CVE-2017-9472

2017-06-0705:29:00

Google

osv.dev

6.8 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.6%

JSON

In ytnef 1.9.2, the SwapDWord function in lib/ytnef.c allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.

CPENameOperatorVersion
ytnefeq1.9.1-2
ytnefeq1.9.1
ytnefeq1.8
ytnefeq1.7
ytnefeq1.9.2
ytnefeq1.9

Name	Operator	Version
ytnef	eq	1.9.1-2
ytnef	eq	1.9.1
ytnef	eq	1.8
ytnef	eq	1.7
ytnef	eq	1.9.2
ytnef	eq	1.9

References

blogs.gentoo.org/ago/2017/05/24/ytnef-heap-based-buffer-overflow-in-swapdword-ytnef-c/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LFJWMUEUC4ILH2HEOCYVVLQT654ZMCGQ/