CVE-2017-2920
An memory corruption vulnerability exists in the .SVG parsing functionality of Computerinsel...
An memory corruption vulnerability exists in the .SVG parsing functionality of Computerinsel Photoline 20.02. A specially crafted .SVG file can cause a vulnerability resulting in memory corruption, which can potentially lead to arbitrary code execution. An attacker can send a specific .SVG file to trigger this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
An memory corruption vulnerability exists in the .SVG parsing functionality of Computerinsel Photoline 20.02. A specially crafted .SVG file can cause a vulnerability resulting in memory corruption, which can potentially lead to arbitrary code execution. An attacker can send a specific .SVG file to trigger this vulnerability.
- Record
CVE-2017-2920- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
EUVDEUVD-2017-12061
An memory corruption vulnerability exists in the .SVG parsing functionality of Computerinsel Photoline 20.02. A specially crafted .SVG file can cause a vulnerability resulting in memory corruption, which can potentially lead to arbitrary code execution. An attacker can send a specific .SVG file to trigger this vulnerability.
- Record
EUVD-2017-12061- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7vxg-r92h-f463
An memory corruption vulnerability exists in the .SVG parsing functionality of Computerinsel...
An memory corruption vulnerability exists in the .SVG parsing functionality of Computerinsel Photoline 20.02. A specially crafted .SVG file can cause a vulnerability resulting in memory corruption, which can potentially lead to arbitrary code execution. An attacker can send a specific .SVG file to trigger this vulnerability.
- Record
GHSA-7vxg-r92h-f463- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
NVD
An memory corruption vulnerability exists in the .SVG parsing functionality of Computerinsel Photoline 20.02. A specially crafted .SVG file can cause a vulnerability resulting in memory corruption, which can potentially lead to arbitrary code execution. An attacker can send a specific .SVG file to trigger this vulnerability.
- Record
CVE-2017-2920- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
An memory corruption vulnerability exists in the .SVG parsing functionality of Computerinsel Photoline 20.02. A specially crafted .SVG file can cause a vulnerability resulting in memory corruption, which can potentially lead to arbitrary code execution. An attacker can send a specific .SVG file to trigger this vulnerability.
- Record
CVE-2017-2920- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0214 No score
Updated libofx packages fix security vulnerabilities
An exploitable buffer overflow vulnerability exists in the tag parsing functionality of LibOFX 0.9.11. A specially crafted OFX file can cause a write out of bounds resulting in a buffer overflow on the stack. An attacker can construct a malicious OFX file to trigger this vulnerability (CVE-2017-2816).
An exploitable buffer overflow vulnerability exists in the tag parsing functionality of LibOFX 0.9.11. A specially crafted OFX file can cause a write out of bounds resulting in a buffer overflow on the stack. An attacker can construct a malicious OFX file to trigger this vulnerability (CVE-2017-2920).
ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file, as demonstrated by an ofxdump call (CVE-2017-14731).
- Record
MGASA-2018-0214- Updated
- 2026-11-02
OSVSUSE-SU-2018:2045-1 No score
Security update for libofx
This update for libofx fixes the following issues:
Security issues fixed:
- CVE-2017-2816: Fix an exploitable buffer overflow vulnerability in the tag parsing functionality (bsc#1058673).
- CVE-2017-2920: Fix a buffer overflow vulnerability in sanitize_proprietary_tags in lib/ofx_preproc.cpp (bsc#1061964).
- CVE-2017-14731: Fix remote denial of service via a crafted file in ofx_proc_file in ofx_preproc.cpp (bsc#1060437).
- Record
SUSE-SU-2018:2045-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:2064-1 No score
Security update for libofx
This update for libofx fixes the following issues:
Security issues fixed:
- CVE-2017-2816: Fix an exploitable buffer overflow vulnerability in the tag parsing functionality (bsc#1058673).
- CVE-2017-2920: Fix a buffer overflow vulnerability in sanitize_proprietary_tags in lib/ofx_preproc.cpp (bsc#1061964).
- CVE-2017-14731: Fix remote denial of service via a crafted file in ofx_proc_file in ofx_preproc.cpp (bsc#1060437).
- Record
SUSE-SU-2018:2064-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libofxMageia:6 |
before 0.9.10-2.mga6 | 0.9.10-2.mga6 |
libofxSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 0.9.0-3.7.1 | 0.9.0-3.7.1 |
libofxSUSE:Linux Enterprise Desktop 12 SP3 |
before 0.9.9-3.7.1 | 0.9.9-3.7.1 |
libofxSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 0.9.9-3.7.1 | 0.9.9-3.7.1 |
libofxSUSE:Linux Enterprise Workstation Extension 12 SP3 |
before 0.9.9-3.7.1 | 0.9.9-3.7.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-2920 is a high vulnerability (CVSS 8.8) in Computerinsel Photoline, published October 5, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.84%, the 79th percentile. Fixed in libofx 0.9.10-2.mga6.
References
securityfocus.com/bid/101186
security.gentoo.org/glsa/201908-26
github.com/libofx/libofx/commit/a70934eea95c76a7737b83773bffe8738935082d
talosintelligence.com/vulnerability_reports/TALOS-2017-0427
nvd.nist.gov/vuln/detail/CVE-2017-2920
Show 11 moreShow less
advisories.mageia.org/MGASA-2018-0214.html
bugs.mageia.org/show_bug.cgi?id=22878
lists.fedoraproject.org/archives/list/[email protected]/thread/O2W5PV4QMNKEUZEPKO2GNBDRLIDSVDZM
suse.com/support/update/announcement/2018/suse-su-20182045-1
bugzilla.suse.com/1058673