CVE-2017-11450

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via JPEG data that is too short.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867894Issue Tracking, Patch, Third Party Advisory
https://github.com/ImageMagick/ImageMagick/commit/948356eec65aea91995d4b7cc487d197d2c5f602Issue Tracking, Patch, Third Party Advisory
https://github.com/ImageMagick/ImageMagick/issues/556Issue Tracking, Patch, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2017-11450Issue Tracking, Patch, Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867894Issue Tracking, Patch, Third Party Advisory
https://github.com/ImageMagick/ImageMagick/commit/948356eec65aea91995d4b7cc487d197d2c5f602Issue Tracking, Patch, Third Party Advisory
https://github.com/ImageMagick/ImageMagick/issues/556Issue Tracking, Patch, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2017-11450Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Jul 19, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-114558.8diag.cgi in Pulse Connect Secure 8.2R1 through 8.2R5, 8.1R1 through 8.1R10 and Pulse Policy Secure 5.3R1 through 5.3R5, 5.2R1 through 5.2R8,CVE-2017-114567.5Geneko GWR routers allow directory traversal sequences starting with a /../ substring, as demonstrated by unauthenticated read access to the CVE-2017-114576.5XML external entity (XXE) vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to read arbitrar CVE-2017-114586.1Cross-site scripting (XSS) vulnerability in the ctcprotocol/Protocol servlet in SAP NetWeaver AS JAVA 7.3 allows remote attackers to inject CVE-2017-114599.8SAP TREX 7.10 allows remote attackers to (1) read arbitrary files via an fget command or (2) write to arbitrary files and consequently execu CVE-2017-11465.4IBM Content Navigator 2.0.3 and 3.0.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript CVE-2017-114606.1Cross-site scripting (XSS) vulnerability in the DataArchivingService servlet in SAP NetWeaver Portal 7.4 allows remote attackers to inject a CVE-2017-114614.3NetApp OnCommand Unified Manager for 7-mode (core package) versions prior to 5.2.1 are susceptible to a clickjacking or "UI redress attack" CVE-2017-114629.8Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion CVE-2017-114638.8In Ivanti Service Desk (formerly LANDESK Management Suite) versions between 2016.3 and 2017.3, an Unrestricted Direct Object Reference leads CVE-2017-114647.8A SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg 2.40.17 during an attempted parse of a crafted SVG file, CVE-2017-114659.8The parser_yyerror function in the UTF-8 parser in Ruby 2.4.1 allows attackers to cause a denial of service (invalid write or read) or possi