Memory corruption in GraphicsMagick - CVE-2017-18229
Published: March 19, 2018
Vulnerability identifier: #VU11149
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-18229
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists in the ReadTIFFImage function due to memory allocation. A remote attacker can send a specially crafted file, trick the victim into opening it, trigger memory corruption and cause the service to crash.
The weakness exists in the ReadTIFFImage function due to memory allocation. A remote attacker can send a specially crafted file, trick the victim into opening it, trigger memory corruption and cause the service to crash.
Affected software
GraphicsMagick
graphicsmagick (Alpine package)
graphicsmagick (Alpine package)
How to mitigate CVE-2017-18229
Install update from vendor's website.