CVE-2017-17498

HIGH

GraphicsMagick 1.3.26 - Heap-Based Buffer Overflow in WritePNMImage

Title source: llm

Description

WritePNMImage in coders/pnm.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (bit_stream.c MagickBitStreamMSBWrite heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.

References (9)

Core 9

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/102158

Third Party Advisory vendor-advisory x_refsource_debian

https://www.debian.org/security/2018/dsa-4321

Mailing List mailing-list x_refsource_mlist

https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html

Patch x_refsource_confirm

http://hg.code.sf.net/p/graphicsmagick/code/rev/f1c418ef0260

Mailing List mailing-list x_refsource_mlist

https://lists.debian.org/debian-lts-announce/2018/01/msg00005.html

Issue Tracking x_refsource_confirm

https://sourceforge.net/p/graphicsmagick/bugs/525/

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF62B5PJA2JDUOCKJGUQO3SPL74BEYSV/

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WHIKB4TP6KBJWT2UIPWL5MWMG5QXKGEJ/

Vendor Advisory vendor-advisory x_refsource_ubuntu

https://usn.ubuntu.com/4248-1/

Scores

CVSS v3 8.8

EPSS 0.0290

EPSS Percentile 85.2%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-119

Status published

Products (1)

graphicsmagick/graphicsmagick 1.3.26

Published Dec 11, 2017

Tracked Since Feb 18, 2026