Heap-based buffer overflow in GraphicsMagick - CVE-2017-16669

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU9814

Heap-based buffer overflow in GraphicsMagick - CVE-2017-16669

Published: December 27, 2017


Vulnerability identifier: #VU9814
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-16669
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to heap-based buffer overflow in coders/wpg.c. A remote attacker can provide a specially crafted file, related to the AcquireCacheNexus function in magick/pixel_cache.c, trigger memory corruption and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Affected software

GraphicsMagick
Amazon Linux AMI
Fedora
SUSE Linux
Opensuse
graphicsmagick (Alpine package)
GraphicsMagick

How to mitigate CVE-2017-16669

Install update from vendor's website.

GraphicsMagick - addressed in versions 1.3.28-1.el6, 1.3.28-1.el7, 1.3.28-1.fc26, 1.3.28-1.fc27

External References

Related Security Bulletins