Lucene search

MitreCVE-2017-15277

HistoryOct 12, 2017 - 8:29 a.m.

CVE-2017-15277

2017-10-1208:29:00

CWE-200

mitre

web.nvd.nist.gov

128

readgifimage

uninitialized palette

data leakage

cve-2017-15277

imagemagick

graphicsmagick

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

6.4

Confidence

High

EPSS

0.018

Percentile

88.2%

JSON

ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when processing a GIF file that has neither a global nor local palette. If the affected product is used as a library loaded into a process that operates on interesting data, this data sometimes can be leaked via the uninitialized palette.

Affected configurations

Nvd

Node

graphicsmagickgraphicsmagickMatch1.3.26

imagemagickimagemagickMatch7.0.6-1

VendorProductVersionCPE
graphicsmagickgraphicsmagick1.3.26cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.26:*:*:*:*:*:*:*
imagemagickimagemagick7.0.6-1cpe:2.3:a:imagemagick:imagemagick:7.0.6-1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
graphicsmagick	graphicsmagick	1.3.26	cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.26:::::::*
imagemagick	imagemagick	7.0.6-1	cpe:2.3:a:imagemagick:imagemagick:7.0.6-1:::::::*