Search for vulnerabilities
Vulnerability details: VCID-wbnz-b12d-tbcb
Vulnerability ID VCID-wbnz-b12d-tbcb
Aliases CVE-2017-18229
Summary An issue was discovered in GraphicsMagick 1.3.26. An allocation failure vulnerability was found in the function ReadTIFFImage in coders/tiff.c, which allows attackers to cause a denial of service via a crafted file, because file size is not properly used to restrict scanline, strip, and tile allocations.
Status Published
Exploitability 0.5
Weighted Severity 5.9
Risk 3.0
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-770 Allocation of Resources Without Limits or Throttling
System Score Found at
cvssv3 3.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-18229.json
epss 0.00635 https://api.first.org/data/v1/epss?cve=CVE-2017-18229
epss 0.00635 https://api.first.org/data/v1/epss?cve=CVE-2017-18229
epss 0.00635 https://api.first.org/data/v1/epss?cve=CVE-2017-18229
epss 0.00635 https://api.first.org/data/v1/epss?cve=CVE-2017-18229
epss 0.00635 https://api.first.org/data/v1/epss?cve=CVE-2017-18229
epss 0.00635 https://api.first.org/data/v1/epss?cve=CVE-2017-18229
epss 0.00635 https://api.first.org/data/v1/epss?cve=CVE-2017-18229
epss 0.00635 https://api.first.org/data/v1/epss?cve=CVE-2017-18229
epss 0.00635 https://api.first.org/data/v1/epss?cve=CVE-2017-18229
epss 0.00635 https://api.first.org/data/v1/epss?cve=CVE-2017-18229
epss 0.00635 https://api.first.org/data/v1/epss?cve=CVE-2017-18229
epss 0.00635 https://api.first.org/data/v1/epss?cve=CVE-2017-18229
epss 0.00635 https://api.first.org/data/v1/epss?cve=CVE-2017-18229
epss 0.00635 https://api.first.org/data/v1/epss?cve=CVE-2017-18229
epss 0.00635 https://api.first.org/data/v1/epss?cve=CVE-2017-18229
epss 0.00635 https://api.first.org/data/v1/epss?cve=CVE-2017-18229
epss 0.00635 https://api.first.org/data/v1/epss?cve=CVE-2017-18229
epss 0.00635 https://api.first.org/data/v1/epss?cve=CVE-2017-18229
cvssv3 4 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv2 4.3 https://nvd.nist.gov/vuln/detail/CVE-2017-18229
cvssv3 6.5 https://nvd.nist.gov/vuln/detail/CVE-2017-18229
Reference id Reference type URL
http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/752c0b41fa32
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-18229.json
https://api.first.org/data/v1/epss?cve=CVE-2017-18229
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10794
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10799
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10800
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11102
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11139
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11140
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11403
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11636
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11637
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11638
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11641
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11642
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11643
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11722
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12935
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12936
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12937
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13063
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13064
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13065
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13134
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13737
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13775
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13776
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13777
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14314
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14504
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14733
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14994
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14997
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15238
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15277
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15930
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16352
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16353
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16545
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16547
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16669
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17498
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17500
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17501
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17502
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17503
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17782
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17783
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17912
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17913
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17915
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18219
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18220
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18229
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18230
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18231
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5685
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6799
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9018
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://lists.debian.org/debian-lts-announce/2018/03/msg00025.html
https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html
https://sourceforge.net/p/graphicsmagick/bugs/461/
https://www.debian.org/security/2018/dsa-4321
1558749 https://bugzilla.redhat.com/show_bug.cgi?id=1558749
cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.26:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.26:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
CVE-2017-18229 https://nvd.nist.gov/vuln/detail/CVE-2017-18229
USN-4266-1 https://usn.ubuntu.com/4266-1/
No exploits are available.
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-18229.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2017-18229
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2017-18229
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.69488
EPSS Score 0.00635
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:34:27.382501+00:00 Ubuntu USN Importer Import https://usn.ubuntu.com/4266-1/ 37.0.0