CVE-2017-17681

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In ImageMagick 7.0.7-12 Q16, an infinite loop vulnerability was found in the function ReadPSDChannelZip in coders/psd.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted psd image file.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

No affected versions have been published.

Timeline

Published
Dec 14, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-176826.5In ImageMagick 7.0.7-12 Q16, a large loop vulnerability was found in the function ExtractPostscript in coders/wpg.c, which allows attackers CVE-2017-176837.5Panda Global Protection 17.0.1 allows a system crash via a 0xb3702c44 \\.\PSMEMDriver DeviceIoControl request.CVE-2017-176847.5Panda Global Protection 17.0.1 allows a system crash via a 0xb3702c04 \\.\PSMEMDriver DeviceIoControl request.CVE-2017-176885.9The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration,CVE-2017-176895.9The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration,CVE-2017-17698.8IBM Business Process Manager 8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorCVE-2017-176918.1Homeputer CL Studio fur HomeMatic 4.0 Rel 160808 and earlier uses cleartext to exchange the username and password between server and client CVE-2017-176927.5Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaCVE-2017-176934.3Techno - Portfolio Management Panel through 2017-11-16 does not check authorization for panel/portfolio.php?action=delete requests that remoCVE-2017-176945.4Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter.CVE-2017-176958.8Techno - Portfolio Management Panel through 2017-11-16 allows SQL Injection via the panel/search.php s parameter.CVE-2017-176964.3Techno - Portfolio Management Panel through 2017-11-16 allows full path disclosure via an invalid s parameter to panel/search.php.