CVE-2017-14528

The TIFFSetProfiles function in coders/tiff.c in ImageMagick 7.0.6 has incorrect expectations about whether LibTIFF TIFFGetField return values imply that data validation has occurred, which allows remote attackers to cause a denial of service (use-after-free after an invalid call to TIFFSetField, and application crash) via a crafted file.

• CWE-416

• http://bugzilla.maptools.org/show_bug.cgi?id=2730Exploit, Issue Tracking, Third Party Advisory
• http://www.securityfocus.com/bid/100875Third Party Advisory, VDB Entry
• https://lists.debian.org/debian-lts-announce/2021/01/msg00010.htmlMailing List, Third Party Advisory
• https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=32560Issue Tracking, Vendor Advisory
• http://bugzilla.maptools.org/show_bug.cgi?id=2730Exploit, Issue Tracking, Third Party Advisory
• http://www.securityfocus.com/bid/100875Third Party Advisory, VDB Entry
• https://lists.debian.org/debian-lts-announce/2021/01/msg00010.htmlMailing List, Third Party Advisory
• https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=32560Issue Tracking, Vendor Advisory

Published

Sep 18, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-14522In WonderCMS 2.3.1, the application's input fields accept ar…6.1
• CVE-2017-14523WonderCMS 2.3.1 is vulnerable to an HTTP Host header injecti…
• CVE-2017-14524Multiple open redirect vulnerabilities in OpenText Documentu…
• CVE-2017-14525Multiple open redirect vulnerabilities in OpenText Documentu…
• CVE-2017-14526Multiple XML external entity (XXE) vulnerabilities in the Op…
• CVE-2017-14527Multiple XML external entity (XXE) vulnerabilities in the Op…
• CVE-2017-14529The pe_print_idata function in peXXigen.c in the Binary File…
• CVE-2017-1453IBM Security Access Manager Appliance 9.0.3 could allow a re…
• CVE-2017-14530WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7…8
• CVE-2017-14531ImageMagick 7.0.7-0 has a memory exhaustion issue in ReadSUN…
• CVE-2017-14532ImageMagick 7.0.7-0 has a NULL Pointer Dereference in TIFFIg…
• CVE-2017-14533ImageMagick 7.0.6-6 has a memory leak in ReadMATImage in cod…