CVE-2017-14172: canonical ubuntu_linux Excessive Iteration
Vulnerability summary
CVE-2017-14172 is a high (CVSS 7.1) Excessive Iteration vulnerability in canonical ubuntu_linux. EPSS estimates a 2.19% chance of exploitation in the next 30 days, higher than 82.1% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 6 · Related 3Timeline
- 07-09-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
In coders/ps.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSImage() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file, which claims a large "extent" field in the header but does not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no EOF check inside the loop.
CVSS metrics
5 scores · 3 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
2.19%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
0.00 pp
From 2.19% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundImagemagick
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Debian2 products
- imagemagick< 8:6.9.9.34+dfsg-3
- debian_linuxEOL8.0 | 9.0
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 17.10 | 18.04
Imagemagick1 product
- imagemagick7.0.7-0
Ubuntu1 product
- imagemagick< 8:6.7.7.10-6ubuntu3.11 | < 8:6.8.9.9-7ubuntu5.11 | < 8:6.9.7.4+dfsg-16ubuntu6.2
4 vendors · 5 products
References
10 links- github.com/ImageMagick/ImageMagick/issues/715X Refsource CONFIRMExploitIssue TrackingPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2019/05/msg00015.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.debian.org/debian-lts-announce/2020/09/msg00007.htmlMailing ListX Refsource MLISTThird Party Advisory
- github.com/ImageMagick/ImageMagick/commit/bdbbb13f1fe9b7e2465502c500561720f7456aacX Refsource CONFIRMPatchVendor Advisory