PT-2017-14814 · Graphicsmagick+2 · Graphicsmagick+2
Littleputa
·
Publicado
2017-12-11
·
Atualizado
2020-01-22
·
CVE-2017-17503
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
GraphicsMagick version 1.3.26
Description
The issue is related to a heap-based buffer over-read in the
ReadGRAYImage function in coders/gray.c of GraphicsMagick. This occurs via a crafted file, specifically affecting the ImportGrayQuantumType in magick/import.c.Recommendations
For GraphicsMagick version 1.3.26, consider avoiding the use of crafted files that may trigger the heap-based buffer over-read in the
ReadGRAYImage function until a patch is available. As a temporary workaround, restrict the import of gray quantum types to minimize the risk of exploitation.Correção
Out of bounds Read
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Graphicsmagick
Suse
Ubuntu