CVE-2017-11537

Vulnerability

In ImageMagick 7.0.6-1, the WritePALMImage() function in coders/palm.c contains an incorrect bits-per-pixel calculation that triggers a Floating Point Exception (FPE) when processing a specially crafted image file [1][2]. This affects the convert utility and other tools relying on the affected code path.

Exploitation

An attacker can exploit this vulnerability by providing a maliciously crafted image file to a user or automated system that processes it with convert or other ImageMagick tools [2]. No authentication is required, and the only user interaction is opening the file. The crash occurs during conversion to PALM format [2].

Impact

Successful exploitation causes a denial of service via an unhandled FPE, resulting in an abort or crash of the ImageMagick process [1][2]. Depending on the context, arbitrary code execution may also be possible, as noted in the advisory [1].

Mitigation

The issue is fixed in ImageMagick versions after 7.0.6-1, and specific packages are available in Ubuntu through USN-3681-1 [1]. Users should update to the latest patched version. No workarounds are documented.