CVE-2017-14138

ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in certain error cases, as demonstrated by…

published September 4, 2017

CVSS
—
EPSS
2%
Percentile
81.0
In the wild
Unconfirmed
What it is

💡 A memory leak in ImageMagick may not scream urgency, but it’s a sneaky way for your server to waste resources over time! Think of it as a leaky faucet in your home — it doesn’t flood the place immediately, but over time, it can really add up on your water bill. Just like that faucet, this leak could slow down your image processing as memory accumulates without being freed. While there’s no immediate danger, this memory leak can lead to performance degradation and increased resource consumption over time as your server struggles to keep up. If left unattended, it may even cause your service to slow down or crash during high-demand periods, which is definitely not ideal!

Put simply

Think of it as a leaky faucet in your home — it doesn’t flood the place immediately, but over time, it can really add up on your water bill. Just like that faucet, this leak could slow down your image processing as memory accumulates without being freed. In ImageMagick 7.0.6-5, the ReadWEBPImage function doesn’t properly free memory in certain error cases related to VP8 decoding. This oversight leads to a memory leak, causing the application to consume increasing amounts of memory with each error encountered.

What to do

While there’s no immediate danger, this memory leak can lead to performance degradation and increased resource consumption over time as your server struggles to keep up. If left unattended, it may even cause your service to slow down or crash during high-demand periods, which is definitely not ideal! To remediate this vulnerability, consider upgrading to a newer version of ImageMagick where this issue is addressed. Regularly monitor your application's memory usage to catch any unintended spikes that could arise from this leak. Staying updated ensures you're leveraging the latest fixes! You've got this! Stay vigilant and keep your resources in check! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02056 · 81.0th percentile
Published
2017-09-04T23:00Z
EPSS history
Timeline
  • 04 SEP 23:00Z
    ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in certain error cases, as demonstrated by…
    cvelistv5