CVE-2017-15602
HighSummary
In GNU Libextractor 1.4, there is an integer signedness error for the chunk size in the EXTRACTOR_nsfe_extract_method function in plugins/nsfe_extractor.c, leading to an infinite loop for a crafted size.
Risk Assessment
This bug may lead to application hang, affecting service availability within the organization.
Recommendation
It is recommended to update to the latest version of GNU Libextractor to mitigate this vulnerability.
Other vulnerabilities in GNU Libextractor 1.4
See all- CVE-2017-15601High
In GNU Libextractor version 1.4, there is a heap-based buffer overflow in the EXTRACTOR_png_extract_method function in plugins/png_extractor.c, related to processiTXt and stndup.
- CVE-2017-15600High
In GNU Libextractor version 1.4, there is a NULL Pointer Dereference in the EXTRACTOR_nsf_extract_method function of plugins/nsf_extractor.c.
- CVE-2017-15267High
In GNU Libextractor version 1.4, there is a NULL Pointer Dereference in the flac_metadata function in flac_extractor.c.
Original NVD description (English source)
In GNU Libextractor 1.4, there is an integer signedness error for the chunk size in the EXTRACTOR_nsfe_extract_method function in plugins/nsfe_extractor.c, leading to an infinite loop for a crafted size.