CVE-2017-15277

Name of the Vulnerable Software and Affected Versions ImageMagick version 7.0.6-1 GraphicsMagick version 1.3.26

Description The issue arises from the ReadGIFImage function in coders/gif.c, which fails to initialize the palette when processing a GIF file without a global or local palette. This can lead to data leakage if the affected product is used as a library in a process handling sensitive data. An attacker could exploit this by using a specially crafted GIF image to gain unauthorized access to protected information.

Recommendations For ImageMagick version 7.0.6-1, update to a version that fixes the ReadGIFImage function issue. For GraphicsMagick version 1.3.26, update to a version that fixes the ReadGIFImage function issue. As a temporary workaround, consider restricting the use of the ReadGIFImage function in coders/gif.c until a patch is available.