CVE-2017-17884: Medium severity ImageMagick vulnerability

Published Dec 24, 2017

Updated

In ImageMagick 7.0.7-16 Q16, a memory leak vulnerability was found in ...

Affected Software

10 affected componentsFixes available

ImageMagick=7.0.7-16

Ubuntu Linux=14.04

Ubuntu Linux=16.04

Ubuntu Linux=17.10

Ubuntu Linux=18.04

Ubuntu=14.04

Ubuntu=16.04

Ubuntu=17.10

Ubuntu=18.04

debian/imagemagick

8:6.9.11.60+dfsg-1.3+deb11u48:6.9.11.60+dfsg-1.3+deb11u58:6.9.11.60+dfsg-1.6+deb12u28:6.9.11.60+dfsg-1.6+deb12u18:7.1.1.43+dfsg1-18:7.1.1.47+dfsg1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:6.9.11.60+dfsg-1.3+deb11u4Fixed in 8:6.9.11.60+dfsg-1.3+deb11u5Fixed in 8:6.9.11.60+dfsg-1.6+deb12u2Fixed in 8:6.9.11.60+dfsg-1.6+deb12u1Fixed in 8:7.1.1.43+dfsg1-1Fixed in 8:7.1.1.47+dfsg1-1

Event History

Dec 24, 2017

CVE Published

via MITRE·04:00 AM

Data Sourced

via MITRE·04:00 AM

Description

Frequently Asked Questions

What is the vulnerability ID of this ImageMagick vulnerability?

The vulnerability ID is CVE-2017-17884.

What is the severity level of CVE-2017-17884?

The severity level of CVE-2017-17884 is medium, with a severity value of 6.5.

How does the vulnerability in ImageMagick 7.0.7-16 Q16 affect the software?

The vulnerability in ImageMagick 7.0.7-16 Q16 allows attackers to cause a denial of service via a crafted PNG image file.

Which versions of Ubuntu are affected by this ImageMagick vulnerability?

The versions of Ubuntu affected by this ImageMagick vulnerability are Trusty (14.04), Artful (17.10), and Bionic (18.04).

How can I fix CVE-2017-17884 in ImageMagick?

To fix CVE-2017-17884 in ImageMagick, you should update to version 8:6.7.7.10-6ubuntu3.11 (for Trusty), 8:6.9.7.4+dfsg-16ubuntu2.2 (for Artful), or 8:6.9.7.4+dfsg-16ubuntu6.2 (for Bionic).