CVE-2017-12935: High severity GraphicsMagick Graphicsmagick vulnerability
Last updated 24 July 2024
Other sources
The ReadMNGImage function in coders/png.c in GraphicsMagick 1.3.26 mishandles large MNG images, leading to an invalid memory read in the SetImageColorCallBack function in magick/image.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/graphicsmagickto a version that resolves this vulnerability.Fixed in 1.3.26-r2 - Upgrade
Upgrade
debian/graphicsmagickto a version that resolves this vulnerability.Fixed in 1.4+really1.3.40-4+deb12u1Fixed in 1.4+really1.3.45+hg17696-1Fixed in 1.4+really1.3.49-1
Event History
Frequently Asked Questions
What is CVE-2017-12935?
CVE-2017-12935 is a vulnerability in GraphicsMagick 1.3.26 that mishandles large MNG images, leading to an invalid memory read.
What is the severity of CVE-2017-12935?
The severity of CVE-2017-12935 is high, with a CVSS score of 8.8.
How does CVE-2017-12935 affect the affected software?
CVE-2017-12935 affects GraphicsMagick 1.3.26 and may also affect other versions specified in the affected software section.
How can I fix CVE-2017-12935 in GraphicsMagick?
To fix CVE-2017-12935 in GraphicsMagick, you should update to version 1.4+really1.3.35-1~deb10u2 or higher, 1.4+really1.3.35-1~deb10u3 or higher, 1.4+really1.3.36+hg16481-2+deb11u1 or higher, 1.4+really1.3.40-4 or higher, or 1.4+really1.3.42-1 or higher, depending on your system.
Are there any additional resources about CVE-2017-12935?
Yes, you can find more information about CVE-2017-12935 at the following references: [1] http://hg.code.sf.net/p/graphicsmagick/code/rev/cd699a44f188 [2] https://blogs.gentoo.org/ago/2017/08/05/graphicsmagick-invalid-memory-read-in-setimagecolorcallback-image-c/ [3] https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html