PT-2017-3878 · Graphicsmagick+1 · Graphicsmagick+1

Allan Zhou · Published 2017-12-13 · Updated 2020-01-27 · CVE-2017-17783

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GraphicsMagick version 1.3.27a

Description The issue is related to a buffer over-read error in the ReadPALMImage function, located in coders/palm.c, when QuantumDepth is set to 8. This error can be exploited by a remote attacker to execute arbitrary code.

Recommendations For GraphicsMagick version 1.3.27a, consider disabling the ReadPALMImage function in coders/palm.c until a patch is available to prevent potential exploitation. Restrict access to the ReadPALMImage function to minimize the risk of exploitation when QuantumDepth is 8. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2019-04158

CVE-2017-17783

DSA-4321-1

DSA-4321-2

USN-4248-1

Affected Products

Graphicsmagick

Ubuntu

References · 26

• https://ubuntu.com/security/CVE-2017-17503 · Vendor Advisory
• https://debian.org/security/2018/dsa-4321 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04158 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-17783 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-17783 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-17783 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-17501 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16669 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-17500 · Vendor Advisory
• https://sourceforge.net/p/graphicsmagick/bugs/529 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4248-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4248-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-17783 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-17783 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4321-1 · Vendor Advisory