CVE-2017-13064

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

GraphicsMagick 1.3.26 has a heap-based buffer overflow vulnerability in the function GetStyleTokens in coders/svg.c:311:12.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://hg.code.sf.net/p/graphicsmagick/code/rev/54f48ab2d52aMailing List, Third Party Advisory
http://www.securityfocus.com/bid/100474Third Party Advisory, VDB Entry
https://lists.debian.org/debian-lts-announce/2018/06/msg00009.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF62B5PJA2JDUOCKJGUQO3SPL74BEYSV/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WHIKB4TP6KBJWT2UIPWL5MWMG5QXKGEJ/
https://sourceforge.net/p/graphicsmagick/bugs/436/Third Party Advisory
https://usn.ubuntu.com/4222-1/
https://www.debian.org/security/2018/dsa-4321Third Party Advisory
http://hg.code.sf.net/p/graphicsmagick/code/rev/54f48ab2d52aMailing List, Third Party Advisory
http://www.securityfocus.com/bid/100474Third Party Advisory, VDB Entry
https://lists.debian.org/debian-lts-announce/2018/06/msg00009.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF62B5PJA2JDUOCKJGUQO3SPL74BEYSV/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WHIKB4TP6KBJWT2UIPWL5MWMG5QXKGEJ/
https://sourceforge.net/p/graphicsmagick/bugs/436/Third Party Advisory
https://usn.ubuntu.com/4222-1/
https://www.debian.org/security/2018/dsa-4321Third Party Advisory

Timeline

Published: Aug 22, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-130656.5GraphicsMagick 1.3.26 has a NULL pointer dereference vulnerability in the function SVGStartElement in coders/svg.c.CVE-2017-130666.5GraphicsMagick 1.3.26 has a memory leak vulnerability in the function CloneImage in magick/image.c.CVE-2017-130679.8QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and CVE-2017-130687.5QNAP has already patched this vulnerability. This security concern allows a remote attacker to perform an SQL injection on the application a CVE-2017-130699.8QNAP discovered a number of command injection vulnerabilities found in Music Station versions 4.8.6 (for QTS 4.2.x), 5.0.7 (for QTS 4.3.x), CVE-2017-130707.8A DLL Hijacking vulnerability in QNAP Qsync for Windows (exe) version 4.2.2.0724 and earlier could allow remote attackers to execute arbitra CVE-2017-130719.8QNAP has already patched this vulnerability. This security concern allows a remote attacker to run arbitrary commands on the QNAP Video Stat CVE-2017-130726.1Cross-site scripting (XSS) vulnerability in App Center in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20171213, QTS 4.3.4 build 20171223,CVE-2017-130736.1Cross-site scripting (XSS) vulnerability in QNAP NAS application Photo Station versions 5.2.7, 5.4.3, and their earlier versions could allow CVE-2017-130776.8Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handsh CVE-2017-130785.3Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an attac CVE-2017-130795.3Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the