CVE-2017-6498
An issue was discovered in ImageMagick 6.9.7. Incorrect TGA files could trigger assertion...
An issue was discovered in ImageMagick 6.9.7. Incorrect TGA files could trigger assertion failures, thus leading to DoS.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in ImageMagick 6.9.7. Incorrect TGA files could trigger assertion failures, thus leading to DoS.
- Record
CVE-2017-6498- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in ImageMagick 6.9.7. Incorrect TGA files could trigger assertion failures, thus leading to DoS.
- Record
CVE-2017-6498- Updated
- 2026-11-02
EUVDEUVD-2017-15554 No score
An issue was discovered in ImageMagick 6.9.7. Incorrect TGA files could trigger assertion failures, thus leading to DoS.
- Record
EUVD-2017-15554- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9f9f-6gwp-wv9g
An issue was discovered in ImageMagick 6.9.7. Incorrect TGA files could trigger assertion...
An issue was discovered in ImageMagick 6.9.7. Incorrect TGA files could trigger assertion failures, thus leading to DoS.
- Record
GHSA-9f9f-6gwp-wv9g- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
An issue was discovered in ImageMagick 6.9.7. Incorrect TGA files could trigger assertion failures, thus leading to DoS.
- Record
CVE-2017-6498- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-6498
An issue was discovered in ImageMagick 6.9.7. Incorrect TGA files could trigger assertion failures, thus leading to DoS.
- Record
DEBIAN-CVE-2017-6498- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-6498
An issue was discovered in ImageMagick 6.9.7. Incorrect TGA files could trigger assertion failures, thus leading to DoS.
- Record
UBUNTU-CVE-2017-6498- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUSN-3232-1 No score
imagemagick vulnerabilities
It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program.
- Record
USN-3232-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
imagemagickDebian:12 |
before 8:6.9.7.4+dfsg-2 | 8:6.9.7.4+dfsg-2 |
imagemagickDebian:13 |
before 8:6.9.7.4+dfsg-2 | 8:6.9.7.4+dfsg-2 |
imagemagickDebian:14 |
before 8:6.9.7.4+dfsg-2 | 8:6.9.7.4+dfsg-2 |
imagemagickDebian:7 From an advisory covering 3 CVEs |
before 8:6.7.7.10-5+deb7u12, plus listed versions 8:6.7.7.10-58:6.7.7.10-5+deb7u108:6.7.7.10-5+deb7u118:6.7.7.10-5+deb7u28:6.7.7.10-5+deb7u3 Show 6 moreShow less8:6.7.7.10-5+deb7u48:6.7.7.10-5+deb7u58:6.7.7.10-5+deb7u68:6.7.7.10-5+deb7u78:6.7.7.10-5+deb7u88:6.7.7.10-5+deb7u9 |
8:6.7.7.10-5+deb7u12 |
imagemagickDebian:8 From an advisory covering 4 CVEs |
before 8:6.8.9.9-5+deb8u8, plus listed versions 8:6.8.9.9-58:6.8.9.9-5+deb8u18:6.8.9.9-5+deb8u28:6.8.9.9-5+deb8u38:6.8.9.9-5+deb8u48:6.8.9.9-5+deb8u58:6.8.9.9-5+deb8u68:6.8.9.9-5+deb8u7 |
8:6.8.9.9-5+deb8u8 |
imagemagickUbuntu:14.04:LTS |
before 8:6.7.7.10-6ubuntu3.6, plus listed versions 8:6.7.7.10-5ubuntu38:6.7.7.10-5ubuntu48:6.7.7.10-6ubuntu18:6.7.7.10-6ubuntu28:6.7.7.10-6ubuntu3 Show 5 moreShow less8:6.7.7.10-6ubuntu3.18:6.7.7.10-6ubuntu3.28:6.7.7.10-6ubuntu3.38:6.7.7.10-6ubuntu3.48:6.7.7.10-6ubuntu3.5 |
8:6.7.7.10-6ubuntu3.6 |
imagemagickUbuntu:16.04:LTS |
before 8:6.8.9.9-7ubuntu5.6, plus listed versions 8:6.8.9.9-5ubuntu28:6.8.9.9-68:6.8.9.9-6build18:6.8.9.9-78:6.8.9.9-7ubuntu1 Show 9 moreShow less8:6.8.9.9-7ubuntu28:6.8.9.9-7ubuntu38:6.8.9.9-7ubuntu48:6.8.9.9-7ubuntu58:6.8.9.9-7ubuntu5.18:6.8.9.9-7ubuntu5.28:6.8.9.9-7ubuntu5.38:6.8.9.9-7ubuntu5.48:6.8.9.9-7ubuntu5.5 |
8:6.8.9.9-7ubuntu5.6 |
imagemagickUbuntu:14.04:LTS From an advisory covering 3 CVEs |
before 8:6.7.7.10-6ubuntu3.6, plus listed versions 8:6.7.7.10-5ubuntu38:6.7.7.10-5ubuntu48:6.7.7.10-6ubuntu18:6.7.7.10-6ubuntu28:6.7.7.10-6ubuntu3 Show 5 moreShow less8:6.7.7.10-6ubuntu3.18:6.7.7.10-6ubuntu3.28:6.7.7.10-6ubuntu3.38:6.7.7.10-6ubuntu3.48:6.7.7.10-6ubuntu3.5 |
8:6.7.7.10-6ubuntu3.6 |
imagemagickUbuntu:16.04:LTS From an advisory covering 3 CVEs |
before 8:6.8.9.9-7ubuntu5.6, plus listed versions 8:6.8.9.9-5ubuntu28:6.8.9.9-68:6.8.9.9-6build18:6.8.9.9-78:6.8.9.9-7ubuntu1 Show 9 moreShow less8:6.8.9.9-7ubuntu28:6.8.9.9-7ubuntu38:6.8.9.9-7ubuntu48:6.8.9.9-7ubuntu58:6.8.9.9-7ubuntu5.18:6.8.9.9-7ubuntu5.28:6.8.9.9-7ubuntu5.38:6.8.9.9-7ubuntu5.48:6.8.9.9-7ubuntu5.5 |
8:6.8.9.9-7ubuntu5.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-6498 is a medium vulnerability (CVSS 5.5) in Imagemagick, published March 5, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.32%, the 71st percentile. Fixed in imagemagick 8:6.9.7.4+dfsg-2.