Arch Linux: ASA-201805-19 Medium: Denial Of Service In Libofx

Arch Linux Security Advisory ASA-201805-19
=========================================
Severity: Medium
Date    : 2018-05-20
CVE-ID  : CVE-2017-14731
Package : libofx
Type    : denial of service
Remote  : Yes
Link    : https://security.archlinux.org/AVG-536

Summary
======
The package libofx before version 0.9.13-1 is vulnerable to denial of
service.

Resolution
=========
Upgrade to 0.9.13-1.

# pacman -Syu "libofx>=0.9.13-1"

The problem has been fixed upstream in version 0.9.13.

Workaround
=========
None.

Description
==========
ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote
attackers to cause a denial of service (heap-based buffer over-read and
application crash) via a crafted file, as demonstrated by an ofxdump
call.

Impact
=====
A remote attacker is able to cause a denial of service via a specially
crafted file.

References
=========
https://bugs.archlinux.org/task/56544
https://github.com/libofx/libofx/issues/10
https://github.com/libofx/libofx/commit/fad8418f34094de42e1307113598e0e8bee0a2bd
https://security.archlinux.org/CVE-2017-14731