icoutils - Security Update (CVE-2017-5208, CVE-2017-5331, CVE-2017-5332, CVE-2017-5333)
Summary
DLA-789-1: icoutils - security update. Affects icoutils versions < 0.29.1-5deb7u1. Fixed in 0.29.1-5deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
icoutils is a set of command-line tools for extracting and converting icons in Microsoft Windows icon and cursor files. These tools are commonly used in various applications, including KDE's metadata parsing. However, icoutils versions prior to 0.29.1-5deb7u1 are vulnerable to multiple security issues.
Vulnerability Detail
The vulnerabilities in icoutils include:
-
CVE-2017-5208: An exploitable crash in wrestool, one of the command-line tools in icoutils, was discovered. This vulnerability could be exploited by an attacker to cause a denial of service or potentially execute arbitrary code.
-
CVE-2017-5331: The initial fix for CVE-2017-5208 was found to be insufficient, requiring an additional correction to address the vulnerability completely.
-
CVE-2017-5332: Certain combinations of arguments can still lead to a successful test, even if the identified memory block is not fully within the total memory size.
-
CVE-2017-5333: The memory check in icoutils was not stringent enough on 64-bit systems, potentially allowing an attacker to bypass memory restrictions.
These vulnerabilities pose a risk to systems using icoutils prior to version 0.29.1-5deb7u1.
How To Fix
Minimum fixed version
0.29.1-5deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade icoutilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Upgrading the icoutils package to version 0.29.1-5deb7u1 or later is crucial to protect systems from the identified vulnerabilities. It is recommended to follow the provided steps to apply the necessary updates. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for icoutils →
FAQ
icoutils is a set of command-line tools used for extracting and converting icons in Microsoft Windows icon and cursor files.
These vulnerabilities could allow an attacker to cause a denial of service or potentially execute arbitrary code on systems using vulnerable versions of icoutils.
No, only versions prior to 0.29.1-5deb7u1 are affected by these vulnerabilities.
No specific workaround has been provided for these vulnerabilities. It is recommended to upgrade to the fixed version of icoutils.
More information about Debian LTS security advisories, including how to apply updates and frequently asked questions, can be found at: https://wiki.debian.org/LTS
Related vulnerabilities
Recent vulnerabilities recorded for icoutils.
