CVE-2017-16353: Infoleak
GraphicsMagick 1.3.26 is vulnerable to a memory information disclosure vulnerability found in the DescribeImage function of the magick/describe.c file, because of a heap-based buffer over-read. The portion of the code containing the vulnerability is responsible for printing the IPTC Profile information contained in the image. This vulnerability can be triggered with a specially crafted MIFF file. There is an out-of-bounds buffer dereference because certain increments are never checked.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this GraphicsMagick vulnerability?
The vulnerability ID for this GraphicsMagick vulnerability is CVE-2017-16353.
What is the severity rating of CVE-2017-16353?
CVE-2017-16353 has a severity rating of 6.5 (medium).
How can I fix the CVE-2017-16353 vulnerability in GraphicsMagick?
To fix the CVE-2017-16353 vulnerability in GraphicsMagick, update to version 1.3.26-17 or higher.
Where can I find more information about CVE-2017-16353?
You can find more information about CVE-2017-16353 at the following references: - [GraphicsMagick Changeset](http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset;node=e4e1c2a581d8) - [SecuriTeam Blog](https://blogs.securiteam.com/index.php/archives/3494) - [SecurityFocus BID](http://www.securityfocus.com/bid/101653)
What are the affected software versions of GraphicsMagick for CVE-2017-16353?
The affected software versions of GraphicsMagick for CVE-2017-16353 are: - 1.3.26-17 (Ubuntu) - 1.3.23-1ubuntu0.4 (Ubuntu) - 1.3.18-1ubuntu3.1+ (Ubuntu) - 1.3.26 (Graphicsmagick) - 7.0 (Debian Linux) - 8.0 (Debian Linux) - 9.0 (Debian Linux) - 1.4+really1.3.35-1~deb10u2 - 1.4+really1.3.35-1~deb10u3 - 1.4+really1.3.36+hg16481-2+deb11u1 - 1.4+really1.3.40-4 - 1.4+really1.3.42-1 (Debian)