In ImageMagick before 6.9.8-8 and 7.x before 7.0.5-9, the ReadJP2Image function in coders/jp2.c does not properly validate the channel geometry, leading to a crash.
{
"unresolved_ranges": [
{
"source": "CPE_STRING",
"extracted_events": [
{
"introduced": "14.04"
},
{
"last_affected": "14.04"
},
{
"introduced": "16.04"
},
{
"last_affected": "16.04"
},
{
"introduced": "17.10"
},
{
"last_affected": "17.10"
},
{
"introduced": "18.04"
},
{
"last_affected": "18.04"
}
],
"vendor_product": "canonical:ubuntu_linux",
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*"
]
},
{
"source": "CPE_STRING",
"extracted_events": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
},
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
}
],
"vendor_product": "debian:debian_linux",
"cpes": [
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
]
},
{
"source": "CPE_STRING",
"extracted_events": [
{
"introduced": "7.0.1-0"
},
{
"last_affected": "7.0.1-0"
},
{
"introduced": "7.0.1-0"
},
{
"last_affected": "7.0.1-0"
},
{
"introduced": "7.0.1-1"
},
{
"last_affected": "7.0.1-1"
},
{
"introduced": "7.0.1-1"
},
{
"last_affected": "7.0.1-1"
},
{
"introduced": "7.0.1-2"
},
{
"last_affected": "7.0.1-2"
},
{
"introduced": "7.0.1-2"
},
{
"last_affected": "7.0.1-2"
},
{
"introduced": "7.0.1-3"
},
{
"last_affected": "7.0.1-3"
},
{
"introduced": "7.0.1-3"
},
{
"last_affected": "7.0.1-3"
},
{
"introduced": "7.0.1-4"
},
{
"last_affected": "7.0.1-4"
},
{
"introduced": "7.0.1-4"
},
{
"last_affected": "7.0.1-4"
},
{
"introduced": "7.0.1-5"
},
{
"last_affected": "7.0.1-5"
},
{
"introduced": "7.0.1-5"
},
{
"last_affected": "7.0.1-5"
},
{
"introduced": "7.0.1-6"
},
{
"last_affected": "7.0.1-6"
},
{
"introduced": "7.0.1-6"
},
{
"last_affected": "7.0.1-6"
},
{
"introduced": "7.0.1-7"
},
{
"last_affected": "7.0.1-7"
},
{
"introduced": "7.0.1-7"
},
{
"last_affected": "7.0.1-7"
},
{
"introduced": "7.0.1-8"
},
{
"last_affected": "7.0.1-8"
},
{
"introduced": "7.0.1-8"
},
{
"last_affected": "7.0.1-8"
},
{
"introduced": "7.0.1-9"
},
{
"last_affected": "7.0.1-9"
},
{
"introduced": "7.0.1-9"
},
{
"last_affected": "7.0.1-9"
},
{
"introduced": "7.0.1-10"
},
{
"last_affected": "7.0.1-10"
},
{
"introduced": "7.0.1-10"
},
{
"last_affected": "7.0.1-10"
},
{
"introduced": "7.0.2-0"
},
{
"last_affected": "7.0.2-0"
},
{
"introduced": "7.0.2-0"
},
{
"last_affected": "7.0.2-0"
},
{
"introduced": "7.0.2-1"
},
{
"last_affected": "7.0.2-1"
},
{
"introduced": "7.0.2-1"
},
{
"last_affected": "7.0.2-1"
},
{
"introduced": "7.0.2-2"
},
{
"last_affected": "7.0.2-2"
},
{
"introduced": "7.0.2-2"
},
{
"last_affected": "7.0.2-2"
},
{
"introduced": "7.0.2-3"
},
{
"last_affected": "7.0.2-3"
},
{
"introduced": "7.0.2-3"
},
{
"last_affected": "7.0.2-3"
},
{
"introduced": "7.0.2-4"
},
{
"last_affected": "7.0.2-4"
},
{
"introduced": "7.0.2-4"
},
{
"last_affected": "7.0.2-4"
},
{
"introduced": "7.0.2-5"
},
{
"last_affected": "7.0.2-5"
},
{
"introduced": "7.0.2-5"
},
{
"last_affected": "7.0.2-5"
},
{
"introduced": "7.0.2-6"
},
{
"last_affected": "7.0.2-6"
},
{
"introduced": "7.0.2-6"
},
{
"last_affected": "7.0.2-6"
},
{
"introduced": "7.0.2-7"
},
{
"last_affected": "7.0.2-7"
},
{
"introduced": "7.0.2-7"
},
{
"last_affected": "7.0.2-7"
},
{
"introduced": "7.0.2-8"
},
{
"last_affected": "7.0.2-8"
},
{
"introduced": "7.0.2-8"
},
{
"last_affected": "7.0.2-8"
},
{
"introduced": "7.0.2-9"
},
{
"last_affected": "7.0.2-9"
},
{
"introduced": "7.0.2-9"
},
{
"last_affected": "7.0.2-9"
},
{
"introduced": "7.0.2-10"
},
{
"last_affected": "7.0.2-10"
},
{
"introduced": "7.0.2-10"
},
{
"last_affected": "7.0.2-10"
},
{
"introduced": "7.0.3-0"
},
{
"last_affected": "7.0.3-0"
},
{
"introduced": "7.0.3-0"
},
{
"last_affected": "7.0.3-0"
},
{
"introduced": "7.0.3-1"
},
{
"last_affected": "7.0.3-1"
},
{
"introduced": "7.0.3-1"
},
{
"last_affected": "7.0.3-1"
},
{
"introduced": "7.0.3-2"
},
{
"last_affected": "7.0.3-2"
},
{
"introduced": "7.0.3-2"
},
{
"last_affected": "7.0.3-2"
},
{
"introduced": "7.0.3-3"
},
{
"last_affected": "7.0.3-3"
},
{
"introduced": "7.0.3-3"
