Published: 24/03/2017 Updated: 04/11/2017

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Heap-based buffer overflow in the PushQuantumPixel function in ImageMagick prior to 6.9.7-3 and 7.x prior to 7.0.4-3 allows remote malicious users to cause a denial of service (application crash) via a crafted TIFF file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
imagemagick imagemagick 7.0.1-3
imagemagick imagemagick 7.0.1-4
imagemagick imagemagick 7.0.2-10
imagemagick imagemagick 7.0.2-2
imagemagick imagemagick 7.0.2-9
imagemagick imagemagick 7.0.3-0
imagemagick imagemagick 7.0.3-6
imagemagick imagemagick 7.0.3-7
imagemagick imagemagick 7.0.1-5
imagemagick imagemagick 7.0.1-6
imagemagick imagemagick 7.0.2-3
imagemagick imagemagick 7.0.2-4
imagemagick imagemagick 7.0.3-1
imagemagick imagemagick 7.0.3-10
imagemagick imagemagick 7.0.3-8
imagemagick imagemagick 7.0.3-9
imagemagick imagemagick 7.0.1-0
imagemagick imagemagick 7.0.1-1
imagemagick imagemagick 7.0.1-7
imagemagick imagemagick 7.0.1-8
imagemagick imagemagick 7.0.2-5
imagemagick imagemagick 7.0.2-6
imagemagick imagemagick 7.0.3-2
imagemagick imagemagick 7.0.3-3
imagemagick imagemagick 7.0.4-0
imagemagick imagemagick 7.0.4-1
imagemagick imagemagick 7.0.1-10
imagemagick imagemagick 7.0.1-2
imagemagick imagemagick 7.0.1-9
imagemagick imagemagick 7.0.2-0
imagemagick imagemagick 7.0.2-1
imagemagick imagemagick 7.0.2-7
imagemagick imagemagick 7.0.2-8
imagemagick imagemagick 7.0.3-4
imagemagick imagemagick 7.0.3-5
imagemagick imagemagick 7.0.4-2
imagemagick imagemagick

Several security issues were fixed in ImageMagick ...

This update fixes several vulnerabilities in imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service or the execution of arbitrary code if malformed TIFF, WPG, IPL, MPC or PSB files are processed For the stable distribution (jessie), these problems have been fixed in version ...

Debian Bug report logs - #851374 imagemagick: CVE-2017-5511: coders/psdc: memory corruption heap overflow Package: imagemagick; Maintainer for imagemagick is ImageMagick Packaging Team <pkg-gmagick-im-team@listsaliothdebianorg>; Source for imagemagick is src:imagemagick (PTS, buildd, popcon) Reported by: Bastien ROUCARI� ...

Debian Bug report logs - #851383 imagemagick: CVE-2017-5506: magick/profilec: double-free memory corruption Package: imagemagick; Maintainer for imagemagick is ImageMagick Packaging Team <pkg-gmagick-im-team@listsaliothdebianorg>; Source for imagemagick is src:imagemagick (PTS, buildd, popcon) Reported by: Bastien ROUCAR ...

Debian Bug report logs - #848139 CVE-2016-8707 ImageMagick Convert Tiff Adobe Deflate Code Execution Vulnerability Package: src:imagemagick; Maintainer for src:imagemagick is ImageMagick Packaging Team <pkg-gmagick-im-team@listsaliothdebianorg>; Reported by: Bastien ROUCARIES <roucariesbastien@gmailcom> Date: Wed ...

Debian Bug report logs - #851382 imagemagick: CVE-2017-5507: coders/mpcc: memory leak in mpc file handling Package: imagemagick; Maintainer for imagemagick is ImageMagick Packaging Team <pkg-gmagick-im-team@listsaliothdebianorg>; Source for imagemagick is src:imagemagick (PTS, buildd, popcon) Reported by: Bastien ROUCARI ...

Debian Bug report logs - #851380 imagemagick: CVE-2016-10146: memory leak in caption and label handling Package: imagemagick; Maintainer for imagemagick is ImageMagick Packaging Team <pkg-gmagick-im-team@listsaliothdebianorg>; Source for imagemagick is src:imagemagick (PTS, buildd, popcon) Reported by: Bastien ROUCARIÈS ...

Debian Bug report logs - #851376 imagemagick: CVE-2017-5510: coders/psdc: out-of-bounds write flaw in psd file handling Package: imagemagick; Maintainer for imagemagick is ImageMagick Packaging Team <pkg-gmagick-im-team@listsaliothdebianorg>; Source for imagemagick is src:imagemagick (PTS, buildd, popcon) Reported by: Ba ...

Debian Bug report logs - #851381 imagemagick: CVE-2017-5508: PushQuantumPixel heap buffer-overflow Package: imagemagick; Maintainer for imagemagick is ImageMagick Packaging Team <pkg-gmagick-im-team@listsaliothdebianorg>; Source for imagemagick is src:imagemagick (PTS, buildd, popcon) Reported by: Bastien ROUCARIÈS <r ...

CWE-119 https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=31161 https://github.com/ImageMagick/ImageMagick/commit/c073a7712d82476b5fbee74856c46b88af9c3175 https://github.com/ImageMagick/ImageMagick/blob/7.0.4-3/ChangeLog https://github.com/ImageMagick/ImageMagick/blob/6.9.7-3/ChangeLog https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851381 http://www.securityfocus.com/bid/95748 http://www.openwall.com/lists/oss-security/2017/01/17/5 http://www.openwall.com/lists/oss-security/2017/01/16/6 https://security.gentoo.org/glsa/201702-09 http://www.debian.org/security/2017/dsa-3799 https://usn.ubuntu.com/3222-1/https://nvd.nist.gov

Get Started

CVE-2017-5508

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect