CVE-2017-12935: High severity imagemagick vulnerability
Last updated 24 July 2024
Other sources
The ReadMNGImage function in coders/png.c in GraphicsMagick 1.3.26 mishandles large MNG images, leading to an invalid memory read in the SetImageColorCallBack function in magick/image.c.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2017-12935?
CVE-2017-12935 is a vulnerability in GraphicsMagick 1.3.26 that mishandles large MNG images, leading to an invalid memory read.
What is the severity of CVE-2017-12935?
The severity of CVE-2017-12935 is high, with a CVSS score of 8.8.
How does CVE-2017-12935 affect the affected software?
CVE-2017-12935 affects GraphicsMagick 1.3.26 and may also affect other versions specified in the affected software section.
How can I fix CVE-2017-12935 in GraphicsMagick?
To fix CVE-2017-12935 in GraphicsMagick, you should update to version 1.4+really1.3.35-1~deb10u2 or higher, 1.4+really1.3.35-1~deb10u3 or higher, 1.4+really1.3.36+hg16481-2+deb11u1 or higher, 1.4+really1.3.40-4 or higher, or 1.4+really1.3.42-1 or higher, depending on your system.
Are there any additional resources about CVE-2017-12935?
Yes, you can find more information about CVE-2017-12935 at the following references: [1] http://hg.code.sf.net/p/graphicsmagick/code/rev/cd699a44f188 [2] https://blogs.gentoo.org/ago/2017/08/05/graphicsmagick-invalid-memory-read-in-setimagecolorcallback-image-c/ [3] https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html