CVE-2017-11140

Published: Jul 10, 2017Modified: May 13, 2026

5.5

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

The ReadJPEGImage function in coders/jpeg.c in GraphicsMagick 1.3.26 creates a pixel cache before a successful read of a scanline, which allows remote attackers to cause a denial of service (resource consumption) via crafted JPEG files.

Affected (1)

Products: Graphicsmagick: Graphicsmagick

Graphicsmagick

1 product

Graphicsmagick

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Graphicsmagick Graphicsmagick	Version 1.3.26

Related CWEs

CWE-400

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

CWE-755

Improper Handling of Exceptional Conditions

The product does not handle or incorrectly handles an exceptional condition.

References (10)

http://hg.code.sf.net/p/graphicsmagick/code/rev/b4139088b49a

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

http://www.securityfocus.com/bid/99503

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html

Source: cve@mitre.org

https://usn.ubuntu.com/4206-1/

Source: cve@mitre.org

https://www.debian.org/security/2018/dsa-4321

Source: cve@mitre.org

http://hg.code.sf.net/p/graphicsmagick/code/rev/b4139088b49a