CVE-2017-5508: Buffer Overflow
Heap-based buffer overflow in the PushQuantumPixel function in ImageMagick before 6.9.7-3 and 7.x before 7.0.4-3 allows remote attackers to cause a denial of service (application crash) via a crafted TIFF file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.7.4+dfsg-1Fixed in 8:6.8.9.9-5+deb8u7 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.3+deb11u4Fixed in 8:6.9.11.60+dfsg-1.3+deb11u3Fixed in 8:6.9.11.60+dfsg-1.6+deb12u2Fixed in 8:6.9.11.60+dfsg-1.6+deb12u1Fixed in 8:6.9.13.12+dfsg1-1Fixed in 8:7.1.1.39+dfsg1-2
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5508?
CVE-2017-5508 has a severity rating that allows remote attackers to potentially crash the application through a crafted TIFF file.
How do I fix CVE-2017-5508?
To mitigate CVE-2017-5508, upgrade to ImageMagick versions 6.9.7-3 or 7.0.4-3 or later.
Which versions of ImageMagick are affected by CVE-2017-5508?
CVE-2017-5508 affects ImageMagick versions prior to 6.9.7-3 and 7.x versions before 7.0.4-3.
What type of vulnerability is CVE-2017-5508?
CVE-2017-5508 is classified as a heap-based buffer overflow vulnerability.
What impact does CVE-2017-5508 have on systems?
The impact of CVE-2017-5508 can lead to denial of service, causing the application to crash.