CVE-2017-9433
libmwaw: Out-of-bounds write in the MsWrd1Parser::readFootnoteCorrespondence function
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (media), Ubuntu (media).
Descripción
Document Liberation Project libmwaw before 2017-04-08 has an out-of-bounds write caused by a heap-based buffer overflow related to the MsWrd1Parser::readFootnoteCorrespondance function in lib/MsWrd1Parser.cxx.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 11 | libmwaw | 0.3.9-2 |
| debian 12 | libmwaw | 0.3.9-2 |
| debian 13 | libmwaw | 0.3.9-2 |
| debian 14 | libmwaw | 0.3.9-2 |
| debian 8 | libmwaw | 0.3.1-2+deb8u1 |
| echo | libmwaw | 0.3.9-2 |
| Red Hat | libmwaw, libmwaw-devel, libmwaw-doc y 1 más | sin corrección indicada |
| ubuntu 14.04 | libmwaw | 0.1.11-1ubuntu1.1 |
| ubuntu 16.04 | libmwaw | 0.3.7-1ubuntu2.1 |
| ubuntu 16.04-ESM | libmwaw | 0.3.7-1ubuntu2.1 |
| ubuntu 16.10 | libmwaw | 0.3.8-2ubuntu0.1 |
| ubuntu 17.04 | libmwaw | 0.3.9-1ubuntu0.1 |
Mostrar las 15 entradas de 12 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 11 | libmwaw | 0.3.9-2 |
| debian 12 | libmwaw | 0.3.9-2 |
| debian 13 | libmwaw | 0.3.9-2 |
| debian 14 | libmwaw | 0.3.9-2 |
| debian 8 | libmwaw | 0.3.1-2+deb8u1 |
| echo | libmwaw | 0.3.9-2 |
| Red Hat | libmwaw | sin corrección indicada |
| Red Hat | libmwaw-devel | sin corrección indicada |
| Red Hat | libmwaw-doc | sin corrección indicada |
| Red Hat | libmwaw-tools | sin corrección indicada |
| ubuntu 14.04 | libmwaw | 0.1.11-1ubuntu1.1 |
| ubuntu 16.04 | libmwaw | 0.3.7-1ubuntu2.1 |
| ubuntu 16.04-ESM | libmwaw | 0.3.7-1ubuntu2.1 |
| ubuntu 16.10 | libmwaw | 0.3.8-2ubuntu0.1 |
| ubuntu 17.04 | libmwaw | 0.3.9-1ubuntu0.1 |
Referencias
- http://www.debian.org/security/2017/dsa-3875
- https://access.redhat.com/security/cve/CVE-2017-9433
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1037
- https://nvd.nist.gov/vuln/detail/CVE-2017-9433
- https://sourceforge.net/p/libmwaw/libmwaw/ci/68b3b74569881248bfb6cbb4266177cc253b292f/
- https://ubuntu.com/security/notices/USN-3319-1
- https://www.cve.org/CVERecord?id=CVE-2017-9433