CVE-2017-12434: Medium severity ImageMagick ImageMagick vulnerability

Published Aug 4, 2017

Updated

In ImageMagick 7.0.6-1, a missing NULL check vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service (assertion failure) in DestroyImageInfo in image.c.

Affected Software

2 affected componentsFixes available

ImageMagick ImageMagick=7.0.6-1

debian/imagemagick

8:6.9.11.60+dfsg-1.6+deb12u118:6.9.11.60+dfsg-1.6+deb12u158:7.1.1.43+dfsg1-1+deb13u128:7.1.1.43+dfsg1-1+deb13u138:7.1.2.34+dfsg1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:6.9.11.60+dfsg-1.6+deb12u11Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15Fixed in 8:7.1.1.43+dfsg1-1+deb13u12Fixed in 8:7.1.1.43+dfsg1-1+deb13u13Fixed in 8:7.1.2.34+dfsg1-1

Event History

Aug 4, 2017

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Parent advisories

This vulnerability appears in the following advisories.

DSA-4019

Frequently Asked Questions

What is the severity of CVE-2017-12434?

CVE-2017-12434 has been classified as a denial of service vulnerability that can cause an assertion failure.

How do I fix CVE-2017-12434?

To mitigate CVE-2017-12434, update your ImageMagick installation to a version higher than 7.0.6-1.

What causes the CVE-2017-12434 vulnerability?

CVE-2017-12434 is caused by a missing NULL check in the ReadMATImage function within ImageMagick's MAT image decoder.

Which versions of ImageMagick are affected by CVE-2017-12434?

Versions older than 7.0.6-1 of ImageMagick are vulnerable to CVE-2017-12434.

Can CVE-2017-12434 be exploited remotely?

Yes, CVE-2017-12434 can potentially be exploited remotely, leading to a denial of service condition.