CVE-2017-12428: High severity ImageMagick ImageMagick vulnerability

Published Aug 4, 2017

Updated

In ImageMagick 7.0.6-1, a memory leak vulnerability was found in the function ReadWMFImage in coders/wmf.c, which allows attackers to cause a denial of service in CloneDrawInfo in draw.c.

Affected Software

2 affected componentsFixes available

ImageMagick ImageMagick=7.0.6-1

debian/imagemagick

8:6.9.11.60+dfsg-1.6+deb12u118:6.9.11.60+dfsg-1.6+deb12u158:7.1.1.43+dfsg1-1+deb13u128:7.1.1.43+dfsg1-1+deb13u138:7.1.2.34+dfsg1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:6.9.11.60+dfsg-1.6+deb12u11Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15Fixed in 8:7.1.1.43+dfsg1-1+deb13u12Fixed in 8:7.1.1.43+dfsg1-1+deb13u13Fixed in 8:7.1.2.34+dfsg1-1

Event History

Aug 4, 2017

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Parent advisories

This vulnerability appears in the following advisories.

DSA-4019

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-1081-1

Frequently Asked Questions

What is the severity of CVE-2017-12428?

CVE-2017-12428 is classified as a medium severity vulnerability due to potential denial of service risks.

How do I fix CVE-2017-12428?

To mitigate CVE-2017-12428, upgrade ImageMagick to versions 6.9.10.23+dfsg-2.1+deb10u1 or later.

What type of vulnerability is CVE-2017-12428?

CVE-2017-12428 is a memory leak vulnerability found in the ReadWMFImage function.

Which versions of ImageMagick are affected by CVE-2017-12428?

ImageMagick version 7.0.6-1 and below are affected by CVE-2017-12428.

What impact does CVE-2017-12428 have on applications?

CVE-2017-12428 can lead to denial of service by causing memory leaks during image processing.