CVE-2017-12140: High severity ImageMagick vulnerability
Last updated 24 July 2024
Other sources
The ReadDCMImage function in coders\dcm.c in ImageMagick 7.0.6-1 has an integer signedness error leading to excessive memory consumption via a crafted DCM file.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-12140?
The severity of CVE-2017-12140 is high with a CVSS score of 6.5.
How does the ReadDCMImage function in ImageMagick 7.0.6-1 lead to excessive memory consumption?
The ReadDCMImage function in coders\dcm.c in ImageMagick 7.0.6-1 has an integer signedness error that leads to excessive memory consumption when processing a crafted DCM file.
Which versions of ImageMagick are affected by CVE-2017-12140?
ImageMagick versions 8:6.9.7.4+dfsg-16ubuntu2.2, 8:6.9.7.4+dfsg-16ubuntu6.2, 8:6.7.7.10-6ubuntu3.11, 8:6.9.9.34+dfsg-3, 8:6.8.9.9-7ubuntu5.11, 7.0.6-1, 8:6.9.10.23+dfsg-2.1+deb10u1, 8:6.9.10.23+dfsg-2.1+deb10u5, 8:6.9.11.60+dfsg-1.3+deb11u1, 8:6.9.11.60+dfsg-1.6, and 8:6.9.12.98+dfsg1-2 are affected by CVE-2017-12140.
How do I fix CVE-2017-12140 on Ubuntu?
To fix CVE-2017-12140 on Ubuntu, update ImageMagick to version 8:6.9.7.4+dfsg-16ubuntu2.2, 8:6.9.7.4+dfsg-16ubuntu6.2, 8:6.7.7.10-6ubuntu3.11, or a later version.
How do I fix CVE-2017-12140 on Debian?
To fix CVE-2017-12140 on Debian, update ImageMagick to version 8:6.9.10.23+dfsg-2.1+deb10u1, 8:6.9.10.23+dfsg-2.1+deb10u5, 8:6.9.11.60+dfsg-1.3+deb11u1, 8:6.9.11.60+dfsg-1.6, or 8:6.9.12.98+dfsg1-2, or a later version.