CVE-2017-13133
In ImageMagick 7.0.6-8, the load_level function in coders/xcf.c lacks offset validation, which...
6.5 MediumFix available
In ImageMagick 7.0.6-8, the load_level function in coders/xcf.c lacks offset validation, which allows attackers to cause a denial of service (load_tile memory exhaustion) via a crafted file.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
1.63%Up 0.1 points since Apr 14, 2021
What each source reports
NVD Score used
In ImageMagick 7.0.6-8, the load_level function in coders/xcf.c lacks offset validation, which allows attackers to cause a denial of service (load_tile memory exhaustion) via a crafted file.
- Record
CVE-2017-13133- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 7.1 High
AV:N/AC:M/Au:N/C:N/I:N/A:C - Weakness
- CWE-770
- Updated
- 2026-11-02
CVE List No score
In ImageMagick 7.0.6-8, the load_level function in coders/xcf.c lacks offset validation, which allows attackers to cause a denial of service (load_tile memory exhaustion) via a crafted file.
- Record
CVE-2017-13133- Updated
- 2026-11-02
EUVDEUVD-2017-4650 No score
In ImageMagick 7.0.6-8, the load_level function in coders/xcf.c lacks offset validation, which allows attackers to cause a denial of service (load_tile memory exhaustion) via a crafted file.
- Record
EUVD-2017-4650- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r2q6-58c8-8c3j
In ImageMagick 7.0.6-8, the load_level function in coders/xcf.c lacks offset validation, which...
In ImageMagick 7.0.6-8, the load_level function in coders/xcf.c lacks offset validation, which allows attackers to cause a denial of service (load_tile memory exhaustion) via a crafted file.
- Record
GHSA-r2q6-58c8-8c3j- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
In ImageMagick 7.0.6-8, the load_level function in coders/xcf.c lacks offset validation, which allows attackers to cause a denial of service (load_tile memory exhaustion) via a crafted file.
- Record
CVE-2017-13133- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-13133
In ImageMagick 7.0.6-8, the load_level function in coders/xcf.c lacks offset validation, which allows attackers to cause a denial of service (load_tile memory exhaustion) via a crafted file.
- Record
DEBIAN-CVE-2017-13133- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-13133
In ImageMagick 7.0.6-8, the load_level function in coders/xcf.c lacks offset validation, which allows attackers to cause a denial of service (load_tile memory exhaustion) via a crafted file.
- Record
UBUNTU-CVE-2017-13133- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2017:2949-1 No score
Security update for ImageMagick
This update for ImageMagick fixes the following issues:
Security issues fixed:
- CVE-2017-15033: A denial of service attack (memory leak) was fixed in ReadYUVImage in coders/yuv.c [bsc#1061873]
- CVE-2017-11446: An infinite loop in ReadPESImage was fixed. (bsc#1049379)
- CVE-2017-12433: A memory leak in ReadPESImage in coders/pes.c was fixed. (bsc#1052545)
- CVE-2017-12428: A memory leak in ReadWMFImage in coders/wmf.c was fixed. (bsc#1052249)
- CVE-2017-12431: A use-after-free in ReadWMFImage was fixed. (bsc#1052253)
- CVE-2017-11534: A memory leak in the lite_font_map() in coders/wmf.c was fixed. (bsc#1050135)
- CVE-2017-13133: A memory exhaustion in load_level function in coders/xcf.c was fixed. (bsc#1055219)
- CVE-2017-13139: A out-of-bounds read in the ReadOneMNGImage was fixed. (bsc#1055430)
This update also reverts an incorrect fix for CVE-2016-7530 [bsc#1054924].
- Record
SUSE-SU-2017:2949-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:3168-1 No score
Security update for ImageMagick
This update for ImageMagick fixes several issues.
These security issues were fixed:
- CVE-2017-11534: Processing a crafted file in convert could have lead to a Memory Leak in the lite_font_map() function in coders/wmf.c (bsc#1050135).
- CVE-2017-13133: The load_level function in coders/xcf.c lacked offset validation, which allowed attackers to cause a denial of service (load_tile memory exhaustion) via a crafted file (bsc#1055219).
- CVE-2017-13139: The ReadOneMNGImage function in coders/png.c had an out-of-bounds read with the MNG CLIP chunk (bsc#1055430).
- CVE-2017-15033: Fixed a memory leak in ReadYUVImage in coders/yuv.c (bsc#1061873).
