CVE-2017-17501: High severity GraphicsMagick Graphicsmagick vulnerability
Last updated 25 August 2025
Other sources
WriteOnePNGImage in coders/png.c in GraphicsMagick 1.3.26 has a heap-based buffer over-read via a crafted file.
— Debian
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/graphicsmagickto a version that resolves this vulnerability.Fixed in 1.3.27-r0 - Upgrade
Upgrade
debian/graphicsmagickto a version that resolves this vulnerability.Fixed in 1.4+really1.3.40-4+deb12u1Fixed in 1.4+really1.3.45+hg17696-1Fixed in 1.4+really1.3.49-1
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2017-17501.
What is the severity of CVE-2017-17501?
The severity of CVE-2017-17501 is high with a CVSS score of 8.8.
Which software is affected by CVE-2017-17501?
GraphicsMagick versions 1.3.18-1ubuntu3.1+ to 1.3.26 are affected.
How can I fix CVE-2017-17501?
Upgrade to a version of GraphicsMagick that is not affected, such as versions 1.3.27-1 or later.
Where can I find more information about CVE-2017-17501?
You can find more information about CVE-2017-17501 at the following references: [1] http://hg.code.sf.net/p/graphicsmagick/code/rev/5b8414c0d0c4 [2] https://sourceforge.net/p/graphicsmagick/bugs/526/ [3] http://www.securityfocus.com/bid/102185