CVE-2017-7448

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The allocate_channel_framebuffer function in uncompressed_components.hh in Dropbox Lepton 1.2.1 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a malformed JPEG image.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-369

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/97490
https://github.com/dropbox/lepton/commit/7789d99ac156adfd7bbf66e7824bd3e948a74cf7Patch, Third Party Advisory
https://github.com/dropbox/lepton/issues/86Exploit, Third Party Advisory
http://www.securityfocus.com/bid/97490
https://github.com/dropbox/lepton/commit/7789d99ac156adfd7bbf66e7824bd3e948a74cf7Patch, Third Party Advisory
https://github.com/dropbox/lepton/issues/86Exploit, Third Party Advisory

Timeline

Published: Apr 5, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-74509.8AIRTAME HDMI dongle with firmware before 2.2.0 allows unauthenticated access to a big part of the management interface. It is possible to ex CVE-2017-74525.5The iwbmp_read_info_header function in imagew-bmp.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial o CVE-2017-74535.5The iwgif_record_pixel function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of se CVE-2017-74545.5The iwgif_record_pixel function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of se CVE-2017-74557.5Moxa MXView 2.8 allows remote attackers to read web server's private key file, no access control.CVE-2017-74567.5Moxa MXView 2.8 allows remote attackers to cause a Denial of Service by sending overly long junk payload for the MXView client login credent CVE-2017-74575.0XML External Entity via ".AOP" files used by Moxa MX-AOPC Server 1.5 result in remote file disclosure.CVE-2017-74587.5The NetworkInterface::getHost function in NetworkInterface.cpp in ntopng before 3.0 allows remote attackers to cause a denial of service (NU CVE-2017-74597.5ntopng before 3.0 allows HTTP Response Splitting.CVE-2017-74614.9Directory traversal vulnerability in the web-based management site on the Intellinet NFC-30ir IP Camera with firmware LM.1.6.16.05 allows re CVE-2017-74629.8Intellinet NFC-30ir IP Camera has a vendor backdoor that can allow a remote attacker access to a vendor-supplied CGI script in the web direc CVE-2017-74636.1JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a reflected XSS via artifact upload. A malformed XML file, if uploaded, causes a