PT-2017-3899 · Graphicsmagick+2 · Graphicsmagick+2

Publicado

2017-07-22

·

Atualizado

2019-12-16

·

CVE-2017-11643

CVSS v2.0

10

Crítica

VetorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions GraphicsMagick version 1.3.26
Description The issue is related to a heap overflow in the WriteCMYKImage() function when processing multiple frames with non-identical widths. This can be exploited by a remote attacker to execute arbitrary code in the context of the vulnerable application.
Recommendations For GraphicsMagick version 1.3.26, consider disabling the WriteCMYKImage() function until a patch is available to prevent potential exploitation. Restrict access to the coders/cmyk.c module to minimize the risk of exploitation. Avoid using the WriteCMYKImage() function when processing multiple frames with different widths until the issue is resolved.

Correção

Buffer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2019-04558
CVE-2017-11643
DLA-1045-1
DLA-1401-1
DSA-4321-1
DSA-4321-2
SUSE-SU-2017:2229-1
USN-4222-1

Produtos afetados

Graphicsmagick
Suse
Ubuntu