Vulnerability CVE-2017-18219

Vulnerability Name:

CVE-2017-18219 (CCN-139926)

Assigned:

2017-09-13

Published:

2017-09-13

Updated:

2019-10-03

Summary:

An issue was discovered in GraphicsMagick 1.3.26. An allocation failure vulnerability was found in the function ReadOnePNGImage in coders/png.c, which allows attackers to cause a denial of service via a crafted file that triggers an attempt at a large png_pixels array allocation.

CVSS v3 Severity:

6.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
5.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

3.3 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
2.9 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Low

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

1.7 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

Vulnerability Type:

CWE-770

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2017-18219

Source: CONFIRM
Type: Patch, Vendor Advisory
http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/cadd4b0522fa

Source: BID
Type: Third Party Advisory, VDB Entry
103258

Source: CCN
Type: BID-103258
GraphicsMagick CVE-2017-18219 Denial of Service Vulnerability

Source: XF
Type: UNKNOWN
graphicsmagick-cve201718219-dos(139926)

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20180328 [SECURITY] [DLA 1322-1] graphicsmagick security update

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20180803 [SECURITY] [DLA 1456-1] graphicsmagick security update

Source: FEDORA
Type: UNKNOWN
FEDORA-2019-da4c20882c

Source: FEDORA
Type: UNKNOWN
FEDORA-2019-425a1aa7c9

Source: CCN
Type: GraphicsMagick Web page
#459 allocation failure in ReadOnePNGImage

Source: CONFIRM
Type: Exploit, Issue Tracking, Third Party Advisory
https://sourceforge.net/p/graphicsmagick/bugs/459/

Source: UBUNTU
Type: UNKNOWN
USN-4266-1

Source: DEBIAN
Type: Third Party Advisory
DSA-4321

Vulnerable Configuration:

Configuration 1:

cpe:/a:graphicsmagick:graphicsmagick:1.3.26:*:*:*:*:*:*:*

Configuration 2:

