CVE-2017-6004

What it actually does

The flaw is an out-of-bounds read in the compile_bracket_matchingpath function within the PCRE JIT compiler, triggered when processing a specially crafted regular expression, resulting in an application crash.

Why it matters to the business

Services relying on image processing libraries may experience unexpected crashes when handling user-supplied or untrusted content containing complex patterns, leading to denial of service and potential operational disruption across widely deployed image manipulation tools.

How an attack unfolds

An attacker supplies a crafted regular expression through an image processing operation that invokes PCRE matching; the JIT compilation path encounters an invalid bracket sequence, performs an out-of-bounds memory read, and terminates the process.

How to fix it

Upgrade to fixed package versions: imagemagick GIT commit 1bc1fd0ff8c555841c78829217ac81fa0598255d, Debian 11/12/13 packages 8:6.9.6.2+dfsg-2, Ubuntu 14.04 packages 8:6.7.7.10-6ubuntu3.3, and Ubuntu 16.04 packages 8:6.8.9.9-7ubuntu5.3. Rebuild any custom builds against patched PCRE sources and restart affected services.

How to confirm the fix worked

Confirm the installed library reports a version or commit hash matching the listed fixed releases; test with known triggering regex patterns in a controlled environment to verify absence of crash behavior.

Typical attack path

1. Identify an entry point that accepts image data or metadata processed by the vulnerable library
2. Craft a regular expression containing malformed bracket constructs designed to trigger the JIT path
3. Embed or trigger the expression during image handling operations such as thumbnail generation or format conversion
4. Cause the application to dereference invalid memory during pattern compilation, resulting in a crash

How to detect it

Review application and system logs for sudden crashes or segmentation faults occurring during image processing tasks; correlate with inbound requests containing image uploads or conversions around the time of the incident.

What your security team should do

• Prioritize patching all ImageMagick deployments to the listed fixed versions within standard maintenance windows
• Inventory and restrict use of regex-based processing on untrusted image inputs until upgrades are complete
• Monitor vendor advisories for any related downstream package updates