CVE-2017-12877

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Use-after-free vulnerability in the DestroyImage function in image.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted file.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2017/08/16/2Mailing List, Patch, Third Party Advisory
https://blogs.gentoo.org/ago/2017/08/10/imagemagick-use-after-free-in-destroyimage-image-c/Patch, Third Party Advisory, VDB Entry
https://github.com/ImageMagick/ImageMagick/commit/04178de2247e353fc095846784b9a10fefdbf890Issue Tracking, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201711-07Third Party Advisory
https://usn.ubuntu.com/3681-1/Third Party Advisory
https://www.debian.org/security/2017/dsa-4040Third Party Advisory
https://www.debian.org/security/2017/dsa-4074Third Party Advisory
http://www.openwall.com/lists/oss-security/2017/08/16/2Mailing List, Patch, Third Party Advisory
https://blogs.gentoo.org/ago/2017/08/10/imagemagick-use-after-free-in-destroyimage-image-c/Patch, Third Party Advisory, VDB Entry
https://github.com/ImageMagick/ImageMagick/commit/04178de2247e353fc095846784b9a10fefdbf890Issue Tracking, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201711-07Third Party Advisory
https://usn.ubuntu.com/3681-1/Third Party Advisory
https://www.debian.org/security/2017/dsa-4040Third Party Advisory
https://www.debian.org/security/2017/dsa-4074Third Party Advisory

Timeline

Published: Aug 28, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-128795.4Cross-site scripting (XSS-STORED) vulnerability in the DEVICES OR SENSORS functionality in Paessler PRTG Network Monitor before 17.3.33.2654 CVE-2017-128818.8Cross-site request forgery (CSRF) vulnerability in the Spring Batch Admin before 1.3.0 allows remote attackers to hijack the authentication CVE-2017-128825.4Stored Cross-site scripting (XSS) vulnerability in Spring Batch Admin before 1.3.0 allows remote authenticated users to inject arbitrary Jav CVE-2017-128839.1Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attacker CVE-2017-128847.5OX Software GmbH App Suite 7.8.4 and earlier is affected by: Information Exposure.CVE-2017-128856.1OX Software GmbH App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).CVE-2017-12898.2IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data. A remote attacker could e CVE-2017-128927.8Foxit PDF Compressor installers from versions from 7.0.0.183 to 7.7.2.10 contain a DLL preloading vulnerability, wherein it is possible for CVE-2017-128939.8The SMB/CIFS parser in tcpdump before 4.9.2 has a buffer over-read in smbutil.c:name_len().CVE-2017-128949.8Several protocol parsers in tcpdump before 4.9.2 could cause a buffer over-read in addrtoname.c:lookup_bytestring().CVE-2017-128959.8The ICMP parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp.c:icmp_print().CVE-2017-128969.8The ISAKMP parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c:isakmp_rfc3948_print().