CVE-2017-16352 EXPLOIT
8.8
HIGH · CVSS 3.0 · EPSS 14.5% (pctl 97)
Patch early
A public exploit exists.
Description
GraphicsMagick 1.3.26 is vulnerable to a heap-based buffer overflow vulnerability found in the "Display visual image directory" feature of the DescribeImage() function of the magick/describe.c file. One possible way to trigger the vulnerability is to run the identify command on a specially crafted MIFF format file with the verbose flag.
Scoring
| CVSS | 8.8 (HIGH, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| EPSS | 14.51% — more likely to be exploited than 97% of all CVEs |
| Weakness | CWE-119 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2017-11-01 |
| Last modified | 2026-06-17 |
Affected (2)
| Vendor | Product |
|---|---|
| debian | debian linux |
| graphicsmagick | graphicsmagick |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | GraphicsMagick - Memory Disclosure / Heap Overflow | 2017-11-03 |
References
- ftp://ftp.graphicsmagick.org/pub/GraphicsMagick/snapshots/ChangeLog.txt
- http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset%3Bnode=7292230dd185
- http://www.securityfocus.com/bid/101658
- https://blogs.securiteam.com/index.php/archives/3494
- https://lists.debian.org/debian-lts-announce/2017/11/msg00002.html
- https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html
- https://usn.ubuntu.com/4232-1/
- https://www.debian.org/security/2018/dsa-4321
- https://www.exploit-db.com/exploits/43111/
- ftp://ftp.graphicsmagick.org/pub/GraphicsMagick/snapshots/ChangeLog.txt
- http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset%3Bnode=7292230dd185
- http://www.securityfocus.com/bid/101658
- https://blogs.securiteam.com/index.php/archives/3494
- https://lists.debian.org/debian-lts-announce/2017/11/msg00002.html
- https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html
- https://usn.ubuntu.com/4232-1/
- https://www.debian.org/security/2018/dsa-4321
- https://www.exploit-db.com/exploits/43111/
→ the Explorer · watch your stack · NVD