CVE-2017-16352

GraphicsMagick 1.3.26 is vulnerable to a heap-based buffer overflow vulnerability found in the "Display visual image directory" feature of the DescribeImage() function of the magick/describe.c file. One possible way to trigger the vulnerability is to run the identify command on a specially crafted MIFF format file with the verbose flag.

• CWE-119

• ftp://ftp.graphicsmagick.org/pub/GraphicsMagick/snapshots/ChangeLog.txtRelease Notes, Vendor Advisory
• http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset%3Bnode=7292230dd185
• http://www.securityfocus.com/bid/101658Third Party Advisory, VDB Entry
• https://blogs.securiteam.com/index.php/archives/3494Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2017/11/msg00002.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/08/msg00002.htmlMailing List, Third Party Advisory
• https://usn.ubuntu.com/4232-1/
• https://www.debian.org/security/2018/dsa-4321Third Party Advisory
• https://www.exploit-db.com/exploits/43111/Exploit, Third Party Advisory, VDB Entry
• ftp://ftp.graphicsmagick.org/pub/GraphicsMagick/snapshots/ChangeLog.txtRelease Notes, Vendor Advisory
• http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset%3Bnode=7292230dd185
• http://www.securityfocus.com/bid/101658Third Party Advisory, VDB Entry
• https://blogs.securiteam.com/index.php/archives/3494Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2017/11/msg00002.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/08/msg00002.htmlMailing List, Third Party Advisory
• https://usn.ubuntu.com/4232-1/
• https://www.debian.org/security/2018/dsa-4321Third Party Advisory
• https://www.exploit-db.com/exploits/43111/Exploit, Third Party Advisory, VDB Entry

Published

Nov 1, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-16347An attacker could send an authenticated HTTP request to trig…9.9
• CVE-2017-16348An exploitable denial of service vulnerability exists in Ins…7.5
• CVE-2017-16349An exploitable XML external entity vulnerability exists in t…8.1
• CVE-2017-1635IBM Tivoli Monitoring V6 6.2.2.x could allow a remote attack…
• CVE-2017-16350Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-16351Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-16353GraphicsMagick 1.3.26 is vulnerable to a memory information …
• CVE-2017-16355In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1…4.7
• CVE-2017-16356Reflected XSS in Kubik-Rubik SIGE (aka Simple Image Gallery …
• CVE-2017-16357In radare 2.0.1, a memory corruption vulnerability exists in…
• CVE-2017-16358In radare 2.0.1, an out-of-bounds read vulnerability exists …
• CVE-2017-16359In radare 2.0.1, a pointer wraparound vulnerability exists i…