CVE-2017-6010

NameCVE-2017-6010
DescriptionAn issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "extract_icons" function in the "extract.c" source file. This issue can be triggered by processing a corrupted ico file and will result in an icotool crash.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-854-1, DSA-3807-1
NVD severitymedium (attack range: remote)
Debian Bugs854054

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
icoutils (PTS)wheezy0.29.1-5vulnerable
wheezy (security)0.29.1-5deb7u2fixed
jessie (security), jessie0.31.0-2+deb8u3fixed
stretch0.31.2-1.1fixed
buster, sid0.31.3-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
icoutilssource(unstable)0.31.2-1medium854054
icoutilssourcejessie0.31.0-2+deb8u3mediumDSA-3807-1
icoutilssourcewheezy0.29.1-5deb7u2mediumDLA-854-1

Notes

Fixed by: http://git.savannah.gnu.org/cgit/icoutils.git/commit/?id=bf97b99109607d4367a4e57df9a37cbcac02e220
Fixed by: http://git.savannah.gnu.org/cgit/icoutils.git/commit/?id=45a0207225df4cd4b82f41eee636e21f11a7db74
Proposed patch from Red Hat contributor: https://bugzilla.redhat.com/attachment.cgi?id=1256393

Search for package or bug name: Reporting problems