CVE-2017-5511

moderate-risk

Published 2017-03-24

coders/psd.c in ImageMagick allows remote attackers to have unspecified impact by leveraging an improper cast, which triggers a heap-based buffer overflow.

Do I need to act?

1.4% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Fix available

Upgrade to: 80973288d5cb3fd6165a7ac3e2e88344229bf465, 7d65a814ac76bd04760072c33e452371692ee790, c8c6a0f123d5e35c173125365c97e2c0fc7eca42, 42b46010047f45e5ccee3f3da5b5b21728a38566

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (3)

Debian Linux

Imagemagick

Affected Vendors

Debian Imagemagick

References (18)

Third Party Advisory http://www.debian.org/security/2017/dsa-3799

Mailing List http://www.openwall.com/lists/oss-security/2017/01/16/6

Mailing List http://www.openwall.com/lists/oss-security/2017/01/17/5

Broken Link http://www.securityfocus.com/bid/95746

Issue Tracking https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851374

Issue Tracking https://github.com/ImageMagick/ImageMagick/commit/7d65a814ac76bd04760072c33e4523...

Issue Tracking https://github.com/ImageMagick/ImageMagick/commit/c8c6a0f123d5e35c173125365c97e2...

Issue Tracking https://github.com/ImageMagick/ImageMagick/issues/347

Third Party Advisory https://security.gentoo.org/glsa/201702-09