CVE-2017-14731
ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote attackers to cause a denial of...
ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file, as demonstrated by an ofxdump call.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file, as demonstrated by an ofxdump call.
- Record
CVE-2017-14731- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file, as demonstrated by an ofxdump call.
- Record
CVE-2017-14731- Updated
- 2026-11-02
EUVDEUVD-2017-6228 No score
ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file, as demonstrated by an ofxdump call.
- Record
EUVD-2017-6228- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-72rp-65j6-49qh
ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote attackers to cause a denial of...
ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file, as demonstrated by an ofxdump call.
- Record
GHSA-72rp-65j6-49qh- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file, as demonstrated by an ofxdump call.
- Record
CVE-2017-14731- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-14731
ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file, as demonstrated by an ofxdump call.
- Record
DEBIAN-CVE-2017-14731- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2017-14731
ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file, as demonstrated by an ofxdump call.
- Record
UBUNTU-CVE-2017-14731- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0214 No score
Updated libofx packages fix security vulnerabilities
An exploitable buffer overflow vulnerability exists in the tag parsing functionality of LibOFX 0.9.11. A specially crafted OFX file can cause a write out of bounds resulting in a buffer overflow on the stack. An attacker can construct a malicious OFX file to trigger this vulnerability (CVE-2017-2816).
An exploitable buffer overflow vulnerability exists in the tag parsing functionality of LibOFX 0.9.11. A specially crafted OFX file can cause a write out of bounds resulting in a buffer overflow on the stack. An attacker can construct a malicious OFX file to trigger this vulnerability (CVE-2017-2920).
ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file, as demonstrated by an ofxdump call (CVE-2017-14731).
- Record
MGASA-2018-0214- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10964-1 No score
libofx-0.10.1-1.9 on GA media
These are all security issues fixed in the libofx-0.10.1-1.9 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10964-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:2045-1 No score
Security update for libofx
This update for libofx fixes the following issues:
Security issues fixed:
- CVE-2017-2816: Fix an exploitable buffer overflow vulnerability in the tag parsing functionality (bsc#1058673).
- CVE-2017-2920: Fix a buffer overflow vulnerability in sanitize_proprietary_tags in lib/ofx_preproc.cpp (bsc#1061964).
- CVE-2017-14731: Fix remote denial of service via a crafted file in ofx_proc_file in ofx_preproc.cpp (bsc#1060437).
- Record
SUSE-SU-2018:2045-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:2064-1 No score
Security update for libofx
This update for libofx fixes the following issues:
Security issues fixed:
- CVE-2017-2816: Fix an exploitable buffer overflow vulnerability in the tag parsing functionality (bsc#1058673).
- CVE-2017-2920: Fix a buffer overflow vulnerability in sanitize_proprietary_tags in lib/ofx_preproc.cpp (bsc#1061964).
- CVE-2017-14731: Fix remote denial of service via a crafted file in ofx_proc_file in ofx_preproc.cpp (bsc#1060437).
- Record
SUSE-SU-2018:2064-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libofxDebian:12 |
before 1:0.9.11-5 | 1:0.9.11-5 |
libofxDebian:13 |
before 1:0.9.11-5 | 1:0.9.11-5 |
libofxDebian:14 |
before 1:0.9.11-5 | 1:0.9.11-5 |
libofxDebian:7 |
before 1:0.9.4-2.1+deb7u1, plus listed versions 1:0.9.4-2.1 |
1:0.9.4-2.1+deb7u1 |
libofxMageia:6 |
before 0.9.10-2.mga6 | 0.9.10-2.mga6 |
libofxSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 0.9.0-3.7.1 | 0.9.0-3.7.1 |
libofxSUSE:Linux Enterprise Desktop 12 SP3 |
before 0.9.9-3.7.1 | 0.9.9-3.7.1 |
libofxSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 0.9.9-3.7.1 | 0.9.9-3.7.1 |
libofxSUSE:Linux Enterprise Workstation Extension 12 SP3 |
before 0.9.9-3.7.1 | 0.9.9-3.7.1 |
libofxUbuntu:16.04:LTS |
before 1:0.9.10-1+deb8u1build0.16.04.1, plus listed versions 1:0.9.10-1build2 |
1:0.9.10-1+deb8u1build0.16.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-14731 is a medium vulnerability (CVSS 6.5) in Libofx Project Libofx, published September 25, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.26%, the 69th percentile. Fixed in libofx 1:0.9.11-5.
References
lists.debian.org/debian-lts-announce/2017/11/msg00038.html
github.com/libofx/libofx/issues/10
security.gentoo.org/glsa/201908-26
nvd.nist.gov/vuln/detail/CVE-2017-14731
security-tracker.debian.org/tracker/CVE-2017-14731
Show 13 moreShow less
advisories.mageia.org/MGASA-2018-0214.html
bugs.mageia.org/show_bug.cgi?id=22878
lists.fedoraproject.org/archives/list/[email protected]/thread/O2W5PV4QMNKEUZEPKO2GNBDRLIDSVDZM
suse.com/support/update/announcement/2018/suse-su-20182045-1
bugzilla.suse.com/1058673
ubuntu.com/security/CVE-2017-14731
cve.org/CVERecord?id=CVE-2017-14731