CVE-2017-7263
HighSummary
The bm_readbody_bmp function in bitmap_io.c in Potrace 1.14 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted BMP image.
Risk Assessment
This vulnerability may lead to application crashes, disrupting service operations within the organization. Additionally, there is a risk that attackers could exploit this flaw for further attacks.
Recommendation
It is recommended to update Potrace to the latest version to mitigate this vulnerability and to monitor systems for suspicious activity related to BMP image processing.
Other vulnerabilities in Potrace 1.14
See all- CVE-2017-12067High
Potrace version 1.14 has a heap-based buffer over-read vulnerability in the interpolate_cubic function in mkbitmap.c.
- CVE-2016-8703High
Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image.
- CVE-2016-8702High
A heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before version 1.13 allows remote attackers to exploit it via a crafted BMP image.
- CVE-2016-8701High
A heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before version 1.13 allows remote attackers to exploit it via a crafted BMP image.
- CVE-2016-8700High
Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to exploit a crafted BMP image.
- CVE-2016-8699High
Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to exploit this via a crafted BMP image.
- CVE-2016-8698High
Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to exploit it via a crafted BMP image.
- CVE-2016-8686High
The bm_new function in bitmap.h in potrace 1.13 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure.
Original NVD description (English source)
The bm_readbody_bmp function in bitmap_io.c in Potrace 1.14 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted BMP image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8698.