PT-2017-8043 · Graphicsmagick+1 · Graphicsmagick+1

Martin Prpič · Published 2016-07-01 · Updated 2024-06-15 · CVE-2016-2317

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GraphicsMagick version 1.3.23

Description The issue is related to multiple buffer overflows that can be triggered by remote attackers via a crafted SVG file, leading to a denial of service (crash). This is associated with the (1) TracePoint function in magick/render.c, (2) GetToken function in magick/utility.c, and (3) GetTransformTokens function in coders/svg.c.

Recommendations For GraphicsMagick version 1.3.23, consider disabling the processing of SVG files or restricting access to the TracePoint(), GetToken(), and GetTransformTokens() functions until a patch is available. Avoid using these functions with untrusted input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2016-2317

DLA-484-1

DSA-3746-1

MGASA-2016-0252

OPENSUSE-SU-2016_1724-1

OPENSUSE-SU-2016_2073-1

OPENSUSE-SU-2024:10505-1

SUSE-SU-2016:1783-1

Affected Products

Graphicsmagick

Suse

References · 114

• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00037.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-2317 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-2317 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00000.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:1783-1 · Vendor Advisory
• http://debian.org/security/2016/dsa-3746 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0252.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-2317 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-2317 · Security Note
• https://ubuntu.com/security/CVE-2016-2317 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10505-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-2317 · Security Note
• https://osv.dev/vulnerability/DSA-3746-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-2317 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0252 · Vendor Advisory