},
{
"last_affected": "7.0.3-3"
},
{
"introduced": "7.0.3-4"
},
{
"last_affected": "7.0.3-4"
},
{
"introduced": "7.0.3-4"
},
{
"last_affected": "7.0.3-4"
},
{
"introduced": "7.0.3-5"
},
{
"last_affected": "7.0.3-5"
},
{
"introduced": "7.0.3-5"
},
{
"last_affected": "7.0.3-5"
},
{
"introduced": "7.0.3-6"
},
{
"last_affected": "7.0.3-6"
},
{
"introduced": "7.0.3-6"
},
{
"last_affected": "7.0.3-6"
},
{
"introduced": "7.0.3-7"
},
{
"last_affected": "7.0.3-7"
},
{
"introduced": "7.0.3-7"
},
{
"last_affected": "7.0.3-7"
},
{
"introduced": "7.0.3-8"
},
{
"last_affected": "7.0.3-8"
},
{
"introduced": "7.0.3-8"
},
{
"last_affected": "7.0.3-8"
},
{
"introduced": "7.0.3-9"
},
{
"last_affected": "7.0.3-9"
},
{
"introduced": "7.0.3-9"
},
{
"last_affected": "7.0.3-9"
},
{
"introduced": "7.0.3-10"
},
{
"last_affected": "7.0.3-10"
},
{
"introduced": "7.0.3-10"
},
{
"last_affected": "7.0.3-10"
},
{
"introduced": "7.0.4-0"
},
{
"last_affected": "7.0.4-0"
},
{
"introduced": "7.0.4-0"
},
{
"last_affected": "7.0.4-0"
},
{
"introduced": "7.0.4-1"
},
{
"last_affected": "7.0.4-1"
},
{
"introduced": "7.0.4-1"
},
{
"last_affected": "7.0.4-1"
},
{
"introduced": "7.0.4-2"
},
{
"last_affected": "7.0.4-2"
},
{
"introduced": "7.0.4-2"
},
{
"last_affected": "7.0.4-2"
},
{
"introduced": "7.0.4-3"
},
{
"last_affected": "7.0.4-3"
},
{
"introduced": "7.0.4-3"
},
{
"last_affected": "7.0.4-3"
},
{
"introduced": "7.0.4-4"
},
{
"last_affected": "7.0.4-4"
},
{
"introduced": "7.0.4-4"
},
{
"last_affected": "7.0.4-4"
},
{
"introduced": "7.0.4-5"
},
{
"last_affected": "7.0.4-5"
},
{
"introduced": "7.0.4-5"
},
{
"last_affected": "7.0.4-5"
},
{
"introduced": "7.0.4-6"
},
{
"last_affected": "7.0.4-6"
},
{
"introduced": "7.0.4-6"
},
{
"last_affected": "7.0.4-6"
},
{
"introduced": "7.0.4-7"
},
{
"last_affected": "7.0.4-7"
},
{
"introduced": "7.0.4-7"
},
{
"last_affected": "7.0.4-7"
},
{
"introduced": "7.0.4-8"
},
{
"last_affected": "7.0.4-8"
},
{
"introduced": "7.0.4-8"
},
{
"last_affected": "7.0.4-8"
},
{
"introduced": "7.0.4-9"
},
{
"last_affected": "7.0.4-9"
},
{
"introduced": "7.0.4-9"
},
{
"last_affected": "7.0.4-9"
},
{
"introduced": "7.0.4-10"
},
{
"last_affected": "7.0.4-10"
},
{
"introduced": "7.0.4-10"
},
{
"last_affected": "7.0.4-10"
},
{
"introduced": "7.0.5-0"
},
{
"last_affected": "7.0.5-0"
},
{
"introduced": "7.0.5-0"
},
{
"last_affected": "7.0.5-0"
},
{
"introduced": "7.0.5-1"
},
{
"last_affected": "7.0.5-1"
},
{
"introduced": "7.0.5-1"
},
{
"last_affected": "7.0.5-1"
},
{
"introduced": "7.0.5-4"
},
{
"last_affected": "7.0.5-4"
},
{
"introduced": "7.0.5-4"
},
{
"last_affected": "7.0.5-4"
},
{
"introduced": "7.0.5-5"
},
{
"last_affected": "7.0.5-5"
},
{
"introduced": "7.0.5-5"
},
{
"last_affected": "7.0.5-5"
},
{
"introduced": "7.0.5-6"
},
{
"last_affected": "7.0.5-6"
},
{
"introduced": "7.0.5-6"
},
{
"last_affected": "7.0.5-6"
},
{
"introduced": "7.0.5-7"
},
{
"last_affected": "7.0.5-7"
},
{
"introduced": "7.0.5-7"
},
{
"last_affected": "7.0.5-7"
},
{
"introduced": "7.0.5-8"
},
{
"last_affected": "7.0.5-8"
},
{
"introduced": "7.0.5-8"
},
{
"last_affected": "7.0.5-8"
}
],
"vendor_product": "imagemagick:imagemagick",
"cpes": [
"cpe:2.3:a:imagemagick:imagemagick:7.0.1-0:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.1-10:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.1-1:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.1-2:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.1-3:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.1-4:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.1-5:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.1-6:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.1-7:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.1-8:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.1-9:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.2-0:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.2-10:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.2-1:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.2-2:