CVE-2017-16545

HIGH

GraphicsMagick 1.3.26 - Denial of Service via Malformed WPG Image

Title source: llm

Description

The ReadWPGImage function in coders/wpg.c in GraphicsMagick 1.3.26 does not properly validate colormapped images, which allows remote attackers to cause a denial of service (ImportIndexQuantumType invalid write and application crash) or possibly have unspecified other impact via a malformed WPG image.

References (7)

Core 7

Core References

Issue Tracking, Patch, Vendor Advisory x_refsource_confirm

http://hg.code.sf.net/p/graphicsmagick/code/rev/e8086faa52d0

Third Party Advisory vendor-advisory x_refsource_debian

https://www.debian.org/security/2018/dsa-4321

Mailing List mailing-list x_refsource_mlist

https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html

Issue Tracking, Patch, Third Party Advisory x_refsource_confirm

https://sourceforge.net/p/graphicsmagick/bugs/519/

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF62B5PJA2JDUOCKJGUQO3SPL74BEYSV/

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WHIKB4TP6KBJWT2UIPWL5MWMG5QXKGEJ/

Vendor Advisory vendor-advisory x_refsource_ubuntu

https://usn.ubuntu.com/4248-1/

Scores

CVSS v3 8.8

EPSS 0.0220

EPSS Percentile 80.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-476

Status published

Products (1)

graphicsmagick/graphicsmagick 1.3.26

Published Nov 05, 2017

Tracked Since Feb 18, 2026