CVE-2017-16353

GraphicsMagick 1.3.26 is vulnerable to a memory information disclosure vulnerability found in the DescribeImage function of the magick/describe.c file, because of a heap-based buffer over-read. The portion of the code containing the vulnerability is responsible for printing the IPTC Profile information contained in the image. This vulnerability can be triggered with a specially crafted MIFF file. There is an out-of-bounds buffer dereference because certain increments are never checked.

• CWE-125
• CWE-200

• ftp://ftp.graphicsmagick.org/pub/GraphicsMagick/snapshots/ChangeLog.txtRelease Notes, Vendor Advisory
• http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset%3Bnode=e4e1c2a581d8
• http://www.securityfocus.com/bid/101653Third Party Advisory, VDB Entry
• https://blogs.securiteam.com/index.php/archives/3494Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2017/11/msg00002.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/06/msg00009.htmlMailing List, Third Party Advisory
• https://usn.ubuntu.com/4232-1/
• https://www.debian.org/security/2018/dsa-4321Third Party Advisory
• https://www.exploit-db.com/exploits/43111/Exploit, Third Party Advisory, VDB Entry
• ftp://ftp.graphicsmagick.org/pub/GraphicsMagick/snapshots/ChangeLog.txtRelease Notes, Vendor Advisory
• http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset%3Bnode=e4e1c2a581d8
• http://www.securityfocus.com/bid/101653Third Party Advisory, VDB Entry
• https://blogs.securiteam.com/index.php/archives/3494Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2017/11/msg00002.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/06/msg00009.htmlMailing List, Third Party Advisory
• https://usn.ubuntu.com/4232-1/
• https://www.debian.org/security/2018/dsa-4321Third Party Advisory
• https://www.exploit-db.com/exploits/43111/Exploit, Third Party Advisory, VDB Entry

Published

Nov 1, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-16348An exploitable denial of service vulnerability exists in Ins…7.5
• CVE-2017-16349An exploitable XML external entity vulnerability exists in t…8.1
• CVE-2017-1635IBM Tivoli Monitoring V6 6.2.2.x could allow a remote attack…
• CVE-2017-16350Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-16351Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-16352GraphicsMagick 1.3.26 is vulnerable to a heap-based buffer o…
• CVE-2017-16355In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1…4.7
• CVE-2017-16356Reflected XSS in Kubik-Rubik SIGE (aka Simple Image Gallery …
• CVE-2017-16357In radare 2.0.1, a memory corruption vulnerability exists in…
• CVE-2017-16358In radare 2.0.1, an out-of-bounds read vulnerability exists …
• CVE-2017-16359In radare 2.0.1, a pointer wraparound vulnerability exists i…
• CVE-2017-16360An issue was discovered in Adobe Acrobat and Reader: 2017.01…