Vulnerability-Lookup

CVE-2017-13144 (GCVE-0-2017-13144)

Vulnerability from cvelistv5 – Published: 2017-08-23 06:00 – Updated: 2024-08-05 18:58

Summary

In ImageMagick before 6.9.7-10, there is a crash (rather than a "width or height exceeds limit" error report) if the image dimensions are too large, as demonstrated by use of the mpc coder.

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE

Assigner

mitre mitre root

References

6 references

URL	Tags
https://www.debian.org/security/2017/dsa-4040	vendor-advisoryx_refsource_DEBIAN
https://usn.ubuntu.com/3681-1/	vendor-advisoryx_refsource_UBUNTU
https://security.gentoo.org/glsa/201711-07	vendor-advisoryx_refsource_GENTOO
https://www.debian.org/security/2017/dsa-4019	vendor-advisoryx_refsource_DEBIAN
https://www.imagemagick.org/discourse-server/view…	x_refsource_CONFIRM
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug…	x_refsource_CONFIRM

Date Public

2017-08-23 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T18:58:12.299Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-4040",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2017/dsa-4040"
          },
          {
            "name": "USN-3681-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3681-1/"
          },
          {
            "name": "GLSA-201711-07",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201711-07"
          },
          {
            "name": "DSA-4019",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2017/dsa-4019"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.imagemagick.org/discourse-server/viewtopic.php?f=3\u0026t=31438"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869728"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-08-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In ImageMagick before 6.9.7-10, there is a crash (rather than a \"width or height exceeds limit\" error report) if the image dimensions are too large, as demonstrated by use of the mpc coder."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-06-13T09:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-4040",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2017/dsa-4040"
        },
        {
          "name": "USN-3681-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3681-1/"
        },
        {
          "name": "GLSA-201711-07",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201711-07"
        },
        {
          "name": "DSA-4019",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2017/dsa-4019"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.imagemagick.org/discourse-server/viewtopic.php?f=3\u0026t=31438"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869728"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-13144",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In ImageMagick before 6.9.7-10, there is a crash (rather than a \"width or height exceeds limit\" error report) if the image dimensions are too large, as demonstrated by use of the mpc coder."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-4040",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2017/dsa-4040"
            },
            {
              "name": "USN-3681-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3681-1/"
            },
            {
              "name": "GLSA-201711-07",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201711-07"
            },
            {
              "name": "DSA-4019",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2017/dsa-4019"
            },
            {
              "name": "https://www.imagemagick.org/discourse-server/viewtopic.php?f=3\u0026t=31438",
              "refsource": "CONFIRM",
              "url": "https://www.imagemagick.org/discourse-server/viewtopic.php?f=3\u0026t=31438"
            },
            {
              "name": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869728",
              "refsource": "CONFIRM",
              "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869728"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-13144",
    "datePublished": "2017-08-23T06:00:00.000Z",
    "dateReserved": "2017-08-23T00:00:00.000Z",
    "dateUpdated": "2024-08-05T18:58:12.299Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2017-13144",
      "date": "2026-09-17",
      "epss": "0.02011",
      "percentile": "0.79916"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"6.9.7-9\", \"matchCriteriaId\": \"917C274B-F692-4773-9C99-A8179120B794\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In ImageMagick before 6.9.7-10, there is a crash (rather than a \\\"width or height exceeds limit\\\" error report) if the image dimensions are too large, as demonstrated by use of the mpc coder.\"}, {\"lang\": \"es\", \"value\": \"En ImageMagick en versiones anteriores a la 6.9.7-10, hay un bloqueo (en vez de un informe de error \\\"width or height exceeds limit\\\") si las dimensiones de la imagen son demasiado grandes, tal y como demuestra el uso del coder mp3.\"}]",
      "id": "CVE-2017-13144",
      "lastModified": "2024-11-21T03:11:01.883",
      "metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:N/I:N/A:P\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2017-08-23T06:29:00.370",
      "references": "[{\"url\": \"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869728\", \"source\": \"cve@mitre.org\", \"tags\": [\"Issue Tracking\", \"Third Party Advisory\"]}, {\"url\": \"https://security.gentoo.org/glsa/201711-07\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://usn.ubuntu.com/3681-1/\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://www.debian.org/security/2017/dsa-4019\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://www.debian.org/security/2017/dsa-4040\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://www.imagemagick.org/discourse-server/viewtopic.php?f=3\u0026t=31438\", \"source\": \"cve@mitre.org\", \"tags\": [\"Issue Tracking\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869728\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Third Party Advisory\"]}, {\"url\": \"https://security.gentoo.org/glsa/201711-07\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://usn.ubuntu.com/3681-1/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.debian.org/security/2017/dsa-4019\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.debian.org/security/2017/dsa-4040\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.imagemagick.org/discourse-server/viewtopic.php?f=3\u0026t=31438\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Patch\", \"Third Party Advisory\"]}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2017-13144\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2017-08-23T06:29:00.370\",\"lastModified\":\"2026-05-13T00:24:29.033\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In ImageMagick before 6.9.7-10, there is a crash (rather than a \\\"width or height exceeds limit\\\" error report) if the image dimensions are too large, as demonstrated by use of the mpc coder.\"},{\"lang\":\"es\",\"value\":\"En ImageMagick en versiones anteriores a la 6.9.7-10, hay un bloqueo (en vez de un informe de error \\\"width or height exceeds limit\\\") si las dimensiones de la imagen son demasiado grandes, tal y como demuestra el uso del coder mp3.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:N/A:P\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"6.9.7-9\",\"matchCriteriaId\":\"917C274B-F692-4773-9C99-A8179120B794\"}]}]}],\"references\":[{\"url\":\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869728\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/201711-07\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://usn.ubuntu.com/3681-1/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.debian.org/security/2017/dsa-4019\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.debian.org/security/2017/dsa-4040\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.imagemagick.org/discourse-server/viewtopic.php?f=3\u0026t=31438\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869728\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/201711-07\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://usn.ubuntu.com/3681-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.debian.org/security/2017/dsa-4019\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.debian.org/security/2017/dsa-4040\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.imagemagick.org/discourse-server/viewtopic.php?f=3\u0026t=31438\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-05-13T02:14:40+00:00",
      "cve": "CVE-2017-13144",
      "id": "CVE-2017-13144",
      "initial_release_date": "2017-08-23T00:00:00+00:00",
      "product_status:known_affected": "16",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "ImageMagick: Improper size validation in ReadJPEGImage function in error/jpeg.c",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2017/cve-2017-13144.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-01T00:20:49Z",
      "cve": "CVE-2017-13144",
      "id": "CVE-2017-13144",
      "initial_release_date": "2023-02-15T04:40:30Z",
      "product_status:known_affected": "10",
      "product_status:known_not_affected": "144",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2017-13144",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2017-13144.json",
      "version": "10"
    }
  }
}

