CVE-2017-9500: Medium severity ImageMagick ImageMagick vulnerability
Published Jun 7, 2017
·Updated
In ImageMagick 7.0.5-8 Q16, an assertion failure was found in the function ResetImageProfileIterator, which allows attackers to cause a denial of service via a crafted file.
Affected Software
2 affected componentsFixes available
ImageMagick ImageMagick=7.0.5-8
debian/imagemagick
8:6.9.11.60+dfsg-1.6+deb12u118:6.9.11.60+dfsg-1.6+deb12u158:7.1.1.43+dfsg1-1+deb13u128:7.1.1.43+dfsg1-1+deb13u138:7.1.2.34+dfsg1-1
Remediation
Patch Available
Event History
Jun 7, 2017
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-9500?
CVE-2017-9500 is classified as a denial of service vulnerability due to an assertion failure in ImageMagick.
2
How do I fix CVE-2017-9500?
To fix CVE-2017-9500, you should upgrade ImageMagick to a patched version, specifically any version after 7.0.5-8.
3
Which versions of ImageMagick are affected by CVE-2017-9500?
Affected versions of ImageMagick by CVE-2017-9500 include 7.0.5-8 and earlier versions.
4
What can be the impact of CVE-2017-9500?
The impact of CVE-2017-9500 is a denial of service condition, which can disrupt the availability of the application.
5
Is CVE-2017-9500 exploitable in all environments?
CVE-2017-9500 is exploitable when an attacker supplies a specially crafted image file to the ImageMagick service.