{"id":"CVE-2017-18250","aliases":["EUVD-2017-9381","GHSA-mrc3-mw9q-6pg8","SUSE-SU-2018:1178-1"],"status":"published","title":"An issue was discovered in ImageMagick 7.0.7. A NULL pointer dereference vulnerability was found...","description":"An issue was discovered in ImageMagick 7.0.7. A NULL pointer dereference vulnerability was found in the function LogOpenCLBuildFailure in MagickCore/opencl.c, which allows attackers to cause a denial of service via a crafted file.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01351,"percentile":0.71709,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-476"],"published":"2018-03-27T03:00:00Z","modified":"2026-10-24T10:47:29Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.54.5"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.54.5"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.54.5"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.54.5"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.54.5"}]}],"bundled":13}],"products":[{"vendor":"imagemagick","product":"imagemagick"}],"references":[{"url":"https://github.com/ImageMagick/ImageMagick/issues/793","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18250"},{"url":"https://github.com/advisories/GHSA-mrc3-mw9q-6pg8"},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181178-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1047356","tags":["report"]},{"url":"https://bugzilla.suse.com/1058635","tags":["report"]},{"url":"https://bugzilla.suse.com/1074117","tags":["report"]},{"url":"https://bugzilla.suse.com/1086773","tags":["report"]},{"url":"https://bugzilla.suse.com/1086782","tags":["report"]},{"url":"https://bugzilla.suse.com/1087027","tags":["report"]},{"url":"https://bugzilla.suse.com/1087033","tags":["report"]},{"url":"https://bugzilla.suse.com/1087037","tags":["report"]},{"url":"https://bugzilla.suse.com/1087039","tags":["report"]},{"url":"https://bugzilla.suse.com/1087825","tags":["report"]},{"url":"https://bugzilla.suse.com/1089781","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-9018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-9135","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-18250","description":"An issue was discovered in ImageMagick 7.0.7. A NULL pointer dereference vulnerability was found in the function LogOpenCLBuildFailure in MagickCore/opencl.c, which allows attackers to cause a denial of service via a crafted file.","status":"published","published":"2018-03-27T03:00:00Z","modified":"2024-08-05T21:13:49.269Z","updated_at":"2026-11-02T14:33:21.747294Z"}],"euvd":[{"id":"EUVD-2017-9381","description":"An issue was discovered in ImageMagick 7.0.7. A NULL pointer dereference vulnerability was found in the function LogOpenCLBuildFailure in MagickCore/opencl.c, which allows attackers to cause a denial of service via a crafted file.","status":"published","published":"2018-03-27T03:00:00Z","modified":"2024-08-05T21:13:49Z","updated_at":"2026-11-03T02:23:07.6199Z"}],"ghsa":[{"id":"GHSA-mrc3-mw9q-6pg8","title":"An issue was discovered in ImageMagick 7.0.7. A NULL pointer dereference vulnerability was found...","description":"An issue was discovered in ImageMagick 7.0.7. A NULL pointer dereference vulnerability was found in the function LogOpenCLBuildFailure in MagickCore/opencl.c, which allows attackers to cause a denial of service via a crafted file.","status":"published","published":"2022-05-14T03:08:38Z","modified":"2023-02-02T05:06:59Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:52:24.271651Z"}],"nvd":[{"id":"CVE-2017-18250","description":"An issue was discovered in ImageMagick 7.0.7. A NULL pointer dereference vulnerability was found in the function LogOpenCLBuildFailure in MagickCore/opencl.c, which allows attackers to cause a denial of service via a crafted file.","status":"published","published":"2018-03-27T03:29:00.213Z","modified":"2026-06-17T01:12:28.883Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:04:17.032862Z"}],"osv":[{"id":"CVE-2017-18250","description":"An issue was discovered in ImageMagick 7.0.7. A NULL pointer dereference vulnerability was found in the function LogOpenCLBuildFailure in MagickCore/opencl.c, which allows attackers to cause a denial of service via a crafted file.","status":"published","published":"2018-03-27T03:29:00.213Z","modified":"2026-10-24T10:47:29.667335222Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:05.486486Z"},{"id":"SUSE-SU-2018:1178-1","title":"Security update for ImageMagick","description":"This update for ImageMagick fixes the following issues:\n\n- CVE-2017-14325: In ImageMagick, a memory leak vulnerability was found in\n  the function PersistPixelCache in magick/cache.c, which allowed attackers\n  to cause a denial of service (memory consumption in ReadMPCImage in\n  coders/mpc.c) via a crafted file.  [bsc#1058635]\n- CVE-2017-17887: In ImageMagick, a memory leak vulnerability was found\n  in the function GetImagePixelCache in magick/cache.c, which allowed\n  attackers to cause a denial of service via a crafted MNG image file that\n  is processed by ReadOneMNGImage.  [bsc#1074117]\n- CVE-2017-18250: A NULL pointer dereference vulnerability was found in the function \n  LogOpenCLBuildFailure in MagickCore/opencl.c, which could lead to a denial of service \n  via a crafted file. [bsc#1087039]\n- CVE-2017-18251: A memory leak vulnerability was found in the function ReadPCDImage in coders/pcd.c, \n  which could lead to a denial of service via a crafted file. [bsc#1087037]\n- CVE-2017-18252: The MogrifyImageList function in MagickWand/mogrify.c could allow \n  attackers to cause a denial of service via a crafted file. [bsc#1087033]\n- CVE-2017-18254: A memory leak vulnerability was found in the function WriteGIFImage in coders/gif.c, \n  which could lead to  denial of service via a crafted file. [bsc#1087027]\n- CVE-2018-8960: The ReadTIFFImage function in coders/tiff.c in\n  ImageMagick did not properly restrict memory allocation, leading to a\n  heap-based buffer over-read.  [bsc#1086782]\n- CVE-2018-9018: divide-by-zero in the ReadMNGImage function of coders/png.c. \n  Attackers could leverage this vulnerability to cause a crash and denial of service \n  via a crafted mng file. [bsc#1086773]\n- CVE-2018-9135: heap-based buffer over-read in IsWEBPImageLossless in coders/webp.c \n  could lead to denial of service. [bsc#1087825]\n- CVE-2018-10177: In ImageMagick, there was an infinite loop in the\n  ReadOneMNGImage function of the coders/png.c file. Remote attackers\n  could leverage this vulnerability to cause a denial of service via a\n  crafted mng file.  [bsc#1089781]\n- CVE-2017-10928: a heap-based buffer over-read in the GetNextToken function in token.c \n  could allow attackers to obtain sensitive information from process memory or possibly have \n  unspecified other impact via a crafted SVG document that is mishandled in the \n  GetUserSpaceCoordinateValue function in coders/svg.c. [bsc#1047356]\n\n","status":"published","published":"2018-05-09T11:30:27Z","modified":"2026-02-04T04:31:36.451313Z","updated_at":"2026-11-02T15:53:44.972817Z"}]}}