CNVD-2017-25060

Vulnerability from cnvd - Published: 2017-09-05

Title

ImageMagick拒绝服务漏洞（CNVD-2017-25060）

Description

ImageMagick是美国ImageMagick Studio公司的一套开源的图象处理软件。 ImageMagick存在拒绝服务漏洞，允许远程攻击者利用漏洞构建恶意文件，诱使用户解析，可使应用程序崩溃。

Severity

中

Patch Name

ImageMagick拒绝服务漏洞（CNVD-2017-25060）的补丁

Patch Description

ImageMagick是美国ImageMagick Studio公司的一套开源的图象处理软件。 ImageMagick存在拒绝服务漏洞，允许远程攻击者利用漏洞构建恶意文件，诱使用户解析，可使应用程序崩溃。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=31438

Reference

https://nvd.nist.gov/vuln/detail/CVE-2017-13144

Impacted products

Name
ImageMagick ImageMagick <6.9.7-10

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-13144"
    }
  },
  "description": "ImageMagick\u662f\u7f8e\u56fdImageMagick Studio\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u7684\u56fe\u8c61\u5904\u7406\u8f6f\u4ef6\u3002\r\n\r\nImageMagick\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff0c\u5141\u8bb8\u8fdc\u7a0b\u653b\u51fb\u8005\u5229\u7528\u6f0f\u6d1e\u6784\u5efa\u6076\u610f\u6587\u4ef6\uff0c\u8bf1\u4f7f\u7528\u6237\u89e3\u6790\uff0c\u53ef\u4f7f\u5e94\u7528\u7a0b\u5e8f\u5d29\u6e83\u3002",
  "discovererName": "Bastien ROUCARIES \u003croucaries.bastien@gmail.com\u003e",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://www.imagemagick.org/discourse-server/viewtopic.php?f=3\u0026t=31438",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-25060",
  "openTime": "2017-09-05",
  "patchDescription": "ImageMagick\u662f\u7f8e\u56fdImageMagick Studio\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u7684\u56fe\u8c61\u5904\u7406\u8f6f\u4ef6\u3002\r\n\r\nImageMagick\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff0c\u5141\u8bb8\u8fdc\u7a0b\u653b\u51fb\u8005\u5229\u7528\u6f0f\u6d1e\u6784\u5efa\u6076\u610f\u6587\u4ef6\uff0c\u8bf1\u4f7f\u7528\u6237\u89e3\u6790\uff0c\u53ef\u4f7f\u5e94\u7528\u7a0b\u5e8f\u5d29\u6e83\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "ImageMagick\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff08CNVD-2017-25060\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "ImageMagick ImageMagick \u003c6.9.7-10"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2017-13144",
  "serverity": "\u4e2d",
  "submitTime": "2017-08-24",
  "title": "ImageMagick\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff08CNVD-2017-25060\uff09"
}

