Candidate: CVE-2017-11722
PublicDate: 2017-07-28 13:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11722
 http://hg.code.sf.net/p/graphicsmagick/code/rev/f423ba88ca4e
Description:
 The WriteOnePNGImage function in coders/png.c in GraphicsMagick 1.3.26
 allows remote attackers to cause a denial of service (out-of-bounds read
 and application crash) via a crafted file, because the program's actual
 control flow was inconsistent with its indentation. This resulted in a
 logging statement executing outside of a loop, and consequently using an
 invalid array index corresponding to the loop's exit condition.
Ubuntu-Description:
Notes:
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H [6.5 MEDIUM]

Patches_graphicsmagick:
 upstream: http://hg.code.sf.net/p/graphicsmagick/code/rev/f423ba88ca4e
upstream_graphicsmagick: needed
precise/esm_graphicsmagick: DNE
trusty_graphicsmagick: ignored (out of standard support)
trusty/esm_graphicsmagick: not-affected (code not present)
vivid/ubuntu-core_graphicsmagick: DNE
xenial_graphicsmagick: not-affected (code not present)
zesty_graphicsmagick: ignored (reached end-of-life)
artful_graphicsmagick: ignored (reached end-of-life)
bionic_graphicsmagick: not-affected (1.3.26-4)
cosmic_graphicsmagick: not-affected (1.3.26-4)
disco_graphicsmagick: not-affected (1.3.26-4)
eoan_graphicsmagick: not-affected (1.3.26-4)
devel_graphicsmagick: not-affected (1.3.26-4)