CVE-2017-12431: Use After Free

Published Aug 4, 2017

Updated

In ImageMagick 7.0.6-1, a use-after-free vulnerability was found in th ...

Affected Software

2 affected componentsFixes available

ImageMagick ImageMagick=7.0.6-1

debian/imagemagick

8:6.9.11.60+dfsg-1.6+deb12u118:6.9.11.60+dfsg-1.6+deb12u158:7.1.1.43+dfsg1-1+deb13u128:7.1.1.43+dfsg1-1+deb13u138:7.1.2.34+dfsg1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:6.9.11.60+dfsg-1.3+deb11u4Fixed in 8:6.9.11.60+dfsg-1.3+deb11u5Fixed in 8:6.9.11.60+dfsg-1.6+deb12u2Fixed in 8:6.9.11.60+dfsg-1.6+deb12u1Fixed in 8:7.1.1.43+dfsg1-1Fixed in 8:7.1.1.47+dfsg1-1

Event History

Aug 4, 2017

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-1081-1

Frequently Asked Questions

What is CVE-2017-12431?

CVE-2017-12431 is a use-after-free vulnerability in ImageMagick 7.0.6-1 that allows attackers to cause a denial of service.

Which software versions are affected by CVE-2017-12431?

The affected software versions include ImageMagick 7.0.6-1, 6.7.7.10-6ubuntu3.11, 6.9.7.4+dfsg-13, and 6.8.9.9-7ubuntu5.11.

What is the severity of CVE-2017-12431?

The severity of CVE-2017-12431 is medium with a CVSS score of 6.5.

How can I fix CVE-2017-12431?

To fix CVE-2017-12431, you should update to ImageMagick versions 8:6.7.7.10-6ubuntu3.11, 8:6.9.7.4+dfsg-13, or 8:6.8.9.9-7ubuntu5.11, depending on the affected software version.

Where can I find more information about CVE-2017-12431?

You can find more information about CVE-2017-12431 at the following references: [Reference 1](https://github.com/ImageMagick/ImageMagick/issues/555), [Reference 2](https://www.debian.org/security/2017/dsa-4019), [Reference 3](https://www.debian.org/security/2017/dsa-4040).