Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

ImageMagick can crash when processing malicious MNG file

CVE-2017-17914 · published 8 years ago
Summary

The ImageMagick program used on Ubuntu and Debian Linux can be forced to stop working by opening a specially crafted MNG image file. This causes the software to enter a large loop and crash, denying service to users. Upgrade ImageMagick to the latest package version provided by your Linux distribution to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
imagemagick imagemagick 7.0.7-16
cpe:2.3:a:imagemagick:imagemagick:7.0.7-16:*:*:*:*:*:*:*
canonical ubuntu_linux 14.04
16.04
17.10
18.04
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
debian debian_linux 7.0
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
Original advisory text
In ImageMagick 7.0.7-16 Q16, a vulnerability was found in the function ReadOnePNGImage in coders/png.c, which allows attackers to cause a denial of service (ReadOneMNGImage large loop) via a crafte...
In ImageMagick 7.0.7-16 Q16, a vulnerability was found in the function ReadOnePNGImage in coders/png.c, which allows attackers to cause a denial of service (ReadOneMNGImage large loop) via a crafted mng image file.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.5 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-834Excessive Iteration
Timeline
Published27 Dec 2017
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-17914 · NVD
Track software like this
Free during beta