{"id":"CVE-2017-13066","aliases":["DEBIAN-CVE-2017-13066","EUVD-2017-4584","GHSA-8hvw-vw2f-mvvg","SUSE-SU-2018:1163-1","UBUNTU-CVE-2017-13066"],"status":"published","title":"GraphicsMagick 1.3.26 has a memory leak vulnerability in the function CloneImage in magick/image.c.","description":"GraphicsMagick 1.3.26 has a memory leak vulnerability in the function CloneImage in magick/image.c.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01424,"percentile":0.73081,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-772"],"published":"2017-08-22T06:00:00Z","modified":"2026-09-01T20:03:43Z","fixes":[{"ecosystem":"Debian:12","package":"graphicsmagick","fixed_in":["1.3.27-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"graphicsmagick","fixed_in":["1.3.27-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"graphicsmagick","fixed_in":["1.3.27-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.27-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.27-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.27-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-78.52.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Studio Onsite 1.3","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-78.52.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.16-1.1ubuntu2","1.3.16-1.1ubuntu3","1.3.18-1ubuntu3","1.3.18-1ubuntu3.1","1.3.18-1ubuntu3.1+esm1","1.3.18-1ubuntu3.1+esm2","1.3.18-1ubuntu3.1+esm3","1.3.18-1ubuntu3.1+esm4","1.3.18-1ubuntu3.1+esm5","1.3.18-1ubuntu3.1+esm6","1.3.18-1ubuntu3.1+esm7","1.3.18-1ubuntu3.1+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.21-3","1.3.23-1","1.3.23-1build1","1.3.23-1ubuntu0.1","1.3.23-1ubuntu0.1+esm1","1.3.23-1ubuntu0.2","1.3.23-1ubuntu0.3","1.3.23-1ubuntu0.4","1.3.23-1ubuntu0.5","1.3.23-1ubuntu0.6","1.3.23-1ubuntu0.6+esm1","1.3.23-1ubuntu0.6+esm2"]}],"products":[{"vendor":"graphicsmagick","product":"graphicsmagick"}],"references":[{"url":"https://sourceforge.net/p/graphicsmagick/bugs/430/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","report"]},{"url":"http://www.securityfocus.com/bid/100463","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-13066"},{"url":"https://sourceforge.net/p/graphicsmagick/bugs/430"},{"url":"https://github.com/advisories/GHSA-8hvw-vw2f-mvvg"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-13066","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181163-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1050623","tags":["report"]},{"url":"https://bugzilla.suse.com/1055010","tags":["report"]},{"url":"https://bugzilla.suse.com/1085236","tags":["report"]},{"url":"https://bugzilla.suse.com/1089781","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10177","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-13066","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-13066","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-13066","description":"GraphicsMagick 1.3.26 has a memory leak vulnerability in the function CloneImage in magick/image.c.","status":"published","published":"2017-08-22T06:00:00Z","modified":"2024-08-05T18:58:12.285Z","updated_at":"2026-11-02T14:33:17.903346Z"}],"euvd":[{"id":"EUVD-2017-4584","description":"GraphicsMagick 1.3.26 has a memory leak vulnerability in the function CloneImage in magick/image.c.","status":"published","published":"2017-08-22T06:00:00Z","modified":"2024-08-05T18:58:12Z","updated_at":"2026-11-03T02:23:19.724201Z"}],"ghsa":[{"id":"GHSA-8hvw-vw2f-mvvg","title":"GraphicsMagick 1.3.26 has a memory leak vulnerability in the function CloneImage in magick/image.c.","description":"GraphicsMagick 1.3.26 has a memory leak vulnerability in the function CloneImage in magick/image.c.","status":"published","published":"2022-05-13T01:42:59Z","modified":"2025-04-20T03:44:48Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T15:01:51.143792Z"}],"nvd":[{"id":"CVE-2017-13066","description":"GraphicsMagick 1.3.26 has a memory leak vulnerability in the function CloneImage in magick/image.c.","status":"published","published":"2017-08-22T06:29:00.503Z","modified":"2026-06-17T01:04:28.24Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T14:03:57.82609Z"}],"osv":[{"id":"CVE-2017-13066","description":"GraphicsMagick 1.3.26 has a memory leak vulnerability in the function CloneImage in magick/image.c.","status":"published","published":"2017-08-22T06:29:00.503Z","modified":"2026-03-13T23:21:31.622742Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:04.159616Z"},{"id":"DEBIAN-CVE-2017-13066","description":"GraphicsMagick 1.3.26 has a memory leak vulnerability in the function CloneImage in magick/image.c.","status":"published","published":"2017-08-22T06:29:00.503Z","modified":"2026-09-01T20:03:43.007892906Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:28.50097Z"},{"id":"UBUNTU-CVE-2017-13066","description":"GraphicsMagick 1.3.26 has a memory leak vulnerability in the function CloneImage in magick/image.c.","status":"published","published":"2017-08-22T06:29:00Z","modified":"2026-04-22T11:13:55.800633Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:14.122973Z"},{"id":"SUSE-SU-2018:1163-1","title":"Security update for GraphicsMagick","description":"This update for GraphicsMagick fixes the following issues:\n\n* CVE-2017-18229: An allocation failure vulnerability was found in the function ReadTIFFImage in coders/tiff.c, \n  which could allows attackers to cause a denial of service via a crafted file, \n  because file size is not properly used to restrict scanline, strip, and tile allocations. [bsc#1085236]\n* CVE-2017-11641: A memory Leak in the PersistCache function in magick/pixel_cache.c during writing of \n  Magick Persistent Cache (MPC) files could lead to denial of servic3. [bsc#1050623]\n* CVE-2017-13066: A memory leak vulnerability in the function CloneImage in magick/image.c could \n  lead to denial of service [bsc#1055010]\n* CVE-2018-10177: An infinite loop when reading MNG was fixed which could lead to a denial of service (hang) [bsc#1089781]\n\n  ","status":"published","published":"2018-05-08T08:24:41Z","modified":"2026-02-04T04:28:54.823676Z","updated_at":"2026-11-02T15:53:44.594517Z"}]}}