Vulnerabilities > CVE-2017-14528 - Use After Free vulnerability in multiple products

047910
CVSS 6.5 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH
network
low complexity
imagemagick
debian
CWE-416
NVD
Published: 2017-09-18
Updated: 2024-11-21

Summary

The TIFFSetProfiles function in coders/tiff.c in ImageMagick 7.0.6 has incorrect expectations about whether LibTIFF TIFFGetField return values imply that data validation has occurred, which allows remote attackers to cause a denial of service (use-after-free after an invalid call to TIFFSetField, and application crash) via a crafted file.

Vulnerable Configurations

Part Description Count
Application
Imagemagick
1
OS
Debian
1

Common Weakness Enumeration (CWE)

References