CVE-2017-11643
CriticalSummary
GraphicsMagick 1.3.26 has a heap overflow in the WriteCMYKImage() function in coders/cmyk.c when processing multiple frames that have non-identical widths.
Risk Assessment
Heap overflow may lead to the execution of malicious code, posing a serious security threat to the system.
Recommendation
It is recommended to upgrade to the latest version of GraphicsMagick to mitigate this vulnerability.
Other vulnerabilities in GraphicsMagick 1.3.26
See all- CVE-2017-17912High
In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadNewsProfile in coders/tiff.c, in which LocaleNCompare reads heap data beyond the allocated region.
- CVE-2017-17783High
In GraphicsMagick 1.3.27a, there is a buffer over-read in ReadPALMImage in coders/palm.c when QuantumDepth is 8.
- CVE-2017-17782High
In GraphicsMagick 1.3.27a, there is a heap-based buffer over-read in ReadOneJNGImage in coders/png.c, related to oFFs chunk allocation.
- CVE-2017-17503High
GraphicsMagick 1.3.26 has a vulnerability in the ReadGRAYImage function in coders/gray.c that allows for a heap-based buffer over-read via a crafted file.
- CVE-2017-17502High
GraphicsMagick 1.3.26 has a vulnerability in the ReadCMYKImage function in coders/cmyk.c that allows for a heap-based buffer over-read via a crafted file.
- CVE-2017-17501High
GraphicsMagick 1.3.26 has a heap-based buffer over-read vulnerability in the WriteOnePNGImage function in coders/png.c, which can be exploited via a crafted file.
- CVE-2017-17500High
GraphicsMagick 1.3.26 has a vulnerability in the ReadRGBImage function in coders/rgb.c that allows for a heap-based buffer over-read via a crafted file.
- CVE-2017-17498High
The WritePNMImage function in coders/pnm.c in GraphicsMagick 1.3.26 has a vulnerability that allows remote attackers to cause a denial of service through a heap-based buffer overflow, leading to application crashes.
- CVE-2017-16669High
GraphicsMagick 1.3.26 has a vulnerability that allows remote attackers to cause a denial of service through a heap-based buffer overflow in coders/wpg.c, leading to application crash. This issue is related to the AcquireCacheNexus function in magick/pixel_cache.c.
- CVE-2017-16547High
The DrawImage function in GraphicsMagick 1.3.26 does not properly handle pop keywords associated with push keywords, potentially leading to application crashes or denial of service.
Original NVD description (English source)
GraphicsMagick 1.3.26 has a heap overflow in the WriteCMYKImage() function in coders/cmyk.c when processing multiple frames that have non-identical widths.