PT-2018-6747 · Graphicsmagick+1 · Graphicsmagick+1
Bestshow
·
Publicado
2018-03-05
·
Atualizado
2018-10-28
·
CVE-2017-18220
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
GraphicsMagick version 1.3.26
Description:
The issue is related to the ReadOneJNGImage and ReadJNGImage functions in GraphicsMagick, which can be exploited by remote attackers using a crafted file. This can cause a denial of service due to a use-after-free error in magick/blob.c when CloseBlob is called, and may have other unspecified impacts.
Recommendations:
For GraphicsMagick version 1.3.26, consider avoiding the use of the ReadOneJNGImage and ReadJNGImage functions until a patch is available. As a temporary workaround, restrict the processing of crafted files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Use After Free
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Graphicsmagick
Suse