PT-2017-13611 · Horde+1 · Horde Image+1

Fariskhi Vidyan + 1 · Published 2017-09-21 · Updated 2018-08-18 · CVE-2017-14650

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Horde Image versions 2.0.0 through 2.5.1

Description A Remote Code Execution issue has been found in the Horde Image library when using the "Im" backend that utilizes ImageMagick's "convert" utility. This issue is not exploitable through any Horde application, as the vulnerable code path is not used by any Horde code. However, custom applications using the Horde Image library might be affected. The problem stems from missing input validation of the index field in raw() during the construction of an ImageMagick command line.

Recommendations For Horde Image versions 2.0.0 through 2.5.1, update to version 2.5.2 to resolve the issue. As a temporary workaround, consider disabling the use of the "Im" backend or restricting access to the raw() function until the update can be applied.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-14650

DLA-1395-1

DSA-4276-1

Affected Products

Horde Image

Imagemagick

References · 20

• 🔥 https://github.com/horde/horde/commit/eb3afd14c22c77ae0d29e2848f5ac726ef6e7c5b · Exploit
• https://security-tracker.debian.org/tracker/source-package/php-horde-image · Vendor Advisory
• https://debian.org/security/2018/dsa-4276 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4276-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-14650 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-14650 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9774 · Security Note
• https://security-tracker.debian.org/tracker/DSA-4276-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-14650 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-14650 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-14650 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9773 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-14650 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-14650 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DLA-1395-1 · Vendor Advisory