CVE-2017-9098

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

ImageMagick before 7.0.5-2 and GraphicsMagick before 1.3.24 use uninitialized memory in the RLE decoder, allowing an attacker to leak sensitive information from process memory space, as demonstrated by remote attacks against ImageMagick code in a long-running server process that converts image data on behalf of multiple users. This is caused by a missing initialization step in the ReadRLEImage function in coders/rle.c.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-908

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://hg.code.sf.net/p/graphicsmagick/code/diff/0a5b75e019b6/coders/rle.cPatch, Third Party Advisory
http://www.debian.org/security/2017/dsa-3863Third Party Advisory
http://www.securityfocus.com/bid/98593Third Party Advisory, VDB Entry
https://github.com/ImageMagick/ImageMagick/commit/1c358ffe0049f768dd49a8a889c1cbf99ac9849bPatch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/08/msg00002.htmlMailing List, Third Party Advisory
https://scarybeastsecurity.blogspot.com/2017/05/bleed-continues-18-byte-file-14k-bounty.htmlExploit, Technical Description, Third Party Advisory
http://hg.code.sf.net/p/graphicsmagick/code/diff/0a5b75e019b6/coders/rle.cPatch, Third Party Advisory
http://www.debian.org/security/2017/dsa-3863Third Party Advisory
http://www.securityfocus.com/bid/98593Third Party Advisory, VDB Entry
https://github.com/ImageMagick/ImageMagick/commit/1c358ffe0049f768dd49a8a889c1cbf99ac9849bPatch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/08/msg00002.htmlMailing List, Third Party Advisory
https://scarybeastsecurity.blogspot.com/2017/05/bleed-continues-18-byte-file-14k-bounty.htmlExploit, Technical Description, Third Party Advisory

Timeline

Published: May 19, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-91008.8login.cgi on D-Link DIR-600M devices with firmware 3.04 allows remote attackers to bypass authentication by entering more than 20 blank spac CVE-2017-91019.8import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header a CVE-2017-91039.8An issue was discovered in adns before 1.5.2. pap_mailbox822 does not properly check st from adns__findlabel_next. Without this, an uninitia CVE-2017-91049.8An issue was discovered in adns before 1.5.2. It hangs, eating CPU, if a compression pointer loop is encountered.CVE-2017-91058.8An issue was discovered in adns before 1.5.2. It corrupts a pointer when a nameserver speaks first because of a wrong number of pointer dere CVE-2017-91067.5An issue was discovered in adns before 1.5.2. adns_rr_info mishandles a bogus *datap. The general pattern for formatting integers is to spri CVE-2017-91077.5An issue was discovered in adns before 1.5.2. It overruns reading a buffer if a domain ends with backslash. If the query domain ended with \CVE-2017-91087.5An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a stdin read. It is wrong to increment used as CVE-2017-91099.8An issue was discovered in adns before 1.5.2. It fails to ignore apparent answers before the first RR that was found the first time. when th CVE-2017-91106.5In OpenEXR 2.2.0, an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the application to crash.CVE-2017-91118.8In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or CVE-2017-91126.5In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.