Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2014-1947

CWE-787 — Out-of-bounds Write15 documents8 sources
Severity
7.8HIGH
EPSS
7.0%
top 8.56%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
4
Imagemagick ImagemagickSuse Linux Enterprise DesktopSuse Linux Enterprise Server+1 more
Timeline
PublishedFeb 17
Latest updateMay 17

Description

Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick 6.5.4 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of layers in a PSD image, involving the L%02ld string, a different vulnerability than CVE-2014-2030.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages6 packages

▶Debianimagemagick< 8:6.7.7.10+dfsg-1+3
▶Debiangraphicsmagick< 1.3.20-1+3

Patches

Patch: www.openwall.com ↗Patch: www.openwall.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-jfcr-jpxh-mcqv: Stack-based buffer overflow in the WritePSDImage function in coders/psd↗2022-05-17
▶
OSV
CVE-2014-1947: Stack-based buffer overflow in the WritePSDImage function in coders/psd↗2020-02-17
▶
CVEList
CVE-2014-1947: Stack-based buffer overflow in the WritePSDImage function in coders/psd↗2020-02-17
▶

💥Exploits & PoCs

1
Exploit-DB
ImageMagick 6.8.8-4 - Local Buffer Overflow (SEH)↗2014-02-16
▶

📋Vendor Advisories

3
Debian
CVE-2014-1947: graphicsmagick - Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in Ima...↗2014
▶
Red Hat
ImageMagick: PSD writing layer name buffer overflow ("L%02ld")↗2013-11-14
▶
Red Hat
ImageMagick: PSD writing layer name buffer overflow ("L%06ld")↗2013-11-14
▶

💬Community

7
Bugzilla
CVE-2014-3561 ovirt-engine-log-collector: database password disclosed in process listing↗2014-07-24
▶
Bugzilla
CVE-2014-2030 ImageMagick: PSD writing layer name buffer overflow ("L%06ld")↗2014-04-02
▶
Bugzilla
CVE-2014-1947 CVE-2014-2030 ImageMagick, GraphicsMagick: buffer overflow when handling PSD images [fedora-all]↗2014-04-01
▶
Bugzilla
CVE-2014-1947 CVE-2014-2030 ImageMagick, GraphicsMagick: buffer overflow when handling PSD images [epel-5]↗2014-04-01
▶
Bugzilla
CVE-2014-1947 CVE-2014-2030 ImageMagick, GraphicsMagick: buffer overflow when handling PSD images [epel-6]↗2014-04-01
▶