cpe:/o:debian:debian_linux:7.0:*:*:*:*:*:*:*

OR cpe:/o:debian:debian_linux:8.0:*:*:*:*:*:*:*

OR cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:graphicsmagick:graphicsmagick:1.3.26:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:201718219	V	CVE-2017-18219	2022-05-22
oval:org.opensuse.security:def:29494	P	Security update for MozillaFirefox (Important) (in QA)	2022-01-14
oval:org.opensuse.security:def:34680	P	Security update for openexr (Important)	2022-01-12
oval:org.opensuse.security:def:34597	P	Security update for java-1_8_0-openjdk (Important)	2021-11-23
oval:org.opensuse.security:def:31708	P	Security update for webkit2gtk3 (Important)	2021-11-23
oval:org.opensuse.security:def:30269	P	Security update for postgresql96 (Important)	2021-11-22
oval:org.opensuse.security:def:33998	P	Security update for samba (Important)	2021-11-19
oval:org.opensuse.security:def:30258	P	Security update for strongswan (Important)	2021-10-19
oval:org.opensuse.security:def:30257	P	Security update for MozillaFirefox (Important)	2021-10-15
oval:org.opensuse.security:def:29408	P	Security update for MozillaFirefox (Important)	2021-08-17
oval:org.opensuse.security:def:34499	P	Security update for djvulibre (Important)	2021-08-05
oval:org.opensuse.security:def:32140	P	Security update for MozillaFirefox (Important)	2021-07-16
oval:org.opensuse.security:def:33935	P	Security update for libnettle (Important)	2021-06-23
oval:org.opensuse.security:def:33672	P	Security update for java-1_8_0-openjdk (Moderate)	2021-06-15
oval:org.opensuse.security:def:32066	P	Security update for the Linux Kernel (Live Patch 38 for SLE 12 SP3) (Important)	2021-04-07
oval:org.opensuse.security:def:31746	P	Security update for wavpack (Important)	2021-03-24
oval:org.opensuse.security:def:32274	P	Security update for glib2 (Important)	2021-03-16
oval:org.opensuse.security:def:34654	P	Security update for apache2 (Moderate)	2021-03-12
oval:org.opensuse.security:def:29466	P	Security update for the Linux Kernel (Important)	2021-02-11
oval:org.opensuse.security:def:34042	P	Security update for MozillaFirefox (Important)	2021-01-12
oval:org.opensuse.security:def:33974	P	Security update for tomcat (Moderate)	2021-01-05
oval:org.opensuse.security:def:33886	P	Security update for cyrus-sasl (Important)	2020-12-28
oval:org.opensuse.security:def:32833	P	Security update for ovmf (Moderate)	2020-12-16
oval:org.opensuse.security:def:29949	P	Security update for postgresql12 (Important)	2020-12-04
oval:org.opensuse.security:def:35757	P	libnewt0_52-0.52.10-1.35.7 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:35798	P	pam_krb5-2.3.1-47.10.15 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:29197	P	Security update for openssh (Moderate)	2020-12-01
oval:org.opensuse.security:def:29843	P	Security update for Linux kernel	2020-12-01
oval:org.opensuse.security:def:29993	P	Security update for libtcnative-1-0 (Moderate)	2020-12-01
oval:org.opensuse.security:def:30475	P	Security update for bind (Important)	2020-12-01
oval:org.opensuse.security:def:30863	P	Security update for elfutils	2020-12-01
oval:org.opensuse.security:def:31026	P	Security update for java-1_7_0-ibm (Important)	2020-12-01
oval:org.opensuse.security:def:32511	P	findutils on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:32811	P	xterm on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:33554	P	Security update for ImageMagick (Moderate)	2020-12-01
oval:org.opensuse.security:def:33218	P	openssh on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:33584	P	Security update for MozillaFirefox (Important)	2020-12-01
oval:org.opensuse.security:def:34268	P	Security update for procmail (Moderate)	2020-12-01
oval:org.opensuse.security:def:34961	P	Security update for freetype2 (Moderate)	2020-12-01
oval:org.opensuse.security:def:35119	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:26494	P	Security update for pdns-recursor (Important)	2020-12-01
oval:org.opensuse.security:def:26778	P	logrotate on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27123	P	file-32bit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27269	P	postgresql on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:26518	P	OpenEXR on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:26722	P	kbd on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27095	P	cifs-utils on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27250	P	ofed on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:28120	P	Security update for gtk2 (Moderate)	2020-12-01
oval:org.opensuse.security:def:28475	P	Security update for xorg-x11-server (Moderate)	2020-12-01
oval:org.opensuse.security:def:28768	P	Security update for net-snmp	2020-12-01
oval:org.opensuse.security:def:29502	P	Security update for ImageMagick (Moderate)	2020-12-01
oval:org.opensuse.security:def:29208	P	Security update for openssl (Moderate)	2020-12-01
oval:org.opensuse.security:def:29551	P	Security update for MozillaFirefox (Moderate)	2020-12-01
oval:org.opensuse.security:def:29892	P	Security update for Kerberos 5	2020-12-01
oval:org.opensuse.security:def:30631	P	Security update for Xen	2020-12-01
oval:org.opensuse.security:def:30564	P	Security update for poppler	2020-12-01
oval:org.opensuse.security:def:30918	P	Security update for gd (Moderate)	2020-12-01
oval:org.opensuse.security:def:31070	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:32054	P	Security update for kvm (Important)	2020-12-01
oval:org.opensuse.security:def:32667	P	fuse on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:33297	P	xorg-x11-libXp-32bit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:34720	P	Security update for ImageMagick (Moderate)	2020-12-01
oval:org.opensuse.security:def:34279	P	Security update for python (Moderate)	2020-12-01
oval:org.opensuse.security:def:35010	P	Security update for gnutls (Moderate)	2020-12-01
oval:org.opensuse.security:def:26505	P	Security update for phpMyAdmin (Moderate)	2020-12-01
oval:org.opensuse.security:def:26835	P	unrar on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27172	P	libadns1 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27907	P	Security update for Xen	2020-12-01
