Summaryinfo

A vulnerability identified as problematic has been detected in ImageMagick 7.0.6-6. The impacted element is the function ReadMATImage of the file coders/mat.c. Performing a manipulation results in memory corruption. This vulnerability was named CVE-2017-14533. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Detailsinfo

A vulnerability was found in ImageMagick 7.0.6-6 (Image Processing Software). It has been classified as problematic. This affects the function ReadMATImage of the file coders/mat.c. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on availability. The summary by CVE is:

ImageMagick 7.0.6-6 has a memory leak in ReadMATImage in coders/mat.c.

The bug was discovered 09/17/2017. The weakness was presented 09/18/2017 (GitHub Repository). The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2017-14533 since 09/17/2017. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 106184 (SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2018:0130-1)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family SuSE Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 170696 (SUSE Enterprise Linux Security Update for ImageMagick (SUSE-SU-2018:0130-1)).

Upgrading eliminates this vulnerability. A possible mitigation has been published 5 months after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at Tenable (106184) and SecurityFocus (BID 100885†). See VDB-104970, VDB-104975, VDB-104978 and VDB-105652 for similar entries. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Image Processing Software

Name

• ImageMagick

Version

• 7.0.6-6

License

• open-source

Website

• Product: https://www.imagemagick.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion