CVE-2017-15277
Severity Score
6.5
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
2
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when processing a GIF file that has neither a global nor local palette. If the affected product is used as a library loaded into a process that operates on interesting data, this data sometimes can be leaked via the uninitialized palette.
ReadGIFImage en coders/gif.c en ImageMagick 7.0.6-1 y GraphicsMagick 1.3.26 deja sin inicializar la paleta cuando se procesa un archivo GIF que no tiene ni una paleta global ni una local. Si el producto afectado se utiliza como una librería cargada en un proceso que opera en datos de interés, estos datos pueden filtrarse a veces mediante la paleta no inicializada.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2017-10-11 CVE Reserved
- 2017-10-12 CVE Published
- 2020-09-02 First Exploit
- 2023-07-28 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (10)
| URL | Tag | Source |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html | Mailing List |
|
| URL | Date | SRC |
|---|---|---|
| https://github.com/hexrom/ImageMagick-CVE-2017-15277 | 2020-09-02 | |
| https://github.com/neex/gifoeb | 2024-08-05 |
| URL | Date | SRC |
|---|---|---|
| https://github.com/ImageMagick/ImageMagick/commit/9fd10cf630832b36a588c1545d8736539b2f1fb5 | 2018-10-18 | |
| https://github.com/ImageMagick/ImageMagick/issues/592 | 2018-10-18 |
| URL | Date | SRC |
|---|---|---|
| https://usn.ubuntu.com/3681-1 | 2018-10-18 | |
| https://usn.ubuntu.com/4232-1 | 2018-10-18 | |
| https://www.debian.org/security/2017/dsa-4032 | 2018-10-18 | |
| https://www.debian.org/security/2017/dsa-4040 | 2018-10-18 | |
| https://www.debian.org/security/2018/dsa-4321 | 2018-10-18 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Graphicsmagick Search vendor "Graphicsmagick" | Graphicsmagick Search vendor "Graphicsmagick" for product "Graphicsmagick" | 1.3.26 Search vendor "Graphicsmagick" for product "Graphicsmagick" and version "1.3.26" | - |
Affected
| ||||||
| Imagemagick Search vendor "Imagemagick" | Imagemagick Search vendor "Imagemagick" for product "Imagemagick" | 7.0.6-1 Search vendor "Imagemagick" for product "Imagemagick" and version "7.0.6-1" | - |
Affected
| ||||||