CVE-2017-6009

MEDIUM

Icoutils - Memory Corruption

Title source: rule

Description

An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "decode_ne_resource_id" function in the "restable.c" source file. This is happening because the "len" parameter for memcpy is not checked for size and thus becomes a negative integer in the process, resulting in a failed memcpy. This affects wrestool.

Scores

CVSS v3 5.5
EPSS 0.0028
EPSS Percentile 51.1%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Classification

CWE
CWE-119
Status published

Affected Products (16)

icoutils_project/icoutils
debian/debian_linux
debian/debian_linux
redhat/enterprise_linux_desktop
redhat/enterprise_linux_server
redhat/enterprise_linux_server_aus
redhat/enterprise_linux_server_aus
redhat/enterprise_linux_server_aus
redhat/enterprise_linux_server_eus
redhat/enterprise_linux_server_eus
redhat/enterprise_linux_server_eus
redhat/enterprise_linux_server_eus
redhat/enterprise_linux_server_tus
redhat/enterprise_linux_server_tus
redhat/enterprise_linux_workstation
... and 1 more

Timeline

Published Feb 16, 2017
Tracked Since Feb 18, 2026