CVE-2017-13145: Input Validation
In ImageMagick before 6.9.8-8 and 7.x before 7.0.5-9, the ReadJP2Image function in coders/jp2.c does not properly validate the channel geometry, leading to a crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.3+deb11u4Fixed in 8:6.9.11.60+dfsg-1.3+deb11u3Fixed in 8:6.9.11.60+dfsg-1.6+deb12u2Fixed in 8:6.9.11.60+dfsg-1.6+deb12u1Fixed in 8:7.1.1.43+dfsg1-1Fixed in 8:7.1.1.47+dfsg1-1 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 6.9.8-8 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 7.0.5-9
Event History
Frequently Asked Questions
What is the severity of CVE-2017-13145?
CVE-2017-13145 has a severity that can lead to application crashes due to improper validation in the ReadJP2Image function.
How do I fix CVE-2017-13145?
To fix CVE-2017-13145, update ImageMagick to version 6.9.8-8 or later, or 7.0.5-9 or later.
Which versions of ImageMagick are affected by CVE-2017-13145?
CVE-2017-13145 affects ImageMagick versions before 6.9.8-8 and 7.x before 7.0.5-9.
Can CVE-2017-13145 lead to data loss?
CVE-2017-13145 primarily causes crashes and may lead to data loss in the context of executing improper input processing.
What should I monitor for after addressing CVE-2017-13145?
After addressing CVE-2017-13145, monitor for any abnormal application crashes or behavior related to image processing tasks.