CVE-2017-9832

MEDIUM

libmtp <1.1.12 - DoS/Remote Code Execution

Title source: llm

Description

An integer overflow vulnerability in ptp-pack.c (ptp_unpack_OPL function) of libmtp (version 1.1.12 and below) allows attackers to cause a denial of service (out-of-bounds memory access) or maybe remote code execution by inserting a mobile device into a personal computer through a USB cable.

References (2)

[Issue Tracking, Mailing List, Patch, Third Party Advisory] https://sourceforge.net/p/libmtp/mailman/message/35729062

[Mailing List] https://lists.debian.org/debian-lts-announce/2020/04/msg00003.html

Scores

CVSS v3 6.8

EPSS 0.0023

EPSS Percentile 45.8%

Attack Vector PHYSICAL

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-190

Status published

Products (2)

libmtp_project/libmtp < 1.1.12

n/a/n/a

Published Jun 24, 2017

Tracked Since Feb 18, 2026