CVE-2017-16353
Published: 1 November 2017
GraphicsMagick 1.3.26 is vulnerable to a memory information disclosure vulnerability found in the DescribeImage function of the magick/describe.c file, because of a heap-based buffer over-read. The portion of the code containing the vulnerability is responsible for printing the IPTC Profile information contained in the image. This vulnerability can be triggered with a specially crafted MIFF file. There is an out-of-bounds buffer dereference because certain increments are never checked.
From the Ubuntu Security Team
It was discovered that GraphicsMagick incorrectly handled certain image files. An attacker could possibly use this issue to cause a denial of service or other unspecified impact.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
graphicsmagick Launchpad, Ubuntu, Debian |
artful |
Ignored
(end of life)
|
| bionic |
Not vulnerable
(1.3.26-17)
|
|
| cosmic |
Not vulnerable
(1.3.26-17)
|
|
| disco |
Not vulnerable
(1.3.26-17)
|
|
| eoan |
Not vulnerable
(1.3.26-17)
|
|
| focal |
Not vulnerable
(1.3.26-17)
|
|
| groovy |
Not vulnerable
(1.3.26-17)
|
|
| hirsute |
Not vulnerable
(1.3.26-17)
|
|
| impish |
Not vulnerable
(1.3.26-17)
|
|
| jammy |
Not vulnerable
(1.3.26-17)
|
|
| trusty |
Released
(1.3.18-1ubuntu3.1+esm4)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
| upstream |
Released
(1.3.26-17)
|
|
| xenial |
Released
(1.3.23-1ubuntu0.4)
|
|
| zesty |
Ignored
(end of life)
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 6.5 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | None |
| Availability impact | None |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |