Integer Signedness Error in GNU Libextractor - libextractor Vulnerability
Summary
UBUNTU-CVE-2017-15602: In GNU Libextractor 1.4, there is an integer signedness error for the chunk size in the EXTRACTOR_nsfe_extract_method function in plugins/nsfe_extractor.c, leading to an infinite loop for a crafted size. Affects libextractor versions 1:1.1-1ubuntu1 – 1:1.3-1ubuntu0.1~esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU Libextractor is a library designed for extracting metadata from various file formats. It provides a modular architecture that allows developers to add new extraction methods easily. The library is widely used in applications that require metadata extraction, making it a critical component in many software systems. However, a vulnerability has been identified in version 1.4 of Libextractor, which can lead to severe consequences if exploited.
Vulnerability Detail
In GNU Libextractor 1.4, there exists an integer signedness error in the EXTRACTOR_nsfe_extract_method function located in plugins/nsfe_extractor.c. This flaw can be exploited by providing a crafted size, resulting in an infinite loop. Such an infinite loop can lead to denial of service, potentially causing applications that rely on Libextractor to become unresponsive. The vulnerability has been assigned a CVSS score of 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate patching is not possible, consider disabling the use of the affected extraction method or limiting the input size to prevent exploitation until the package can be updated.
Conclusion
The identified vulnerability in GNU Libextractor poses a significant risk to applications that rely on this library for metadata extraction. It is crucial to update to the patched version to ensure the security and stability of your software. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for libextractor →
FAQ
The vulnerability can lead to an infinite loop, causing denial of service in applications that utilize the affected version of Libextractor.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The vulnerability affects GNU Libextractor version 1.4. Ensure you are using a patched version to mitigate the risk.
Yes, the fix involves updating to the patched version of libextractor. For Ubuntu 16.04 LTS, use the command: sudo apt-get install libextractor=1:1.3-4+deb9u3build0.16.04.1.
As a temporary measure, consider disabling the affected extraction method or restricting input sizes to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for libextractor.
