PT-2017-3832 · Graphicsmagick+2 · Graphicsmagick+2

Bob Friesenhahn · Published 2016-10-08 · Updated 2024-06-15 · CVE-2016-7997

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GraphicsMagick versions 1.3.25 and earlier

Description The issue is related to the WPG format reader in GraphicsMagick, which allows remote attackers to cause a denial of service. This can be achieved through vectors related to a ReferenceBlob and a NULL pointer, leading to an assertion failure and crash. The vulnerability is associated with a NULL pointer dereference.

Recommendations For GraphicsMagick versions 1.3.25 and earlier, consider updating to a newer version to mitigate the risk of exploitation. As a temporary workaround, restrict the use of the WPG format reader until a patch is available.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2018-2652

BDU:2019-04038

CVE-2016-7997

DLA-683-1

DSA-3746-1

MGASA-2016-0337

MGASA-2017-0229

OPENSUSE-SU-2016_3060-1

OPENSUSE-SU-2024:10596-1

SUSE-SU-2016:2667-1

SUSE-SU-2016:2724-1

SUSE-SU-2016:2964-1

Affected Products

Alt Linux

Graphicsmagick

Suse

References · 138

• http://openwall.com/lists/oss-security/2016/10/07/4 · Patch
• https://advisories.mageia.org/MGASA-2016-0337.html · Security Note
• https://cve.org/CVERecord?id=CVE-2016-7997 · Security Note
• http://debian.org/security/2016/dsa-3746 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10596-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-7997 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2016:2964-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-7997 · Vendor Advisory
• https://debian.org/security/2016/dsa-3746 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3746-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-7997 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2724-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-7997 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0229 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2667-1 · Vendor Advisory