VulnerabilityModified

CVE-2017-14173

MEDIUM 6.5EPSS 1.94%

Does this matter?

Lower severity and a low EPSS score (1.94%). Track it; it rarely justifies an emergency change on its own.

Description

In the function ReadTXTImage() in coders/txt.c in ImageMagick 7.0.6-10, an integer overflow might occur for the addition operation "GetQuantumRange(depth)+1" when "depth" is large, producing a smaller value than expected. As a result, an infinite loop would occur for a crafted TXT file that claims a very large "max_value" value.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS: 1.94% probability · 79th percentile
CISA KEV: Not listed
Weakness: CWE-190, CWE-835
Affected: imagemagick/imagemagick · canonical/ubuntu linux · debian/debian linux
Source: cve@mitre.org

References

https://github.com/ImageMagick/ImageMagick/commit/50f54462076648ac2e36c3f58f4dadd4babbf1c9Patch, Vendor Advisory
https://github.com/ImageMagick/ImageMagick/issues/713Exploit, Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/05/msg00015.htmlThird Party Advisory
https://lists.debian.org/debian-lts-announce/2020/09/msg00007.htmlThird Party Advisory
https://security.gentoo.org/glsa/201711-07Third Party Advisory
https://usn.ubuntu.com/3681-1/Third Party Advisory
https://github.com/ImageMagick/ImageMagick/commit/50f54462076648ac2e36c3f58f4dadd4babbf1c9Patch, Vendor Advisory
https://github.com/ImageMagick/ImageMagick/issues/713Exploit, Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/05/msg00015.htmlThird Party Advisory
https://lists.debian.org/debian-lts-announce/2020/09/msg00007.htmlThird Party Advisory
https://security.gentoo.org/glsa/201711-07Third Party Advisory
https://usn.ubuntu.com/3681-1/Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.