CVE-2017-11102: Input Validation
Published Jul 7, 2017
·Updated
Last updated 25 August 2025
Other sources
The ReadOneJNGImage function in coders/png.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (application crash) during JNG reading via a zero-length colorimage data structure.
— Launchpad
Affected Software
2 affected componentsFixes available
GraphicsMagick Graphicsmagick=1.3.26
debian/graphicsmagick
1.4+really1.3.36+hg16481-2+deb11u11.4+really1.3.40-4+deb12u11.4+really1.3.45+hg17696-11.4+really1.3.46-2
Remediation
Patch Available
Patch Available
Event History
Jul 7, 2017
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Data Sourced
via NVD·06:29 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jan 11, 2024
Data Sourced
via Launchpad·10:24 PM
Description
Feb 20, 2026
Data Sourced
via Ubuntu·08:04 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·08:04 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2017-11102?
CVE-2017-11102 has a moderate severity, allowing for denial of service through application crashes.
2
How do I fix CVE-2017-11102?
To fix CVE-2017-11102, update GraphicsMagick to version 1.4+really1.3.36+hg16481-2+deb11u1 or later.
3
What type of attack does CVE-2017-11102 enable?
CVE-2017-11102 enables remote attacks resulting in denial of service during JNG image reading.
4
Which versions of GraphicsMagick are affected by CVE-2017-11102?
GraphicsMagick version 1.3.26 is affected by CVE-2017-11102.
5
What is the nature of the vulnerability in CVE-2017-11102?
The vulnerability in CVE-2017-11102 arises from the handling of a zero-length color_image data structure, leading to application crashes.