CVE-2017-14650
A Remote Code Execution vulnerability has been found in the Horde_Image library when using the "Im" backend that utilizes ImageMagick's…
- Published
- Updated
- Reserved
- Assigned by
- mitre
Description
A Remote Code Execution vulnerability has been found in the Horde_Image library when using the "Im" backend that utilizes ImageMagick's "convert" utility. It's not exploitable through any Horde application, because the code path to the vulnerability is not used by any Horde code. Custom applications using the Horde_Image library might be affected. This vulnerability affects all versions of Horde_Image from 2.0.0 to 2.5.1, and is fixed in 2.5.2. The problem is missing input validation of the index field in _raw() during construction of an ImageMagick command line.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | High8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 4.0% · top 9.5% of all CVEs (4 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.1.
Weakness
Affected products
n/a
- affected n/a
References (4)
- https://marc.info/?l=horde-announce&m=150600299528079&w=2 (opens in a new tab)x_refsource_MISCx_transferred
- DSA-4276 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
- https://github.com/horde/horde/commit/eb3afd14c22c77ae0d29e2848f5ac726ef6e7c5b (opens in a new tab)x_refsource_MISCx_transferred
- http://www.openwall.com/lists/oss-security/2017/09/21/4 (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2017-14650)Record last updated .