- Record
SUSE-SU-2017:3168-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
imagemagickDebian:12 |
before 8:6.9.9.34+dfsg-3 | 8:6.9.9.34+dfsg-3 |
imagemagickDebian:13 |
before 8:6.9.9.34+dfsg-3 | 8:6.9.9.34+dfsg-3 |
imagemagickDebian:14 |
before 8:6.9.9.34+dfsg-3 | 8:6.9.9.34+dfsg-3 |
imagemagickDebian:7 From an advisory covering 74 CVEs |
before 8:6.7.7.10-5+deb7u16, plus listed versions 8:6.7.7.10-58:6.7.7.10-5+deb7u108:6.7.7.10-5+deb7u118:6.7.7.10-5+deb7u128:6.7.7.10-5+deb7u13 Show 10 moreShow less8:6.7.7.10-5+deb7u148:6.7.7.10-5+deb7u158:6.7.7.10-5+deb7u28:6.7.7.10-5+deb7u38:6.7.7.10-5+deb7u48:6.7.7.10-5+deb7u58:6.7.7.10-5+deb7u68:6.7.7.10-5+deb7u78:6.7.7.10-5+deb7u88:6.7.7.10-5+deb7u9 |
8:6.7.7.10-5+deb7u16 |
imagemagickDebian:8 From an advisory covering 50 CVEs |
before 8:6.8.9.9-5+deb8u16, plus listed versions 8:6.8.9.9-58:6.8.9.9-5+deb8u18:6.8.9.9-5+deb8u108:6.8.9.9-5+deb8u118:6.8.9.9-5+deb8u12 Show 11 moreShow less8:6.8.9.9-5+deb8u138:6.8.9.9-5+deb8u148:6.8.9.9-5+deb8u158:6.8.9.9-5+deb8u28:6.8.9.9-5+deb8u38:6.8.9.9-5+deb8u48:6.8.9.9-5+deb8u58:6.8.9.9-5+deb8u68:6.8.9.9-5+deb8u78:6.8.9.9-5+deb8u88:6.8.9.9-5+deb8u9 |
8:6.8.9.9-5+deb8u16 |
imagemagickDebian:9 From an advisory covering 50 CVEs |
before 8:6.9.7.4+dfsg-11+deb9u10, plus listed versions 8:6.9.7.4+dfsg-118:6.9.7.4+dfsg-11+deb9u18:6.9.7.4+dfsg-11+deb9u28:6.9.7.4+dfsg-11+deb9u38:6.9.7.4+dfsg-11+deb9u4 Show 5 moreShow less8:6.9.7.4+dfsg-11+deb9u58:6.9.7.4+dfsg-11+deb9u68:6.9.7.4+dfsg-11+deb9u78:6.9.7.4+dfsg-11+deb9u88:6.9.7.4+dfsg-11+deb9u9 |
8:6.9.7.4+dfsg-11+deb9u10 |
ImageMagickSUSE:Linux Enterprise Desktop 12 SP2 From an advisory covering 9 CVEs |
before 6.8.8.1-71.12.1 | 6.8.8.1-71.12.1 |
ImageMagickSUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 9 CVEs |
before 6.8.8.1-71.12.1 | 6.8.8.1-71.12.1 |
ImageMagickSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 From an advisory covering 9 CVEs |
before 6.8.8.1-71.12.1 | 6.8.8.1-71.12.1 |
ImageMagickSUSE:Linux Enterprise Software Development Kit 12 SP2 From an advisory covering 9 CVEs |
before 6.8.8.1-71.12.1 | 6.8.8.1-71.12.1 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ImageMagickSUSE:Linux Enterprise Software Development Kit 12 SP3 From an advisory covering 9 CVEs |
before 6.8.8.1-71.12.1 | 6.8.8.1-71.12.1 |
ImageMagickSUSE:Linux Enterprise Server 12 SP2 From an advisory covering 9 CVEs |
before 6.8.8.1-71.12.1 | 6.8.8.1-71.12.1 |
ImageMagickSUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 9 CVEs |
before 6.8.8.1-71.12.1 | 6.8.8.1-71.12.1 |
