PT-2017-3901 · Graphicsmagick+2 · Graphicsmagick+2

Publicado 2017-08-24 · Atualizado 2019-12-16 · CVE-2017-13776

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GraphicsMagick version 1.3.26

Description The issue is related to a denial of service in the ReadXBMImage() function, specifically in the "Read hex image data" case when the version is not equal to 10. This results in the reader not returning, causing large amounts of CPU and memory consumption. The vulnerability is associated with resource exhaustion of the central processor. Exploitation of this issue may allow a remote attacker to cause a denial of service.

Recommendations For GraphicsMagick version 1.3.26, consider disabling the ReadXBMImage() function as a temporary workaround to minimize the risk of exploitation until a patch is available.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-834

Identificadores relacionados

BDU:2019-04560

BDU:2019-04561

CVE-2017-13776

DLA-1082-1

DLA-1456-1

DSA-4321-1

DSA-4321-2

SUSE-SU-2017:3435-1

USN-4222-1

Produtos afetados

Graphicsmagick

Suse

Ubuntu

Referências · 65

• 🔥 http://openwall.com/lists/oss-security/2017/08/31/2 · Exploit
• https://suse.com/security/cve/CVE-2017-15930 · Nota
• https://ubuntu.com/security/CVE-2017-13134 · Aviso do Fabricante
• https://debian.org/security/2018/dsa-4321 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-12936 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-4222-1 · Aviso do Fabricante
• http://securityfocus.com/bid/100574 · Nota
• https://ubuntu.com/security/CVE-2017-13777 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html · Nota
• https://ubuntu.com/security/CVE-2017-13065 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-13776 · Nota de Segurança
• https://suse.com/security/cve/CVE-2017-16669 · Nota
• http://hg.code.sf.net/p/graphicsmagick/code/rev/233a720bfd5e · Correção
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-13776 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-11638 · Aviso do Fabricante