CVE-2017-6010
An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "extract_icons"...
An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "extract_icons" function in the "extract.c" source file. This issue can be triggered by processing a corrupted ico file and will result in an icotool crash.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "extract_icons" function in the "extract.c" source file. This issue can be triggered by processing a corrupted ico file and will result in an icotool crash.
- Record
CVE-2017-6010- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "extract_icons" function in the "extract.c" source file. This issue can be triggered by processing a corrupted ico file and will result in an icotool crash.
- Record
CVE-2017-6010- Updated
- 2026-11-02
EUVDEUVD-2017-15078 No score
An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "extract_icons" function in the "extract.c" source file. This issue can be triggered by processing a corrupted ico file and will result in an icotool crash.
- Record
EUVD-2017-15078- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7w3j-wxh4-94xw
An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "extract_icons"...
An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "extract_icons" function in the "extract.c" source file. This issue can be triggered by processing a corrupted ico file and will result in an icotool crash.
- Record
GHSA-7w3j-wxh4-94xw- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "extract_icons" function in the "extract.c" source file. This issue can be triggered by processing a corrupted ico file and will result in an icotool crash.
- Record
CVE-2017-6010- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-6010
An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "extract_icons" function in the "extract.c" source file. This issue can be triggered by processing a corrupted ico file and will result in an icotool crash.
- Record
DEBIAN-CVE-2017-6010- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVRHSA-2017:0837
Red Hat Security Advisory: icoutils security update
- Record
RHSA-2017:0837- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-6010
An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "extract_icons" function in the "extract.c" source file. This issue can be triggered by processing a corrupted ico file and will result in an icotool crash.
- Record
UBUNTU-CVE-2017-6010- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0080 No score
Updated icoutils packages fix security vulnerability
Multiple vulnerabilities were discovered in the icotool (CVE-2017-6010, CVE-2017-6011) and wrestool (CVE-2017-6009) tools of icoutils, a set of programs that deal with MS Windows icons and cursors, which may result in denial of service or the execution of arbitrary code if a malformed .ico or .exe file is processed.
- Record
MGASA-2017-0080- Updated
- 2026-11-02
OSVUSN-4695-1 No score
icoutils vulnerabilities
Choongwoo Han discovered that icoutils incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2017-5208)
It was discovered that icoutils incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2017-5331, CVE-2017-5332, CVE-2017-5333)
Jerzy Kramarz discovered that icoutils incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2017-6009, CVE-2017-6010)
Jerzy Kramarz discovered that icoutils incorrectly handled certain files. An attacker could possibly use this issue to expose sensitive information. (CVE-2017-6011)
- Record
USN-4695-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
icoutilsDebian:12 |
before 0.31.2-1 | 0.31.2-1 |
icoutilsDebian:13 |
before 0.31.2-1 | 0.31.2-1 |
icoutilsDebian:14 |
before 0.31.2-1 | 0.31.2-1 |
icoutilsDebian:7 From an advisory covering 3 CVEs |
before 0.29.1-5deb7u2, plus listed versions 0.29.1-50.29.1-5deb7u1 |
0.29.1-5deb7u2 |
icoutilsDebian:8 From an advisory covering 3 CVEs |
before 0.31.0-2+deb8u3, plus listed versions 0.31.0-20.31.0-2+deb8u10.31.0-2+deb8u2 |
0.31.0-2+deb8u3 |
icoutilsMageia:5 From an advisory covering 3 CVEs |
before 0.31.3-1.mga5 | 0.31.3-1.mga5 |
icoutilsRed Hat:enterprise_linux:7::client From an advisory covering 6 CVEs |
before 0:0.31.3-1.el7_3 | 0:0.31.3-1.el7_3 |
icoutils-debuginfoRed Hat:enterprise_linux:7::client From an advisory covering 6 CVEs |
before 0:0.31.3-1.el7_3 | 0:0.31.3-1.el7_3 |
icoutilsRed Hat:enterprise_linux:7::computenode From an advisory covering 6 CVEs |
before 0:0.31.3-1.el7_3 | 0:0.31.3-1.el7_3 |
icoutils-debuginfoRed Hat:enterprise_linux:7::computenode From an advisory covering 6 CVEs |
before 0:0.31.3-1.el7_3 | 0:0.31.3-1.el7_3 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
icoutilsRed Hat:enterprise_linux:7::server From an advisory covering 6 CVEs |
before 0:0.31.3-1.el7_3 | 0:0.31.3-1.el7_3 |
icoutils-debuginfoRed Hat:enterprise_linux:7::server From an advisory covering 6 CVEs |
before 0:0.31.3-1.el7_3 | 0:0.31.3-1.el7_3 |
icoutilsRed Hat:enterprise_linux:7::workstation From an advisory covering 6 CVEs |
before 0:0.31.3-1.el7_3 | 0:0.31.3-1.el7_3 |
icoutils-debuginfoRed Hat:enterprise_linux:7::workstation From an advisory covering 6 CVEs |
before 0:0.31.3-1.el7_3 | 0:0.31.3-1.el7_3 |
icoutilsUbuntu:14.04:LTS |
before 0.31.0-2+deb8u3build0.14.04.1, plus listed versions 0.31.0-10.31.0-20.31.0-2+deb8u2build0.14.04.1 |
0.31.0-2+deb8u3build0.14.04.1 |
icoutilsUbuntu:16.04:LTS |
before 0.31.0-3ubuntu0.1, plus listed versions 0.31.0-20.31.0-3 |
0.31.0-3ubuntu0.1 |
icoutilsUbuntu:16.04:LTS From an advisory covering 7 CVEs |
before 0.31.0-3ubuntu0.1, plus listed versions 0.31.0-20.31.0-3 |
0.31.0-3ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-6010 is a medium vulnerability (CVSS 5.5) in Icoutils Project Icoutils, published February 16, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.54%, the 74th percentile. Fixed in icoutils 0.31.2-1.
References
security.gentoo.org/glsa/201801-12
bugs.debian.org/cgi-bin/bugreport.cgi?bug=854054
rhn.redhat.com/errata/RHSA-2017-0837.html
securityfocus.com/bid/96288
debian.org/security/2017/dsa-3807
nvd.nist.gov/vuln/detail/CVE-2017-6010
Show 40 moreShow less
github.com/advisories/GHSA-7w3j-wxh4-94xw
security-tracker.debian.org/tracker/CVE-2017-6010
advisories.mageia.org/MGASA-2017-0080.html
bugs.mageia.org/show_bug.cgi?id=20477
git.savannah.gnu.org/cgit/icoutils.git/tree/NEWS?h=0.31.3
access.redhat.com/errata/RHSA-2017:0837
bugzilla.redhat.com/show_bug.cgi?id=1411251
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0837.json
cve.org/CVERecord?id=CVE-2017-5208
ubuntu.com/security/CVE-2017-6010