PT-2017-11914 · Imagemagick · Imagemagick

Jgj212 · Publicado 2017-07-13 · Atualizado 2019-10-03 · CVE-2017-11310

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ImageMagick version 7.0.6-1 Q16 2017-06-21 (beta)

Description The issue is related to memory leak vulnerabilities in the read user chunk callback function, located in coderspng.c, which can be exploited via crafted PNG files.

Recommendations For ImageMagick version 7.0.6-1 Q16 2017-06-21 (beta), consider restricting the use of the read user chunk callback function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Release of Resource after Effective Lifetime

Enumeração de Fraquezas

CWE-772

Identificadores relacionados

CVE-2017-11310

Produtos afetados

Imagemagick

Referências · 5

• https://github.com/ImageMagick/ImageMagick/issues/517 · Correção
• https://github.com/ImageMagick/ImageMagick/commit/8ca35831e91c3db8c6d281d09b605001003bec08 · Correção
• https://osv.dev/vulnerability/CVE-2017-11310 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-11310 · Nota de Segurança
• http://securityfocus.com/bid/99585 · Nota