ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file, as demonstrated by an ofxdump call.

The remote host is affected by the vulnerability described in GLSA-201908-26 (libofx: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libofx. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to process a specially crafted       file using an application linked against libofx, possibly resulting in       execution of arbitrary code with the privileges of the process or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update fixes assorted CVEs in LibOFX.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libofx fixes the following issues: Security issues fixed :

  - CVE-2017-2816: Fix an exploitable buffer overflow     vulnerability in the tag parsing functionality     (bsc#1058673).

  - CVE-2017-2920: Fix a buffer overflow vulnerability in     sanitize_proprietary_tags in lib/ofx_preproc.cpp     (bsc#1061964).

  - CVE-2017-14731: Fix remote denial of service via a     crafted file in ofx_proc_file in ofx_preproc.cpp     (bsc#1060437).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This updates LibOFX to fix assorted CVEs.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2017-2816 An exploitable buffer overflow vulnerability exists in the tag parsing functionality of LibOFX 0.9.11. A specially crafted OFX file can cause a write out of bounds resulting in a buffer overflow on the stack. An attacker can construct a malicious OFX file to trigger this vulnerability.

CVE-2017-14731 ofx_proc_file in ofx_preproc.cpp allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file

For Debian 7 'Wheezy', these problems have been fixed in version 1:0.9.4-2.1+deb7u1.

We recommend that you upgrade your libofx packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
128441	GLSA-201908-26 : libofx: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
120591	Fedora 28 : libofx (2018-8a208fba70)	Nessus	Fedora Local Security Checks	medium
111368	SUSE SLED12 Security Update : libofx (SUSE-SU-2018:2064-1)	Nessus	SuSE Local Security Checks	high
109005	Fedora 26 : libofx (2018-4a2b875d6b)	Nessus	Fedora Local Security Checks	medium
109004	Fedora 27 : libofx (2018-1b3a73b45f)	Nessus	Fedora Local Security Checks	medium
104751	Debian DLA-1192-1 : libofx security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-14731

medium

Tenable Plugins

high

medium

high

medium

medium

high