CVE-2017-15922
In GNU Libextractor 1.4, there is an out-of-bounds read in the EXTRACTOR_dvi_extract_method...
In GNU Libextractor 1.4, there is an out-of-bounds read in the EXTRACTOR_dvi_extract_method function in plugins/dvi_extractor.c.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
5.5
In GNU Libextractor 1.4, there is an out-of-bounds read in the EXTRACTOR_dvi_extract_method function in plugins/dvi_extractor.c.
- Record
CVE-2017-15922- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
In GNU Libextractor 1.4, there is an out-of-bounds read in the EXTRACTOR_dvi_extract_method function in plugins/dvi_extractor.c.
- Record
CVE-2017-15922- Updated
- 2026-11-02
EUVDEUVD-2017-7339 No score
In GNU Libextractor 1.4, there is an out-of-bounds read in the EXTRACTOR_dvi_extract_method function in plugins/dvi_extractor.c.
- Record
EUVD-2017-7339- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9r4w-4465-whwv
5.5
In GNU Libextractor 1.4, there is an out-of-bounds read in the EXTRACTOR_dvi_extract_method...
In GNU Libextractor 1.4, there is an out-of-bounds read in the EXTRACTOR_dvi_extract_method function in plugins/dvi_extractor.c.
- Record
GHSA-9r4w-4465-whwv- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
5.5
In GNU Libextractor 1.4, there is an out-of-bounds read in the EXTRACTOR_dvi_extract_method function in plugins/dvi_extractor.c.
- Record
CVE-2017-15922- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-15922
5.5
In GNU Libextractor 1.4, there is an out-of-bounds read in the EXTRACTOR_dvi_extract_method function in plugins/dvi_extractor.c.
- Record
DEBIAN-CVE-2017-15922- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-15922
5.5
In GNU Libextractor 1.4, there is an out-of-bounds read in the EXTRACTOR_dvi_extract_method function in plugins/dvi_extractor.c.
- Record
UBUNTU-CVE-2017-15922- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUSN-4641-1 No score
libextractor vulnerabilities
It was discovered that Libextractor incorrectly handled zero sample rate. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-15266)
It was discovered that Libextractor incorrectly handled certain FLAC metadata. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-15267)
It was discovered that Libextractor incorrectly handled certain specially crafted files. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-15600, CVE-2018-16430, CVE-2018-20430)
It was discovered that Libextractor incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-15601)
It was discovered that Libextractor incorrectly handled integers. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-15602)
It was discovered that Libextractore incorrectly handled certain crafted files. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-15922)
It was discovered tha Libextractor incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-17440)
It was discovered that Libextractor incorrectly handled certain malformed files. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-14346)
It was discovered that Libextractor incorrectly handled malformed files. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-14347)
It was discovered that Libextractor incorrectly handled metadata. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-20431)
- Record
USN-4641-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libextractorDebian:12 |
before 1:1.6-2 | 1:1.6-2 |
libextractorDebian:13 |
before 1:1.6-2 | 1:1.6-2 |
libextractorDebian:14 |
before 1:1.6-2 | 1:1.6-2 |
libextractorDebian:7 |
before 1:0.6.3-5+deb7u1, plus listed versions 1:0.6.3-5 |
1:0.6.3-5+deb7u1 |
libextractorUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1:1.1-1ubuntu11:1.2-1ubuntu11:1.3-11:1.3-1ubuntu0.1~esm1 |
None known |
libextractorUbuntu:16.04:LTS |
before 1:1.3-4+deb9u3build0.16.04.1, plus listed versions 1:1.3-2build11:1.3-2ubuntu11:1.3-3 |
1:1.3-4+deb9u3build0.16.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-15922 is a medium vulnerability (CVSS 5.5) in Gnu Libextractor, published October 26, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.31%, the 70th percentile. Fixed in libextractor 1:1.6-2.
References
securityfocus.com/bid/101595
lists.gnu.org/archive/html/bug-libextractor/2017-10/msg00008.html
lists.debian.org/debian-lts-announce/2017/12/msg00000.html
nvd.nist.gov/vuln/detail/CVE-2017-15922
github.com/advisories/GHSA-9r4w-4465-whwv
security-tracker.debian.org/tracker/CVE-2017-15922
Show 14 moreShow less
ubuntu.com/security/CVE-2017-15922
ubuntu.com/security/notices/USN-4641-1
cve.org/CVERecord?id=CVE-2017-15922
ubuntu.com/security/CVE-2017-15266
ubuntu.com/security/CVE-2017-15267
ubuntu.com/security/CVE-2017-15600
ubuntu.com/security/CVE-2017-15601
ubuntu.com/security/CVE-2017-15602
ubuntu.com/security/CVE-2017-17440
ubuntu.com/security/CVE-2018-14346
ubuntu.com/security/CVE-2018-14347
ubuntu.com/security/CVE-2018-16430
ubuntu.com/security/CVE-2018-20430
ubuntu.com/security/CVE-2018-20431