CVE-2017-11722: Medium severity GraphicsMagick Graphicsmagick vulnerability
The WriteOnePNGImage function in coders/png.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file, because the program's actual control flow was inconsistent with its indentation. This resulted in a logging statement executing outside of a loop, and consequently using an invalid array index corresponding to the loop's exit condition.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/graphicsmagickto a version that resolves this vulnerability.Fixed in 1.3.26-r2 - Upgrade
Upgrade
debian/graphicsmagickto a version that resolves this vulnerability.Fixed in 1.4+really1.3.40-4+deb12u1Fixed in 1.4+really1.3.45+hg17696-1Fixed in 1.4+really1.3.49-1
Event History
Frequently Asked Questions
What is the severity of CVE-2017-11722?
CVE-2017-11722 has a severity that leads to denial of service due to an out-of-bounds read and application crash.
How do I fix CVE-2017-11722?
To fix CVE-2017-11722, upgrade to GraphicsMagick versions 1.3.27 or later.
Which versions of GraphicsMagick are affected by CVE-2017-11722?
Versions of GraphicsMagick prior to 1.3.27, including version 1.3.26, are affected by CVE-2017-11722.
Can CVE-2017-11722 be exploited remotely?
Yes, CVE-2017-11722 can be exploited remotely through crafted PNG files.
What impact does CVE-2017-11722 have on applications?
The impact of CVE-2017-11722 is application instability, leading to crashes when processing specific files.