Search for vulnerabilities
Vulnerability details: VCID-cgdb-1ktx-aaaq
Vulnerability ID VCID-cgdb-1ktx-aaaq
Aliases CVE-2017-14173
Summary In the function ReadTXTImage() in coders/txt.c in ImageMagick 7.0.6-10, an integer overflow might occur for the addition operation "GetQuantumRange(depth)+1" when "depth" is large, producing a smaller value than expected. As a result, an infinite loop would occur for a crafted TXT file that claims a very large "max_value" value.
Status Published
Exploitability 0.5
Weighted Severity 5.9
Risk 3.0
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-190 Integer Overflow or Wraparound
CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
System Score Found at
generic_textual Low http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-14173.html
cvssv3 3.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-14173.json
epss 0.00411 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.00411 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.00411 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.00411 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.00411 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.00411 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.00411 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.00411 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.00411 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.00411 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.00411 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.00519 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.00519 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.00519 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.00519 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.01402 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
epss 0.02839 https://api.first.org/data/v1/epss?cve=CVE-2017-14173
rhbs low https://bugzilla.redhat.com/show_bug.cgi?id=1489702
generic_textual Low https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14173
cvssv2 4.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3 3.7 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv2 4.3 https://nvd.nist.gov/vuln/detail/CVE-2017-14173
cvssv3 6.5 https://nvd.nist.gov/vuln/detail/CVE-2017-14173
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2017-14173
generic_textual Low https://ubuntu.com/security/notices/USN-3681-1
Reference id Reference type URL
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-14173.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-14173.json
https://api.first.org/data/v1/epss?cve=CVE-2017-14173
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14173
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/ImageMagick/ImageMagick/commit/50f54462076648ac2e36c3f58f4dadd4babbf1c9
https://github.com/ImageMagick/ImageMagick/issues/713
https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html
https://security.gentoo.org/glsa/201711-07
https://ubuntu.com/security/notices/USN-3681-1
https://usn.ubuntu.com/3681-1/
1489702 https://bugzilla.redhat.com/show_bug.cgi?id=1489702
875504 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=875504
cpe:2.3:a:imagemagick:imagemagick:7.0.6-10:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:imagemagick:imagemagick:7.0.6-10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
CVE-2017-14173 https://nvd.nist.gov/vuln/detail/CVE-2017-14173
No exploits are available.
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-14173.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2017-14173
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2017-14173
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2017-14173
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.74427
EPSS Score 0.00411
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.