PT-2017-2567 · Imagemagick+3 · Imagemagick+3
Jgj212
·
Publicado
2017-07-18
·
Atualizado
2019-10-03
·
CVE-2017-11478
CVSS v2.0
7.1
Alta
| Vetor | AV:N/AC:M/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
ImageMagick versions 6.9.9-0 through 7.0.6-1
ImageMagick version 7.x
Description
The issue is related to the ReadOneDJVUImage function in ImageMagick, which is vulnerable to errors in resource management. This can be exploited by remote attackers to cause a denial of service, resulting in an infinite loop and CPU consumption, by using a specially crafted DJVU image.
Recommendations
For ImageMagick versions 6.9.9-0 through 7.0.6-1, consider disabling the ReadOneDJVUImage function as a temporary workaround until a patch is available.
For ImageMagick version 7.x, restrict the use of DJVU image processing to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
DoS
Infinite Loop
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Imagemagick
Suse
Ubuntu