ImageMagickSUSE:Linux Enterprise Server 12 SP3 From an advisory covering 9 CVEs |
before 6.8.8.1-71.12.1 | 6.8.8.1-71.12.1 |
ImageMagickSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 9 CVEs |
before 6.8.8.1-71.12.1 | 6.8.8.1-71.12.1 |
ImageMagickSUSE:Linux Enterprise Workstation Extension 12 SP2 From an advisory covering 9 CVEs |
before 6.8.8.1-71.12.1 | 6.8.8.1-71.12.1 |
ImageMagickSUSE:Linux Enterprise Workstation Extension 12 SP3 From an advisory covering 9 CVEs |
before 6.8.8.1-71.12.1 | 6.8.8.1-71.12.1 |
ImageMagickSUSE:Linux Enterprise Software Development Kit 11 SP4 From an advisory covering 4 CVEs |
before 6.4.3.6-7.78.8.1 | 6.4.3.6-7.78.8.1 |
ImageMagickSUSE:Linux Enterprise Server 11 SP4 From an advisory covering 4 CVEs |
before 6.4.3.6-7.78.8.1 | 6.4.3.6-7.78.8.1 |
ImageMagickSUSE:Linux Enterprise Server for SAP Applications 11 SP4 From an advisory covering 4 CVEs |
before 6.4.3.6-7.78.8.1 | 6.4.3.6-7.78.8.1 |
imagemagickUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 8:6.7.7.10-5ubuntu38:6.7.7.10-5ubuntu48:6.7.7.10-6ubuntu18:6.7.7.10-6ubuntu28:6.7.7.10-6ubuntu3 Show 39 moreShow less8:6.7.7.10-6ubuntu3.18:6.7.7.10-6ubuntu3.28:6.7.7.10-6ubuntu3.38:6.7.7.10-6ubuntu3.48:6.7.7.10-6ubuntu3.58:6.7.7.10-6ubuntu3.68:6.7.7.10-6ubuntu3.78:6.7.7.10-6ubuntu3.88:6.7.7.10-6ubuntu3.98:6.7.7.10-6ubuntu3.118:6.7.7.10-6ubuntu3.128:6.7.7.10-6ubuntu3.138:6.7.7.10-6ubuntu3.13+esm18:6.7.7.10-6ubuntu3.13+esm28:6.7.7.10-6ubuntu3.13+esm38:6.7.7.10-6ubuntu3.13+esm48:6.7.7.10-6ubuntu3.13+esm58:6.7.7.10-6ubuntu3.13+esm68:6.7.7.10-6ubuntu3.13+esm78:6.7.7.10-6ubuntu3.13+esm88:6.7.7.10-6ubuntu3.13+esm98:6.7.7.10-6ubuntu3.13+esm108:6.7.7.10-6ubuntu3.13+esm118:6.7.7.10-6ubuntu3.13+esm128:6.7.7.10-6ubuntu3.13+esm138:6.7.7.10-6ubuntu3.13+esm148:6.7.7.10-6ubuntu3.13+esm158:6.7.7.10-6ubuntu3.13+esm168:6.7.7.10-6ubuntu3.13+esm178:6.7.7.10-6ubuntu3.13+esm188:6.7.7.10-6ubuntu3.13+esm198:6.7.7.10-6ubuntu3.13+esm208:6.7.7.10-6ubuntu3.13+esm218:6.7.7.10-6ubuntu3.13+esm228:6.7.7.10-6ubuntu3.13+esm238:6.7.7.10-6ubuntu3.13+esm248:6.7.7.10-6ubuntu3.13+esm258:6.7.7.10-6ubuntu3.13+esm268:6.7.7.10-6ubuntu3.13+esm27 |
None known |
imagemagickUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 8:6.8.9.9-5ubuntu28:6.8.9.9-68:6.8.9.9-6build18:6.8.9.9-78:6.8.9.9-7ubuntu1 Show 45 moreShow