The ReadJNGImage and ReadOneJNGImage functions in coders/png.c in GraphicsMagick 1.3.26 do not properly manage image pointers after certain error conditions, which allows remote attackers to conduct use-after-free attacks via a crafted file, related to a ReadMNGImage out-of-order CloseBlob call. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-11403.
CVSS Details
- CVSS 3.0 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade graphicsmagick | Dec 11, 2017 | Sep 1, 2017 |
| Debian | — | Upgrade graphicsmagick | Feb 25, 2019 | Sep 1, 2017 |
| Suse | — | Upgrade libMagickWand1-32bitUpgrade GraphicsMagickUpgrade libMagickCore1Upgrade libMagick++1Upgrade libGraphicsMagick2Upgrade libMagickCore-6_Q16-1-32bitUpgrade libMagick++-6_Q16-3Upgrade libMagickWand-6_Q16-1Upgrade ImageMagick-develUpgrade perl-PerlMagickUpgrade libMagickCore1-32bitUpgrade ImageMagick-config-6-upstreamUpgrade ImageMagick-config-6-SUSEUpgrade ImageMagickUpgrade libMagickCore-6_Q16-1Upgrade libMagickWand1Upgrade libMagick++-develUpgrade perl-GraphicsMagick | Jan 26, 2018 | Sep 1, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub