CVE-2017-10928

What it actually does

Heap-based buffer over-read in GetNextToken allows reading beyond allocated memory when parsing crafted SVG files, potentially disclosing process memory contents or leading to further unspecified impacts.

Why it matters to the business

Organizations relying on the listed Python packages may face risks of sensitive data exposure or application instability when handling untrusted image files, increasing operational costs for incident response in widely distributed environments.

How an attack unfolds

An attacker creates a malicious SVG document that triggers mishandling in GetUserSpaceCoordinateValue, causing the buffer over-read during token processing; the file is then supplied to an application using the vulnerable library to leak memory or achieve other effects.

How to fix it

Upgrade affected packages to the fixed versions provided: python-3.11 (Chainguard) fixed in 0, python-3.11 (Wolfi) fixed in 0, and similarly for all listed python-3.11 variants and derivatives.

How to confirm the fix worked

Confirm package versions match the fixed releases, test SVG parsing with known malicious samples in isolated environments, and verify no residual vulnerable binaries remain in the runtime.

Typical attack path

1. Craft a malicious SVG document designed to trigger the GetNextToken buffer over-read
2. Deliver the SVG to a target application that processes it via the affected library
3. Trigger parsing in GetUserSpaceCoordinateValue to induce the over-read
4. Extract sensitive information from the resulting memory disclosure or leverage for further impact

How to detect it

Review application logs for unusual SVG processing errors or memory-related crashes around image handling routines; search for unexpected memory patterns in crash dumps or process traces from affected services.

What your security team should do

• Immediately audit and upgrade all listed Python packages to the specified fixed versions
• Implement input validation and sandboxing for any SVG or image processing workflows
• Monitor for new disclosures related to ImageMagick dependencies in Python ecosystems