CVE-2017-5331
Integer overflow in the check_offset function in b/wrestool/fileread.c in icoutils before 0.31.1...
CVE-2017-5331 is a high vulnerability (CVSS 7.8) in Debian Icoutils, published January 11, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 39th percentile. Fixed in icoutils 0.31.1-1.
Integer overflow in the check_offset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Integer overflow in the check_offset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable.
- Record
CVE-2017-5331- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-190
- Updated
- 2026-11-02
CVE List No score
Integer overflow in the check_offset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable.
- Record
CVE-2017-5331- Updated
- 2026-11-02
EUVDEUVD-2017-14436 No score
Integer overflow in the check_offset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable.
- Record
EUVD-2017-14436- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pp7c-cq7m-4vmc
Integer overflow in the check_offset function in b/wrestool/fileread.c in icoutils before 0.31.1...
Integer overflow in the check_offset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable.
- Record
GHSA-pp7c-cq7m-4vmc- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSV
Integer overflow in the check_offset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable.
- Record
CVE-2017-5331- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-5331
Integer overflow in the check_offset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable.
- Record
DEBIAN-CVE-2017-5331- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-5331
Integer overflow in the check_offset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable.
- Record
UBUNTU-CVE-2017-5331- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0044 No score
Updated icoutils packages fix security vulnerability
Multiple programming errors in the wrestool tool of the icoutils suite allows denial of service or the execution of arbitrary code if a malformed binary is parsed (CVE-2017-5208, CVE-2017-5331, CVE-2017-5332, CVE-2017-5333).
- Record
MGASA-2017-0044- Updated
- 2026-11-02
OSVUSN-4695-1 No score
icoutils vulnerabilities
Choongwoo Han discovered that icoutils incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2017-5208)
It was discovered that icoutils incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2017-5331, CVE-2017-5332, CVE-2017-5333)
Jerzy Kramarz discovered that icoutils incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2017-6009, CVE-2017-6010)
Jerzy Kramarz discovered that icoutils incorrectly handled certain files. An attacker could possibly use this issue to expose sensitive information. (CVE-2017-6011)
- Record
USN-4695-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
icoutilsDebian:12 |
before 0.31.1-1 | 0.31.1-1 |
icoutilsDebian:13 |
before 0.31.1-1 | 0.31.1-1 |
icoutilsDebian:14 |
before 0.31.1-1 | 0.31.1-1 |
icoutilsDebian:7 |
before 0.29.1-5deb7u1, plus listed versions 0.29.1-5 |
0.29.1-5deb7u1 |
icoutilsDebian:8 |
before 0.31.0-2+deb8u2, plus listed versions 0.31.0-20.31.0-2+deb8u1 |
0.31.0-2+deb8u2 |
icoutilsMageia:5 |
before 0.31.1-1.mga5 | 0.31.1-1.mga5 |
icoutilsUbuntu:14.04:LTS |
before 0.31.0-2+deb8u2build0.14.04.1, plus listed versions 0.31.0-10.31.0-2 |
0.31.0-2+deb8u2build0.14.04.1 |
icoutilsUbuntu:16.04:LTS |
before 0.31.0-3ubuntu0.1, plus listed versions 0.31.0-20.31.0-3 |
0.31.0-3ubuntu0.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
lists.opensuse.org/opensuse-security-announce/2017-01/msg00025.html
openwall.com/lists/oss-security/2017/01/11/3
debian.org/security/2017/dsa-3765
securityfocus.com/bid/95378
ubuntu.com/usn/USN-3178-1
Show 20 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=1412248
nvd.nist.gov/vuln/detail/CVE-2017-5331
github.com/advisories/GHSA-pp7c-cq7m-4vmc
security-tracker.debian.org/tracker/CVE-2017-5331
advisories.mageia.org/MGASA-2017-0044.html
bugs.mageia.org/show_bug.cgi?id=20091
openwall.com/lists/oss-security/2017/01/08/5
ubuntu.com/security/CVE-2017-5331
cve.org/CVERecord?id=CVE-2017-5331