CVE-2017-13140: Buffer Overflow
Published Jul 29, 2017
·Updated
In ImageMagick before 6.9.9-1 and 7.x before 7.0.6-2, the ReadOnePNGImage function in coders/png.c allows remote attackers to cause a denial of service (application hang in LockSemaphoreInfo) via a PNG file with a width equal to MAGICKWIDTHLIMIT.
Affected Software
60 affected componentsFixes available
debian/imagemagick
8:6.9.10.23+dfsg-2.1+deb10u18:6.9.10.23+dfsg-2.1+deb10u58:6.9.11.60+dfsg-1.3+deb11u18:6.9.11.60+dfsg-1.68:6.9.12.98+dfsg1-48:6.9.12.98+dfsg1-5
debian/imagemagick<=8:6.7.7.10-5+deb9u1, <=8:6.8.9.9-5+deb8u9, <=8:6.9.7.4+dfsg-13, <=8:6.7.7.10-5+deb7u14, <=8:6.8.9.9-5+deb8u8
ImageMagick<=6.9.9-0
ImageMagick=7.0.0-0
ImageMagick=7.0.1-0
ImageMagick=7.0.1-1
ImageMagick=7.0.1-2
ImageMagick=7.0.1-3
ImageMagick=7.0.1-4
ImageMagick=7.0.1-5
ImageMagick=7.0.1-6
ImageMagick=7.0.1-7
ImageMagick=7.0.1-8
ImageMagick=7.0.1-9
ImageMagick=7.0.1-10
ImageMagick=7.0.2-0
ImageMagick=7.0.2-1
ImageMagick=7.0.2-2
ImageMagick=7.0.2-3
ImageMagick=7.0.2-4
ImageMagick=7.0.2-5
ImageMagick=7.0.2-6
ImageMagick=7.0.2-7
ImageMagick=7.0.2-8
ImageMagick=7.0.2-9
ImageMagick=7.0.2-10
ImageMagick=7.0.3-0
ImageMagick=7.0.3-1
ImageMagick=7.0.3-2
ImageMagick=7.0.3-3
ImageMagick=7.0.3-4
ImageMagick=7.0.3-5
ImageMagick=7.0.3-6
ImageMagick=7.0.3-7
ImageMagick=7.0.3-8
ImageMagick=7.0.3-9
ImageMagick=7.0.3-10
ImageMagick=7.0.4-0
ImageMagick=7.0.4-1
ImageMagick=7.0.4-2
ImageMagick=7.0.4-3
ImageMagick=7.0.4-4
ImageMagick=7.0.4-5
ImageMagick=7.0.4-6
ImageMagick=7.0.4-7
ImageMagick=7.0.4-8
ImageMagick=7.0.4-9
ImageMagick=7.0.4-10
ImageMagick=7.0.5-0
ImageMagick=7.0.5-1
ImageMagick=7.0.5-2
ImageMagick=7.0.5-3
ImageMagick=7.0.5-4
ImageMagick=7.0.5-5
ImageMagick=7.0.5-6
ImageMagick=7.0.5-7
ImageMagick=7.0.5-8
ImageMagick=7.0.5-10
ImageMagick=7.0.6-0
ImageMagick=7.0.6-1
Remediation
Patch Available
Patch Available
Event History
Aug 23, 2017
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-13140?
The severity of CVE-2017-13140 is classified as medium, affecting the application availability.
2
How do I fix CVE-2017-13140?
To fix CVE-2017-13140, upgrade to ImageMagick versions 6.9.10.23 or 7.0.6-2 and above.
3
What is the impact of CVE-2017-13140?
CVE-2017-13140 allows remote attackers to cause a denial of service through specially crafted PNG files.
4
Which versions of ImageMagick are affected by CVE-2017-13140?
ImageMagick versions before 6.9.9-1 and 7.x before 7.0.6-2 are affected by CVE-2017-13140.
5
Are there any workarounds for CVE-2017-13140?
A workaround for CVE-2017-13140 includes avoiding the processing of untrusted PNG files until the software is updated.