CVE-2017-14607

moderate-risk
Published 2017-09-20

In ImageMagick 7.0.7-4 Q16, an out of bounds read flaw related to ReadTIFFImage has been reported in coders/tiff.c. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash.

Do I need to act?

~
1.7% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.1/10 High
NETWORK / LOW complexity

Affected Products (7)

Affected Vendors

Canonical Imagemagick Debian

References (10)

Third Party Advisory http://www.securityfocus.com/bid/100944
Issue Tracking https://github.com/ImageMagick/ImageMagick/issues/765
Third Party Advisory https://usn.ubuntu.com/3681-1/
Third Party Advisory https://www.debian.org/security/2017/dsa-4032
Third Party Advisory https://www.debian.org/security/2017/dsa-4040
Third Party Advisory http://www.securityfocus.com/bid/100944
Issue Tracking https://github.com/ImageMagick/ImageMagick/issues/765
Third Party Advisory https://usn.ubuntu.com/3681-1/
Third Party Advisory https://www.debian.org/security/2017/dsa-4032
Third Party Advisory https://www.debian.org/security/2017/dsa-4040
46
/ 100
moderate-risk
Severity 28/34 · Critical
Exploitability 4/34 · Minimal
Exposure 14/34 · Moderate