{"id":"CVE-2017-13755","aliases":["DEBIAN-CVE-2017-13755","DLA-3054-1","EUVD-2017-5272","GHSA-cqw5-qvh9-f85v","MGASA-2018-0368","UBUNTU-CVE-2017-13755","USN-4765-1"],"status":"published","title":"In The Sleuth Kit (TSK) 4.4.2, opening a crafted ISO 9660 image triggers an out-of-bounds read in...","description":"In The Sleuth Kit (TSK) 4.4.2, opening a crafted ISO 9660 image triggers an out-of-bounds read in iso9660_proc_dir() in tsk/fs/iso9660_dent.c in libtskfs.a, as demonstrated by fls.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00744,"percentile":0.55016,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-125"],"published":"2017-08-29T22:00:00Z","modified":"2026-10-20T10:47:45Z","fixes":[{"ecosystem":"Debian:12","package":"sleuthkit","fixed_in":["4.4.2-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sleuthkit","fixed_in":["4.4.2-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sleuthkit","fixed_in":["4.4.2-3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"sleuthkit","fixed_in":["3.2.3-2.2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"sleuthkit","fixed_in":["4.2.0-3ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"sleuthkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sleuthkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sleuthkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2-3"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"sleuthkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-5+deb9u1"}]}],"versions":["4.4.0-5"],"bundled":6},{"source":"osv","ecosystem":"Mageia:6","package":"sleuthkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.2-2.mga6"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"sleuthkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-2.2ubuntu0.1~esm1"}]}],"versions":["3.2.3-2ubuntu1","3.2.3-2ubuntu2","3.2.3-2.1","3.2.3-2.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"sleuthkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-3ubuntu0.1~esm1"}]}],"versions":["4.1.3-11ubuntu2","4.1.3-12ubuntu1","4.2.0-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"sleuthkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-2.2ubuntu0.1~esm1"}]}],"versions":["3.2.3-2ubuntu1","3.2.3-2ubuntu2","3.2.3-2.1","3.2.3-2.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"sleuthkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-3ubuntu0.1~esm1"}]}],"versions":["4.1.3-11ubuntu2","4.1.3-12ubuntu1","4.2.0-3"],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"sleuthkit","product":"the_sleuth_kit"}],"references":[{"url":"https://github.com/sleuthkit/sleuthkit/issues/913","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/06/msg00015.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-13755"},{"url":"https://github.com/advisories/GHSA-cqw5-qvh9-f85v"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-13755","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0368.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23501","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/VEGCW34ZQ2RZ3OUDKF3BGXNLDPAIX6YM/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-13755","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-13755","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4765-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2012-5619","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-13755","description":"In The Sleuth Kit (TSK) 4.4.2, opening a crafted ISO 9660 image triggers an out-of-bounds read in iso9660_proc_dir() in tsk/fs/iso9660_dent.c in libtskfs.a, as demonstrated by fls.","status":"published","published":"2017-08-29T22:00:00Z","modified":"2024-08-05T19:05:20.274Z","updated_at":"2026-11-02T14:33:17.903346Z"}],"euvd":[{"id":"EUVD-2017-5272","description":"In The Sleuth Kit (TSK) 4.4.2, opening a crafted ISO 9660 image triggers an out-of-bounds read in iso9660_proc_dir() in tsk/fs/iso9660_dent.c in libtskfs.a, as demonstrated by fls.","status":"published","published":"2017-08-29T22:00:00Z","modified":"2024-08-05T19:05:20Z","updated_at":"2026-11-03T02:23:19.185271Z"}],"ghsa":[{"id":"GHSA-cqw5-qvh9-f85v","title":"In The Sleuth Kit (TSK) 4.4.2, opening a crafted ISO 9660 image triggers an out-of-bounds read in...","description":"In The Sleuth Kit (TSK) 4.4.2, opening a crafted ISO 9660 image triggers an out-of-bounds read in iso9660_proc_dir() in tsk/fs/iso9660_dent.c in libtskfs.a, as demonstrated by fls.","status":"published","published":"2022-05-17T01:18:59Z","modified":"2023-02-01T05:07:46Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-119","CWE-125"],"updated_at":"2026-11-02T14:50:36.63783Z"}],"nvd":[{"id":"CVE-2017-13755","description":"In The Sleuth Kit (TSK) 4.4.2, opening a crafted ISO 9660 image triggers an out-of-bounds read in iso9660_proc_dir() in tsk/fs/iso9660_dent.c in libtskfs.a, as demonstrated by fls.","status":"published","published":"2017-08-29T22:29:00.237Z","modified":"2026-06-17T01:05:07.253Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:03:57.82609Z"}],"osv":[{"id":"CVE-2017-13755","description":"In The Sleuth Kit (TSK) 4.4.2, opening a crafted ISO 9660 image triggers an out-of-bounds read in iso9660_proc_dir() in tsk/fs/iso9660_dent.c in libtskfs.a, as demonstrated by fls.","status":"published","published":"2017-08-29T22:29:00.237Z","modified":"2026-10-20T10:47:45.961239939Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:04.572713Z"},{"id":"DEBIAN-CVE-2017-13755","description":"In The Sleuth Kit (TSK) 4.4.2, opening a crafted ISO 9660 image triggers an out-of-bounds read in iso9660_proc_dir() in tsk/fs/iso9660_dent.c in libtskfs.a, as demonstrated by fls.","status":"published","published":"2017-08-29T22:29:00.237Z","modified":"2026-09-01T20:03:43.410476038Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:28.801885Z"},{"id":"UBUNTU-CVE-2017-13755","description":"In The Sleuth Kit (TSK) 4.4.2, opening a crafted ISO 9660 image triggers an out-of-bounds read in iso9660_proc_dir() in tsk/fs/iso9660_dent.c in libtskfs.a, as demonstrated by fls.","status":"published","published":"2017-08-29T22:29:00Z","modified":"2026-04-22T11:15:19.88631Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:14.122973Z"},{"id":"DLA-3054-1","title":"sleuthkit - security update","status":"published","published":"2022-06-20T00:00:00Z","modified":"2026-03-09T01:19:37.545216Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2018-0368","title":"Updated sleuthkit packages fix security vulnerabilities","description":"Updated sleuthkit packages fix security vulnerabilities:\n\nIn The Sleuth Kit (TSK) 4.4.2, opening a crafted ISO 9660 image triggers\nan out-of-bounds read in iso9660_proc_dir() in tsk/fs/iso9660_dent.c in\nlibtskfs.a, as demonstrated by fls (CVE-2017-13755).\n\nIn The Sleuth Kit (TSK) 4.4.2, opening a crafted disk image triggers\ninfinite recursion in dos_load_ext_table() in tsk/vs/dos.c in libtskvs.a,\nas demonstrated by mmls (CVE-2017-13756).\n\nIn The Sleuth Kit (TSK) 4.4.2, fls hangs on a corrupt exfat image in\ntsk_img_read() in tsk/img/img_io.c in libtskimg.a (CVE-2017-13760).\n\nAn issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release\n4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found\nin the function ntfs_fix_idxrec in tsk/fs/ntfs_dent.cpp which could be\nleveraged by an attacker to disclose information or manipulated to read\nfrom unmapped memory causing a denial of service (CVE-2018-11737).\n\nAn issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release\n4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found\nin the function ntfs_make_data_run in tsk/fs/ntfs.c which could be\nleveraged by an attacker to disclose information or manipulated to read\nfrom unmapped memory causing a denial of service attack (CVE-2018-11738).\n\nAn issue was discovered in libtskimg.a in The Sleuth Kit (TSK) from release\n4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found\nin the function raw_read in tsk/img/raw.c which could be leveraged by an\nattacker to disclose information or manipulated to read from unmapped\nmemory causing a denial of service attack (CVE-2018-11739).\n\nAn issue was discovered in libtskbase.a in The Sleuth Kit (TSK) from\nrelease 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region\nwas found in the function tsk_UTF16toUTF8 in tsk/base/tsk_unicode.c which\ncould be leveraged by an attacker to disclose information or manipulated\nto read from unmapped memory causing a denial of service attack\n(CVE-2018-11740).\n","status":"published","published":"2018-09-07T10:15:03Z","modified":"2026-04-16T06:25:43.425131829Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"USN-4765-1","title":"sleuthkit vulnerabilities","description":"It was discovered that The Sleuth Kit did not properly handle certain\nentires in FAT file systems. An attacker could use this vulnerability to\nmislead an analyst and obscure their activities. This issue only affected\nUbuntu 14.04 ESM. (CVE-2012-5619)\n\nIt was discovered that The Sleuth Kit mishandled certain crafted ISO 9660\nimages. If an analyst were tricked into opening a malicious image, an\nattacker could cause a denial of service (crash). (CVE-2017-13755)","status":"published","published":"2021-03-15T20:04:57Z","modified":"2026-06-29T13:48:11.650101323Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}