CVE-2017-12671: Use After Free
In ImageMagick 7.0.6-3, a missing NULL assignment was found in coders/png.c, leading to an invalid free in the function RelinquishMagickMemory in MagickCore/memory.c, which allows attackers to cause a denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u11Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15Fixed in 8:7.1.1.43+dfsg1-1+deb13u12Fixed in 8:7.1.1.43+dfsg1-1+deb13u13Fixed in 8:7.1.2.34+dfsg1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2017-12671?
CVE-2017-12671 has a moderate severity level as it can lead to a denial of service.
How do I fix CVE-2017-12671?
To fix CVE-2017-12671, update ImageMagick to version 8:6.9.10.23+dfsg-2.1+deb10u1 or later.
Which versions of ImageMagick are affected by CVE-2017-12671?
ImageMagick version 7.0.6-3 is affected by CVE-2017-12671.
Can CVE-2017-12671 lead to remote code execution?
CVE-2017-12671 does not directly lead to remote code execution but can lead to a denial of service.
Is CVE-2017-12671 relevant for Debian users?
Yes, CVE-2017-12671 is relevant for Debian users, particularly those using vulnerable versions of ImageMagick.