PT-2017-2112 · Imagemagick+2 · Imagemagick+2

Jgj212 · Published 2017-05-04 · Updated 2019-10-03 · CVE-2017-8765

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions ImageMagick version 7.0.5-5

Description The issue is related to a memory leak vulnerability in the ReadICONImage function, located in codersicon.c. This vulnerability can be exploited by a remote attacker using a specially crafted ICON file, potentially causing memory exhaustion and leading to a denial-of-service condition.

Recommendations For ImageMagick version 7.0.5-5, consider disabling the ReadICONImage function as a temporary workaround until a patch is available. Restrict access to handling ICON files to minimize the risk of exploitation. Avoid using the affected function to process ICON files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-399

CWE-772

Related Identifiers

BDU:2017-01289

CVE-2017-8765

DLA-960-1

DSA-3863-1

MGASA-2018-0229

SUSE-SU-2017:1489-1

SUSE-SU-2017:1599-1

SUSE-SU-2017:1600-1

USN-3302-1

Affected Products

Imagemagick

Suse

Ubuntu

References · 108

• https://github.com/ImageMagick/ImageMagick/issues/466 · Patch
• http://debian.org/security/2017/dsa-3863 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7941 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-8356 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9142 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0229 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3302-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-8348 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3302-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7942 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-8345 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-8765 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-8830 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01289 · Security Note
• https://ubuntu.com/security/CVE-2017-8347 · Vendor Advisory