CVE-2017-16546

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-16546
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-16546.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-16546
Downstream
DEBIAN (1)
MGASA (1)
SUSE (3)
UBUNTU (1)
Related
SUSE (3)
Published
2017-11-05T22:29:00Z
Modified
2026-10-24T14:19:46Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

The ReadWPGImage function in coders/wpg.c in ImageMagick 7.0.7-9 does not properly validate the colormap index in a WPG palette, which allows remote attackers to cause a denial of service (use of uninitialized data or invalid memory allocation) or possibly have unspecified other impact via a malformed WPG file.

Database specific 
{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "14.04"
                        },
                        {
                            "last_affected":  "14.04"
                        },
                        {
                            "introduced":  "16.04"
                        },
                        {
                            "last_affected":  "16.04"
                        },
                        {
                            "introduced":  "17.10"
                        },
                        {
                            "last_affected":  "17.10"
                        },
                        {
                            "introduced":  "18.04"
                        },
                        {
                            "last_affected":  "18.04"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "canonical:ubuntu_linux"
        },
        {
            "cpes":  [
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "8.0"
                        },
                        {
                            "last_affected":  "8.0"
                        },
                        {
                            "introduced":  "9.0"
                        },
                        {
                            "last_affected":  "9.0"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "debian:debian_linux"
        },
        {
            "cpes":  [
                "cpe:2.3:a:imagemagick:imagemagick:7.0.7-9:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "7.0.7-9"
                        },
                        {
                            "last_affected":  "7.0.7-9"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "imagemagick:imagemagick"
        }
    ]
}
References

Affected packages

Git / github.com/imagemagick/imagemagick

Affected ranges

Type
GIT
Repo
https://github.com/imagemagick/imagemagick
Events
Introduced
b964b20847be9015699bdb59b6431cf1101806ad
Last Affected
b964b20847be9015699bdb59b6431cf1101806ad
Fixed
2130bf6f89ded32ef0c88a11694f107c52566c53
Fixed
e04cf3e9524f50ca336253513d977224e083b816
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:imagemagick:imagemagick:7.0.7-9:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "7.0.7-9"
                },
                {
                    "last_affected":  "7.0.7-9"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "range":  [
                {
                    "fixed":  "2130bf6f89ded32ef0c88a11694f107c52566c53"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "e04cf3e9524f50ca336253513d977224e083b816"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

7.*
7.0.7-9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-16546.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "239037879911661576146958638240697473991",
                "6775137549662369651095735069313677055",
                "230263286374246415018531447678239154621",
                "167777559930016920714550450146410033513"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2017-16546-1a59bbd4",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/imagemagick/imagemagick/commit/2130bf6f89ded32ef0c88a11694f107c52566c53",
        "target":  {
            "file":  "coders/wpg.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "120950539745086131144898489314772176044",
            "length":  12071
        },
        "id":  "CVE-2017-16546-71e01bf3",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/imagemagick/imagemagick/commit/e04cf3e9524f50ca336253513d977224e083b816",
        "target":  {
            "file":  "coders/wpg.c",
            "function":  "ReadWPGImage"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "45674372341530071912301067453092590117",
            "length":  12161
        },
        "id":  "CVE-2017-16546-9dbc3eb1",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/imagemagick/imagemagick/commit/2130bf6f89ded32ef0c88a11694f107c52566c53",
        "target":  {
            "file":  "coders/wpg.c",
            "function":  "ReadWPGImage"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "6775137549662369651095735069313677055",
                "230263286374246415018531447678239154621",
                "265662654767131670731158258118047212943",
                "328812252873929144357777357305708714005"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2017-16546-b18edb87",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/imagemagick/imagemagick/commit/e04cf3e9524f50ca336253513d977224e083b816",
        "target":  {
            "file":  "coders/wpg.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-24T14:19:46Z"