CVE catalog

CVE-2017-0357

iucode-tool: CVE-2017-0357

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.84% · Oct 25, 2026

A heap-overflow flaw exists in the -tr loader of iucode-tool starting with v1.4 and before v2.1.1, potentially leading to SIGSEGV, or heap corruption.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianiucode-toolsid2.3.1-3fixed
Debianiucode-toolforky2.3.1-3fixed
Debianiucode-tooltrixie2.3.1-3fixed
Debianiucode-toolbookworm2.3.1-3fixed
Ubuntuiucode-tool16.041.3-1vulnerable
Ubuntuiucode-tool16.041.5-1vulnerable
Ubuntuiucode-tool16.041.5.1-1vulnerable
Ubuntuiucode-tool16.041.5.1-1ubuntu0.1fixed
Ubuntuiucode-tool16.041.3-1vulnerable
Ubuntuiucode-tool16.041.5-1vulnerable
Ubuntuiucode-tool16.041.5.1-1vulnerable
Ubuntuiucode-tool16.041.5.1-1ubuntu0.1fixed
Opensuseiucode-tooltumbleweed2.3.1-1.13fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianiucode-toolsourcesid2.1.1-1not yet assignedNot reportedNot reported
Debianiucode-toolsourceforky2.1.1-1not yet assignedNot reportedNot reported
Debianiucode-toolsourcetrixie2.1.1-1not yet assignedNot reportedNot reported
Debianiucode-toolsourcebookworm2.1.1-1not yet assignedNot reportedNot reported
Ubuntuiucode-tooldeb16.041.5.1-1ubuntu0.1Not reportedUSN-3186-1Not reported
Ubuntuiucode-tooldeb16.041.5.1-1ubuntu0.1Not reportedUBUNTU-CVE-2017-0357Not reported
Opensuseiucode-toolrpmtumbleweed2.3.1-1.13Not reportedOPENSUSE-SU-2024:10867-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [iucode-tool]Fixed
    Details (1)

    • 2.3.1-3 · amd64 · bookworm

      Fixed · Fixed: 2.1.1-1

      dsa · iucode-tool · debian · bookworm; dsa · iucode-tool · debian · 12

[Debian 13 (Trixie)]

  • [iucode-tool]Fixed
    Details (1)

    • 2.3.1-3 · amd64 · trixie

      Fixed · Fixed: 2.1.1-1

      dsa · iucode-tool · debian · 13

[openSUSE Tumbleweed]

  • [iucode-tool]Fixed

    Source package: [iucode-tool]

    Details (1)

    • 2.3.1-3.3 · x86_64 · tumbleweed

      Fixed · Fixed: 2.3.1-1.13

      dsa · iucode-tool · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]