PT-2017-13619 · Imagemagick+2 · Imagemagick+2

Fumfel

+1

·

Publicado

2017-09-21

·

Atualizado

2018-06-14

·

CVE-2017-14682

CVSS v3.1

8.8

Alta

VetorAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions ImageMagick version 7.0.6
Description The issue allows remote attackers to cause a denial of service, which is a heap-based buffer overflow and application crash, or possibly have other unspecified impacts via a crafted SVG document.
Recommendations For ImageMagick version 7.0.6, update to a version that fixes the GetNextToken issue in MagickCore/token.c to prevent a heap-based buffer overflow and application crash. As a temporary workaround, consider avoiding the use of crafted SVG documents until a patch is available.

Exploit

Correção

DoS

Buffer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2017-14682
DLA-1131-1
DSA-4032-1
DSA-4040-1
MGASA-2018-0229
OPENSUSE-SU-2017_3420-1
SUSE-SU-2017:3388-1
USN-3681-1

Produtos afetados

Imagemagick
Suse
Ubuntu