CVE-2017-14528

Published: 18 September 2017

The TIFFSetProfiles function in coders/tiff.c in ImageMagick 7.0.6 has incorrect expectations about whether LibTIFF TIFFGetField return values imply that data validation has occurred, which allows remote attackers to cause a denial of service (use-after-free after an invalid call to TIFFSetField, and application crash) via a crafted file.

Priority

Negligible

CVSS 3 base score: 6.5

Status

Package Release Status
imagemagick
Launchpad, Ubuntu, Debian
Upstream Needs triage

Ubuntu 20.10 (Groovy Gorilla) Not vulnerable
(8:6.9.10.8+dfsg-1ubuntu2)
Ubuntu 20.04 LTS (Focal Fossa) Not vulnerable
(8:6.9.10.8+dfsg-1ubuntu2)
Ubuntu 18.04 LTS (Bionic Beaver) Deferred
(2020-10-26)
Ubuntu 16.04 LTS (Xenial Xerus) Deferred
(2020-10-26)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist
(trusty was deferred [2020-10-26])