Excessive Iteration

Affecting imagemagick package, versions <8:6.9.7.4+dfsg-11+deb9u10

Report new vulnerabilities
Do your applications use this vulnerable package? Test your applications

Overview

In coders/xbm.c in ImageMagick 7.0.6-1 Q16, a DoS in ReadXBMImage() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted XBM file, which claims large rows and columns fields in the header but does not contain sufficient backing data, is provided, the loop over the rows would consume huge CPU resources, since there is no EOF check inside the loop.

References

CVSS Score

6.5
medium severity
  • Attack Vector
    Network
  • Attack Complexity
    Low
  • Privileges Required
    None
  • User Interaction
    Required
  • Scope
    Unchanged
  • Confidentiality
    None
  • Integrity
    None
  • Availability
    High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE
CVE-2017-14175
CWE
CWE-834
Snyk ID
SNYK-DEBIAN9-IMAGEMAGICK-402200
Disclosed
07 Sep, 2017
Published
07 Sep, 2017