CVE-2017-16546: Buffer Overflow

Published Nov 5, 2017

Updated

Last updated 24 July 2024

Other sources

The ReadWPGImage function in coders/wpg.c in ImageMagick 7.0.7-9 does ...

— Debian

Affected Software

8 affected componentsFixes available

ImageMagick ImageMagick=7.0.7-9

Canonical Ubuntu Linux=14.04

Canonical Ubuntu Linux=16.04

Canonical Ubuntu Linux=17.10

Canonical Ubuntu Linux=18.04

Debian Debian Linux=8.0

Debian Debian Linux=9.0

debian/imagemagick

8:6.9.11.60+dfsg-1.6+deb12u118:6.9.11.60+dfsg-1.6+deb12u158:7.1.1.43+dfsg1-1+deb13u128:7.1.1.43+dfsg1-1+deb13u138:7.1.2.34+dfsg1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:6.9.11.60+dfsg-1.6+deb12u11Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15Fixed in 8:7.1.1.43+dfsg1-1+deb13u12Fixed in 8:7.1.1.43+dfsg1-1+deb13u13Fixed in 8:7.1.2.34+dfsg1-1

Event History

Nov 5, 2017

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2017-16546.

What is the severity of CVE-2017-16546?

The severity of CVE-2017-16546 is rated as high with a score of 8.8.

What software is affected by CVE-2017-16546?

The affected software includes ImageMagick versions 7.0.7-9 and Ubuntu packages imagemagick, as well as Canonical Ubuntu Linux and Debian Debian Linux versions specified in the references.

How does CVE-2017-16546 impact systems?

CVE-2017-16546 can result in a denial of service (use of uninitialized data or invalid memory allocation) or other unspecified impacts.

How can I fix the CVE-2017-16546 vulnerability?

To fix the CVE-2017-16546 vulnerability, you should update ImageMagick to version 8:6.9.7.4+dfsg-16ubuntu2.2 or later, as specified in the references.