CVE-2017-12937
HighSummary
The ReadSUNImage function in coders/sun.c in GraphicsMagick 1.3.26 has a colormap heap-based buffer over-read.
Risk Assessment
The buffer over-read may lead to the exposure of sensitive data in memory, posing a security risk to the application.
Recommendation
It is recommended to update to the latest version of GraphicsMagick to mitigate this vulnerability.
Other vulnerabilities in GraphicsMagick 1.3.26
See all- CVE-2017-17912High
In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadNewsProfile in coders/tiff.c, in which LocaleNCompare reads heap data beyond the allocated region.
- CVE-2017-17783High
In GraphicsMagick 1.3.27a, there is a buffer over-read in ReadPALMImage in coders/palm.c when QuantumDepth is 8.
- CVE-2017-17782High
In GraphicsMagick 1.3.27a, there is a heap-based buffer over-read in ReadOneJNGImage in coders/png.c, related to oFFs chunk allocation.
- CVE-2017-17503High
GraphicsMagick 1.3.26 has a vulnerability in the ReadGRAYImage function in coders/gray.c that allows for a heap-based buffer over-read via a crafted file.
- CVE-2017-17502High
GraphicsMagick 1.3.26 has a vulnerability in the ReadCMYKImage function in coders/cmyk.c that allows for a heap-based buffer over-read via a crafted file.
- CVE-2017-17501High
GraphicsMagick 1.3.26 has a heap-based buffer over-read vulnerability in the WriteOnePNGImage function in coders/png.c, which can be exploited via a crafted file.
- CVE-2017-17500High
GraphicsMagick 1.3.26 has a vulnerability in the ReadRGBImage function in coders/rgb.c that allows for a heap-based buffer over-read via a crafted file.
- CVE-2017-17498High
The WritePNMImage function in coders/pnm.c in GraphicsMagick 1.3.26 has a vulnerability that allows remote attackers to cause a denial of service through a heap-based buffer overflow, leading to application crashes.
- CVE-2017-16669High
GraphicsMagick 1.3.26 has a vulnerability that allows remote attackers to cause a denial of service through a heap-based buffer overflow in coders/wpg.c, leading to application crash. This issue is related to the AcquireCacheNexus function in magick/pixel_cache.c.
- CVE-2017-16547High
The DrawImage function in GraphicsMagick 1.3.26 does not properly handle pop keywords associated with push keywords, potentially leading to application crashes or denial of service.
Original NVD description (English source)
The ReadSUNImage function in coders/sun.c in GraphicsMagick 1.3.26 has a colormap heap-based buffer over-read.