CVE-2017-14175

Publication date 7 September 2017

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

In coders/xbm.c in ImageMagick 7.0.6-1 Q16, a DoS in ReadXBMImage() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted XBM file, which claims large rows and columns fields in the header but does not contain sufficient backing data, is provided, the loop over the rows would consume huge CPU resources, since there is no EOF check inside the loop.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
imagemagick	18.04 LTS bionic	Fixed 8:6.9.7.4+dfsg-16ubuntu6.2
	17.10 artful	Fixed 8:6.9.7.4+dfsg-16ubuntu2.2
	17.04 zesty	Ignored end of life
	16.04 LTS xenial	Fixed 8:6.8.9.9-7ubuntu5.11
	14.04 LTS trusty	Fixed 8:6.7.7.10-6ubuntu3.11

Notes

mdeslaur

0314-CVE-2017-14175-Fix-DoS-missing-EOF-check-in-ReadXBMImage-1-of-2.patch and 0315-CVE-2017-14175-Fix-DoS-missing-EOF-check-in-ReadXBMImage-2-of-2.patch in wheezy

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
imagemagick	Upstream: b8c63b1 Upstream: 169a20e

Severity score breakdown

Parameter	Value
Base score	6.5 · Medium
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H