CVE-2017-5332

La función extract_group_icon_cursor_resource en el archivo wrestool/extract.c en icoutils versiones anteriores a la versión 0.31.1, puede acceder a la memoria no asignada, lo que permite a usuarios locales causar una denegación de servicio (bloqueo del proceso) y ejecutar código arbitrario mediante un ejecutable especialmente diseñado.

A vulnerability was found in icoutils, in the wrestool program. An attacker could create a crafted executable that, when read by wrestool, could result in failure to allocate memory or an over-large memcpy operation, leading to a crash.

The icoutils are a set of programs for extracting and converting images in Microsoft Windows icon and cursor files. These files usually have the extension .ico or .cur, but they can also be embedded in executables or libraries. Security Fix: Multiple vulnerabilities were found in icoutils, in the wrestool program. An attacker could create a crafted executable that, when read by wrestool, could result in memory corruption leading to a crash or potential code execution.