{"id":"CVE-2017-5509","aliases":["DEBIAN-CVE-2017-5509","EUVD-2017-14613","GHSA-563x-mrp6-2hq2","MGASA-2018-0229"],"status":"published","title":"coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD...","description":"coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0172,"percentile":0.77626,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2017-03-24T15:00:00Z","modified":"2026-10-24T14:09:01Z","fixes":[{"ecosystem":"Debian:12","package":"imagemagick","fixed_in":["8:6.9.7.4+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"imagemagick","fixed_in":["8:6.9.7.4+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"imagemagick","fixed_in":["8:6.9.7.4+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"converseen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6.2-1.3.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"cuneiform-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-9.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"dvdauthor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2-2.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.5-8.3.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.9.41-1.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"inkscape","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.92.1-2.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"k3d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0.5-5.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"kxstitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-2.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"libopenshot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.8-1.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"ocaml-glmlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.03.51-17.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"perl-Image-SubImageFind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.0-6.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"pfstools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-3.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"php-imagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-6.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"php-magickwand","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9.2-10.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"psiconv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-26.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"pythonmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12-7.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"ruby-rmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.4-12.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"synfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-2.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"vdr-plugin-skinelchi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8-8.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"vdr-plugin-skinenigmang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2-10.2.mga6"}]}],"bundled":104}],"products":[{"vendor":"imagemagick","product":"imagemagick"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2017/01/16/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851377","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://security.gentoo.org/glsa/201702-09","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/commit/37a1710e2dab6ed91128ea648d654a22fbe2a6af","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/ImageMagick/ImageMagick/commit/d4ec73f866a7c42a2e7f301fcd696e5cb7a7d3ab","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/ImageMagick/ImageMagick/issues/350","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"http://www.securityfocus.com/bid/95751","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2017/01/17/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5509"},{"url":"https://github.com/advisories/GHSA-563x-mrp6-2hq2"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-5509","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0229.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19078","tags":["report"]},{"url":"http://git.imagemagick.org/repos/ImageMagick/blob/ImageMagick-6/ChangeLog","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-5509","description":"coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.","status":"published","published":"2017-03-24T15:00:00Z","modified":"2024-08-05T15:04:14.625Z","updated_at":"2026-11-02T14:33:12.599234Z"}],"euvd":[{"id":"EUVD-2017-14613","description":"coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.","status":"published","published":"2017-03-24T15:00:00Z","modified":"2024-08-05T15:04:14Z","updated_at":"2026-11-03T02:39:15.385305Z"}],"ghsa":[{"id":"GHSA-563x-mrp6-2hq2","title":"coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD...","description":"coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.","status":"published","published":"2022-05-13T01:14:01Z","modified":"2023-02-01T05:04:12Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:50:08.411477Z"}],"nvd":[{"id":"CVE-2017-5509","description":"coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.","status":"published","published":"2017-03-24T15:59:01.123Z","modified":"2026-06-17T01:20:38.7Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:03:44.275273Z"}],"osv":[{"id":"CVE-2017-5509","description":"coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.","status":"published","published":"2017-03-24T15:59:01.123Z","modified":"2026-10-24T14:09:01.370586024Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:06.029968Z"},{"id":"DEBIAN-CVE-2017-5509","description":"coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.","status":"published","published":"2017-03-24T15:59:01.123Z","modified":"2026-09-01T20:03:48.498791645Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.412243Z"},{"id":"MGASA-2018-0229","title":"Updated imagemagick packages fix security vulnerabilities","description":"The imagemagick package has been updated to version 6.9.9.41 which\nfixes several unspecified security vulnerabilities.\nThis update fixes several vulnerabilities in imagemagick, including:\nVarious memory handling problems and cases of missing or incomplete\ninput sanitising may result in denial of service, memory disclosure\nor the execution of arbitrary code if malformed GIF, TTF, SVG, TIFF,\nPCX, JPG or SFW files are processed.\n\nSeveral packages have been rebuilt for the updated ImageMagick.\n","status":"published","published":"2018-05-12T06:28:12Z","modified":"2026-04-16T06:25:36.607120995Z","updated_at":"2026-11-02T15:49:40.442238Z"}]}}