CVE-2017-13140: Buffer Overflow
In ImageMagick before 6.9.9-1 and 7.x before 7.0.6-2, the ReadOnePNGImage function in coders/png.c allows remote attackers to cause a denial of service (application hang in LockSemaphoreInfo) via a PNG file with a width equal to MAGICKWIDTHLIMIT.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u11Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15Fixed in 8:7.1.1.43+dfsg1-1+deb13u12Fixed in 8:7.1.1.43+dfsg1-1+deb13u13Fixed in 8:7.1.2.34+dfsg1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2017-13140?
The severity of CVE-2017-13140 is classified as medium, affecting the application availability.
How do I fix CVE-2017-13140?
To fix CVE-2017-13140, upgrade to ImageMagick versions 6.9.10.23 or 7.0.6-2 and above.
What is the impact of CVE-2017-13140?
CVE-2017-13140 allows remote attackers to cause a denial of service through specially crafted PNG files.
Which versions of ImageMagick are affected by CVE-2017-13140?
ImageMagick versions before 6.9.9-1 and 7.x before 7.0.6-2 are affected by CVE-2017-13140.
Are there any workarounds for CVE-2017-13140?
A workaround for CVE-2017-13140 includes avoiding the processing of untrusted PNG files until the software is updated.