Vulnerability CVE-2017-13143

Vulnerability Name:

CVE-2017-13143 (CCN-130831)

Assigned:

2017-01-26

Published:

2017-01-26

Updated:

2018-06-14

Summary:

In ImageMagick before 6.9.7-6 and 7.x before 7.0.4-6, the ReadMATImage function in coders/mat.c uses uninitialized data, which might allow remote attackers to obtain sensitive information from process memory.

CVSS v3 Severity:

7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): None Availibility (A): None

Vulnerability Type:

CWE-200

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2017-13143

Source: CONFIRM
Type: Issue Tracking, Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870012

Source: XF
Type: UNKNOWN
imagemagick-cve201713143-info-disc(130831)

Source: CONFIRM
Type: Issue Tracking, Patch, Third Party Advisory
https://github.com/ImageMagick/ImageMagick/commit/51b0ae01709adc1e4a9245e158ef17b85a110960

Source: CCN
Type: ImageMagick GIT Repository
use of uninitialized data in ImageMagick/coders/mat.c:407 #362

Source: CONFIRM
Type: Issue Tracking, Patch, Third Party Advisory
https://github.com/ImageMagick/ImageMagick/issues/362

Source: GENTOO
Type: UNKNOWN
GLSA-201711-07

Source: UBUNTU
Type: UNKNOWN
USN-3681-1

Source: DEBIAN
Type: UNKNOWN
DSA-4019

Source: DEBIAN
Type: UNKNOWN
DSA-4204

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2017-13143

Vulnerable Configuration:

Configuration 1:

cpe:/a:imagemagick:imagemagick:*:*:*:*:*:*:*:* (Version <= 6.9.7-5)

OR cpe:/a:imagemagick:imagemagick:7.0.1-0:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.1-1:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.1-2:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.1-3:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.1-4:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.1-5:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.1-6:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.1-7:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.1-8:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.1-9:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.1-10:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.2-0:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.2-1:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.2-2:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.2-3:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.2-4:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.2-5:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.2-6:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.2-7:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.2-8:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.2-9:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.2-10:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.3-0:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.3-1:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.3-2:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.3-3:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.3-4:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.3-5:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.3-6:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.3-7:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.3-8:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.3-9:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.3-10:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.4-0:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.4-1:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.4-2:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.4-3:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.4-4:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.4-5:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:imagemagick:imagemagick:6.9.7-5:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:7.0.4-5:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:com.ubuntu.artful:def:201713143000	V	CVE-2017-13143 on Ubuntu 17.10 (artful) - medium.	2017-08-23
oval:com.ubuntu.bionic:def:2017131430000000	V	CVE-2017-13143 on Ubuntu 18.04 LTS (bionic) - medium.	2017-08-23
oval:com.ubuntu.bionic:def:201713143000	V	CVE-2017-13143 on Ubuntu 18.04 LTS (bionic) - medium.	2017-08-23
oval:com.ubuntu.xenial:def:2017131430000000	V	CVE-2017-13143 on Ubuntu 16.04 LTS (xenial) - medium.	2017-08-23
oval:com.ubuntu.trusty:def:201713143000	V	CVE-2017-13143 on Ubuntu 14.04 LTS (trusty) - medium.	2017-08-23
oval:com.ubuntu.xenial:def:201713143000	V	CVE-2017-13143 on Ubuntu 16.04 LTS (xenial) - medium.	2017-08-23

BACK