CVE-2017-7606: imagemagick Improper Input Validation
Vulnerability summary
CVE-2017-7606 is a medium (CVSS 6.5) Improper Input Validation vulnerability in imagemagick. EPSS estimates a 2.23% chance of exploitation in the next 30 days, higher than 82.4% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 7 · Related 4Timeline
- 09-04-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
coders/rle.c in ImageMagick 7.0.5-4 has an "outside the range of representable values of type unsigned char" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
2.23%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
0.00 pp
From 2.23% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (blogs.gentoo.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian1 product
- imagemagick< 8:6.9.7.4+dfsg-4
Imagemagick1 product
- imagemagick7.0.5-4
Ubuntu1 product
- imagemagick< 8:6.7.7.10-6ubuntu3.7 | < 8:6.8.9.9-7ubuntu5.7
3 vendors · 3 products
References
8 links
- blogs.gentoo.org/ago/2017/04/02/imagemagick-undefined-behavior-in-codersrle-c/X Refsource MISCExploitPatchThird Party AdvisoryREPORT