Vulnerability Details : CVE-2017-15277
ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when processing a GIF file that has neither a global nor local palette. If the affected product is used as a library loaded into a process that operates on interesting data, this data sometimes can be leaked via the uninitialized palette.
Vulnerability category: Information leak
Exploit prediction scoring system (EPSS) score for CVE-2017-15277
Probability of exploitation activity in the next 30 days: 1.81%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 87 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2017-15277
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:N/A:N |
8.6
|
2.9
|
NIST |
|
6.5
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
2.8
|
3.6
|
NIST |
CWE ids for CVE-2017-15277
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-15277
-
https://usn.ubuntu.com/3681-1/
USN-3681-1: ImageMagick vulnerabilities | Ubuntu security notices
-
https://github.com/neex/gifoeb
GitHub - neex/gifoeb: exploit for ImageMagick's uninitialized memory disclosure in gif coderExploit;Third Party Advisory
-
https://www.debian.org/security/2017/dsa-4040
Debian -- Security Information -- DSA-4040-1 imagemagick
-
https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html
[SECURITY] [DLA 1456-1] graphicsmagick security update
-
https://github.com/ImageMagick/ImageMagick/issues/592
uninitialized image palette in coders/gif.c · Issue #592 · ImageMagick/ImageMagick · GitHubIssue Tracking;Patch;Third Party Advisory
-
https://www.debian.org/security/2017/dsa-4032
Debian -- Security Information -- DSA-4032-1 imagemagick
-
https://www.debian.org/security/2018/dsa-4321
Debian -- Security Information -- DSA-4321-1 graphicsmagick
-
https://github.com/ImageMagick/ImageMagick/commit/9fd10cf630832b36a588c1545d8736539b2f1fb5
https://github.com/ImageMagick/ImageMagick/issues/592 · ImageMagick/ImageMagick@9fd10cf · GitHubIssue Tracking;Patch;Third Party Advisory
-
https://usn.ubuntu.com/4232-1/
USN-4232-1: GraphicsMagick vulnerabilities | Ubuntu security notices
Products affected by CVE-2017-15277
- cpe:2.3:a:imagemagick:imagemagick:7.0.6-1:*:*:*:*:*:*:*
- cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.26:*:*:*:*:*:*:*