CVE-2017-16353
Medium
Description
GraphicsMagick 1.3.26 is vulnerable to a memory information disclosure vulnerability found in the DescribeImage function of the magick/describe.c file, because of a heap-based buffer over-read. The portion of the code containing the vulnerability is responsible for printing the IPTC Profile information contained in the image. This vulnerability can be triggered with a specially crafted MIFF file. There is an out-of-bounds buffer dereference because certain increments are never checked.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Graphicsmagick
PublishedNov 1, 2017
First seenNov 1, 2017
How to fix
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| graphicsmagick graphicsmagick | 1.3.26 | — |
| debian debian_linux | 7.0, 8.0, 9.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.