CVE-2017-14174

NameCVE-2017-14174
DescriptionIn coders/psd.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSDLayersInternal() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file, which claims a large "length" field in the header but does not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no EOF check inside the loop.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1131-1
NVD severityhigh (attack range: remote)
Debian Bugs875503

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
imagemagick (PTS)jessie8:6.8.9.9-5+deb8u12vulnerable
jessie (security)8:6.8.9.9-5+deb8u13vulnerable
stretch8:6.9.7.4+dfsg-11+deb9u3vulnerable
stretch (security)8:6.9.7.4+dfsg-11+deb9u5vulnerable
buster8:6.9.9.34+dfsg-3fixed
sid8:6.9.10.2+dfsg-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
imagemagicksource(unstable)8:6.9.9.34+dfsg-3low875503
imagemagicksourcewheezy8:6.7.7.10-5+deb7u17highDLA-1131-1

Notes

[stretch] - imagemagick <ignored> (Minor issue)
[jessie] - imagemagick <ignored> (Minor issue)
https://github.com/ImageMagick/ImageMagick/issues/714
https://github.com/ImageMagick/ImageMagick/commit/04a567494786d5bb50894fc8bb8fea0cf496bea8
ImageMagick-6: https://github.com/ImageMagick/ImageMagick/commit/f68a98a9d385838a1c73ec960a14102949940a64

Search for package or bug name: Reporting problems