6.5

CVE-2017-13145

In ImageMagick before 6.9.8-8 and 7.x before 7.0.5-9, the ReadJP2Image function in coders/jp2.c does not properly validate the channel geometry, leading to a crash.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Imagemagick ≫ Imagemagick Version <= 6.9.8-7
Imagemagick ≫ Imagemagick Version 7.0.1-0
Imagemagick ≫ Imagemagick Version 7.0.1-1
Imagemagick ≫ Imagemagick Version 7.0.1-2
Imagemagick ≫ Imagemagick Version 7.0.1-3
Imagemagick ≫ Imagemagick Version 7.0.1-4
Imagemagick ≫ Imagemagick Version 7.0.1-5
Imagemagick ≫ Imagemagick Version 7.0.1-6
Imagemagick ≫ Imagemagick Version 7.0.1-7
Imagemagick ≫ Imagemagick Version 7.0.1-8
Imagemagick ≫ Imagemagick Version 7.0.1-9
Imagemagick ≫ Imagemagick Version 7.0.1-10
Imagemagick ≫ Imagemagick Version 7.0.2-0
Imagemagick ≫ Imagemagick Version 7.0.2-1
Imagemagick ≫ Imagemagick Version 7.0.2-2
Imagemagick ≫ Imagemagick Version 7.0.2-3
Imagemagick ≫ Imagemagick Version 7.0.2-4
Imagemagick ≫ Imagemagick Version 7.0.2-5
Imagemagick ≫ Imagemagick Version 7.0.2-6
Imagemagick ≫ Imagemagick Version 7.0.2-7
Imagemagick ≫ Imagemagick Version 7.0.2-8
Imagemagick ≫ Imagemagick Version 7.0.2-9
Imagemagick ≫ Imagemagick Version 7.0.2-10
Imagemagick ≫ Imagemagick Version 7.0.3-0
Imagemagick ≫ Imagemagick Version 7.0.3-1
Imagemagick ≫ Imagemagick Version 7.0.3-2
Imagemagick ≫ Imagemagick Version 7.0.3-3
Imagemagick ≫ Imagemagick Version 7.0.3-4
Imagemagick ≫ Imagemagick Version 7.0.3-5
Imagemagick ≫ Imagemagick Version 7.0.3-6
Imagemagick ≫ Imagemagick Version 7.0.3-7
Imagemagick ≫ Imagemagick Version 7.0.3-8
Imagemagick ≫ Imagemagick Version 7.0.3-9
Imagemagick ≫ Imagemagick Version 7.0.3-10
Imagemagick ≫ Imagemagick Version 7.0.4-0
Imagemagick ≫ Imagemagick Version 7.0.4-1
Imagemagick ≫ Imagemagick Version 7.0.4-2
Imagemagick ≫ Imagemagick Version 7.0.4-3
Imagemagick ≫ Imagemagick Version 7.0.4-4
Imagemagick ≫ Imagemagick Version 7.0.4-5
Imagemagick ≫ Imagemagick Version 7.0.4-6
Imagemagick ≫ Imagemagick Version 7.0.4-7
Imagemagick ≫ Imagemagick Version 7.0.4-8
Imagemagick ≫ Imagemagick Version 7.0.4-9
Imagemagick ≫ Imagemagick Version 7.0.4-10
Imagemagick ≫ Imagemagick Version 7.0.5-0
Imagemagick ≫ Imagemagick Version 7.0.5-1
Imagemagick ≫ Imagemagick Version 7.0.5-4
Imagemagick ≫ Imagemagick Version 7.0.5-5
Imagemagick ≫ Imagemagick Version 7.0.5-6
Imagemagick ≫ Imagemagick Version 7.0.5-7
Imagemagick ≫ Imagemagick Version 7.0.5-8
Debian ≫ Debian Linux Version 8.0
Debian ≫ Debian Linux Version 9.0
Canonical ≫ Ubuntu Linux Version 14.04 SwEdition esm
Canonical ≫ Ubuntu Linux Version 16.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 17.10
Canonical ≫ Ubuntu Linux Version 18.04 SwEdition lts
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.57% 0.721
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:N/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
Third Party Advisory
https://www.debian.org/security/2017/dsa-4019
Third Party Advisory
https://usn.ubuntu.com/3681-1/
Third Party Advisory
https://security.gentoo.org/glsa/201711-07
Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869830
Third Party Advisory
Issue Tracking
https://github.com/ImageMagick/ImageMagick/commit/acee073df34aa4d491bf5cb74d3a15fc80f0a3aa
Patch
Third Party Advisory
Issue Tracking
https://github.com/ImageMagick/ImageMagick/commit/f13c6b54a879aaa771ec64b5a066b939e8f8e7f0
Patch
Vendor Advisory
https://github.com/ImageMagick/ImageMagick/issues/501
Patch
Third Party Advisory
Issue Tracking