Vulnerability in Graphicsmagick
CVE-2017-9098
ImageMagick before 7.0.5-2 and GraphicsMagick before 1.3.24 use uninitialized memory in the RLE decoder, allowing an attacker to leak sensitive information from process memory space, as demonstrated by remote attacks against ImageMagick code in a long-running server process that converts image data on behalf of multiple users. This is caused by a missing initialization step in the ReadRLEImage function in coders/rle.c.
EPSS: 0.036 (88.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Graphicsmagick
- Imagemagick
- Debian Debian_linux — versions 8.0, 9.0
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Patch, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (Patch, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- cve@mitre.org (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
- cve@mitre.org (Technical Description, Exploit, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
Frequently asked questions
- What is CVE-2017-9098?
- CVE-2017-9098 is a high-severity vulnerability in Graphicsmagick, classified under Use of Uninitialized Resource. CVSS score: 7.5/10. Published 2017-05-19.
- How severe is CVE-2017-9098?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2017-9098 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.