oval:org.opensuse.security:def:26519	P	PackageKit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:26803	P	perl-32bit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27148	P	ibutils on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27294	P	squidGuard on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:28044	P	Security update for curl (Important)	2020-12-01
oval:org.opensuse.security:def:28250	P	Security update for libxml2 (Moderate)	2020-12-01
oval:org.opensuse.security:def:28627	P	Security update for MozillaFirefox (Critical)	2020-12-01
oval:org.opensuse.security:def:28784	P	Security update for MozillaFirefox, MozillaFirefox-branding-SLED, mozilla-nss (Important)	2020-12-01
oval:org.opensuse.security:def:29277	P	Security update for xen (Important)	2020-12-01
oval:org.opensuse.security:def:29636	P	Security update for clamav (Moderate)	2020-12-01
oval:org.opensuse.security:def:29931	P	Security update for libgdiplus0	2020-12-01
oval:org.opensuse.security:def:30668	P	Security update for ImageMagick (Moderate)	2020-12-01
oval:org.opensuse.security:def:30621	P	Security update for xen	2020-12-01
oval:org.opensuse.security:def:30967	P	Security update for grub2 (Important)	2020-12-01
oval:org.opensuse.security:def:32055	P	Security update for kvm (Important)	2020-12-01
oval:org.opensuse.security:def:32367	P	Security update for syslog-ng (Moderate)	2020-12-01
oval:org.opensuse.security:def:32723	P	libopenssl0_9_8 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:32877	P	gtk2 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:33206	P	mono-core on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:33432	P	Security update for curl	2020-12-01
oval:org.opensuse.security:def:33829	P	Security update for GnuTLS	2020-12-01
oval:org.opensuse.security:def:34363	P	Security update for tcpdump (Moderate)	2020-12-01
oval:org.opensuse.security:def:34744	P	Security update for MozillaFirefox (Critical)	2020-12-01
oval:org.opensuse.security:def:35049	P	Security update for jasper (Moderate)	2020-12-01
oval:org.opensuse.security:def:26569	P	kde4-kgreeter-plugins on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:26919	P	ipsec-tools on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27211	P	libpython2_6-1_0 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27942	P	Security update for GraphicsMagick (Moderate)	2020-12-01
oval:org.opensuse.security:def:26530	P	clamav on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:26860	P	amavisd-new on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27197	P	libmusicbrainz4 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27932	P	Security update for GraphicsMagick (Moderate)	2020-12-01
oval:org.opensuse.security:def:28045	P	Security update for curl (Moderate)	2020-12-01
oval:org.opensuse.security:def:28334	P	Security update for php53 (Important)	2020-12-01
oval:org.opensuse.security:def:28680	P	Security update for flash-player	2020-12-01
oval:org.opensuse.security:def:28828	P	Security update for rxvt-unicode	2020-12-01
oval:org.opensuse.security:def:29196	P	Security update for openslp (Important)	2020-12-01
oval:org.opensuse.security:def:29789	P	Security update for gtk2	2020-12-01
oval:org.opensuse.security:def:30343	P	Security update for unzip (Moderate)	2020-12-01
oval:org.opensuse.security:def:30708	P	Security update for MozillaFirefox (Important)	2020-12-01
oval:org.opensuse.security:def:31006	P	Security update for java-1_6_0-ibm (Moderate)	2020-12-01
oval:org.opensuse.security:def:32424	P	Security update for wpa_supplicant (Important)	2020-12-01
oval:org.opensuse.security:def:32772	P	perl-spamassassin on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:33515	P	Security update for PostgreSQL	2020-12-01
oval:org.opensuse.security:def:33207	P	mozilla-nspr-32bit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:33527	P	Security update for Websphere Community Edition	2020-12-01
oval:org.opensuse.security:def:34267	P	Security update for procmail	2020-12-01
oval:org.opensuse.security:def:34903	P	Security update for dhcpcd (Important)	2020-12-01
oval:org.opensuse.security:def:35075	P	Security update for java-1_7_0-ibm (Important)	2020-12-01
oval:org.opensuse.security:def:26493	P	Security update for phpMyAdmin (Important)	2020-12-01
oval:org.opensuse.security:def:26697	P	findutils on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27070	P	NetworkManager on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27225	P	libvirt on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:26594	P	libopensc2 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:26944	P	libcgroup1 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27236	P	lxc on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27967	P	Security update for ImageMagick (Moderate)	2020-12-01
oval:org.opensuse.security:def:28056	P	Security update for dhcp (Moderate)	2020-12-01
oval:org.opensuse.security:def:28391	P	Security update for samba (Important)	2020-12-01
oval:org.opensuse.security:def:28729	P	Security update for krb5	2020-12-01
oval:com.ubuntu.bionic:def:2017182190000000	V	CVE-2017-18219 on Ubuntu 18.04 LTS (bionic) - low.	2018-03-05
oval:com.ubuntu.artful:def:201718219000	V	CVE-2017-18219 on Ubuntu 17.10 (artful) - low.	2018-03-05
oval:com.ubuntu.xenial:def:201718219000	V	CVE-2017-18219 on Ubuntu 16.04 LTS (xenial) - low.	2018-03-05
oval:com.ubuntu.xenial:def:2017182190000000	V	CVE-2017-18219 on Ubuntu 16.04 LTS (xenial) - low.	2018-03-05
oval:com.ubuntu.bionic:def:201718219000	V	CVE-2017-18219 on Ubuntu 18.04 LTS (bionic) - low.	2018-03-05
oval:com.ubuntu.disco:def:2017182190000000	V	CVE-2017-18219 on Ubuntu 19.04 (disco) - low.	2018-03-05
oval:com.ubuntu.cosmic:def:201718219000	V	CVE-2017-18219 on Ubuntu 18.10 (cosmic) - low.	2018-03-05
oval:com.ubuntu.cosmic:def:2017182190000000	V	CVE-2017-18219 on Ubuntu 18.10 (cosmic) - low.	2018-03-05
oval:com.ubuntu.trusty:def:201718219000	V	CVE-2017-18219 on Ubuntu 14.04 LTS (trusty) - low.	2018-03-05

BACK