CVE-2016-7997
HighSummary
The WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (assertion failure and crash) via vectors related to a ReferenceBlob and a NULL pointer.
Risk Assessment
An attacker can exploit this vulnerability to disrupt application functionality, potentially leading to service downtime.
Recommendation
It is recommended to update GraphicsMagick to the latest version to mitigate this vulnerability.
Other vulnerabilities in GraphicsMagick
See all- CVE-2017-17912High
In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadNewsProfile in coders/tiff.c, in which LocaleNCompare reads heap data beyond the allocated region.
- CVE-2017-17783High
In GraphicsMagick 1.3.27a, there is a buffer over-read in ReadPALMImage in coders/palm.c when QuantumDepth is 8.
- CVE-2017-17782High
In GraphicsMagick 1.3.27a, there is a heap-based buffer over-read in ReadOneJNGImage in coders/png.c, related to oFFs chunk allocation.
- CVE-2017-17503High
GraphicsMagick 1.3.26 has a vulnerability in the ReadGRAYImage function in coders/gray.c that allows for a heap-based buffer over-read via a crafted file.
- CVE-2017-17502High
GraphicsMagick 1.3.26 has a vulnerability in the ReadCMYKImage function in coders/cmyk.c that allows for a heap-based buffer over-read via a crafted file.
- CVE-2017-17501High
GraphicsMagick 1.3.26 has a heap-based buffer over-read vulnerability in the WriteOnePNGImage function in coders/png.c, which can be exploited via a crafted file.
- CVE-2017-17500High
GraphicsMagick 1.3.26 has a vulnerability in the ReadRGBImage function in coders/rgb.c that allows for a heap-based buffer over-read via a crafted file.
- CVE-2017-17498High
The WritePNMImage function in coders/pnm.c in GraphicsMagick 1.3.26 has a vulnerability that allows remote attackers to cause a denial of service through a heap-based buffer overflow, leading to application crashes.
- CVE-2017-16669High
GraphicsMagick 1.3.26 has a vulnerability that allows remote attackers to cause a denial of service through a heap-based buffer overflow in coders/wpg.c, leading to application crash. This issue is related to the AcquireCacheNexus function in magick/pixel_cache.c.
- CVE-2017-16547High
The DrawImage function in GraphicsMagick 1.3.26 does not properly handle pop keywords associated with push keywords, potentially leading to application crashes or denial of service.
Original NVD description (English source)
The WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (assertion failure and crash) via vectors related to a ReferenceBlob and a NULL pointer.