CVE-2017-15602

Опубликовано: 18 окт. 2017

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

In GNU Libextractor 1.4, there is an integer signedness error for the chunk size in the EXTRACTOR_nsfe_extract_method function in plugins/nsfe_extractor.c, leading to an infinite loop for a crafted size.

Ссылки

http://lists.gnu.org/archive/html/bug-libextractor/2017-10/msg00005.html
Exploit
Mailing List
Third Party Advisory
https://ftp.gnu.org/gnu/libextractor/libextractor-1.6.tar.gz
Product
https://lists.debian.org/debian-lts-announce/2017/12/msg00000.html
http://lists.gnu.org/archive/html/bug-libextractor/2017-10/msg00005.html
Exploit
Mailing List
Third Party Advisory
https://ftp.gnu.org/gnu/libextractor/libextractor-1.6.tar.gz
Product
https://lists.debian.org/debian-lts-announce/2017/12/msg00000.html

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:gnu:libextractor:1.4:*:*:*:*:*:*:*

EPSS

Процентиль: 61%

0.00408

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-835

Связанные уязвимости

CVE-2017-15602

CVSS3: 7.5

ubuntu

больше 8 лет назад

CVE-2017-15602

CVSS3: 7.5

debian

больше 8 лет назад

In GNU Libextractor 1.4, there is an integer signedness error for the ...

GHSA-ghp6-q6jg-fc8q

CVSS3: 7.5

github

больше 3 лет назад

EPSS

Процентиль: 61%

0.00408

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-835