CVE catalog

CVE-2017-14650

php-horde-image: CVE-2017-14650

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
3.99% · Oct 25, 2026

A Remote Code Execution vulnerability has been found in the Horde_Image library when using the "Im" backend that utilizes ImageMagick's "convert" utility. It's not exploitable through any Horde application, because the code path to the vulnerability is not used by any Horde code. Custom applications using the Horde_Image library might be affected. This vulnerability affects all versions of Horde_Image from 2.0.0 to 2.5.1, and is fixed in 2.5.2. The problem is missing input validation of the index field in _raw() during construction of an ImageMagick command line.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianphp-horde-imagesid2.6.1-2fixed
Debianphp-horde-imagebookworm2.6.1-2fixed
Ubuntuphp-horde-image16.042.3.2-1vulnerable
Ubuntuphp-horde-image16.042.3.3-2vulnerable
Ubuntuphp-horde-image16.042.3.4-1vulnerable
Ubuntuphp-horde-image16.042.3.4-1ubuntu1vulnerable
Ubuntuphp-horde-image16.042.3.4-2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianphp-horde-imagesourcesid2.5.2-1not yet assignedNot reported[876400]
Debianphp-horde-imagesourcebookworm2.5.2-1not yet assignedNot reported[876400]

[Debian bug #876400]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [php-horde-image]Fixed
    Details (2)

    • 2.6.1-2 · all · bookworm

      Fixed · Fixed: 2.5.2-1

      dsa · php-horde-image · debian · bookworm; dsa · php-horde-image · debian · 12

    • 2.6.1-2 · all · bookworm

      Fixed · Fixed: 2.5.2-1

      dsa · php-horde-image · debian · bookworm; dsa · php-horde-image · debian · 12

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]