CVE-2017-15277: Infoleak
Last updated 25 August 2025
Other sources
ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when processing a GIF file that has neither a global nor local palette. If the affected product is used as a library loaded into a process that operates on interesting data, this data sometimes can be leaked via the uninitialized palette.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/graphicsmagickto a version that resolves this vulnerability.Fixed in 1.3.27-r0 - Upgrade
Upgrade
debian/graphicsmagickto a version that resolves this vulnerability.Fixed in 1.4+really1.3.40-4+deb12u1Fixed in 1.4+really1.3.45+hg17696-1Fixed in 1.4+really1.3.49-1 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u11Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15Fixed in 8:7.1.1.43+dfsg1-1+deb13u12Fixed in 8:7.1.1.43+dfsg1-1+deb13u14Fixed in 8:7.1.2.34+dfsg1-1Fixed in 8:7.1.2.35+dfsg1-1
Event History
Frequently Asked Questions
What is CVE-2017-15277?
CVE-2017-15277 is a vulnerability in ImageMagick and GraphicsMagick that leaves the palette uninitialized when processing a GIF file without a global or local palette.
What is the severity of CVE-2017-15277?
CVE-2017-15277 has a severity rating of medium with a CVSS score of 6.5.
How does CVE-2017-15277 affect ImageMagick?
CVE-2017-15277 affects ImageMagick versions 7.0.6-1 and later.
How does CVE-2017-15277 affect GraphicsMagick?
CVE-2017-15277 affects GraphicsMagick versions 1.3.26 and later.
Is there a fix for CVE-2017-15277?
Yes, there are patches available for both ImageMagick and GraphicsMagick to address CVE-2017-15277.