Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2017-9499: ImageMagick Denial of Service via Crafted File
CVE-2017-9499 · published 9 years ago
Summary
A maliciously crafted image file can crash the ImageMagick software, disrupting operations. This affects version 7.0.5-7 of ImageMagick. Update to the latest version to prevent service disruption.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| imagemagick | imagemagick |
7.0.5-7 cpe:2.3:a:imagemagick:imagemagick:7.0.5-7:*:*:*:*:*:*:* |
Original advisory text
In ImageMagick 7.0.5-7 Q16, an assertion failure was found in the function SetPixelChannelAttributes, which allows attackers to cause a denial of service via a crafted file.
In ImageMagick 7.0.5-7 Q16, an assertion failure was found in the function SetPixelChannelAttributes, which allows attackers to cause a denial of service via a crafted file.
References
- http://www.securityfocus.com/bid/98944 Third Party Advisory VDB Entry
- https://github.com/ImageMagick/ImageMagick/commit/7fd419441bc7103398e313558171d3... Issue Tracking Patch Third Party Advisory
- https://github.com/ImageMagick/ImageMagick/issues/492 Issue Tracking Patch Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-617Reachable Assertion
Timeline
Published7 Jun 2017
Updated3 Nov 2026
First seen11 Apr 2026
Track software like this
Free during beta