CVE-2017-2887: debian debian_linux Out-of-bounds Write
CVSS: 8.8v3.0HighModified
AliasesALPINE-CVE-2017-2887MGASA-2017-0397MGASA-2018-0170UBUNTU-CVE-2017-2887DEBIAN-CVE-2017-2887DLA-1134-1
Published 11-10-2017Last modified 17-09-2024
Vulnerability summary
CVE-2017-2887 is a high (CVSS 8.8) Out-of-bounds Write vulnerability in debian debian_linux. EPSS estimates a 2.66% chance of exploitation in the next 30 days, higher than 85.4% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.0 (CVE.org)EPSS score
2.66%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 11-10-2017PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of SDL_image 2.0.1. A specially crafted xcf file can cause a stack-based buffer overflow resulting in potential code execution. An attacker can provide a specially crafted XCF file to trigger this vulnerability.
CVSS metrics
8 scores · 5 sources · 3 versionsHigh 8.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
High 8.8Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesAll 3 agree
- NVDNIST8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
2.66%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
0.00 pp
From 2.66% on 18-09-2026
18-09-202618-10-2026
EPSS score2.66%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Mageia6 products
- SDL_image< 1.2.12-8.1.mga5
- sdl2_image< 2.0.0-4.1.mga5
- mingw-SDL_image< 1.2.12-13.1.mga6
- mingw-SDL2_image< 2.0.1-2.1.mga6
- SDL_image< 1.2.12-9.1.mga6
Debian3 products
- libsdl2-image< 2.0.1+dfsg-4
- sdl-image1.2< 1.2.12-7 | < 1.2.12-2+deb7u1
- debian_linuxEOL8.0 | 9.0
Ubuntu2 products
- libsdl2-image< 2.0.0+dfsg-3+deb8u1build0.14.04.1 | < 2.0.1+dfsg-2+deb9u1build0.16.04.1
- sdl-image1.2< 1.2.12-5+deb9u1build0.14.04.1 | < 1.2.12-5+deb9u1build0.16.04.1
Alpine1 product
- sdl2_image< 2.0.1-r2
Libsdl1 product
- sdl_image2.0.1
Talos1 product
- simple direct mediaSimple DirectMedia Layer SDL_image 2.0.1
6 vendors · 14 products
References
15 links
- www.talosintelligence.com/vulnerability_reports/TALOS-2017-0394X Refsource MISCMitigationThird Party AdvisoryREPORT