CVE-2017-16353
GraphicsMagick - Memory Disclosure / Heap Overflow
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
GraphicsMagick 1.3.26 is vulnerable to a memory information disclosure vulnerability found in the DescribeImage function of the magick/describe.c file, because of a heap-based buffer over-read. The portion of the code containing the vulnerability is responsible for printing the IPTC Profile information contained in the image. This vulnerability can be triggered with a specially crafted MIFF file. There is an out-of-bounds buffer dereference because certain increments are never checked.
GraphicsMagick 1.3.26 es vulnerable a una revelación de información de memoria que se ha encontrado en la función DescribeImage del archivo magick/describe.c debido a una sobrelectura de búfer basada en memoria dinámica (heap). La porción del código que contiene la vulnerabilidad es responsable de imprimir la información de perfil IPTC incluida en la imagen. Esta vulnerabilidad se puede desencadenar mediante un archivo MIFF especialmente manipulado. Hay una desreferencia de búfer fuera de limites debido a que nunca se verifican ciertos incrementos.
GraphicsMagick suffers from memory disclosure and heap overflow vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-11-01 CVE Reserved
- 2017-11-01 CVE Published
- 2024-02-05 EPSS Updated
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-125: Out-of-bounds Read
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (9)
| URL | Tag | Source |
|---|---|---|
| http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset%3Bnode=e4e1c2a581d8 | X_refsource_misc | |
| http://www.securityfocus.com/bid/101653 | Third Party Advisory | |
| https://lists.debian.org/debian-lts-announce/2017/11/msg00002.html | Mailing List |
|
| https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html | Mailing List |
|
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/43111 | 2024-08-05 | |
| https://blogs.securiteam.com/index.php/archives/3494 | 2024-08-05 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| ftp://ftp.graphicsmagick.org/pub/GraphicsMagick/snapshots/ChangeLog.txt | 2023-11-07 | |
| https://usn.ubuntu.com/4232-1 | 2023-11-07 | |
| https://www.debian.org/security/2018/dsa-4321 | 2023-11-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Graphicsmagick Search vendor "Graphicsmagick" | Graphicsmagick Search vendor "Graphicsmagick" for product "Graphicsmagick" | 1.3.26 Search vendor "Graphicsmagick" for product "Graphicsmagick" and version "1.3.26" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 7.0 Search vendor "Debian" for product "Debian Linux" and version "7.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||