PT-2017-3882 · Graphicsmagick+3 · Graphicsmagick+3

Bob Friesenhahn · Published 2017-03-14 · Updated 2024-06-15 · CVE-2017-6335

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GraphicsMagick versions 1.3.25 and earlier

Description The issue is related to the QuantumTransferMode function in GraphicsMagick, which can cause a denial of service due to an out-of-bounds read and application crash. This can be triggered by a small samples per pixel value in a CMYKA TIFF file. The vulnerability is also described as a buffer overflow error that can be exploited using a specially crafted TIFF file.

Recommendations For versions 1.3.25 and earlier, consider disabling the QuantumTransferMode function as a temporary workaround until a patch is available. Restrict the processing of CMYKA TIFF files to minimize the risk of exploitation. Avoid using the QuantumTransferMode function with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2018-2652

BDU:2019-04173

CVE-2017-6335

DLA-1456-1

MGASA-2017-0229

OPENSUSE-SU-2024:10596-1

SUSE-SU-2017:0918-1

SUSE-SU-2017_0918-1

USN-4206-1

Affected Products

Alt Linux

Graphicsmagick

Suse

Ubuntu

References · 55

• https://osv.dev/vulnerability/USN-4206-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-11102 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6335 · Security Note
• https://advisories.mageia.org/MGASA-2017-0229.html · Security Note
• http://openwall.com/lists/oss-security/2017/02/28/2 · Patch
• https://osv.dev/vulnerability/DLA-1456-1 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=44892734 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1427975 · Patch
• https://ubuntu.com/security/CVE-2017-14042 · Vendor Advisory
• https://sourceforge.net/p/graphicsmagick/code/ci/6156b4c2992d855ece6079653b3b93c3229fc4b8 · Patch
• https://ubuntu.com/security/notices/USN-4206-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-6335 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-6335 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04173 · Security Note
• https://ubuntu.com/security/CVE-2017-10794 · Vendor Advisory