CVE-2017-18008

Vulnerability

In ImageMagick 7.0.7-17 Q16, the ReadPWPImage function in coders/pwp.c contains a memory leak [2]. When processing a PWP image, the function allocates memory via AcquireImageInfo and CloneImageInfo but fails to release it properly, resulting in a direct leak of 13,024 bytes and an indirect leak of 88 bytes per call [2]. This affects all versions prior to the fix.

Exploitation

An attacker can trigger the memory leak by providing a specially crafted PWP image file. No authentication is required; the vulnerability is exploitable if the victim processes the file using ImageMagick (e.g., via convert or an automated service) [1]. The leak occurs during the initial reading of the image, so no complex sequence is needed [2].

Impact

The memory leak leads to gradual exhaustion of system memory when multiple malicious files are processed, causing a denial-of-service condition [1]. While the immediate impact is limited to denial of service, the advisory from Ubuntu notes that other ImageMagick vulnerabilities in the same update could allow code execution [1].

Mitigation

The vulnerability is fixed in ImageMagick version 7.0.7-18 and later [2]. Ubuntu users can update to the packages provided in USN-3681-1 (released 2018-06-11) for Ubuntu 14.04, 16.04, 17.10, and 18.04 LTS [1]. Users unable to upgrade should avoid processing untrusted PWP files.