Resource exhaustion in GraphicsMagick - CVE-2017-11140
Published: July 10, 2017 / Updated: August 3, 2020
Vulnerability identifier: #VU33190
CSH Severity: Low
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-11140
CWE-ID: CWE-400
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local non-authenticated attacker to perform a denial of service (DoS) attack.
The ReadJPEGImage function in coders/jpeg.c in GraphicsMagick 1.3.26 creates a pixel cache before a successful read of a scanline, which allows remote attackers to cause a denial of service (resource consumption) via crafted JPEG files.
Affected software
GraphicsMagick
Amazon Linux AMI
Fedora
graphicsmagick (Alpine package)
GraphicsMagick
Amazon Linux AMI
Fedora
graphicsmagick (Alpine package)
GraphicsMagick
How to mitigate CVE-2017-11140
Install update from vendor's website.
GraphicsMagick - update to 1.3.27
GraphicsMagick - addressed in versions 1.3.28-1.el6, 1.3.28-1.el7, 1.3.28-1.fc26, 1.3.28-1.fc27
GraphicsMagick - addressed in versions 1.3.28-1.el6, 1.3.28-1.el7, 1.3.28-1.fc26, 1.3.28-1.fc27