CVE-2017-18252: Medium severity IBM Data Risk Manager vulnerability
An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via a crafted file.
Other sources
ImageMagick is vulnerable to a denial of service, caused by an error in the MogrifyImageList function in MagickWand/mogrify.c. By persuading a victim to open a specially-crafted file, a remote attacker could exploit this vulnerability to cause an assertion failure.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.3+deb11u4Fixed in 8:6.9.11.60+dfsg-1.3+deb11u5Fixed in 8:6.9.11.60+dfsg-1.6+deb12u2Fixed in 8:6.9.11.60+dfsg-1.6+deb12u1Fixed in 8:7.1.1.43+dfsg1-1Fixed in 8:7.1.1.47+dfsg1-1 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Patch 12f34b60564de1cbec08e23e2413dab5b64daeb7 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Patch bb04ccb34fd45e9c3020786857fb79b09f44d7db
Event History
Frequently Asked Questions
What is CVE-2017-18252?
CVE-2017-18252 is a vulnerability in ImageMagick 7.0.7 that allows a remote attacker to cause a denial of service.
What is the severity of CVE-2017-18252?
The severity of CVE-2017-18252 is medium with a CVSS score of 6.5.
How does CVE-2017-18252 impact ImageMagick?
CVE-2017-18252 affects the MogrifyImageList function in MagickWand/mogrify.c and can lead to an assertion failure.
How can I fix CVE-2017-18252 in IBM Data Risk Manager 2.0.6?
To fix CVE-2017-18252 in IBM Data Risk Manager 2.0.6, apply the latest patch available from IBM.
How can I fix CVE-2017-18252 in Ubuntu ImageMagick 6.9.9.34?
To fix CVE-2017-18252 in Ubuntu ImageMagick 6.9.9.34, update to version 8:6.9.9.34+dfsg-3 or higher.