CVE-2017-14649 - ReadOneJNGImage in coders/png.c in GraphicsMagick version 1.3.26 does not properly validate JNG data

CVE-2017-14649

Summary

ReadOneJNGImage in coders/png.c in GraphicsMagick version 1.3.26 does not properly validate JNG data, leading to a denial of service (assertion failure in magick/pixel_cache.c, and application crash).

References

Vulnerable Configurations

cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.26:*:*:*:*:*:*:*
cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.26:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 03-10-2019 - 00:03)
Impact:
Exploitability:

CWE

CWE-617

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:N/A:P

refmap via4

bid	100958
fedora	FEDORA-2019-425a1aa7c9 FEDORA-2019-da4c20882c
misc	http://hg.code.sf.net/p/graphicsmagick/code/rev/358608a46f0a https://blogs.gentoo.org/ago/2017/09/19/graphicsmagick-assertion-failure-in-pixel_cache-c/ https://sourceforge.net/p/graphicsmagick/bugs/439/
ubuntu	USN-4232-1

Last major update

03-10-2019 - 00:03

Published

21-09-2017 - 17:29

Last modified

03-10-2019 - 00:03