ImageMagick 'coders/webp.c' Stack Buffer Overflow Vulnerability

Bugtraq ID:	102317
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2017-17880
Remote:	Yes
Local:	No
Published:	Dec 22 2017 12:00AM
Updated:	Dec 22 2017 12:00AM
Credit:	zz of NSFocus Security Team.
Vulnerable:	Redhat Enterprise Linux 7 Redhat Enterprise Linux 6 + Trustix Secure Enterprise Linux 2.0 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 Redhat Enterprise Linux 5 ImageMagick ImageMagick 7.0.7-16 Q16
Not Vulnerable:

ImageMagick 'coders/webp.c' Stack Buffer Overflow Vulnerability

ImageMagick is prone to a stack-based buffer-overflow vulnerability.

An attacker can exploit this issue to cause a denial-of-service condition or obtain sensitive information. Due to the nature of this issue, code execution may be possible but this has not been confirmed.

ImageMagick 7.0.7-16 Q16 is vulnerable; other versions may also be affected.

ImageMagick 'coders/webp.c' Stack Buffer Overflow Vulnerability

The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.

ImageMagick 'coders/webp.c' Stack Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

ImageMagick 'coders/webp.c' Stack Buffer Overflow Vulnerability

References:

• #907 (ImageMagick)
  
• Bug 1529316 - (CVE-2017-17880) CVE-2017-17880 ImageMagick: stack-based buffer ov (Red Hat)
  
• CVE-2017-17880 (Red Hat)
  
• ImageMagick Homepage (ImageMagick)
  
• stack-buffer-overflow in SetImageProgress #907 (ImageMagick)