CVE-2017-14637
CriticalSummary
In sam2p version 0.49.3, there is an invalid read of size 2 in the parse_rgb function in in_xpm.cpp. This can also cause a write to an illegal address.
Risk Assessment
This vulnerability may lead to unexpected application behavior, potentially resulting in crashes or exploitation by malicious software.
Recommendation
It is recommended to update to the latest version of sam2p to mitigate this vulnerability and conduct a code audit to identify other potential issues.
Other vulnerabilities in sam2p 0.49.3
See all- CVE-2017-14629High
In sam2p version 0.49.3, there is an integer signedness error in the in_xpm_reader function in in_xpm.cpp, leading to a crash when writing to an out-of-bounds array element.
- CVE-2017-14636Critical
Due to an integer overflow in sam2p 0.49.3, a loop executes 0xffffffff times, ending with an invalid read of size 1 in the Image::Indexed::sortPal function in image.cpp. This also causes memory corruption due to an attempted write to the invalid d[0xfffffffe] array element.
- CVE-2017-14631Critical
In sam2p version 0.49.3, there is an integer signedness error in the pcxLoadRaster function in in_pcx.cpp, leading to a heap-based buffer overflow.
- CVE-2017-14630Critical
In sam2p version 0.49.3, an integer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp, leading to an invalid write operation.
- CVE-2017-14628Critical
In version 0.49.3 of sam2p, a heap-based buffer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp.
Original NVD description (English source)
In sam2p 0.49.3, there is an invalid read of size 2 in the parse_rgb function in in_xpm.cpp. However, this can also cause a write to an illegal address.