CVE-2017-18220 - The ReadOneJNGImage and ReadJNGImage functions in coders/png.c in GraphicsMagick 1.3.26 allow remote

CVE-2017-18220

Summary

The ReadOneJNGImage and ReadJNGImage functions in coders/png.c in GraphicsMagick 1.3.26 allow remote attackers to cause a denial of service (magick/blob.c CloseBlob use-after-free) or possibly have unspecified other impact via a crafted file, a related issue to CVE-2017-11403.

References

Vulnerable Configurations

cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.26:*:*:*:*:*:*:*
cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.26:*:*:*:*:*:*:*

CVSS

Base:	6.8 (as of 18-10-2018 - 10:29)
Impact:
Exploitability:

CWE

CWE-416

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:P

refmap via4

bid	103276
confirm	http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/98721124e51f https://sourceforge.net/p/graphicsmagick/bugs/438/
debian	DSA-4321
fedora	FEDORA-2019-425a1aa7c9 FEDORA-2019-da4c20882c
mlist	[debian-lts-announce] 20180328 [SECURITY] [DLA 1322-1] graphicsmagick security update [debian-lts-announce] 20180803 [SECURITY] [DLA 1456-1] graphicsmagick security update

Last major update

18-10-2018 - 10:29

Published

05-03-2018 - 22:29

Last modified

18-10-2018 - 10:29