CVE-2017-16353: debian debian_linux Out-of-bounds Read

Vulnerability summary

CVE-2017-16353 is a medium (CVSS 6.5) Out-of-bounds Read vulnerability in debian debian_linux. EPSS estimates a 13.68% chance of exploitation in the next 30 days, higher than 96.4% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 01-11-2017
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

GraphicsMagick 1.3.26 is vulnerable to a memory information disclosure vulnerability found in the DescribeImage function of the magick/describe.c file, because of a heap-based buffer over-read. The portion of the code containing the vulnerability is responsible for printing the IPTC Profile information contained in the image. This vulnerability can be triggered with a specially crafted MIFF file. There is an out-of-bounds buffer dereference because certain increments are never checked.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.