PT-2017-3868 · Graphicsmagick+2 · Graphicsmagick+2
Ayrx
+3
·
Published
2017-10-22
·
Updated
2020-01-08
·
CVE-2017-16353
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
GraphicsMagick version 1.3.26
Description
The issue is related to a heap-based buffer over-read in the DescribeImage function of the magick/describe.c file, which can lead to a memory information disclosure. This can be triggered by a specially crafted MIFF file, causing an out-of-bounds buffer dereference due to un-checked increments. The vulnerable code portion is responsible for printing the IPTC Profile information contained in the image.
Recommendations
For GraphicsMagick version 1.3.26, as a temporary workaround, consider disabling the
DescribeImage function until a patch is available. Restrict access to the magick/describe.c file to minimize the risk of exploitation. Avoid using specially crafted MIFF files with the affected DescribeImage function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Information Disclosure
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Graphicsmagick
Suse
Ubuntu