CVE-2017-15266
In GNU Libextractor 1.4, there is a Divide-By-Zero in EXTRACTOR_wav_extract_method in...
In GNU Libextractor 1.4, there is a Divide-By-Zero in EXTRACTOR_wav_extract_method in wav_extractor.c via a zero sample rate.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
5.5
In GNU Libextractor 1.4, there is a Divide-By-Zero in EXTRACTOR_wav_extract_method in wav_extractor.c via a zero sample rate.
- Record
CVE-2017-15266- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-369
- Updated
- 2026-11-02
CVE List No score
In GNU Libextractor 1.4, there is a Divide-By-Zero in EXTRACTOR_wav_extract_method in wav_extractor.c via a zero sample rate.
- Record
CVE-2017-15266- Updated
- 2026-11-02
EUVDEUVD-2017-6726 No score
In GNU Libextractor 1.4, there is a Divide-By-Zero in EXTRACTOR_wav_extract_method in wav_extractor.c via a zero sample rate.
- Record
EUVD-2017-6726- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-779v-r8gr-3gpc
5.5
In GNU Libextractor 1.4, there is a Divide-By-Zero in EXTRACTOR_wav_extract_method in...
In GNU Libextractor 1.4, there is a Divide-By-Zero in EXTRACTOR_wav_extract_method in wav_extractor.c via a zero sample rate.
- Record
GHSA-779v-r8gr-3gpc- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-369
- Updated
- 2026-11-02
OSV
5.5
In GNU Libextractor 1.4, there is a Divide-By-Zero in EXTRACTOR_wav_extract_method in wav_extractor.c via a zero sample rate.
- Record
CVE-2017-15266- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-15266
5.5
In GNU Libextractor 1.4, there is a Divide-By-Zero in EXTRACTOR_wav_extract_method in wav_extractor.c via a zero sample rate.
- Record
DEBIAN-CVE-2017-15266- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-15266
5.5
In GNU Libextractor 1.4, there is a Divide-By-Zero in EXTRACTOR_wav_extract_method in wav_extractor.c via a zero sample rate.
- Record
UBUNTU-CVE-2017-15266- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0413 No score
Updated libextractor packages fix security vulnerabilities
In 'EXTRACTOR_wav_extract_method' function of wav_extractor.c, the program does not check the value of sample_rate, with a crafted file, the sample_rate can be set to zero, resulting in a divide by zero and a crash (CVE-2017-15266).
NULL Pointer Dereference vulnerability in libextract when getting flac meta from libFlac (CVE-2017-15267).
NULL Pointer Dereference vulnerability in libextractor EXTRACTOR_nsf_extract_method() (rhbz#1501695).
- Record
MGASA-2017-0413- Updated
- 2026-11-02
OSVUSN-4641-1 No score
libextractor vulnerabilities
It was discovered that Libextractor incorrectly handled zero sample rate. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-15266)
It was discovered that Libextractor incorrectly handled certain FLAC metadata. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-15267)
It was discovered that Libextractor incorrectly handled certain specially crafted files. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-15600, CVE-2018-16430, CVE-2018-20430)
It was discovered that Libextractor incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-15601)
It was discovered that Libextractor incorrectly handled integers. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-15602)
It was discovered that Libextractore incorrectly handled certain crafted files. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-15922)
It was discovered tha Libextractor incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-17440)
It was discovered that Libextractor incorrectly handled certain malformed files. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-14346)
It was discovered that Libextractor incorrectly handled malformed files. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-14347)
It was discovered that Libextractor incorrectly handled metadata. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-20431)
- Record
USN-4641-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libextractorDebian:12 |
before 1:1.6-1 | 1:1.6-1 |
libextractorDebian:13 |
before 1:1.6-1 | 1:1.6-1 |
libextractorDebian:14 |
before 1:1.6-1 | 1:1.6-1 |
libextractorDebian:7 |
before 1:0.6.3-5+deb7u1, plus listed versions 1:0.6.3-5 |
1:0.6.3-5+deb7u1 |
libextractorMageia:5 |
before 1.6-1.mga5 | 1.6-1.mga5 |
libextractorMageia:6 |
before 1.6-1.mga6 | 1.6-1.mga6 |
libextractorUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1:1.1-1ubuntu11:1.2-1ubuntu11:1.3-11:1.3-1ubuntu0.1~esm1 |
None known |
libextractorUbuntu:16.04:LTS |
before 1:1.3-4+deb9u3build0.16.04.1, plus listed versions 1:1.3-2build11:1.3-2ubuntu11:1.3-3 |
1:1.3-4+deb9u3build0.16.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-15266 is a medium vulnerability (CVSS 5.5) in Gnu Libextractor, published October 11, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.50%, the 74th percentile. Fixed in libextractor 1:1.6-1.
References
bugzilla.redhat.com/show_bug.cgi?id=1499599
openwall.com/lists/oss-security/2017/10/11/1
lists.gnu.org/archive/html/bug-libextractor/2017-10/msg00002.html
lists.debian.org/debian-lts-announce/2017/12/msg00000.html
securityfocus.com/bid/101271
nvd.nist.gov/vuln/detail/CVE-2017-15266
Show 20 moreShow less
github.com/advisories/GHSA-779v-r8gr-3gpc
security-tracker.debian.org/tracker/CVE-2017-15266
advisories.mageia.org/MGASA-2017-0413.html
bugs.mageia.org/show_bug.cgi?id=21856
openwall.com/lists/oss-security/2017/10/12/15
lists.fedoraproject.org/archives/list/[email protected]/thread/Z3JVQF4TREMGJ5RI6JHPIZ6STU3H572K
ubuntu.com/security/CVE-2017-15266
ubuntu.com/security/notices/USN-4641-1
cve.org/CVERecord?id=CVE-2017-15266
ubuntu.com/security/CVE-2017-15267
ubuntu.com/security/CVE-2017-15600
ubuntu.com/security/CVE-2017-15601
ubuntu.com/security/CVE-2017-15602
ubuntu.com/security/CVE-2017-15922
ubuntu.com/security/CVE-2017-17440
ubuntu.com/security/CVE-2018-14346
ubuntu.com/security/CVE-2018-14347
ubuntu.com/security/CVE-2018-16430
ubuntu.com/security/CVE-2018-20430
ubuntu.com/security/CVE-2018-20431