CVE-2017-10995: Medium severity ImageMagick ImageMagick vulnerability

Published Jul 7, 2017

Updated

Last updated 24 July 2024

Other sources

The mnggetlong function in coders/png.c in ImageMagick 7.0.6-0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted MNG image.

Affected Software

2 affected componentsFixes available

ImageMagick ImageMagick=7.0.6-0

debian/imagemagick

8:6.9.11.60+dfsg-1.6+deb12u118:6.9.11.60+dfsg-1.6+deb12u158:7.1.1.43+dfsg1-1+deb13u128:7.1.1.43+dfsg1-1+deb13u138:7.1.2.34+dfsg1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:6.9.11.60+dfsg-1.6+deb12u11Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15Fixed in 8:7.1.1.43+dfsg1-1+deb13u12Fixed in 8:7.1.1.43+dfsg1-1+deb13u13Fixed in 8:7.1.2.34+dfsg1-1

Event History

Jul 7, 2017

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Jul 9, 2017

Data Sourced

08:15 AM

SeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-4204

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-1081-1

Frequently Asked Questions

What is CVE-2017-10995?

CVE-2017-10995 is a vulnerability in ImageMagick 7.0.6-0 that allows remote attackers to cause a denial of service via a crafted MNG image.

How severe is CVE-2017-10995?

CVE-2017-10995 has a severity rating of 5.5 (high).

How can I fix CVE-2017-10995?

To fix CVE-2017-10995, update to ImageMagick version 8:6.8.9.9-7ubuntu5.11 (for Ubuntu Xenial), version 8:6.7.7.10-6ubuntu3.11 (for Ubuntu Trusty), or one of the specified versions for Debian.

Where can I find more information about CVE-2017-10995?

You can find more information about CVE-2017-10995 at the following references: [1] [2] [3].

What is the CWE ID for CVE-2017-10995?

The CWE ID for CVE-2017-10995 is CWE-125.