CVE-2017-14172

In coders/ps.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSImage() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file, which claims a large "extent" field in the header but does not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no EOF check inside the loop.

Database specific

{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "14.04"
                },
                {
                    "last_affected": "14.04"
                },
                {
                    "introduced": "16.04"
                },
                {
                    "last_affected": "16.04"
                },
                {
                    "introduced": "17.10"
                },
                {
                    "last_affected": "17.10"
                },
                {
                    "introduced": "18.04"
                },
                {
                    "last_affected": "18.04"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "canonical:ubuntu_linux"
        },
        {
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "8.0"
                },
                {
                    "last_affected": "8.0"
                },
                {
                    "introduced": "9.0"
                },
                {
                    "last_affected": "9.0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "debian:debian_linux"
        },
        {
            "cpes": [
                "cpe:2.3:a:imagemagick:imagemagick:7.0.7-0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "7.0.7-0"
                },
                {
                    "last_affected": "7.0.7-0"
                },
                {
                    "introduced": "7.0.7-0"
                },
                {
                    "last_affected": "7.0.7-0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "imagemagick:imagemagick"
        }
    ]
}

References

Affected packages

Git / github.com/imagemagick/imagemagick

Affected ranges

Type

GIT

Repo

https://github.com/imagemagick/imagemagick

Events

Introduced

Fixed

bdbbb13f1fe9b7e2465502c500561720f7456aac

Database specific

{
    "source": "REFERENCES"
}

Affected versions

7.*

7.0.1-0

7.0.1-1

7.0.1-10

7.0.1-2

7.0.1-3

7.0.1-4

7.0.1-5

7.0.1-6

7.0.1-7

7.0.1-8

7.0.1-9

7.0.2-0

7.0.2-1

7.0.2-10

7.0.2-2

7.0.2-3

7.0.2-4

7.0.2-5

7.0.2-6

7.0.2-7

7.0.2-8

7.0.2-9

7.0.3-0

7.0.3-1

7.0.3-10

7.0.3-2

7.0.3-3

7.0.3-4

7.0.3-5

7.0.3-6

7.0.3-7

7.0.3-8

7.0.3-9

7.0.4-0

7.0.4-1

7.0.4-10

7.0.4-2

7.0.4-3

7.0.4-4

7.0.4-5

7.0.4-6

7.0.4-7

7.0.4-8

7.0.4-9

7.0.5-0

7.0.5-1

7.0.5-10

7.0.5-2

7.0.5-3

7.0.5-4

7.0.5-5

7.0.5-6

7.0.5-7

7.0.5-8

7.0.5-9

7.0.6-0

7.0.6-1

7.0.6-2

7.0.6-3

7.0.6-4

7.0.6-5

7.0.6-6

7.0.6-7

7.0.6-8

7.0.6-9

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-14172.json"

vanir_signatures_modified

"2026-07-11T18:19:27Z"

vanir_signatures

[
    {
        "signature_version": "v1",
        "source": "https://github.com/imagemagick/imagemagick/commit/bdbbb13f1fe9b7e2465502c500561720f7456aac",
        "signature_type": "Function",
        "id": "CVE-2017-14172-630eb8f5",
        "digest": {
            "length": 14625.0,
            "function_hash": "9537011764912027405671843399843009265"
        },
        "deprecated": false,
        "target": {
            "function": "ReadPSImage",
            "file": "coders/ps.c"
        }
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/imagemagick/imagemagick/commit/bdbbb13f1fe9b7e2465502c500561720f7456aac",
        "signature_type": "Function",
        "id": "CVE-2017-14172-9ee869ac",
        "digest": {
            "length": 1798.0,
            "function_hash": "58479823145618228581022058710780723602"
        },
        "deprecated": false,
        "target": {
            "function": "RegisterPSImage",
            "file": "coders/ps.c"
        }
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/imagemagick/imagemagick/commit/bdbbb13f1fe9b7e2465502c500561720f7456aac",
        "signature_type": "Line",
        "id": "CVE-2017-14172-ba977e77",
        "digest": {
            "line_hashes": [
                "135292126018698160666468971952564640438",
                "132534222829792808370145742001388724863",
                "41418898004768674788462144192458876253",
                "197431814783228836736986560833224504274",
                "185876525368505560160034891656701599451",
                "161655646774896142655207482874066622902",
                "70495320583446461142367828567072874858",
                "68764566489383548091647861790507884341",
                "214840200551557280338300049035010879053",
                "214180508259772947281718000033543135117",
                "271993194180293791857269753845963465192",
                "260084162069260263156073204012954071279",
                "28253425513397365356152378281095875034",
                "188467617281027800144393604961558690760",
                "312485988164934789024420650912925934829",
                "204267151015325515462831817699181972122",
                "328035841436348926912287969429653237274",
                "177106032570526478991809101685416653651",
                "312485988164934789024420650912925934829",
                "204267151015325515462831817699181972122",
                "328035841436348926912287969429653237274",
                "226453130297119401775123572952653347687",
                "312485988164934789024420650912925934829",
                "204267151015325515462831817699181972122",
                "328035841436348926912287969429653237274",
                "188467617281027800144393604961558690760",
                "312485988164934789024420650912925934829",
                "204267151015325515462831817699181972122",
                "328035841436348926912287969429653237274",
                "274675445605238745842961799433009229231",
                "150075779093929840955088750206106956602",
                "222431508817935265264542158134725646143",
                "75115875504680177083009774367114069424"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "target": {
            "file": "coders/ps.c"
        }
    }
]