less8:6.8.9.9-7ubuntu28:6.8.9.9-7ubuntu38:6.8.9.9-7ubuntu48:6.8.9.9-7ubuntu58:6.8.9.9-7ubuntu5.18:6.8.9.9-7ubuntu5.28:6.8.9.9-7ubuntu5.38:6.8.9.9-7ubuntu5.48:6.8.9.9-7ubuntu5.58:6.8.9.9-7ubuntu5.68:6.8.9.9-7ubuntu5.78:6.8.9.9-7ubuntu5.88:6.8.9.9-7ubuntu5.98:6.8.9.9-7ubuntu5.118:6.8.9.9-7ubuntu5.128:6.8.9.9-7ubuntu5.138:6.8.9.9-7ubuntu5.148:6.8.9.9-7ubuntu5.158:6.8.9.9-7ubuntu5.168:6.8.9.9-7ubuntu5.16+esm18:6.8.9.9-7ubuntu5.16+esm28:6.8.9.9-7ubuntu5.16+esm38:6.8.9.9-7ubuntu5.16+esm48:6.8.9.9-7ubuntu5.16+esm58:6.8.9.9-7ubuntu5.16+esm68:6.8.9.9-7ubuntu5.16+esm78:6.8.9.9-7ubuntu5.16+esm88:6.8.9.9-7ubuntu5.16+esm98:6.8.9.9-7ubuntu5.16+esm108:6.8.9.9-7ubuntu5.16+esm118:6.8.9.9-7ubuntu5.16+esm128:6.8.9.9-7ubuntu5.16+esm138:6.8.9.9-7ubuntu5.16+esm148:6.8.9.9-7ubuntu5.16+esm158:6.8.9.9-7ubuntu5.16+esm168:6.8.9.9-7ubuntu5.16+esm178:6.8.9.9-7ubuntu5.16+esm188:6.8.9.9-7ubuntu5.16+esm198:6.8.9.9-7ubuntu5.16+esm208:6.8.9.9-7ubuntu5.16+esm218:6.8.9.9-7ubuntu5.16+esm228:6.8.9.9-7ubuntu5.16+esm238:6.8.9.9-7ubuntu5.16+esm248:6.8.9.9-7ubuntu5.16+esm258:6.8.9.9-7ubuntu5.16+esm26 |
None known |
imagemagickUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 8:6.9.7.4+dfsg-16ubuntu28:6.9.7.4+dfsg-16ubuntu38:6.9.7.4+dfsg-16ubuntu48:6.9.7.4+dfsg-16ubuntu58:6.9.7.4+dfsg-16ubuntu6 Show 29 moreShow less8:6.9.7.4+dfsg-16ubuntu6.28:6.9.7.4+dfsg-16ubuntu6.38:6.9.7.4+dfsg-16ubuntu6.48:6.9.7.4+dfsg-16ubuntu6.78:6.9.7.4+dfsg-16ubuntu6.88:6.9.7.4+dfsg-16ubuntu6.98:6.9.7.4+dfsg-16ubuntu6.118:6.9.7.4+dfsg-16ubuntu6.128:6.9.7.4+dfsg-16ubuntu6.138:6.9.7.4+dfsg-16ubuntu6.148:6.9.7.4+dfsg-16ubuntu6.158:6.9.7.4+dfsg-16ubuntu6.15+esm18:6.9.7.4+dfsg-16ubuntu6.15+esm28:6.9.7.4+dfsg-16ubuntu6.15+esm38:6.9.7.4+dfsg-16ubuntu6.15+esm48:6.9.7.4+dfsg-16ubuntu6.15+esm58:6.9.7.4+dfsg-16ubuntu6.15+esm68:6.9.7.4+dfsg-16ubuntu6.15+esm78:6.9.7.4+dfsg-16ubuntu6.15+esm88:6.9.7.4+dfsg-16ubuntu6.15+esm98:6.9.7.4+dfsg-16ubuntu6.15+esm108:6.9.7.4+dfsg-16ubuntu6.15+esm118:6.9.7.4+dfsg-16ubuntu6.15+esm128:6.9.7.4+dfsg-16ubuntu6.15+esm138:6.9.7.4+dfsg-16ubuntu6.15+esm148:6.9.7.4+dfsg-16ubuntu6.15+esm158:6.9.7.4+dfsg-16ubuntu6.15+esm168:6.9.7.4+dfsg-16ubuntu6.15+esm178:6.9.7.4+dfsg-16ubuntu6.15+esm18 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-13133 is a medium vulnerability (CVSS 6.5) in Imagemagick, published August 23, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.63%, the 76th percentile. Fixed in imagemagick 8:6.9.9.34+dfsg-3.
References
securityfocus.com/bid/100479
security.gentoo.org/glsa/201711-07
github.com/ImageMagick/ImageMagick/issues/679
lists.debian.org/debian-lts-announce/2019/05/msg00015.html
nvd.nist.gov/vuln/detail/CVE-2017-13133
Show 24 moreShow less
security-tracker.debian.org/tracker/CVE-2017-13133
suse.com/support/update/announcement/2017/suse-su-20172949-1
bugzilla.suse.com/1049379
ubuntu.com/security/CVE-2017-13133
cve.org/CVERecord?id=CVE-2017-13133