CVE-2017-6502: Buffer Overflow
Published Mar 6, 2017
·Updated
An issue was discovered in ImageMagick 6.9.7. A specially crafted webp file could lead to a file-descriptor leak in libmagickcore (thus, a DoS).
Affected Software
2 affected componentsFixes available
debian/imagemagick
8:6.9.10.23+dfsg-2.1+deb10u18:6.9.10.23+dfsg-2.1+deb10u58:6.9.11.60+dfsg-1.3+deb11u18:6.9.11.60+dfsg-1.68:6.9.12.98+dfsg1-48:6.9.12.98+dfsg1-5
ImageMagick=6.9.7
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.10.23+dfsg-2.1+deb10u1Fixed in 8:6.9.10.23+dfsg-2.1+deb10u5Fixed in 8:6.9.11.60+dfsg-1.3+deb11u1Fixed in 8:6.9.11.60+dfsg-1.6Fixed in 8:6.9.12.98+dfsg1-4Fixed in 8:6.9.12.98+dfsg1-5
Event History
Mar 6, 2017
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Data Sourced
via NVD·02:59 AM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2017-6502?
CVE-2017-6502 is classified as a denial of service (DoS) vulnerability due to a file-descriptor leak in ImageMagick.
2
How do I fix CVE-2017-6502?
To fix CVE-2017-6502, upgrade ImageMagick to versions 6.9.10.23 or later as specified in the official patches.
3
What versions of ImageMagick are affected by CVE-2017-6502?
CVE-2017-6502 affects ImageMagick version 6.9.7.
4
What type of files can exploit CVE-2017-6502?
CVE-2017-6502 can be exploited using specially crafted webp files.
5
Is CVE-2017-6502 capable of causing system crashes?
Yes, CVE-2017-6502 can potentially lead to a denial of service, resulting in system instability.