CVE-2017-14682: Buffer Overflow

Published Sep 21, 2017

Updated

GetNextToken in MagickCore/token.c in ImageMagick 7.0.6 allows remote ...

Affected Software

2 affected componentsFixes available

ImageMagick ImageMagick=7.0.6

debian/imagemagick

8:6.9.11.60+dfsg-1.6+deb12u118:6.9.11.60+dfsg-1.6+deb12u158:7.1.1.43+dfsg1-1+deb13u128:7.1.1.43+dfsg1-1+deb13u138:7.1.2.34+dfsg1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:6.9.11.60+dfsg-1.6+deb12u11Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15Fixed in 8:7.1.1.43+dfsg1-1+deb13u12Fixed in 8:7.1.1.43+dfsg1-1+deb13u13Fixed in 8:7.1.2.34+dfsg1-1

Event History

Sep 21, 2017

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Sep 22, 2017

Data Sourced

06:24 PM

SeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-1131-1

Frequently Asked Questions

What is CVE-2017-14682?

CVE-2017-14682 is a vulnerability in ImageMagick 7.0.6 that allows remote attackers to cause a denial of service or have unspecified other impact via a crafted SVG document.

What is the severity of CVE-2017-14682?

The severity of CVE-2017-14682 is high with a CVSS score of 8.8.

How does CVE-2017-14682 affect ImageMagick?

CVE-2017-14682 affects ImageMagick version 7.0.6.

How can I fix CVE-2017-14682?

To fix CVE-2017-14682, upgrade to a version of ImageMagick that is not affected by the vulnerability.

Where can I find more information about CVE-2017-14682?

More information about CVE-2017-14682 can be found at the following references: <a href='https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=32726'>https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=32726</a>, <a href='https://security-tracker.debian.org/tracker/CVE-2017-14682'>https://security-tracker.debian.org/tracker/CVE-2017-14682</a>