Attacker Value

Unknown

(0 users assessed)

Exploitability

Unknown

(0 users assessed)

User Interaction

Unknown

Privileges Required

Unknown

Attack Vector

Unknown

0

CVE-2016-2317

Disclosure Date: February 03, 2017 •

MITRE ATT&CK

Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

Multiple buffer overflows in GraphicsMagick 1.3.23 allow remote attackers to cause a denial of service (crash) via a crafted SVG file, related to the (1) TracePoint function in magick/render.c, (2) GetToken function in magick/utility.c, and (3) GetTransformTokens function in coders/svg.c.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics

Data provided by the National Vulnerability Database (NVD)

Base Score:

None

Impact Score:

Unknown

Exploitability Score:

Unknown

Vector:

Attack Vector (AV):

Unknown

Attack Complexity (AC):

Unknown

Privileges Required (PR):

Unknown

User Interaction (UI):

Unknown

Scope (S):

Unknown

Confidentiality (C):

Unknown

Integrity (I):

Unknown

Availability (A):

Unknown

Vendors

debian,
graphicsmagick,
opensuse,
suse

Products

debian linux 8.0,
graphicsmagick 1.3.23,
leap 42.1,
linux enterprise debuginfo 11,
linux enterprise software development kit 11,
opensuse 13.2,
studio onsite 1.3

References

Canonical

CVE-2016-2317 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2317)

BID-83241 (http://www.securityfocus.com/bid/83241)

Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00037.html

http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00000.html

https://bugzilla.redhat.com/show_bug.cgi?id=1306148

[oss-security] 20160531 Re: Security issues addressed in GraphicsMagick SVG reader (http://www.openwall.com/lists/oss-security/2016/05/31/3)

[oss-security] 20160520 Re: ImageMagick Is On Fire -- CVE-2016-3714 (http://www.openwall.com/lists/oss-security/2016/05/20/4)

[oss-security] 20160527 Security issues addressed in GraphicsMagick SVG reader (http://www.openwall.com/lists/oss-security/2016/05/27/4)

DSA-3746 (http://www.debian.org/security/2016/dsa-3746)

http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00010.html

[oss-security] 20160918 Re: GraphicsMagick 1.3.25 fixes some security issues (http://www.openwall.com/lists/oss-security/2016/09/18/8)

[oss-security] 20160211 Re: CVE requests: Multiple vulnerabilities in GraphicsMagick parsing and processing SVG files (http://www.openwall.com/lists/oss-security/2016/02/11/6)

[oss-security] 20160906 GraphicsMagick 1.3.25 fixes some security issues (http://www.openwall.com/lists/oss-security/2016/09/07/4)

Rapid7

Technical Analysis