PT-2017-3901 · Graphicsmagick+2 · Graphicsmagick+2

Published 2017-08-24 · Updated 2019-12-16 · CVE-2017-13776

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GraphicsMagick version 1.3.26

Description The issue is related to a denial of service in the ReadXBMImage() function, specifically in the "Read hex image data" case when the version is not equal to 10. This results in the reader not returning, causing large amounts of CPU and memory consumption. The vulnerability is associated with resource exhaustion of the central processor. Exploitation of this issue may allow a remote attacker to cause a denial of service.

Recommendations For GraphicsMagick version 1.3.26, consider disabling the ReadXBMImage() function as a temporary workaround to minimize the risk of exploitation until a patch is available.

Exploit

Fix

DoS

Weakness Enumeration

CWE-834

Related Identifiers

BDU:2019-04560

BDU:2019-04561

CVE-2017-13776

DLA-1082-1

DLA-1456-1

DSA-4321-1

DSA-4321-2

SUSE-SU-2017:3435-1

USN-4222-1

Affected Products

Graphicsmagick

Suse

Ubuntu

References · 65

• 🔥 http://openwall.com/lists/oss-security/2017/08/31/2 · Exploit
• https://ubuntu.com/security/CVE-2017-13134 · Vendor Advisory
• https://debian.org/security/2018/dsa-4321 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-12936 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4222-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-13777 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-13065 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-13776 · Security Note
• http://hg.code.sf.net/p/graphicsmagick/code/rev/233a720bfd5e · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-13776 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-11638 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-11642 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-11643 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4321-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1456-1 · Vendor Advisory