CVE-2017-17440

MEDIUM 6.5CVE-2017-17440 · Published 06/12/2017 · updated 17/06/2026

In short

CVE-2017-17440 is a MEDIUM (CVSS 6.5) vulnerability affecting libextractor (gnu).
Chance of exploitation in the next 30 days (EPSS): 2.4%, higher than 83.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
libextractor gnu	`= 1.6`	No fix yet

Description

GNU Libextractor 1.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted GIF, IT (Impulse Tracker), NSFE, S3M (Scream Tracker 3), SID, or XM (eXtended Module) file, as demonstrated by the EXTRACTOR_xm_extract_method function in plugins/xm_extractor.c.

References

securityfocus.com/bid/102116 · Third Party Advisory
bugs.debian.org/883528 · Exploit
gnunet.org/git/libextractor.git/commit · Patch
lists.gnu.org/archive/html/bug-libextractor/2017-11/msg00000.html · Exploit
lists.gnu.org/archive/html/bug-libextractor/2017-11/msg00001.html · Exploit
lists.gnu.org/archive/html/bug-libextractor/2017-11/msg00002.html · Exploit
lists.gnu.org/archive/html/bug-libextractor/2017-11/msg00004.html · Exploit
lists.gnu.org/archive/html/bug-libextractor/2017-11/msg00005.html · Issue Tracking

More vulnerabilities in libextractor

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

libextractor

gnu

= 1.6

No fix yet

Description

More vulnerabilities in libextractor

See all →