Denial of Service Vulnerability in GNU Libextractor Package
Summary
UBUNTU-CVE-2017-17440: GNU Libextractor 1.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted GIF, IT (Impulse Tracker), NSFE, S3M (Scream Tracker 3), SID, or XM (eXtended Modul... Affects libextractor versions 1:1.1-1ubuntu1 – 1:1.3-1ubuntu0.1~esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU Libextractor is a library that provides a way to extract metadata from various file formats. It supports a wide range of file types, including audio, video, and image formats, making it a versatile tool for developers. However, a vulnerability has been identified in version 1.6 of this library, which can lead to application crashes when processing certain crafted files.
Vulnerability Detail
The vulnerability, identified as CVE-2017-17440, allows remote attackers to cause a denial of service through a NULL pointer dereference and subsequent application crash. This issue arises when the library processes specially crafted files such as GIF, IT, NSFE, S3M, SID, or XM files. The flaw is located in the EXTRACTOR_xm_extract_method function within the xm_extractor.c plugin, which fails to handle these files correctly, leading to potential service disruptions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted or potentially malicious files with the libextractor library until the package is updated to a secure version.
Conclusion
The CVE-2017-17440 vulnerability in the GNU Libextractor library poses a significant risk of denial of service due to improper handling of certain file types. It is crucial to update to the patched versions to mitigate this risk and ensure the stability of applications relying on this library.
See every vulnerability recorded for libextractor →
FAQ
CVE-2017-17440 is a vulnerability in the GNU Libextractor library that allows remote attackers to crash applications by sending specially crafted files.
If your application uses the affected version of libextractor, it may crash when processing certain file types, leading to service interruptions.
The vulnerability is triggered by crafted GIF, IT, NSFE, S3M, SID, or XM files.
Yes, there are patched versions available for both Ubuntu 14.04 LTS and 16.04 LTS. It is recommended to update to these versions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground.
Related vulnerabilities
Recent vulnerabilities recorded for libextractor.
