CVE-2017-14528

Published: 18 September 2017

The TIFFSetProfiles function in coders/tiff.c in ImageMagick 7.0.6 has incorrect expectations about whether LibTIFF TIFFGetField return values imply that data validation has occurred, which allows remote attackers to cause a denial of service (use-after-free after an invalid call to TIFFSetField, and application crash) via a crafted file.

Priority

Negligible

CVSS 3 base score: 6.5

Status

Package Release Status
imagemagick
Launchpad, Ubuntu, Debian
Upstream Needs triage

Ubuntu 21.04 (Hirsute Hippo) Not vulnerable
(8:6.9.10.8+dfsg-1ubuntu2)
Ubuntu 20.04 LTS (Focal Fossa) Not vulnerable
(8:6.9.10.8+dfsg-1ubuntu2)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (8:6.9.7.4+dfsg-16ubuntu6.11)
Ubuntu 16.04 ESM (Xenial Xerus) Deferred
(2020-10-26)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist
(trusty was deferred [2020-10-26])
Patches:
Upstream: https://github.com/ImageMagick/ImageMagick6/commit/6f7cba13ebae405b2689647a2277827f1c272364