CVE-2017-13737: debian debian_linux Use After Free

CVSS: 6.5v3.0MediumModified

AliasesUBUNTU-CVE-2017-13737DEBIAN-CVE-2017-13737

Published 29-08-2017Last modified 05-08-2024

Vulnerability summary

CVE-2017-13737 is a medium (CVSS 6.5) Use After Free vulnerability in debian debian_linux. EPSS estimates a 2.68% chance of exploitation in the next 30 days, higher than 85.5% of scored vulnerabilities.

Overall risk

27/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.5/10

010

Medium · v3.0 (NVD)

EPSS score

2.68%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 1

DLA-1140-1 DLA-1456-1 DSA-4321-1 USN-4222-1

Timeline

29-08-2017
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

There is an invalid free in the MagickFree function in magick/memory.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service attack.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.06.5v2.04.3

EPSS trend

Probability

2.68%

Chance of exploitation in the next 30 days

Percentile

86%

Versus all other CVEs

30-day change

0.00 pp

From 2.68% on 18-09-2026

18-09-202618-10-2026

EPSS score

2.68%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected systems

Debian2 products

graphicsmagick< 1.3.26-15
debian_linuxEOL8.0 | 9.0

Graphicsmagick1 product

graphicsmagick1.3.26

Ubuntu1 product

graphicsmagick< 1.3.18-1ubuntu3.1+esm3 | < 1.3.23-1ubuntu0.3

3 vendors · 4 products

References

14 links

bugzilla.redhat.com/show_bug.cgi?id=1484196X Refsource MISCIssue TrackingREPORT
openwall.com/lists/oss-security/2017/08/29/4X Refsource MISCMailing List
www.securityfocus.com/bid/100518VDB EntryX Refsource BIDThird Party Advisory
hg.graphicsmagick.org/hg/GraphicsMagick/rev/3db9449e3d6a/X Refsource CONFIRMPatchVendor AdvisoryREPORT
www.debian.org/security/2018/dsa-4321Vendor AdvisoryX Refsource DEBIANThird Party Advisory
bugs.debian.org/878511X Refsource CONFIRMIssue TrackingThird Party Advisory
lists.debian.org/debian-lts-announce/2018/08/msg00002.htmlMailing ListX Refsource MLISTThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
usn.ubuntu.com/4222-1/Vendor AdvisoryX Refsource UBUNTU

Show all 14 references

ubuntu.com/security/CVE-2017-13737REPORT
ubuntu.com/security/notices/USN-4222-1Advisory
www.cve.org/CVERecord?id=CVE-2017-13737REPORT
security-tracker.debian.org/tracker/CVE-2017-13737Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities