Use-after-free in GraphicsMagick - CVE-2017-14103
Published: September 1, 2017 / Updated: August 3, 2020
Vulnerability identifier: #VU33244
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-14103
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing a crafted file, related to a ReadMNGImage out-of-order CloseBlob call. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-11403. A remote attackers can conduct use-after-free attacks.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Affected software
GraphicsMagick
graphicsmagick (Alpine package)
GraphicsMagick
Fedora
graphicsmagick (Alpine package)
GraphicsMagick
Fedora
How to mitigate CVE-2017-14103
Update to version 1.3.27.
GraphicsMagick - update to 1.3.27
graphicsmagick (Alpine package) - addressed in versions 1.3.26-r5, 1.3.27-r0
GraphicsMagick - addressed in versions 1.3.34-1.el7, 1.3.34-1.el8
graphicsmagick (Alpine package) - addressed in versions 1.3.26-r5, 1.3.27-r0
GraphicsMagick - addressed in versions 1.3.34-1.el7, 1.3.34-1.el8