CVE-2017-14174

NameCVE-2017-14174
DescriptionIn coders/psd.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSDLayersInternal() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file, which claims a large "length" field in the header but does not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no EOF check inside the loop.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1131-1
NVD severityhigh (attack range: remote)
Debian Bugs875503

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
imagemagick (PTS)wheezy8:6.7.7.10-5+deb7u4vulnerable
wheezy (security)8:6.7.7.10-5+deb7u18fixed
jessie8:6.8.9.9-5+deb8u9vulnerable
jessie (security)8:6.8.9.9-5+deb8u11vulnerable
stretch8:6.9.7.4+dfsg-11+deb9u1vulnerable
stretch (security)8:6.9.7.4+dfsg-11+deb9u3vulnerable
buster, sid8:6.9.7.4+dfsg-16vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
imagemagicksource(unstable)(unfixed)low875503
imagemagicksourcewheezy8:6.7.7.10-5+deb7u17highDLA-1131-1

Notes

[stretch] - imagemagick <no-dsa> (Minor issue)
[jessie] - imagemagick <no-dsa> (Minor issue)
https://github.com/ImageMagick/ImageMagick/issues/714
https://github.com/ImageMagick/ImageMagick/commit/04a567494786d5bb50894fc8bb8fea0cf496bea8
ImageMagick-6: https://github.com/ImageMagick/ImageMagick/commit/f68a98a9d385838a1c73ec960a14102949940a64

Search for package or bug name: Reporting problems