CVE-2017-8305 The UDFclient (before 0.8.8) custom strlcpy implementation has a buffer overflow. UDFclient's strlcpy is used only on systems with a C library (e.g., glibc) that lacks its own strlcpy.
CriticalCVSS 9.8
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The UDFclient (before 0.8.8) custom strlcpy implementation has a buffer overflow. UDFclient's strlcpy is used only on systems with a C library (e.g., glibc) that lacks its own strlcpy.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/udfclient(Debian:12) | < 0.8.8-1 | 0.8.8-1 |
| debian/udfclient(Debian:13) | < 0.8.8-1 | 0.8.8-1 |
| debian/udfclient(Debian:14) | < 0.8.8-1 | 0.8.8-1 |
| 13thmonkey udfclient | <= 0.8.7 | No fix listed |
References
- Debian Security Tracker CVE-2017-8305 vendor-advisory
- bugs.debian.org mailing-list third-party-advisory
- www.13thmonkey.org release-notes vendor-advisory
- bugs.debian.org issue-tracking