CVE-2017-12140: Medium severity ImageMagick vulnerability
Last updated 24 July 2024
Other sources
The ReadDCMImage function in coders\dcm.c in ImageMagick 7.0.6-1 has an integer signedness error leading to excessive memory consumption via a crafted DCM file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.3+deb11u4Fixed in 8:6.9.11.60+dfsg-1.3+deb11u5Fixed in 8:6.9.11.60+dfsg-1.6+deb12u2Fixed in 8:6.9.11.60+dfsg-1.6+deb12u1Fixed in 8:7.1.1.43+dfsg1-1Fixed in 8:7.1.1.47+dfsg1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2017-12140?
The severity of CVE-2017-12140 is high with a CVSS score of 6.5.
How does the ReadDCMImage function in ImageMagick 7.0.6-1 lead to excessive memory consumption?
The ReadDCMImage function in coders\dcm.c in ImageMagick 7.0.6-1 has an integer signedness error that leads to excessive memory consumption when processing a crafted DCM file.
Which versions of ImageMagick are affected by CVE-2017-12140?
ImageMagick versions 8:6.9.7.4+dfsg-16ubuntu2.2, 8:6.9.7.4+dfsg-16ubuntu6.2, 8:6.7.7.10-6ubuntu3.11, 8:6.9.9.34+dfsg-3, 8:6.8.9.9-7ubuntu5.11, 7.0.6-1, 8:6.9.10.23+dfsg-2.1+deb10u1, 8:6.9.10.23+dfsg-2.1+deb10u5, 8:6.9.11.60+dfsg-1.3+deb11u1, 8:6.9.11.60+dfsg-1.6, and 8:6.9.12.98+dfsg1-2 are affected by CVE-2017-12140.
How do I fix CVE-2017-12140 on Ubuntu?
To fix CVE-2017-12140 on Ubuntu, update ImageMagick to version 8:6.9.7.4+dfsg-16ubuntu2.2, 8:6.9.7.4+dfsg-16ubuntu6.2, 8:6.7.7.10-6ubuntu3.11, or a later version.
How do I fix CVE-2017-12140 on Debian?
To fix CVE-2017-12140 on Debian, update ImageMagick to version 8:6.9.10.23+dfsg-2.1+deb10u1, 8:6.9.10.23+dfsg-2.1+deb10u5, 8:6.9.11.60+dfsg-1.3+deb11u1, 8:6.9.11.60+dfsg-1.6, or 8:6.9.12.98+dfsg1-2, or a later version.