PT-2017-3874 · Graphicsmagick+2 · Graphicsmagick+2
Kamil Frankowicz
·
Publicado
2017-09-10
·
Atualizado
2020-01-27
·
CVE-2017-16669
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
GraphicsMagick versions 1.3.26 through 7.0.6
Description
The issue is caused by a buffer overflow in the coders/wpg.c component of the GraphicsMagick library, allowing a remote attacker to cause a denial of service or possibly execute arbitrary code using a specially crafted file. This is related to the
AcquireCacheNexus function in magick/pixel cache.c.Recommendations
For versions 1.3.26 through 7.0.6, consider disabling the
coders/wpg.c component as a temporary workaround until a patch is available. Restrict access to the AcquireCacheNexus function in magick/pixel cache.c to minimize the risk of exploitation. Avoid using specially crafted files that could trigger the buffer overflow until the issue is resolved.Exploit
Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Graphicsmagick
Suse
Ubuntu