CVE-2017-6335

Name of the Vulnerable Software and Affected Versions GraphicsMagick versions 1.3.25 and earlier

Description The issue is related to the QuantumTransferMode function in GraphicsMagick, which can cause a denial of service due to an out-of-bounds read and application crash. This can be triggered by a small samples per pixel value in a CMYKA TIFF file. The vulnerability is also described as a buffer overflow error that can be exploited using a specially crafted TIFF file.

Recommendations For versions 1.3.25 and earlier, consider disabling the QuantumTransferMode function as a temporary workaround until a patch is available. Restrict the processing of CMYKA TIFF files to minimize the risk of exploitation. Avoid using the QuantumTransferMode function with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.