SB20171211347 - Fedora 25 update for libextractor

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20171211347

SB20171211347 - Fedora 25 update for libextractor

Published: December 11, 2017 Updated: April 24, 2025

Security Bulletin ID SB20171211347
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Partial DoS

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Null pointer dereference (CVE-ID: CVE-2017-17440)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists in the EXTRACTOR_xm_extract_method function in plugins/xm_extractor.c due to an error when processing malicious input. A remote attacker can send a specially crafted GIF, IT (Impulse Tracker), NSFE, S3M (Scream Tracker 3), SID, or XM (eXtended Module) file, trigger NULL pointer derference and cause the service to crash.


Remediation

Install update from vendor's website.

References