CVE-2017-14172: High severity imagemagick vulnerability
In coders/ps.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSImage() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file, which claims a large "extent" field in the header but does not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no EOF check inside the loop.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2017-14172?
CVE-2017-14172 is a vulnerability in ImageMagick version 7.0.7-0 Q16 that allows for a denial-of-service (DoS) attack due to a lack of an EOF check.
How severe is the CVE-2017-14172 vulnerability?
The severity of CVE-2017-14172 is high with a severity value of 6.5.
How can I fix the CVE-2017-14172 vulnerability?
To fix the CVE-2017-14172 vulnerability, update ImageMagick to version 8:6.9.7.4+dfsg-16ubuntu2.2 (for Ubuntu), 8:6.9.7.4+dfsg-16ubuntu6.2 (for Ubuntu), 8:6.7.7.10-6ubuntu3.11 (for Ubuntu), 8:6.9.9.34+dfsg-3 (for Ubuntu), 8:6.8.9.9-7ubuntu5.11 (for Ubuntu), 7.0.7-0 (for ImageMagick), or apply the appropriate remedy for your specific system or distribution.
What is the Common Weakness Enumeration (CWE) of CVE-2017-14172?
The CWE of CVE-2017-14172 is CWE-834.
Where can I find more information about CVE-2017-14172?
More information about CVE-2017-14172 can be found at the following references: [GitHub commit](https://github.com/ImageMagick/ImageMagick/commit/bdbbb13f1fe9b7e2465502c500561720f7456aac), [GitHub issue](https://github.com/ImageMagick/ImageMagick/issues/715), [Debian LTS Announcement](https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html).