CVE-2017-12691: Medium severity ImageMagick vulnerability

Published Sep 1, 2017

Updated

Last updated 24 July 2024

Other sources

The ReadOneLayer function in coders/xcf.c in ImageMagick 7.0.6-6 allow ...

— Debian

Affected Software

10 affected componentsFixes available

ImageMagick=7.0.6-6

Ubuntu Linux=14.04

Ubuntu Linux=16.04

Ubuntu Linux=17.10

Ubuntu Linux=18.04

Ubuntu=14.04

Ubuntu=16.04

Ubuntu=17.10

Ubuntu=18.04

debian/imagemagick

8:6.9.11.60+dfsg-1.3+deb11u48:6.9.11.60+dfsg-1.3+deb11u58:6.9.11.60+dfsg-1.6+deb12u28:6.9.11.60+dfsg-1.6+deb12u18:7.1.1.43+dfsg1-18:7.1.1.47+dfsg1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:6.9.11.60+dfsg-1.3+deb11u4Fixed in 8:6.9.11.60+dfsg-1.3+deb11u5Fixed in 8:6.9.11.60+dfsg-1.6+deb12u2Fixed in 8:6.9.11.60+dfsg-1.6+deb12u1Fixed in 8:7.1.1.43+dfsg1-1Fixed in 8:7.1.1.47+dfsg1-1

Event History

Sep 1, 2017

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Event

09:29 PM

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2017-12691.

What is the severity of CVE-2017-12691?

The severity of CVE-2017-12691 is high.

How does CVE-2017-12691 impact ImageMagick?

CVE-2017-12691 allows remote attackers to cause a denial of service (memory consumption) in ImageMagick.

How can I fix CVE-2017-12691 in ImageMagick?

To fix CVE-2017-12691 in ImageMagick, apply the recommended fixes provided by Ubuntu or upgrade to the specified versions of ImageMagick.

Are there any references for CVE-2017-12691?

Yes, you can refer to the following links for more information on CVE-2017-12691: [Link 1](https://github.com/ImageMagick/ImageMagick/issues/656), [Link 2](https://security.gentoo.org/glsa/201711-07), [Link 3](https://usn.ubuntu.com/3681-1/).