{"schemaVersion":3,"id":"CVE-2017-2920","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"An memory corruption vulnerability exists in the .SVG parsing functionality of Computerinsel Photoline 20.02. A specially crafted .SVG file can cause a vulnerability resulting in memory corruption, which can potentially lead to arbitrary code execution. An attacker can send a specific .SVG file to trigger this vulnerability.","dates":{"published":"2017-10-05T19:00:00.000Z","modified":"2024-09-17T01:40:55.531Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.8,"severity":"high","version":"3.0","versionLabel":"v3.0","source":"CVE.org","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"CVE.org","score":8.8,"severity":"high","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.8,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01835,"percentile":0.78633,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.01835},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01835,"percentile":0.78633}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01835,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01835,"percentile":0.78633}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_E95E9A1E4B2C741A","name":"Exploit Reference (talosintelligence.com)","source":"reference","url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0427","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/119.html"}],"affected":[{"vendor":"pl32","product":"photoline","name":"photoline","label":"photoline","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"20.02","noFixRecorded":false,"fixedIn":null}],"versionsText":"20.02","eol":null,"hubHref":"/vendor/pl32/photoline"},{"vendor":"talos","product":"computerinsel photoline","name":"Computerinsel Photoline","label":"computerinsel photoline","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"20.02","noFixRecorded":false,"fixedIn":null}],"versionsText":"20.02","eol":null,"hubHref":"/vendor/talos/computerinsel_photoline"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.securityfocus.com/bid/101186","label":"www.securityfocus.com/bid/101186","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link"]},{"url":"https://security.gentoo.org/glsa/201908-26","label":"security.gentoo.org/glsa/201908-26","hostname":"security.gentoo.org","tags":["Vendor Advisory","X Refsource GENTOO","Third Party Advisory"]},{"url":"https://github.com/libofx/libofx/commit/a70934eea95c76a7737b83773bffe8738935082d","label":"github.com/libofx/libofx/commit/a70934eea95c76a7737b83773bffe8738935082d","hostname":"github.com","tags":["X Refsource CONFIRM","Patch","Third Party Advisory"]},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0427","label":"www.talosintelligence.com/vulnerability_reports/TALOS-2017-0427","hostname":"www.talosintelligence.com","tags":["X Refsource MISC","Exploit","Technical Description","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":["MGASA-2018-0214","SUSE-SU-2018:2045-1","SUSE-SU-2018:2064-1"],"duplicates":[],"related":["SUSE-SU-2018:2045-1","SUSE-SU-2018:2064-1"]},"timeline":[{"kind":"published","date":"2017-10-05T19:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-09-17T01:40:55.531Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":46,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T13:30:13.642Z","stale":false,"partial":false}}