PT-2017-12644 · Imagemagick+2 · Imagemagick+2

Publicado 2017-07-24 · Atualizado 2020-09-08 · CVE-2017-12670

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ImageMagick version 7.0.6-3

Description The issue is related to missing validation in the coders/mat.c file, which can cause an assertion failure in the DestroyImage function in MagickCore/image.c. This allows attackers to cause a denial of service.

Recommendations For ImageMagick version 7.0.6-3, consider updating to a newer version that addresses this issue, as no specific fix is provided for this version. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Assertion Failure

RCE

Enumeração de Fraquezas

CWE-617

CWE-20

Identificadores relacionados

BDU:2026-01422

CVE-2017-12670

DLA-1081-1

DLA-1785-1

DLA-2366-1

SUSE-SU-2018:0130-1

SUSE-SU-2018:0132-1

USN-3681-1

Produtos afetados

Imagemagick

Suse

Ubuntu

Referências · 211

• https://github.com/ImageMagick/ImageMagick/commit/d9f1a91d93871cc6a5c0b99e8bacad4d730acf36 · Nota
• https://github.com/ImageMagick/ImageMagick/issues/610 · Correção
• https://github.com/ImageMagick/ImageMagick/commit/de8cdeceafdc7bbdfcc55cd08e6a8b0cc979c91c · Nota
• https://github.com/ImageMagick/ImageMagick6/commit/75db34b6a4d642cb6f88c792942de27490c900e0 · Nota
• https://github.com/ImageMagick/ImageMagick6/commit/ab440f9ea11e0dbefb7a808cbb9441198758b0cb · Nota
• https://ubuntu.com/security/CVE-2017-14682 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html · Nota
• https://ubuntu.com/security/CVE-2017-18254 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-13758 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-11656 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-13769 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-12432 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-12434 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2018:0130-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-12430 · Aviso do Fabricante