Ubuntu.comUB:CVE-2017-11664CVE-2017-11664
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
0.001 Low
EPSS
Percentile
33.7%
The _WM_SetupMidiEvent function in internal_midi.c:2122 in WildMIDI 0.4.2
can cause a denial of service (invalid memory read and application crash)
via a crafted mid file.
Bugs
Notes
| Author | Note |
|---|---|
| ebarretto | Looking at the patches and the version on Trusty, it seems like some of the patches are not appliable and others are tricky to backport. So considering really low for Trusty. |
References
seclists.org/fulldisclosure/2017/Aug/12
github.com/Mindwerks/wildmidi/commit/660b513d99bced8783a4a5984ac2f742c74ebbdd
launchpad.net/bugs/cve/CVE-2017-11664
nvd.nist.gov/vuln/detail/CVE-2017-11664
security-tracker.debian.org/tracker/CVE-2017-11664
ubuntu.com/security/notices/USN-4807-1
www.cve.org/CVERecord?id=CVE-2017-11664
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
0.001 Low
EPSS
Percentile
33.7%