PT-2017-3836 · Graphicsmagick+2 · Graphicsmagick+2

Published 2017-07-07 · Updated 2019-12-02 · CVE-2017-11102

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GraphicsMagick version 1.3.26

Description The issue exists due to insufficient input validation in the ReadOneJNGImage function, located in coders/png.c. This allows a remote attacker to cause a denial of service, resulting in an application crash, by providing a specially crafted JNG file with a zero-length color image data structure.

Recommendations For GraphicsMagick version 1.3.26, consider disabling the ReadOneJNGImage function as a temporary workaround until a patch is available. Restrict access to JNG files to minimize the risk of exploitation. Avoid using the ReadOneJNGImage function for reading JNG files until the issue is resolved.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2019-04042

CVE-2017-11102

DLA-1045-1

DLA-1456-1

DSA-4321-1

DSA-4321-2

SUSE-SU-2018:0413-1

USN-4206-1

Affected Products

Graphicsmagick

Suse

Ubuntu

References · 96

• https://ubuntu.com/security/CVE-2017-11637 · Vendor Advisory
• https://debian.org/security/2018/dsa-4321 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4206-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-11102 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-11102 · Security Note
• https://osv.dev/vulnerability/CVE-2017-11102 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4321-1 · Vendor Advisory
• http://hg.code.sf.net/p/graphicsmagick/code/rev/d445af60a8d5 · Patch
• https://ubuntu.com/security/notices/USN-4206-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-11102 · Security Note
• https://ubuntu.com/security/CVE-2017-10794 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-11102 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:0413-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-11403 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-11140 · Vendor Advisory