CVE-2017-9774

CVE-2017-9774 affects Horde_Image, with RCE in 2.x prior to 2.5.0. Exploitation requires a logged‑in user via a crafted GET request. Upstream fix is 2.5.0+. Debian notes fixes in 2.1.0-4+deb8u1 (Jessie) and 2.3.6-1+deb9u1 (Stretch); other advisories map to the same CVE set. Monitor for patches an...

CVE-2017-14650

CVE-2017-14650 affects Horde_Image (Im backend) using ImageMagick convert; root cause is missing input validation of the index field in _raw() when building the ImageMagick command. Affected are Horde_Image versions 2.0.0 through 2.5.1; fixed in 2.5.2. The vulnerability is contextual: it is not r...