Vulnerability Details : CVE-2017-16669
coders/wpg.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file, related to the AcquireCacheNexus function in magick/pixel_cache.c.
Vulnerability category: OverflowDenial of service
Products affected by CVE-2017-16669
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.26:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-16669
1.31%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 86 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-16669
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
|
8.8
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2017-16669
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-16669
-
http://hg.code.sf.net/p/graphicsmagick/code/rev/135bdcb88b8d
Mercurial Repository: p/graphicsmagick/code: changeset 15249:135bdcb88b8dPatch
-
http://hg.code.sf.net/p/graphicsmagick/code/rev/75245a215fff
Mercurial Repository: p/graphicsmagick/code: changeset 15247:75245a215fffPatch
-
http://hg.code.sf.net/p/graphicsmagick/code/rev/2a21cda3145b
Mercurial Repository: p/graphicsmagick/code: changeset 15250:2a21cda3145bPatch
-
https://usn.ubuntu.com/4248-1/
USN-4248-1: GraphicsMagick vulnerabilities | Ubuntu security notices | Ubuntu
-
http://www.securityfocus.com/bid/101795
GraphicsMagick CVE-2017-16669 Heap Buffer Overflow VulnerabilityThird Party Advisory;VDB Entry
-
https://sourceforge.net/p/graphicsmagick/bugs/450/
GraphicsMagick / Bugs / #450 Heap buffer overflow in AcquireCacheNexus()Exploit;Issue Tracking;Third Party Advisory;Patch
-
https://lists.debian.org/debian-lts-announce/2017/11/msg00013.html
[SECURITY] [DLA 1168-1] graphicsmagick security updateMailing List;Third Party Advisory
-
http://hg.code.sf.net/p/graphicsmagick/code/rev/fcd3ed3394f6
Mercurial Repository: p/graphicsmagick/code: changeset 15248:fcd3ed3394f6Patch
-
http://hg.code.sf.net/p/graphicsmagick/code/rev/1b9e64a8901e
Mercurial Repository: p/graphicsmagick/code: changeset 15251:1b9e64a8901ePatch
-
http://hg.code.sf.net/p/graphicsmagick/code/rev/e8086faa52d0
Mercurial Repository: p/graphicsmagick/code: changeset 15245:e8086faa52d0Patch
-
https://www.debian.org/security/2018/dsa-4321
Debian -- Security Information -- DSA-4321-1 graphicsmagickThird Party Advisory
-
https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html
[SECURITY] [DLA 1401-1] graphicsmagick security updateMailing List;Third Party Advisory
-
http://hg.code.sf.net/p/graphicsmagick/code/rev/3dc7b4e3779d
Mercurial Repository: p/graphicsmagick/code: changeset 15161:3dc7b4e3779dPatch
-
http://hg.code.sf.net/p/graphicsmagick/code/rev/2b7c826d36af
Mercurial Repository: p/graphicsmagick/code: changeset 15246:2b7c826d36afPatch
Jump to