p PatchFirst

CVE-2017-9098

CVE-2017-9098

This page contains facts from public vulnerability sources. Check the original advisory before updating.

ImageMagick before 7.0.5-2 and GraphicsMagick before 1.3.24 use uninitialized memory in the RLE decoder, allowing an attacker to leak sensitive information from process memory space, as demonstrated by remote attacks against ImageMagick code in a long-running server process that converts image data on behalf of multiple users. This is caused by a missing initialization step in the ReadRLEImage function in coders/rle.c.

CVSS 7.5 · High · EPSS 3.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • graphicsmagick Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.3.24-1

    Update to 1.3.24-1

  • graphicsmagick Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.3.24-1

    Update to 1.3.24-1

  • graphicsmagick Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.3.24-1

    Update to 1.3.24-1

  • imagemagick Debian:12

    Affected ranges
    • ECOSYSTEM: < 8:6.9.7.4+dfsg-9

    Update to 8:6.9.7.4+dfsg-9

  • imagemagick Debian:13

    Affected ranges
    • ECOSYSTEM: < 8:6.9.7.4+dfsg-9

    Update to 8:6.9.7.4+dfsg-9

  • imagemagick Debian:14

    Affected ranges
    • ECOSYSTEM: < 8:6.9.7.4+dfsg-9

    Update to 8:6.9.7.4+dfsg-9

  • imagemagick Ubuntu:14.04:LTS

    Versions
    • 8:6.7.7.10-5ubuntu3
    • 8:6.7.7.10-5ubuntu4
    • 8:6.7.7.10-6ubuntu1
    • 8:6.7.7.10-6ubuntu2
    • 8:6.7.7.10-6ubuntu3
    • 8:6.7.7.10-6ubuntu3.1
    • 8:6.7.7.10-6ubuntu3.2
    • 8:6.7.7.10-6ubuntu3.3
    • 8:6.7.7.10-6ubuntu3.4
    • 8:6.7.7.10-6ubuntu3.5
    • 8:6.7.7.10-6ubuntu3.6
    Affected ranges
    • ECOSYSTEM: < 8:6.7.7.10-6ubuntu3.7

    Update to 8:6.7.7.10-6ubuntu3.7

  • imagemagick Ubuntu:16.04:LTS

    Versions
    • 8:6.8.9.9-5ubuntu2
    • 8:6.8.9.9-6
    • 8:6.8.9.9-6build1
    • 8:6.8.9.9-7
    • 8:6.8.9.9-7ubuntu1
    • 8:6.8.9.9-7ubuntu2
    • 8:6.8.9.9-7ubuntu3
    • 8:6.8.9.9-7ubuntu4
    • 8:6.8.9.9-7ubuntu5
    • 8:6.8.9.9-7ubuntu5.1
    • 8:6.8.9.9-7ubuntu5.2
    • 8:6.8.9.9-7ubuntu5.3
    • 8:6.8.9.9-7ubuntu5.4
    • 8:6.8.9.9-7ubuntu5.5
    • 8:6.8.9.9-7ubuntu5.6
    Affected ranges
    • ECOSYSTEM: < 8:6.8.9.9-7ubuntu5.7

    Update to 8:6.8.9.9-7ubuntu5.7

Original sources

Check your server →