CVE-2017-13777 - GraphicsMagick 1.3.26 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version==10 case that results in the reader not returning; it would cause large amounts of CPU and memory consumption although the crafted file itself does not request it

Back Back to CVE browser

MEDIUM

GraphicsMagick 1.3.26 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version==10 case that results in the reader not returning; it would cause large amounts of CPU and memory consumption although the crafted file itself does not request it

Published Aug 30, 2017

6.5

MEDIUM

CVSS 3.0

EPSS 2.13%

Description

GraphicsMagick 1.3.26 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version==10 case that results in the reader not returning; it would cause large amounts of CPU and memory consumption although the crafted file itself does not request it.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-834

References (7)

http://hg.code.sf.net/p/graphicsmagick/code/rev/233a720bfd5e
x_refsource_CONFIRMIssue TrackingPatchThird Party Advisory
http://openwall.com/lists/oss-security/2017/08/31/1
x_refsource_MISCMailing List
http://www.securityfocus.com/bid/100575
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-5292
Advisory
https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://usn.ubuntu.com/4222-1/
vendor-advisoryx_refsource_UBUNTU
https://www.debian.org/security/2018/dsa-4321
vendor-advisoryx_refsource_DEBIANThird Party Advisory

Link	Providers	Tags
http://hg.code.sf.net/p/graphicsmagick/code/rev/233a720bfd5e		x_refsource_CONFIRMIssue TrackingPatchThird Party Advisory
http://openwall.com/lists/oss-security/2017/08/31/1		x_refsource_MISCMailing List
http://www.securityfocus.com/bid/100575		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-5292		Advisory
https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://usn.ubuntu.com/4222-1/		vendor-advisoryx_refsource_UBUNTU
https://www.debian.org/security/2018/dsa-4321		vendor-advisoryx_refsource_DEBIANThird Party Advisory