CVE-2017-14138: Critical severity imagemagick vulnerability
Published Sep 4, 2017
·Updated
ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in certain error cases, as demonstrated by VP8 errors.
Affected Software
2 affected componentsFixes available
debian/imagemagick
8:6.9.10.23+dfsg-2.1+deb10u18:6.9.10.23+dfsg-2.1+deb10u58:6.9.11.60+dfsg-1.3+deb11u18:6.9.11.60+dfsg-1.68:6.9.12.98+dfsg1-48:6.9.12.98+dfsg1-5
ImageMagick=7.0.6-5
Remediation
Patch Available
Event History
Sep 4, 2017
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-14138?
CVE-2017-14138 is considered a moderate severity vulnerability due to its impact on memory management.
2
How do I fix CVE-2017-14138?
To fix CVE-2017-14138, update to a patched version of ImageMagick that is higher than 7.0.6-5.
3
What is the nature of the vulnerability described in CVE-2017-14138?
CVE-2017-14138 is a memory leak vulnerability caused by failure to free memory in ReadWEBPImage during VP8 error handling.
4
Which versions of ImageMagick are affected by CVE-2017-14138?
CVE-2017-14138 specifically affects ImageMagick version 7.0.6-5.
5
Are there any known exploits for CVE-2017-14138?
As of now, there are no publicly known exploits specifically targeting CVE-2017-14138.