CVE-2017-18231

MEDIUM

GraphicsMagick 1.3.26 - Denial of Service via NULL Pointer Dereference in ReadEnhMetaFile

Title source: llm
STIX 2.1

Description

An issue was discovered in GraphicsMagick 1.3.26. A NULL pointer dereference vulnerability was found in the function ReadEnhMetaFile in coders/emf.c, which allows attackers to cause a denial of service via a crafted file.

References (6)

Core 6
Core References
Patch, Vendor Advisory x_refsource_confirm
http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/ea074081678b
Issue Tracking, Third Party Advisory x_refsource_confirm
https://sourceforge.net/p/graphicsmagick/bugs/475/
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2018/03/msg00025.html
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2018/dsa-4321
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4266-1/

Scores

CVSS v3 6.5
EPSS 0.0172
EPSS Percentile 74.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Details

CWE
CWE-476
Status published
Products (4)
debian/debian_linux 7.0
debian/debian_linux 8.0
debian/debian_linux 9.0
graphicsmagick/graphicsmagick 1.3.26
Published Mar 14, 2018
Tracked Since Feb 18, 2026