cbcvebase.
CVE-2017-16546
published 2017-11-05

CVE-2017-16546: The ReadWPGImage function in coders/wpg.c in ImageMagick 7.0.7-9 does not properly validate the colormap index in a WPG palette, which allows remote attackers…

PriorityP337high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
2.20%
80.5th percentile
The ReadWPGImage function in coders/wpg.c in ImageMagick 7.0.7-9 does not properly validate the colormap index in a WPG palette, which allows remote attackers to cause a denial of service (use of uninitialized data or invalid memory allocation) or possibly have unspecified other impact via a malformed WPG file.

Affected

12 ranges
VendorProductVersion rangeFixed in
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
debiandebian_linux
debiandebian_linux
debianimagemagick< imagemagick 8:6.9.9.34+dfsg-3 (bookworm)imagemagick 8:6.9.9.34+dfsg-3 (bookworm)
imagemagickimagemagick
imagemagickimagemagick>= 0 < 8:6.9.9.34+dfsg-38:6.9.9.34+dfsg-3
imagemagickimagemagick>= 0 < 8:6.9.9.34+dfsg-38:6.9.9.34+dfsg-3
imagemagickimagemagick>= 0 < 8:6.9.9.34+dfsg-38:6.9.9.34+dfsg-3
imagemagickimagemagick>= 0 < 8:6.9.9.34+dfsg-38:6.9.9.34+dfsg-3

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.