PT-2017-2505 · Imagemagick+1 · Imagemagick+1

Jgj212 · Published 2017-07-19 · Updated 2019-10-03 · CVE-2017-11446

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions ImageMagick versions 7.0.6-1

Description The issue is related to the ReadPESImage function in ImageMagick, which is affected by resource management errors. This can be exploited by a remote attacker using a specially crafted PES file to modify the cycle into an infinite loop, potentially causing CPU exhaustion.

Recommendations For ImageMagick version 7.0.6-1, consider disabling the ReadPESImage function as a temporary workaround until a patch is available to prevent potential CPU exhaustion via crafted PES files.

Fix

Infinite Loop

Weakness Enumeration

CWE-399

CWE-835

Related Identifiers

BDU:2017-01715

CVE-2017-11446

DLA-1081-1

DLA-1785-1

DSA-4019-1

MGASA-2018-0229

SUSE-SU-2017:2949-1

Affected Products

Imagemagick

Suse

References · 180

• https://github.com/ImageMagick/ImageMagick/issues/537 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13768 · Security Note
• https://bdu.fstec.ru/vul/2021-03376 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13139 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15017 · Security Note
• https://osv.dev/vulnerability/MGASA-2018-0229 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02351 · Security Note
• https://bdu.fstec.ru/vul/2018-00532 · Security Note
• https://bdu.fstec.ru/vul/2019-01951 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14505 · Security Note
• https://bdu.fstec.ru/vul/2017-02040 · Security Note
• https://bdu.fstec.ru/vul/2017-01828 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14172 · Security Note
• https://bdu.fstec.ru/vul/2021-03373 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14400 · Security Note