CVE-2017-18229

MEDIUM

GraphicsMagick 1.3.26 - Denial of Service via Crafted TIFF File

Title source: llm

Description

An issue was discovered in GraphicsMagick 1.3.26. An allocation failure vulnerability was found in the function ReadTIFFImage in coders/tiff.c, which allows attackers to cause a denial of service via a crafted file, because file size is not properly used to restrict scanline, strip, and tile allocations.

References (6)

Core 6

Core References

Exploit, Issue Tracking, Third Party Advisory x_refsource_confirm

http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/752c0b41fa32

Release Notes x_refsource_confirm

https://sourceforge.net/p/graphicsmagick/bugs/461/

Mailing List, Third Party Advisory mailing-list x_refsource_mlist

https://lists.debian.org/debian-lts-announce/2018/03/msg00025.html

Third Party Advisory vendor-advisory x_refsource_debian

https://www.debian.org/security/2018/dsa-4321

Mailing List, Third Party Advisory mailing-list x_refsource_mlist

https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html

Vendor Advisory vendor-advisory x_refsource_ubuntu

https://usn.ubuntu.com/4266-1/

Scores

CVSS v3 6.5

EPSS 0.0235

EPSS Percentile 81.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Details

CWE

CWE-770

Status published

Products (4)

debian/debian_linux 7.0

debian/debian_linux 8.0

debian/debian_linux 9.0

graphicsmagick/graphicsmagick 1.3.26

Published Mar 14, 2018

Tracked Since Feb 18, 2026