CVE-2017-13776 - Excessive Iteration

Severity

71%

Complexity

86%

Confidentiality

115%

GraphicsMagick 1.3.26 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version!=10 case that results in the reader not returning; it would cause large amounts of CPU and memory consumption although the crafted file itself does not request it.

GraphicsMagick 1.3.26 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version!=10 case that results in the reader not returning; it would cause large amounts of CPU and memory consumption although the crafted file itself does not request it.

CVSS 3.0 Base Score 6.5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).

CVSS 2.0 Base Score 7.1. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:C).

Overview

First reported 7 years ago

2017-08-30 09:29:00

Last updated 5 years ago

2019-12-16 20:15:00

Affected Software

GraphicsMagick 1.3.26

1.3.26

Debian Linux 8.0 (Jessie)

8.0

Debian Linux 9.0

9.0

References

http://hg.code.sf.net/p/graphicsmagick/code/rev/233a720bfd5e

Issue Tracking, Patch, Third Party Advisory

http://openwall.com/lists/oss-security/2017/08/31/2

Exploit, Mailing List

100574

Third Party Advisory, VDB Entry

[debian-lts-announce] 20180803 [SECURITY] [DLA 1456-1] graphicsmagick security update

Mailing List, Third Party Advisory

USN-4222-1

DSA-4321

Third Party Advisory

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.