CVE-2017-9164

2017-05-2300:00:00

ubuntu.com

0.002 Low

EPSS

Percentile

58.5%

libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the
GET_COLOR function in color.c:16:11.

Author	Note
msalvatore	The latest version of AutoTrace was released in 2002. Unless this project is forked or adopted by a new maintainer, this vulnerability will likely never be fixed.

OSVersionArchitecturePackageVersionFilename
ubuntu14.04noarchautotrace< anyUNKNOWN
ubuntu16.04noarchautotrace< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	14.04	noarch	autotrace	< any	UNKNOWN
ubuntu	16.04	noarch	autotrace	< any	UNKNOWN

References

blogs.gentoo.org/ago/2017/05/20/autotrace-multiple-vulnerabilities-the-autotrace-nightmare/

launchpad.net/bugs/cve/CVE-2017-9164

nvd.nist.gov/vuln/detail/CVE-2017-9164

security-tracker.debian.org/tracker/CVE-2017-9164

www.cve.org/CVERecord?id=CVE-2017-9164

0.002 Low

EPSS

Percentile

58.5%

Related for UB:CVE-2017-9164