CVE-2017-9501

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In ImageMagick 7.0.5-7 Q16, an assertion failure was found in the function LockSemaphoreInfo, which allows attackers to cause a denial of service via a crafted file.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-617

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/98943Third Party Advisory, VDB Entry
https://github.com/ImageMagick/ImageMagick/commit/01843366d6a7b96e22ad7bb67f3df7d9fd4d5d74Issue Tracking, Patch, Third Party Advisory
https://github.com/ImageMagick/ImageMagick/issues/491Issue Tracking, Patch, Third Party Advisory
http://www.securityfocus.com/bid/98943Third Party Advisory, VDB Entry
https://github.com/ImageMagick/ImageMagick/commit/01843366d6a7b96e22ad7bb67f3df7d9fd4d5d74Issue Tracking, Patch, Third Party Advisory
https://github.com/ImageMagick/ImageMagick/issues/491Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Jun 7, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-95025.3In curl before 7.54.1 on Windows and DOS, libcurl's default protocol function, which is the logic that allows an application to set which pr CVE-2017-95035.5QEMU (aka Quick Emulator), when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS privileged users t CVE-2017-95054.3Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notifica CVE-2017-95066.1The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows CVE-2017-95075.4The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to inject arbitrary HTML CVE-2017-95085.4Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a CVE-2017-95095.4The review file upload resource in Atlassian Crucible before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript vi CVE-2017-95105.4The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript v CVE-2017-95117.5The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary file CVE-2017-95127.5The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sen CVE-2017-95135.4Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated attackers to watch any C CVE-2017-95148.8Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restric