CVE-2017-6335

Published: Mar 14, 2017Modified: May 13, 2026

5.5

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

The QuantumTransferMode function in coders/tiff.c in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a small samples per pixel value in a CMYKA TIFF file.

Affected (1)

Products: Graphicsmagick: Graphicsmagick

Graphicsmagick

1 product

Graphicsmagick

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Graphicsmagick Graphicsmagick	Up to 1.3.25

Related CWEs

CWE-125

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (12)

http://www.openwall.com/lists/oss-security/2017/02/28/2

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

http://www.securityfocus.com/bid/96544

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://bugzilla.redhat.com/show_bug.cgi?id=1427975

Source: cve@mitre.org

Issue TrackingPatchThird Party AdvisoryVDB Entry

https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html

Source: cve@mitre.org

https://sourceforge.net/p/graphicsmagick/code/ci/6156b4c2992d855ece6079653b3b93c3229fc4b8/

Source: cve@mitre.org

PatchThird Party Advisory

https://usn.ubuntu.com/4206-1/

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2017/02/28/2