---
title: "CVE-2017-9098\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2017-9098?format=md
keywords: index, follow
---

# CVE-2017-9098

Publication date 19 May 2017

Last updated 25 August 2025

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**7.5 · High**

[Score breakdown](https://ubuntu.com/security/CVE-2017-9098?format=md#impact-score)

Toggle side navigation

## Description

ImageMagick before 7.0.5-2 and GraphicsMagick before 1.3.24 use
uninitialized memory in the RLE decoder, allowing an attacker to leak
sensitive information from process memory space, as demonstrated by remote
attacks against ImageMagick code in a long-running server process that
converts image data on behalf of multiple users. This is caused by a
missing initialization step in the ReadRLEImage function in coders/rle.c.

[Read the notes from the security team](https://ubuntu.com/security/CVE-2017-9098?format=md#notes)

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| imagemagick | 17.04 zesty | Fixed 8:6.9.7.4+dfsg-3ubuntu1.1 |
| 16.10 yakkety | Fixed 8:6.8.9.9-7ubuntu8.6 |
| 16.04 LTS xenial | Fixed 8:6.8.9.9-7ubuntu5.7 |
| 14.04 LTS trusty | Fixed 8:6.7.7.10-6ubuntu3.7 |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)
* [Patch details](https://ubuntu.com/security/CVE-2017-9098?format=md#patch-details)

## Notes

---

### [mdeslaur](https://launchpad.net/~mdeslaur)

This is 0216-CVE-2017-9098-use-of-uninitialized-memory-in-RLE-dec.patch

### Patch details

For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)

| Package | Patch details |
| --- | --- |
| imagemagick | * Upstream:   [1c358ff](https://github.com/ImageMagick/ImageMagick/commit/1c358ffe0049f768dd49a8a889c1cbf99ac9849b) |

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

7.5 · High

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | Low |
  | Privileges required | None |
  | User interaction | None |
  | Scope | Unchanged |
  | Confidentiality impact | High |
  | Integrity impact | None |
  | Availability impact | None |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 7.5 · High |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9098)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-9098)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2017-9098)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2017-9098)

### Related Ubuntu Security Notices (USN)

+ [USN-3302-1](https://usn.ubuntu.com/USN-3302-1)
+ ImageMagick vulnerabilities
+ 30 May 2017

### Other references

* <https://scarybeastsecurity.blogspot.com/2017/05/bleed-continues-18-byte-file-14k-bounty.html>
* <https://www.cve.org/CVERecord?id=CVE-2017-9098>