VDB
CVE-2017-14174
CVE-2017-14174
PUBLISHED
In coders/psd.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSDLayersInternal() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file, which claims a large "length" field in the header but does not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no EOF check inside the loop.
EPSS 0.65% · 71.1th percentile
Risk Scores
EPSS Score
0.65%
71.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | imagemagick | *, 0, 8:6.8.9.9-5ubuntu2 |
| Ubuntu:14.04:LTS | imagemagick | *, 0, 8:6.7.7.10-5ubuntu3 |
| Ubuntu:18.04:LTS | imagemagick | 0, *, 8:6.9.7.4+dfsg-16ubuntu6 |
Exploit Intelligence
Timeline
- Sep 7, 2017 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Feb 4, 2022 EPSS Score
- Feb 28, 2022 EPSS Score
- May 2, 2022 EPSS Score
- Jul 3, 2022 EPSS Score
- Sep 5, 2022 EPSS Score
- Nov 6, 2022 EPSS Score
- Jan 8, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2017-14174 third-party-advisory
- https://ubuntu.com/security/notices/USN-3681-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2017-14174 third-party-advisory