Summary
It was discovered that iucode-tool incorrectly handled certain microcodes
when using the -tr loader. If a user were tricked into processing a
specially crafted microcode, a remote attacker could use this issue to
cause iucode-tool to crash, resulting in a denial of service, or possibly
execute arbitrary code.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | iucode-tool | 1.5.1-1ubuntu0.1 |
Vulnerabilities 1
-
Unscored —
iucode-tool: heap buffer overflow on -tr loader
A heap-overflow flaw exists in the -tr loader of iucode-tool starting with v1.4 and before v2.1.1, potentially leading to SIGSEGV, or heap corruption.
References
-
report
https://ubuntu.com/security/CVE-2017-0357