PT-2017-3878 · Graphicsmagick+1 · Graphicsmagick+1

Allan Zhou · Publicado 2017-12-13 · Atualizado 2020-01-27 · CVE-2017-17783

Positive Technologies (AI Summary)

CVSS v2.0

7.6

Alta

Vetor base

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GraphicsMagick version 1.3.27a

Description The issue is related to a buffer over-read error in the ReadPALMImage function, located in coders/palm.c, when QuantumDepth is set to 8. This error can be exploited by a remote attacker to execute arbitrary code.

Recommendations For GraphicsMagick version 1.3.27a, consider disabling the ReadPALMImage function in coders/palm.c until a patch is available to prevent potential exploitation. Restrict access to the ReadPALMImage function to minimize the risk of exploitation when QuantumDepth is 8. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

BDU:2019-04158

CVE-2017-17783

DSA-4321-1

DSA-4321-2

USN-4248-1

Produtos afetados

Graphicsmagick

Ubuntu

Referências · 26

• https://ubuntu.com/security/CVE-2017-17503 · Aviso do Fabricante
• https://debian.org/security/2018/dsa-4321 · Aviso do Fabricante
• http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset;node=60932931559a · Nota
• https://bdu.fstec.ru/vul/2019-04158 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2017-17783 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2017-17783 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-17783 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-17501 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-16669 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-17500 · Aviso do Fabricante
• https://sourceforge.net/p/graphicsmagick/bugs/529 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-4248-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-4248-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-17783 · Aviso do Fabricante
• http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset%3Bnode=60932931559a · Nota