NVD Vulnerability Detail

CVE-2017-14649

Summary	ReadOneJNGImage in coders/png.c in GraphicsMagick version 1.3.26 does not properly validate JNG data, leading to a denial of service (assertion failure in magick/pixel_cache.c, and application crash).
Publication Date	Sept. 22, 2017, 2:29 a.m.
Registration Date	Jan. 26, 2021, 1:16 p.m.
Last Update	Nov. 21, 2024, 12:13 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.26:::::::*

Related information, measures and tools

No	URL	タグ
1	http://hg.code.sf.net/p/graphicsmagick/code/rev/358608a46f0a	Issue Tracking Patch Third Party Advisory
2	http://hg.code.sf.net/p/graphicsmagick/code/rev/358608a46f0a	Issue Tracking Patch Third Party Advisory
3	http://www.securityfocus.com/bid/100958	Third Party Advisory VDB Entry
4	http://www.securityfocus.com/bid/100958	Third Party Advisory VDB Entry
5	https://blogs.gentoo.org/ago/2017/09/19/graphicsmagick-assertion-failure-in-pixel_cache-c/	Patch Third Party Advisory VDB Entry
6	https://blogs.gentoo.org/ago/2017/09/19/graphicsmagick-assertion-failure-in-pixel_cache-c/	Patch Third Party Advisory VDB Entry
7	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF62B5PJA2JDUOCKJGUQO3SPL74BEYSV/
8	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF62B5PJA2JDUOCKJGUQO3SPL74BEYSV/
9	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WHIKB4TP6KBJWT2UIPWL5MWMG5QXKGEJ/
10	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WHIKB4TP6KBJWT2UIPWL5MWMG5QXKGEJ/
11	https://sourceforge.net/p/graphicsmagick/bugs/439/	Issue Tracking Patch Third Party Advisory
12	https://sourceforge.net/p/graphicsmagick/bugs/439/	Issue Tracking Patch Third Party Advisory
13	https://usn.ubuntu.com/4232-1/
14	https://usn.ubuntu.com/4232-1/

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-617	到達可能なアサーション	https://cwe.mitre.org/data/definitions/617.html

JVN Vulnerability Information

GraphicsMagick における入力確認に関する脆弱性

Title	GraphicsMagick における入力確認に関する脆弱性
Summary	GraphicsMagick には、入力確認に関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Sept. 10, 2017, midnight
Registration Date	Oct. 11, 2017, 4:47 p.m.
Last Update	Oct. 11, 2017, 4:47 p.m.

Affected System

GraphicsMagick

GraphicsMagick 1.3.26

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-14649	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14649
National Vulnerability Database (NVD)
2	CVE-2017-14649	https://nvd.nist.gov/vuln/detail/CVE-2017-14649

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
Mercurial
1	Fix Issue 439	http://hg.code.sf.net/p/graphicsmagick/code/rev/358608a46f0a
SourceForge
2	#439 assertion failure in magick/pixel_cache.c:1089	https://sourceforge.net/p/graphicsmagick/bugs/439/

Change Log

No	Changed Details	Date of change
0	[2017年10月11日] 掲載	Feb. 17, 2018, 10:37 a.m.