7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.001 Low
EPSS
Percentile
35.0%
The _WM_SetupMidiEvent function in internal_midi.c:2318 in WildMIDI 0.4.2
can cause a denial of service (invalid memory read and application crash)
via a crafted mid file.
Author | Note |
---|---|
ebarretto | Looking at the patches and the version on Trusty, it seems like some of the patches are not appliable and others are tricky to backport. So considering really low for Trusty. |
seclists.org/fulldisclosure/2017/Aug/12
github.com/Mindwerks/wildmidi/commit/660b513d99bced8783a4a5984ac2f742c74ebbdd
launchpad.net/bugs/cve/CVE-2017-11661
nvd.nist.gov/vuln/detail/CVE-2017-11661
security-tracker.debian.org/tracker/CVE-2017-11661
ubuntu.com/security/notices/USN-4807-1
www.cve.org/CVERecord?id=CVE-2017-11661
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.001 Low
EPSS
Percentile
35.0%