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.2-3:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.2-4:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.2-5:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.2-6:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.2-7:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.2-8:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.2-9:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.3-0:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.3-10:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.3-1:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.3-2:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.3-3:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.3-4:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.3-5:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.3-6:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.3-7:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.3-8:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.3-9:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.4-0:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.4-10:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.4-1:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.4-2:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.4-3:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.4-4:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.4-5:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.4-6:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.4-7:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.4-8:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.4-9:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.5-0:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.5-1:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.5-4:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.5-5:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.5-6:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.5-7:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.5-8:*:*:*:*:*:*:*"
]
}
]
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-13145.json"
"2026-07-11T18:15:06Z"
[
{
"deprecated": false,
"signature_type": "Function",
"source": "https://github.com/imagemagick/imagemagick/commit/acee073df34aa4d491bf5cb74d3a15fc80f0a3aa",
"digest": {
"length": 5546.0,
"function_hash": "210812037954842250015360229604252088346"
},
"signature_version": "v1",
"target": {
"function": "ReadJP2Image",
"file": "coders/jp2.c"
},
"id": "CVE-2017-13145-3c03a189"
},
{
"deprecated": false,
"signature_type": "Line",
"source": "https://github.com/imagemagick/imagemagick/commit/acee073df34aa4d491bf5cb74d3a15fc80f0a3aa",
"digest": {
"line_hashes": [
"289544892483923775505698504647299366310",
"150828706856509596378031902790081773088",
"185082364737125337286265695308364243985",
"138996779276094104144166430639441381356"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "coders/jp2.c"
},
"id": "CVE-2017-13145-b6f97546"
},
{
"deprecated": false,
"signature_type": "Line",
"source": "https://github.com/imagemagick/imagemagick/commit/f13c6b54a879aaa771ec64b5a066b939e8f8e7f0",
"digest": {
"line_hashes": [
"181851534386246535276223839725285355550",
"150403642098431120454694618704616516234",
"271398760415669625730399648412166078382",
"2633580211843223113069224974640682329"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "coders/jp2.c"
},
"id": "CVE-2017-13145-d990c8ff"
},
{
"deprecated": false,
"signature_type": "Function",
"source": "https://github.com/imagemagick/imagemagick/commit/f13c6b54a879aaa771ec64b5a066b939e8f8e7f0",
"digest": {
"length": 5852.0,
"function_hash": "39335548675301854673126907520952059124"
},
"signature_version": "v1",
"target": {
"function": "ReadJP2Image",
"file": "coders/jp2.c"
},
"id": "CVE-2017-13145-fc3b51fa"
}
]
{
"source": "CPE_RANGE",
"cpe": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"extracted_events": [
{
"introduced": "0"
},
{
"last_affected": "6.9.8-7"
}
]
}