Heap-Based Buffer Over-Read in GraphicsMagick Affects Multiple Versions

CVE-2017-17782

What is CVE-2017-17782?

In GraphicsMagick version 1.3.27a, a heap-based buffer over-read vulnerability exists in the ReadOneJNGImage function implemented in the coders/png.c file. This security issue originates from improper handling of the oFFs chunk allocation, which could potentially allow an attacker to exploit this flaw and gain unauthorized access to sensitive information or cause application instability.

References