CVE-2017-17912: High severity GraphicsMagick Graphicsmagick vulnerability
In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadNewsProfile in coders/tiff.c, in which LocaleNCompare reads heap data beyond the allocated region.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2017-17912?
CVE-2017-17912 is a vulnerability in GraphicsMagick 1.4 snapshot-20171217 Q8 which allows a heap-based buffer over-read in ReadNewsProfile in coders/tiff.c.
How severe is CVE-2017-17912?
CVE-2017-17912 has a severity score of 8.8 (high).
Which software versions are affected by CVE-2017-17912?
GraphicsMagick versions 1.3.27, 1.3.23-1ubuntu0.6, and 1.3.18-1ubuntu3.1+; Graphicsmagick (canonical) version 1.3.27; Debian Linux versions 7.0, 8.0, and 9.0; and GraphicsMagick versions 1.4+really1.3.35-1~deb10u2, 1.4+really1.3.35-1~deb10u3, 1.4+really1.3.36+hg16481-2+deb11u1, 1.4+really1.3.40-4, and 1.4+really1.3.42-1 are affected by CVE-2017-17912.
How can I fix CVE-2017-17912?
To fix CVE-2017-17912, update the affected software to one of the recommended versions: 1.3.27-3, 1.3.23-1ubuntu0.6, 1.3.18-1ubuntu3.1+, 1.4+really1.3.35-1~deb10u2, 1.4+really1.3.35-1~deb10u3, 1.4+really1.3.36+hg16481-2+deb11u1, 1.4+really1.3.40-4, or 1.4+really1.3.42-1.
Where can I find more information about CVE-2017-17912?
More information about CVE-2017-17912 can be found at the following references: [MITRE CVE-2017-17912](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17912), [GraphicsMagick Commit](http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/0d871e813a4f), [GraphicsMagick Bug Report](https://sourceforge.net/p/graphicsmagick/bugs/533/).