CVE-2017-12640

high

Published 2017-08-07 · Modified 2026-05-13

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

8.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v4 NEW

—

not yet in upstream

VIR risk

8.8

Description

ImageMagick 7.0.6-1 has an out-of-bounds read vulnerability in ReadOneMNGImage in coders/png.c.

Predictions

Exploit likelihood

92%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Debian Security Tracker · View original ↗ · DFSG

CVE-2017-12640 NameCVE-2017-12640 DescriptionImageMagick 7.0.6-1 has an out-of-bounds read vulnerability in ReadOneMNGImage in coders/png.c. SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) ReferencesDLA-1081-1, DSA-4019-1, DSA-4040-1 Debian Bugs870106 Vulnerable and fixed packages The…

CVE-2017-12640

Name	CVE-2017-12640
Description	ImageMagick 7.0.6-1 has an out-of-bounds read vulnerability in ReadOneMNGImage in coders/png.c.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1081-1, DSA-4019-1, DSA-4040-1
Debian Bugs	870106

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
imagemagick (PTS)	bullseye	8:6.9.11.60+dfsg-1.3+deb11u4	fixed
	bullseye (security)	8:6.9.11.60+dfsg-1.3+deb11u12	fixed
	bookworm	8:6.9.11.60+dfsg-1.6+deb12u9	fixed
	bookworm (security)	8:6.9.11.60+dfsg-1.6+deb12u10	fixed
	trixie	8:7.1.1.43+dfsg1-1+deb13u8	fixed
	trixie (security)	8:7.1.1.43+dfsg1-1+deb13u9	fixed
	forky, sid	8:7.1.2.23+dfsg1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
imagemagick	source	wheezy	8:6.7.7.10-5+deb7u16	DLA-1081-1
imagemagick	source	jessie	8:6.8.9.9-5+deb8u11	DSA-4040-1
imagemagick	source	stretch	8:6.9.7.4+dfsg-11+deb9u2	DSA-4019-1
imagemagick	source	(unstable)	8:6.9.7.4+dfsg-15		870106

Notes

https://github.com/ImageMagick/ImageMagick/issues/542
https://github.com/ImageMagick/ImageMagick/commit/78d4c5db50fbab0b4beb69c46c6167f2c6513dec

Home - Debian Security - Source (Git)

Apply commands

text fix

Notes

https://github.com/ImageMagick/ImageMagick/issues/542https://github.com/ImageMagick/ImageMagick/commit/78d4c5db50fbab0b4beb69c46c6167f2c6513dec

OS impact

SUSE Affected 1 release

Version	Status	Fixed in
—	Affected	—

Debian Mixed 7 releases

Version	Status	Fixed in
trixie	Fixed	`8:6.9.7.4+dfsg-15`
sid	Fixed	`8:6.9.7.4+dfsg-15`
forky	Fixed	`8:6.9.7.4+dfsg-15`
bullseye	Fixed	`8:6.9.7.4+dfsg-15`
bookworm	Fixed	`8:6.9.7.4+dfsg-15`
9.0	Affected	—
8.0	Affected	—

Application impact

Vendor	Product	Versions	Fixed
imagemagick	imagemagick	`7.0.6-1`

References

CWEs

CWE-125

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.