CVE-2017-9098: debian debian_linux Use of Uninitialized Resource
Vulnerability summary
CVE-2017-9098 is a high (CVSS 7.5) Use of Uninitialized Resource vulnerability in debian debian_linux. EPSS estimates a 3.57% chance of exploitation in the next 30 days, higher than 89.2% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 8 · Related 4Timeline
- 19-05-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
ImageMagick before 7.0.5-2 and GraphicsMagick before 1.3.24 use uninitialized memory in the RLE decoder, allowing an attacker to leak sensitive information from process memory space, as demonstrated by remote attacks against ImageMagick code in a long-running server process that converts image data on behalf of multiple users. This is caused by a missing initialization step in the ReadRLEImage function in coders/rle.c.
CVSS metrics
5 scores · 3 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
3.57%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
0.00 pp
From 3.57% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (scarybeastsecurity.blogspot.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian3 products
- graphicsmagick< 1.3.24-1 | < 1.3.16-1.1+deb7u7
- imagemagick< 8:6.9.7.4+dfsg-9
- debian_linuxEOL8.0 | 9.0
Graphicsmagick1 product
- graphicsmagick< 1.3.24
Imagemagick1 product
- imagemagick< 6.9.8-1 | ≥ 7.0.0-0, < 7.0.5-2
Ubuntu1 product
- imagemagick< 8:6.7.7.10-6ubuntu3.7 | < 8:6.8.9.9-7ubuntu5.7
4 vendors · 6 products
References
10 links- hg.code.sf.net/p/graphicsmagick/code/diff/0a5b75e019b6/coders/rle.cX Refsource MISCPatchThird Party Advisory
- github.com/ImageMagick/ImageMagick/commit/1c358ffe0049f768dd49a8a889c1cbf99ac9849bX Refsource MISCPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2018/08/msg00002.htmlMailing ListX Refsource MLISTThird Party Advisory- scarybeastsecurity.blogspot.com/2017/05/bleed-continues-18-byte-file-14k-bounty.htmlX Refsource MISCExploitTechnical DescriptionThird Party AdvisoryREPORT