CVE-2017-15277

ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when processing a GIF file that has neither a global nor local palette. If the affected product is used as a library loaded into a process that operates on interesting data, this data sometimes can be leaked via the uninitialized palette.

CVSS v3.0

6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS

19.19% chance of exploitation in the next 30 days, 97th percentile

Published

2017-10-12

Updated

2024-08-05

Proof-of-concept exploits (2)

• hexrom/ImageMagick-CVE-2017-152775★ · 2020-09-02
• tacticthreat/ImageMagick-CVE-2017-152775★ · 2020-09-02

References

• CVE Record
• NVD entry

Related

• CVE-2017-15276
• CVE-2017-15284
• CVE-2017-15271
• CVE-2017-15286
• CVE-2017-15270
• CVE-2017-15287