptionbchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow (with a resultant invalid free) and crash when processing a malformed CUE (.cue) file.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-1158-1, DSA-4026-1
Debian Bugs880116

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
bchunk (PTS)bullseye1.2.2-2fixed
bookworm1.2.2+git20220715+ds-2fixed
trixie, sid1.2.2+git20220715+ds-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
bchunksourcewheezy1.2.0-12+deb7u1DLA-1158-1
bchunksourcejessie1.2.0-12+deb8u1DSA-4026-1
bchunksourcestretch1.2.0-12+deb9u1DSA-4026-1
bchunksource(unstable)1.2.0-12.1880116

Notes

https://github.com/extramaster/bchunk/issues/3
Search for package or bug name: Reporting problems