CVE-2017-6010

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "extract_icons" function in the "extract.c" source file. This issue can be triggered by processing a corrupted ico file and will result in an icotool crash.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2017-0837.htmlThird Party Advisory
http://www.debian.org/security/2017/dsa-3807Third Party Advisory
http://www.securityfocus.com/bid/96288Third Party Advisory, VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854054Exploit, Issue Tracking, Mailing List, Vendor Advisory
https://security.gentoo.org/glsa/201801-12Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0837.htmlThird Party Advisory
http://www.debian.org/security/2017/dsa-3807Third Party Advisory
http://www.securityfocus.com/bid/96288Third Party Advisory, VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854054Exploit, Issue Tracking, Mailing List, Vendor Advisory
https://security.gentoo.org/glsa/201801-12Third Party Advisory

Timeline

Published: Feb 16, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-60115.5An issue was discovered in icoutils 0.31.1. An out-of-bounds read leading to a buffer overflow was observed in the "simple_vec" function in CVE-2017-60139.8Subrion CMS 4.0.5.10 has SQL injection in admin/database/ via the query parameter.CVE-2017-60147.5In Wireshark 2.2.4 and earlier, a crafted or malformed STANAG 4607 capture file will cause an infinite loop and memory exhaustion. If the pa CVE-2017-60157.8Without quotation marks, any whitespace in the file path for Rockwell Automation FactoryTalk Activation version 4.00.02 remains ambiguous, w CVE-2017-60167.3An Improper Access Control issue was discovered in LCDS - Leao Consultoria e Desenvolvimento de Sistemas LTDA ME LAquis SCADA. The following CVE-2017-60177.5A Resource Exhaustion issue was discovered in Schneider Electric Modicon M340 PLC BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR020 CVE-2017-60186.1An open redirect issue was discovered in B. Braun Medical SpaceCom module, which is integrated into the SpaceStation docking station: SpaceS CVE-2017-60197.5An issue was discovered in Schneider Electric Conext ComBox, model 865-1058, all firmware versions prior to V3.03 BN 830. A series of rapid CVE-2017-60205.3Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA software versions prior to version 4.1.0.3237 do not neutralize e CVE-2017-60217.5In Schneider Electric ClearSCADA 2014 R1 (build 75.5210) and prior, 2014 R1.1 (build 75.5387) and prior, 2015 R1 (build 76.5648) and prior, CVE-2017-60229.8A hard-coded password issue was discovered in Becton, Dickinson and Company (BD) PerformA, Version 2.0.14.0 and prior versions, and KLA Jour CVE-2017-60239.8An issue was discovered in Fatek Automation PLC Ethernet Module. The affected Ether_cfg software configuration tool runs on the following Fa