CVE-2017-16352 — Vulnetix

CVE-2017-16352 PUBLISHED

GraphicsMagick 1.3.26 is vulnerable to a heap-based buffer overflow vulnerability found in the "Display visual image directory" feature of the DescribeImage() function of the magick/describe.c file. One possible way to trigger the vulnerability is to run the identify command on a specially crafted MIFF format file with the verbose flag.

EPSS 29.41% · 96.7th percentile

Risk Scores

EPSS Score

29.41%

96.7th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:16.04:LTS	graphicsmagick	0, 1.3.21-3, 1.3.23-1build1
Ubuntu:Pro:14.04:LTS	graphicsmagick	0, 1.3.16-1.1ubuntu2, 1.3.16-1.1ubuntu3

Exploit Intelligence

https://blogs.securiteam.com/index.php/archives/3494 (nist-nvd)
https://www.exploit-db.com/exploits/43111/ (nist-nvd)
101658 (circl)
http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset%3Bnode=7292230dd185 (circl)
DSA-4321 (circl)
[debian-lts-announce] 20180803 [SECURITY] [DLA 1456-1] graphicsmagick security update (circl)
[debian-lts-announce] 20171103 [SECURITY] [DLA 1159-1] graphicsmagick security update (circl)
ftp://ftp.graphicsmagick.org/pub/GraphicsMagick/snapshots/ChangeLog.txt (circl)
USN-4232-1 (circl)
GraphicsMagick - Memory Disclosure / Heap Overflow Exploit (0day-today)

…and 1 more exploits

Timeline

Nov 1, 2017 CVE Published
Nov 3, 2017 PoC Published
Apr 14, 2021 EPSS Score
Jun 23, 2021 EPSS Score
Oct 26, 2021 EPSS Score
Dec 27, 2021 EPSS Score
Feb 28, 2022 EPSS Score
May 2, 2022 EPSS Score
May 24, 2022 CVE Updated
Jul 3, 2022 EPSS Score
Nov 6, 2022 EPSS Score
Jan 8, 2023 EPSS Score

References

https://ubuntu.com/security/CVE-2017-16352 third-party-advisory
http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset;node=7292230dd185 third-party-advisory
https://blogs.securiteam.com/index.php/archives/3494 third-party-advisory
https://ubuntu.com/security/notices/USN-4232-1 vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2017-16352 third-party-advisory

Open in Interactive Console →