CVE-2017-13143 : In ImageMagick before 6.9.7-6 and 7.x before 7.0.4-6, the ReadMATImage function

In ImageMagick before 6.9.7-6 and 7.x before 7.0.4-6, the ReadMATImage function in coders/mat.c uses uninitialized data, which might allow remote attackers to obtain sensitive information from process memory.

Published 2017-08-23 06:29:00

Updated 2018-06-14 01:29:26

Source MITRE

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2017-13143

Imagemagick » Imagemagick
Versions up to, including, (<=) 6.9.7-5
cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.1-3
cpe:2.3:a:imagemagick:imagemagick:7.0.1-3:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.1-4
cpe:2.3:a:imagemagick:imagemagick:7.0.1-4:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.1-5
cpe:2.3:a:imagemagick:imagemagick:7.0.1-5:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.1-6
cpe:2.3:a:imagemagick:imagemagick:7.0.1-6:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.1-0
cpe:2.3:a:imagemagick:imagemagick:7.0.1-0:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.1-10
cpe:2.3:a:imagemagick:imagemagick:7.0.1-10:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.1-8
cpe:2.3:a:imagemagick:imagemagick:7.0.1-8:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.2-0
cpe:2.3:a:imagemagick:imagemagick:7.0.2-0:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.2-4
cpe:2.3:a:imagemagick:imagemagick:7.0.2-4:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.2-6
cpe:2.3:a:imagemagick:imagemagick:7.0.2-6:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.2-8
cpe:2.3:a:imagemagick:imagemagick:7.0.2-8:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.3-2
cpe:2.3:a:imagemagick:imagemagick:7.0.3-2:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.3-4
cpe:2.3:a:imagemagick:imagemagick:7.0.3-4:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.4-1
cpe:2.3:a:imagemagick:imagemagick:7.0.4-1:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.4-2
cpe:2.3:a:imagemagick:imagemagick:7.0.4-2:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.2-1
cpe:2.3:a:imagemagick:imagemagick:7.0.2-1:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.2-10
cpe:2.3:a:imagemagick:imagemagick:7.0.2-10:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.2-2
cpe:2.3:a:imagemagick:imagemagick:7.0.2-2:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.2-3
cpe:2.3:a:imagemagick:imagemagick:7.0.2-3:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.3-6
cpe:2.3:a:imagemagick:imagemagick:7.0.3-6:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.3-7
cpe:2.3:a:imagemagick:imagemagick:7.0.3-7:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.3-8
cpe:2.3:a:imagemagick:imagemagick:7.0.3-8:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.3-9
cpe:2.3:a:imagemagick:imagemagick:7.0.3-9:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.2-9
cpe:2.3:a:imagemagick:imagemagick:7.0.2-9:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.3-0
cpe:2.3:a:imagemagick:imagemagick:7.0.3-0:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.3-1
cpe:2.3:a:imagemagick:imagemagick:7.0.3-1:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.3-10
cpe:2.3:a:imagemagick:imagemagick:7.0.3-10:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.4-3
cpe:2.3:a:imagemagick:imagemagick:7.0.4-3:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.4-4
cpe:2.3:a:imagemagick:imagemagick:7.0.4-4:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.4-5
cpe:2.3:a:imagemagick:imagemagick:7.0.4-5:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.1-1
cpe:2.3:a:imagemagick:imagemagick:7.0.1-1:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.1-2
cpe:2.3:a:imagemagick:imagemagick:7.0.1-2:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.1-7
cpe:2.3:a:imagemagick:imagemagick:7.0.1-7:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.1-9
cpe:2.3:a:imagemagick:imagemagick:7.0.1-9:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.2-5
cpe:2.3:a:imagemagick:imagemagick:7.0.2-5:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.2-7
cpe:2.3:a:imagemagick:imagemagick:7.0.2-7:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.3-3
cpe:2.3:a:imagemagick:imagemagick:7.0.3-3:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.3-5
cpe:2.3:a:imagemagick:imagemagick:7.0.3-5:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick » Version: 7.0.4-0
cpe:2.3:a:imagemagick:imagemagick:7.0.4-0:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2017-13143

EPSS FAQ

0.11%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 31 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-13143

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2017-13143

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-13143

https://usn.ubuntu.com/3681-1/

USN-3681-1: ImageMagick vulnerabilities | Ubuntu security notices

CVEs referencing this url
https://www.debian.org/security/2017/dsa-4019

Debian -- Security Information -- DSA-4019-1 imagemagick

CVEs referencing this url
https://github.com/ImageMagick/ImageMagick/issues/362

use of uninitialized data in ImageMagick/coders/mat.c:407 · Issue #362 · ImageMagick/ImageMagick · GitHub
Issue Tracking;Patch;Third Party Advisory
https://security.gentoo.org/glsa/201711-07

ImageMagick: Multiple vulnerabilities (GLSA 201711-07) — Gentoo security

CVEs referencing this url
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870012

#870012 - imagemagick: CVE-2017-13143 - Debian Bug report logs
Issue Tracking;Third Party Advisory
https://www.debian.org/security/2018/dsa-4204

Debian -- Security Information -- DSA-4204-1 imagemagick

CVEs referencing this url
https://github.com/ImageMagick/ImageMagick/commit/51b0ae01709adc1e4a9245e158ef17b85a110960

https://github.com/ImageMagick/ImageMagick/issues/362 · ImageMagick/ImageMagick@51b0ae0 · GitHub
Issue Tracking;Patch;Third Party Advisory

Jump to

Vulnerability Details : CVE-2017-13143

Products affected by CVE-2017-13143

Exploit prediction scoring system (EPSS) score for CVE-2017-13143

CVSS scores for CVE-2017-13143

CWE ids for CVE-2017-13143

References for CVE-2017-13143