Exploitation Summary
EIP tracks 1 public exploit for CVE-2017-16353. PoCs published by SecuriTeam.
AI-analyzed exploit summary The exploit demonstrates a memory information disclosure and heap overflow vulnerability in GraphicsMagick's DescribeImage function. It uses a crafted MIFF file to leak libc addresses and trigger a heap overflow via an overly long directory name.
Description
GraphicsMagick 1.3.26 is vulnerable to a memory information disclosure vulnerability found in the DescribeImage function of the magick/describe.c file, because of a heap-based buffer over-read. The portion of the code containing the vulnerability is responsible for printing the IPTC Profile information contained in the image. This vulnerability can be triggered with a specially crafted MIFF file. There is an out-of-bounds buffer dereference because certain increments are never checked.
Exploits (1)
The exploit demonstrates a memory information disclosure and heap overflow vulnerability in GraphicsMagick's DescribeImage function. It uses a crafted MIFF file to leak libc addresses and trigger a heap overflow via an overly long directory name.
References (9)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N