CVE-2017-6011

NameCVE-2017-6011
DescriptionAn issue was discovered in icoutils 0.31.1. An out-of-bounds read leading to a buffer overflow was observed in the "simple_vec" function in the "extract.c" source file. This affects icotool.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-854-1, DSA-3807-1
NVD severitymedium (attack range: remote)
Debian Bugs854054

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
icoutils (PTS)wheezy0.29.1-5vulnerable
wheezy (security)0.29.1-5deb7u2fixed
jessie (security), jessie0.31.0-2+deb8u3fixed
stretch0.31.2-1.1fixed
buster0.31.3-1fixed
sid0.32.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
icoutilssource(unstable)0.31.2-1medium854054
icoutilssourcejessie0.31.0-2+deb8u3mediumDSA-3807-1
icoutilssourcewheezy0.29.1-5deb7u2mediumDLA-854-1

Notes

Fixed by: http://git.savannah.gnu.org/cgit/icoutils.git/commit/?id=bf97b99109607d4367a4e57df9a37cbcac02e220
Fixed by: http://git.savannah.gnu.org/cgit/icoutils.git/commit/?id=45a0207225df4cd4b82f41eee636e21f11a7db74
Proposed patch from Red Hat contributor: https://bugzilla.redhat.com/attachment.cgi?id=1256393

Search for package or bug name: Reporting problems