CVE-2017-11636
CriticalSummary
GraphicsMagick version 1.3.26 has a heap overflow in the WriteRGBImage() function in coders/rgb.c when processing multiple frames with non-identical widths.
Risk Assessment
Heap overflow may lead to arbitrary code execution, posing a significant security risk to the image processing system.
Recommendation
It is recommended to update GraphicsMagick to the latest version to mitigate this vulnerability.
Other vulnerabilities in GraphicsMagick 1.3.26
See all- CVE-2017-17912High
In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadNewsProfile in coders/tiff.c, in which LocaleNCompare reads heap data beyond the allocated region.
- CVE-2017-17783High
In GraphicsMagick 1.3.27a, there is a buffer over-read in ReadPALMImage in coders/palm.c when QuantumDepth is 8.
- CVE-2017-17782High
In GraphicsMagick 1.3.27a, there is a heap-based buffer over-read in ReadOneJNGImage in coders/png.c, related to oFFs chunk allocation.
- CVE-2017-17503High
GraphicsMagick 1.3.26 has a vulnerability in the ReadGRAYImage function in coders/gray.c that allows for a heap-based buffer over-read via a crafted file.
- CVE-2017-17502High
GraphicsMagick 1.3.26 has a vulnerability in the ReadCMYKImage function in coders/cmyk.c that allows for a heap-based buffer over-read via a crafted file.
- CVE-2017-17501High
GraphicsMagick 1.3.26 has a heap-based buffer over-read vulnerability in the WriteOnePNGImage function in coders/png.c, which can be exploited via a crafted file.
- CVE-2017-17500High
GraphicsMagick 1.3.26 has a vulnerability in the ReadRGBImage function in coders/rgb.c that allows for a heap-based buffer over-read via a crafted file.
- CVE-2017-17498High
The WritePNMImage function in coders/pnm.c in GraphicsMagick 1.3.26 has a vulnerability that allows remote attackers to cause a denial of service through a heap-based buffer overflow, leading to application crashes.
- CVE-2017-16669High
GraphicsMagick 1.3.26 has a vulnerability that allows remote attackers to cause a denial of service through a heap-based buffer overflow in coders/wpg.c, leading to application crash. This issue is related to the AcquireCacheNexus function in magick/pixel_cache.c.
- CVE-2017-16547High
The DrawImage function in GraphicsMagick 1.3.26 does not properly handle pop keywords associated with push keywords, potentially leading to application crashes or denial of service.
Original NVD description (English source)
GraphicsMagick 1.3.26 has a heap overflow in the WriteRGBImage() function in coders/rgb.c when processing multiple frames that have non-identical widths.