CVE-2017-14528: Use After Free
First published: Mon Sep 18 2017(Updated: )
Last updated 24 July 2024
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ImageMagick ImageMagick | =7.0.6 | |
| Debian Debian Linux | =9.0 | |
| debian/imagemagick | 8:6.9.11.60+dfsg-1.3+deb11u4 8:6.9.11.60+dfsg-1.3+deb11u3 8:6.9.11.60+dfsg-1.6+deb12u2 8:6.9.11.60+dfsg-1.6+deb12u1 8:7.1.1.39+dfsg1-3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://bugzilla.maptools.org/show_bug.cgi?id=2730
- http://www.securityfocus.com/bid/100875
- https://lists.debian.org/debian-lts-announce/2021/01/msg00010.html
- https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=32560
- https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=32560
- https://launchpad.net/bugs/cve/CVE-2017-14528
- https://github.com/ImageMagick/ImageMagick6/commit/6f7cba13ebae405b2689647a2277827f1c272364
- https://security-tracker.debian.org/tracker/CVE-2017-14528
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14528
- https://nvd.nist.gov/vuln/detail/CVE-2017-14528
- https://ubuntu.com/security/CVE-2017-14528
Frequently Asked Questions
What is CVE-2017-14528?
CVE-2017-14528 is a vulnerability in ImageMagick 7.0.6 that allows remote attackers to cause a denial of service through a use-after-free after an invalid call to TIFFSetField.
How does the TIFFSetProfiles function in coders/tiff.c in ImageMagick 7.0.6 contribute to the vulnerability?
The function has incorrect expectations about whether LibTIFF TIFFGetField return values imply that data validation has occurred, which can be exploited to cause the use-after-free vulnerability.
What is the severity of CVE-2017-14528?
The severity of CVE-2017-14528 is medium with a CVSS score of 6.5.
What can attackers do with CVE-2017-14528?
Attackers can exploit this vulnerability to cause a denial of service by using a crafted TIFF file.
How can I fix CVE-2017-14528?
To fix CVE-2017-14528, update ImageMagick to version 8:6.9.10.23+dfsg-2.1+deb10u1, 8:6.9.10.23+dfsg-2.1+deb10u5, 8:6.9.11.60+dfsg-1.3+deb11u1, or 8:6.9.11.60+dfsg-1.6.
- collector/nvd-index
- agent/author
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/severity
- agent/remedy
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/description
- agent/tags
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/trending
- vendor/imagemagick
- canonical/imagemagick imagemagick
- version/imagemagick imagemagick/7.0.6
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- package-manager/debian