CVE-2017-13658

MEDIUM

Imagemagick < 6.9.9-2 - Reachable Assertion

Title source: rule
STIX 2.1

Description

In ImageMagick before 6.9.9-3 and 7.x before 7.0.6-3, there is a missing NULL check in the ReadMATImage function in coders/mat.c, leading to a denial of service (assertion failure and application exit) in the DestroyImageInfo function in MagickCore/image.c.

References (5)

Core 5
Core References
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870019
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://github.com/ImageMagick/ImageMagick/issues/598
Mailing List mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
Mailing List mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html

Scores

CVSS v3 6.5
EPSS 0.0047
EPSS Percentile 64.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Details

CWE
CWE-617
Status published
Products (50)
imagemagick/imagemagick 7.0.1-0
imagemagick/imagemagick 7.0.1-1
imagemagick/imagemagick 7.0.1-2
imagemagick/imagemagick 7.0.1-3
imagemagick/imagemagick 7.0.1-4
imagemagick/imagemagick 7.0.1-5
imagemagick/imagemagick 7.0.1-6
imagemagick/imagemagick 7.0.1-7
imagemagick/imagemagick 7.0.1-8
imagemagick/imagemagick 7.0.1-9
... and 40 more
Published Aug 24, 2017
Tracked Since Feb 18, 2026