FKIE_CVE-2017-13144

Vulnerability from fkie_nvd - Published: 2017-08-23 06:29 - Updated: 2026-06-17 01:04

Severity

6.5 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Summary

In ImageMagick before 6.9.7-10, there is a crash (rather than a "width or height exceeds limit" error report) if the image dimensions are too large, as demonstrated by use of the mpc coder.

References

URL	Tags
cve@mitre.org	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869728	Issue Tracking, Third Party Advisory
cve@mitre.org	https://security.gentoo.org/glsa/201711-07
cve@mitre.org	https://usn.ubuntu.com/3681-1/
cve@mitre.org	https://www.debian.org/security/2017/dsa-4019
cve@mitre.org	https://www.debian.org/security/2017/dsa-4040
cve@mitre.org	https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=31438	Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869728	Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://security.gentoo.org/glsa/201711-07
af854a3a-2127-422b-91ae-364da2661108	https://usn.ubuntu.com/3681-1/
af854a3a-2127-422b-91ae-364da2661108	https://www.debian.org/security/2017/dsa-4019
af854a3a-2127-422b-91ae-364da2661108	https://www.debian.org/security/2017/dsa-4040
af854a3a-2127-422b-91ae-364da2661108	https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=31438	Issue Tracking, Patch, Third Party Advisory

Impacted products

	Vendor	Product	Version
	imagemagick	imagemagick	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "917C274B-F692-4773-9C99-A8179120B794",
              "versionEndIncluding": "6.9.7-9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In ImageMagick before 6.9.7-10, there is a crash (rather than a \"width or height exceeds limit\" error report) if the image dimensions are too large, as demonstrated by use of the mpc coder."
    },
    {
      "lang": "es",
      "value": "En ImageMagick en versiones anteriores a la 6.9.7-10, hay un bloqueo (en vez de un informe de error \"width or height exceeds limit\") si las dimensiones de la imagen son demasiado grandes, tal y como demuestra el uso del coder mp3."
    }
  ],
  "id": "CVE-2017-13144",
  "lastModified": "2026-06-17T01:04:37.080",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-08-23T06:29:00.370",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869728"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://security.gentoo.org/glsa/201711-07"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://usn.ubuntu.com/3681-1/"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.debian.org/security/2017/dsa-4019"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.debian.org/security/2017/dsa-4040"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.imagemagick.org/discourse-server/viewtopic.php?f=3\u0026t=31438"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869728"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.gentoo.org/glsa/201711-07"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://usn.ubuntu.com/3681-1/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.debian.org/security/2017/dsa-4019"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.debian.org/security/2017/dsa-4040"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.imagemagick.org/discourse-server/viewtopic.php?f=3\u0026t=31438"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-2HH9-VFRM-8F6W

Vulnerability from github – Published: 2022-05-14 03:18 – Updated: 2025-04-20 03:43

Details

In ImageMagick before 6.9.7-10, there is a crash (rather than a "width or height exceeds limit" error report) if the image dimensions are too large, as demonstrated by use of the mpc coder.

Severity

6.5 (Medium)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2017-13144"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-08-23T06:29:00Z",
    "severity": "MODERATE"
  },
  "details": "In ImageMagick before 6.9.7-10, there is a crash (rather than a \"width or height exceeds limit\" error report) if the image dimensions are too large, as demonstrated by use of the mpc coder.",
  "id": "GHSA-2hh9-vfrm-8f6w",
  "modified": "2025-04-20T03:43:44Z",
  "published": "2022-05-14T03:18:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-13144"
    },
    {
      "type": "WEB",
      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869728"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201711-07"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/3681-1"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2017/dsa-4019"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2017/dsa-4040"
    },
    {
      "type": "WEB",
      "url": "https://www.imagemagick.org/discourse-server/viewtopic.php?f=3\u0026t=31438"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2017-13144

Vulnerability from gsd - Updated: 2023-12-13 01:21

Details

In ImageMagick before 6.9.7-10, there is a crash (rather than a "width or height exceeds limit" error report) if the image dimensions are too large, as demonstrated by use of the mpc coder.

Aliases

CVE-2017-13144

Aliases

CVE-2017-13144

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2017-13144",
    "description": "In ImageMagick before 6.9.7-10, there is a crash (rather than a \"width or height exceeds limit\" error report) if the image dimensions are too large, as demonstrated by use of the mpc coder.",
    "id": "GSD-2017-13144",
    "references": [
      "https://www.suse.com/security/cve/CVE-2017-13144.html",
      "https://www.debian.org/security/2017/dsa-4040",
      "https://www.debian.org/security/2017/dsa-4019",
      "https://ubuntu.com/security/CVE-2017-13144",
      "https://advisories.mageia.org/CVE-2017-13144.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2017-13144"
      ],
      "details": "In ImageMagick before 6.9.7-10, there is a crash (rather than a \"width or height exceeds limit\" error report) if the image dimensions are too large, as demonstrated by use of the mpc coder.",
      "id": "GSD-2017-13144",
      "modified": "2023-12-13T01:21:01.653400Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2017-13144",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "In ImageMagick before 6.9.7-10, there is a crash (rather than a \"width or height exceeds limit\" error report) if the image dimensions are too large, as demonstrated by use of the mpc coder."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "DSA-4040",
            "refsource": "DEBIAN",
            "url": "https://www.debian.org/security/2017/dsa-4040"
          },
          {
            "name": "USN-3681-1",
            "refsource": "UBUNTU",
            "url": "https://usn.ubuntu.com/3681-1/"
          },
          {
            "name": "GLSA-201711-07",
            "refsource": "GENTOO",
            "url": "https://security.gentoo.org/glsa/201711-07"
          },
          {
            "name": "DSA-4019",
            "refsource": "DEBIAN",
            "url": "https://www.debian.org/security/2017/dsa-4019"
          },
          {
            "name": "https://www.imagemagick.org/discourse-server/viewtopic.php?f=3\u0026t=31438",
            "refsource": "CONFIRM",
            "url": "https://www.imagemagick.org/discourse-server/viewtopic.php?f=3\u0026t=31438"
          },
          {
            "name": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869728",
            "refsource": "CONFIRM",
            "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869728"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "6.9.7-9",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-13144"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "In ImageMagick before 6.9.7-10, there is a crash (rather than a \"width or height exceeds limit\" error report) if the image dimensions are too large, as demonstrated by use of the mpc coder."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-20"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869728",
              "refsource": "CONFIRM",
              "tags": [
                "Issue Tracking",
                "Third Party Advisory"
              ],
              "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869728"
            },
            {
              "name": "https://www.imagemagick.org/discourse-server/viewtopic.php?f=3\u0026t=31438",
              "refsource": "CONFIRM",
              "tags": [
                "Issue Tracking",
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://www.imagemagick.org/discourse-server/viewtopic.php?f=3\u0026t=31438"
            },
            {
              "name": "DSA-4019",
              "refsource": "DEBIAN",
              "tags": [],
              "url": "https://www.debian.org/security/2017/dsa-4019"
            },
            {
              "name": "GLSA-201711-07",
              "refsource": "GENTOO",
              "tags": [],
              "url": "https://security.gentoo.org/glsa/201711-07"
            },
            {
              "name": "DSA-4040",
              "refsource": "DEBIAN",
              "tags": [],
              "url": "https://www.debian.org/security/2017/dsa-4040"
            },
            {
              "name": "USN-3681-1",
              "refsource": "UBUNTU",
              "tags": [],
              "url": "https://usn.ubuntu.com/3681-1/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2018-06-14T01:29Z",
      "publishedDate": "2017-08-23T06:29Z"
    }
  }
}

ubuntu-cve-2017-13144

Vulnerability from osv_ubuntu

Published

2017-08-23 00:00

Modified

2026-04-22 07:38

Summary

Details

In ImageMagick before 6.9.7-10, there is a crash (rather than a "width or height exceeds limit" error report) if the image dimensions are too large, as demonstrated by use of the mpc coder.

Severity

6.5 (Medium)


                    
                      CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      negligible

References

URL

Type

	https://ubuntu.com/security/CVE-2017-13144	REPORT
	https://www.imagemagick.org/discourse-server/view…	REPORT
	https://ubuntu.com/security/notices/USN-3681-1	ADVISORY
	https://ubuntu.com/security/notices/USN-3785-1	ADVISORY
	https://ubuntu.com/security/notices/USN-5335-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2017-13144	REPORT
	https://ubuntu.com/security/notices/USN-6980-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "imagemagick",
            "binary_version": "8:6.7.7.10-6ubuntu3.13+esm8"
          },
          {
            "binary_name": "imagemagick-common",
            "binary_version": "8:6.7.7.10-6ubuntu3.13+esm8"
          },
          {
            "binary_name": "libmagick++5",
            "binary_version": "8:6.7.7.10-6ubuntu3.13+esm8"
          },
          {
            "binary_name": "libmagickcore5",
            "binary_version": "8:6.7.7.10-6ubuntu3.13+esm8"
          },
          {
            "binary_name": "libmagickcore5-extra",
            "binary_version": "8:6.7.7.10-6ubuntu3.13+esm8"
          },
          {
            "binary_name": "libmagickwand5",
            "binary_version": "8:6.7.7.10-6ubuntu3.13+esm8"
          },
          {
            "binary_name": "perlmagick",
            "binary_version": "8:6.7.7.10-6ubuntu3.13+esm8"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "imagemagick",
        "purl": "pkg:deb/ubuntu/imagemagick@8:6.7.7.10-6ubuntu3.13+esm8?arch=source\u0026distro=trusty/esm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8:6.7.7.10-6ubuntu3.13+esm8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8:6.7.7.10-5ubuntu3",
        "8:6.7.7.10-5ubuntu4",
        "8:6.7.7.10-6ubuntu1",
        "8:6.7.7.10-6ubuntu2",
        "8:6.7.7.10-6ubuntu3",
        "8:6.7.7.10-6ubuntu3.1",
        "8:6.7.7.10-6ubuntu3.2",
        "8:6.7.7.10-6ubuntu3.3",
        "8:6.7.7.10-6ubuntu3.4",
        "8:6.7.7.10-6ubuntu3.5",
        "8:6.7.7.10-6ubuntu3.6",
        "8:6.7.7.10-6ubuntu3.7",
        "8:6.7.7.10-6ubuntu3.8",
        "8:6.7.7.10-6ubuntu3.9",
        "8:6.7.7.10-6ubuntu3.11",
        "8:6.7.7.10-6ubuntu3.12",
        "8:6.7.7.10-6ubuntu3.13",
        "8:6.7.7.10-6ubuntu3.13+esm1",
        "8:6.7.7.10-6ubuntu3.13+esm2",
        "8:6.7.7.10-6ubuntu3.13+esm3",
        "8:6.7.7.10-6ubuntu3.13+esm4",
        "8:6.7.7.10-6ubuntu3.13+esm5",
        "8:6.7.7.10-6ubuntu3.13+esm6",
        "8:6.7.7.10-6ubuntu3.13+esm7"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "imagemagick",
            "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2"
          },
          {
            "binary_name": "imagemagick-6.q16",
            "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2"
          },
          {
            "binary_name": "imagemagick-common",
            "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2"
          },
          {
            "binary_name": "libimage-magick-perl",
            "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2"
          },
          {
            "binary_name": "libimage-magick-q16-perl",
            "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2"
          },
          {
            "binary_name": "libmagick++-6-headers",
            "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2"
          },
          {
            "binary_name": "libmagick++-6.q16-5v5",
            "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2"
          },
          {
            "binary_name": "libmagickcore-6-arch-config",
            "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2"
          },
          {
            "binary_name": "libmagickcore-6-headers",
            "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2"
          },
          {
            "binary_name": "libmagickcore-6.q16-2",
            "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2"
          },
          {
            "binary_name": "libmagickcore-6.q16-2-extra",
            "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2"
          },
          {
            "binary_name": "libmagickwand-6-headers",
            "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2"
          },
          {
            "binary_name": "libmagickwand-6.q16-2",
            "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2"
          },
          {
            "binary_name": "perlmagick",
            "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "imagemagick",
        "purl": "pkg:deb/ubuntu/imagemagick@8:6.8.9.9-7ubuntu5.16+esm2?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8:6.8.9.9-7ubuntu5.16+esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8:6.8.9.9-5ubuntu2",
        "8:6.8.9.9-6",
        "8:6.8.9.9-6build1",
        "8:6.8.9.9-7",
        "8:6.8.9.9-7ubuntu1",
        "8:6.8.9.9-7ubuntu2",
        "8:6.8.9.9-7ubuntu3",
        "8:6.8.9.9-7ubuntu4",
        "8:6.8.9.9-7ubuntu5",
        "8:6.8.9.9-7ubuntu5.1",
        "8:6.8.9.9-7ubuntu5.2",
        "8:6.8.9.9-7ubuntu5.3",
        "8:6.8.9.9-7ubuntu5.4",
        "8:6.8.9.9-7ubuntu5.5",
        "8:6.8.9.9-7ubuntu5.6",
        "8:6.8.9.9-7ubuntu5.7",
        "8:6.8.9.9-7ubuntu5.8",
        "8:6.8.9.9-7ubuntu5.9",
        "8:6.8.9.9-7ubuntu5.11",
        "8:6.8.9.9-7ubuntu5.12",
        "8:6.8.9.9-7ubuntu5.13",
        "8:6.8.9.9-7ubuntu5.14",
        "8:6.8.9.9-7ubuntu5.15",
        "8:6.8.9.9-7ubuntu5.16",
        "8:6.8.9.9-7ubuntu5.16+esm1"
      ]
    }
  ],
  "aliases": [],
  "details": "In ImageMagick before 6.9.7-10, there is a crash (rather than a \"width or height exceeds limit\" error report) if the image dimensions are too large, as demonstrated by use of the mpc coder.",
  "id": "UBUNTU-CVE-2017-13144",
  "modified": "2026-04-22T07:38:20Z",
  "published": "2017-08-23T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-13144"
    },
    {
      "type": "REPORT",
      "url": "https://www.imagemagick.org/discourse-server/viewtopic.php?f=3\u0026t=31438"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3681-1"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3785-1"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5335-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-13144"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6980-1"
    }
  ],
  "related": [
    "USN-3681-1",
    "USN-3785-1",
    "USN-5335-1",
    "USN-6980-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "negligible",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2017-13144"
  ]
}

WID-SEC-W-2024-0171

Vulnerability from csaf_certbund - Published: 2017-08-22 22:00 - Updated: 2024-03-19 23:00

Summary

ImageMagick: Mehrere Schwachstellen

Severity

Hoch

Scope

17 vulnerabilities in this advisory, including CVE-2017-13144.

CVE-2017-13144

In ImageMagick existieren mehrere Schwachstellen. Die Schwachstellen existieren in den Funktionen "WritePCXImage", "WriteOneJNGImage", "WritePDFImage", "ReadPSDLayersInternal", "ReadOnePNGImage", "ReadMIFFImage", "ReadMATImage", "ReadJP2Image", "ReadOneMNGImage", "SFWScan", "formatIPTC" und "load_level". Durch fehlende Speicherinitialisierungen und Validierungen können durch präparierte Bilddateien diverse Speicherlecks ausgenutzt werden. Ein entfernter, anonymer Angreifer kann so Zugriff auf eventuell sensitive Informationen erlangen und einen Denial of Service Zustand herbeiführen. Zur erfolgreichen Ausnutzung dieser Schwachstelle muss der Angreifer den Benutzer dazu bringen, eine modifizierte Bilddatei hochzuladen.

Known affected: 5 products

Open the full advisory

WID-SEC-W-2024-0172

Vulnerability from csaf_certbund - Published: 2017-08-06 22:00 - Updated: 2024-08-22 22:00

Summary

ImageMagick: Mehrere Schwachstellen ermöglichen Denial of Service

Severity

Mittel

Scope

24 vulnerabilities in this advisory, including CVE-2017-13144.

CVE-2017-13144

Es existieren mehrere Schwachstellen in ImageMagick. Die Schwachstellen befinden sich in verschiedenen Funktionen und werden u. a. durch Speicherbeschädigungen und "use-after-free" Fehler verursacht. Ein entfernter, anonymer oder authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Angriff durchführen. Zur erfolgreichen Ausnutzung einiger dieser Schwachstellen muss der Angreifer den Benutzer dazu bringen, eine modifizierte Datei zu öffnen.

Known affected: 4 products Last affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2017-13144 (GCVE-0-2017-13144)

CNVD-2017-25060

FKIE_CVE-2017-13144

GHSA-2HH9-VFRM-8F6W

GSD-2017-13144

ubuntu-cve-2017-13144

Vulnerability from osv_ubuntu

WID-SEC-W-2024-0171

WID-SEC-W-2024-0172

Tags

Sightings

Nomenclature

Related by attack behaviour