Memory corruption in graphicsmagick (Alpine package)



Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2017-16353
CWE-ID CWE-119
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Vulnerable software
 graphicsmagick (Alpine package)
Operating systems & Components / Operating system package or component

Vendor Alpine Linux Development Team

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Memory corruption

EUVDB-ID: #VU11815

Risk: Low

CVSSv4.0: 2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2017-16353

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists in the DescribeImage function of the magick/describe.c file due to heap-based buffer over-read because the portion of the code containing the vulnerability is responsible for printing the IPTC Profile information contained in the image and out-of-bounds buffer dereference because certain increments are never checked. A remote attacker can trick the victim into opening a specially crafted MIFF file and gain access to potentially sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

graphicsmagick (Alpine package): 1.3.26-r0 - 1.3.27-r0

CPE2.3 External links

https://git.alpinelinux.org/aports/commit/?id=f2ad329cc3291f5c66a6c324a27a44cfe0c42c5e


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.



###SIDEBAR###