VIR Vulnerability Intelligence Relay

CVE-2017-14175

medium
Published 2017-09-07 · Modified 2026-05-13
CVSS v3
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v2
7.1
VIR risk
6.5

Description

In coders/xbm.c in ImageMagick 7.0.6-1 Q16, a DoS in ReadXBMImage() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted XBM file, which claims large rows and columns fields in the header but does not contain sufficient backing data, is provided, the loop over the rows would consume huge CPU resources, since there is no EOF check inside the loop.

Predictions

Exploit likelihood
75%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2017-14175

vendor Authored 2026-05-27

Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2017-14175.html

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — https://github.com/ImageMagick/ImageMagick/issues/712

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — https://github.com/ImageMagick/ImageMagick/commit/d9a8234d211da30baf9526fbebe9a8438ea7e11c

OS impact
OSVersionStatusFixed in
suse slesaffected
debian debianbookwormfixed8:6.9.9.34+dfsg-3
debian debianbullseyefixed8:6.9.9.34+dfsg-3
debian debianforkyfixed8:6.9.9.34+dfsg-3
debian debiansidfixed8:6.9.9.34+dfsg-3
debian debiantrixiefixed8:6.9.9.34+dfsg-3
debian debian8.0affected
debian debian9.0affected
ubuntu ubuntu14.04affected
ubuntu ubuntu16.04affected
ubuntu ubuntu17.10affected
ubuntu ubuntu18.04affected

Application impact
VendorProductVersionsFixed
imagemagickimagemagick7.0.6-1

References

CWEs

CWE-834

Verify integrity in audit chain (admin only). AS-IS.