CVE-2017-6335: Medium severity GraphicsMagick Graphicsmagick vulnerability
ImageMagick and GraphicsMagick encounter a read beyond an allocated heap buffer when reading CMYKA TIFF files which claim to offer fewer samples per pixel than required. A maliciously crafted file could cause the application to crash.
References:
http://seclists.org/oss-sec/2017/q1/494
Upstream patch:
https://sourceforge.net/p/graphicsmagick/code/ci/6156b4c2992d855ece6079653b3b93c3229fc4b8/
Other sources
The QuantumTransferMode function in coders/tiff.c in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a small samples per pixel value in a CMYKA TIFF file.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/graphicsmagickto a version that resolves this vulnerability.Fixed in 1.4+really1.3.36+hg16481-2+deb11u1Fixed in 1.4+really1.3.40-4+deb12u1Fixed in 1.4+really1.3.45+hg17696-1Fixed in 1.4+really1.3.46-2 - Upgrade
Upgrade
GraphicsMagickto a version that resolves this vulnerability.Fixed in 1.3.25 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 6156b4c2992d855ece6079653b3b93c3229fc4b8
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6335?
CVE-2017-6335 has a moderate severity rating due to the potential for application crashes from crafted CMYKA TIFF files.
How do I fix CVE-2017-6335?
To fix CVE-2017-6335, you should upgrade to a version of GraphicsMagick that is not affected, ideally one that is 1.3.26 or later.
Which versions of GraphicsMagick are affected by CVE-2017-6335?
Versions of GraphicsMagick prior to 1.3.26 are affected by CVE-2017-6335.
What is the nature of the vulnerability in CVE-2017-6335?
CVE-2017-6335 is a read beyond an allocated heap buffer, leading to potential crashes when processing malformed CMYKA TIFF files.
Is ImageMagick also affected by CVE-2017-6335?
Yes, both ImageMagick and GraphicsMagick are impacted by CVE-2017-6335 in similar ways regarding the processing of CMYKA TIFF files.