CVE-2017-14989

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A use-after-free in RenderFreetype in MagickCore/annotate.c in ImageMagick 7.0.7-4 Q16 allows attackers to crash the application via a crafted font file, because the FT_Done_Glyph function (from FreeType 2) is called at an incorrect place in the ImageMagick code.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/ImageMagick/ImageMagick/issues/781Issue Tracking, Patch, Third Party Advisory
https://usn.ubuntu.com/3681-1/
https://www.debian.org/security/2017/dsa-4032
https://www.debian.org/security/2017/dsa-4040
https://github.com/ImageMagick/ImageMagick/issues/781Issue Tracking, Patch, Third Party Advisory
https://usn.ubuntu.com/3681-1/
https://www.debian.org/security/2017/dsa-4032
https://www.debian.org/security/2017/dsa-4040

Timeline

Published: Oct 3, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-14998.8IBM Maximo Asset Management 7.5 and 7.6 could allow a remote attacker to include arbitrary files, which could allow the attacker to execute CVE-2017-149906.5WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), CVE-2017-149915.5The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel before 4.13.4 allows local users to obtain sensitive information from uniniti CVE-2017-149926.5Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06 CVE-2017-149937.5OXID eShop Community Edition before 6.0.0 RC3 (development), 4.10.x before 4.10.6 (maintenance), and 4.9.x before 4.9.11 (legacy), Enterpris CVE-2017-149946.5ReadDCMImage in coders/dcm.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (NULL pointer dereference) via a CVE-2017-149956.1The Management Console in WSO2 Application Server 5.3.0, WSO2 Business Process Server 3.6.0, WSO2 Business Rules Server 2.2.0, WSO2 Complex CVE-2017-149976.5GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (excessive memory allocation) because of an integer underflow in CVE-2017-15006.1A Reflected Cross Site Scripting (XSS) vulnerability exists in the authorization function exposed by RESTful Web Api of IBM Worklight Framew CVE-2017-150084.8PRTG Network Monitor version 17.3.33.2830 is vulnerable to stored Cross-Site Scripting on all sensor titles, related to incorrect error hand CVE-2017-150096.1PRTG Network Monitor version 17.3.33.2830 is vulnerable to reflected Cross-Site Scripting on error.htm (the error page), via the errormsg pa CVE-2017-15015.9IBM WebSphere Application Server 8.0, 8.5, and 9.0 could provide weaker than expected security after using the Admin Console to update the w