Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-12691: ImageMagick may crash when processing crafted image

CVE-2017-12691 · published 9 years ago

Summary

ImageMagick 7.0.6-6 can run out of memory and stop working if it opens a specially crafted image file. This can affect any system that uses ImageMagick, including Ubuntu installations that ship the software. Upgrade ImageMagick to a newer version or apply the provided patch to prevent the crash.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
imagemagick	imagemagick	7.0.6-6 `cpe:2.3:a:imagemagick:imagemagick:7.0.6-6:::::::*`
canonical	ubuntu_linux	14.04 16.04 17.10 18.04 `cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::`

Original advisory text

The ReadOneLayer function in coders/xcf.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted file.

References

https://github.com/ImageMagick/ImageMagick/issues/656 Issue Tracking Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html
https://security.gentoo.org/glsa/201711-07 Third Party Advisory
https://usn.ubuntu.com/3681-1/ Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-770Allocation of Resources Without Limits

Timeline

Published1 Sep 2017

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2017-12691 · NVD

Track software like this

Free during beta