PT-2006-3401 · Imagemagick+1 · Imagemagick+1

Eero Häkkinen · Publicado 2006-05-18 · Atualizado 2017-10-12 · CVE-2006-2440

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ImageMagick version 6.0.6.2

Description A heap-based buffer overflow issue exists in the libMagick component. This issue might allow attackers to execute arbitrary code via an image index array that triggers the overflow during filename glob expansion by the ExpandFilenames function.

Recommendations For ImageMagick version 6.0.6.2, consider updating to a newer version to mitigate the risk of exploitation. As a temporary workaround, restrict the use of the ExpandFilenames function until a patch is available.

Correção

Identificadores relacionados

CVE-2006-2440

DSA-1168-1

RHSA-2007:0015

RHSA-2007_0015

Produtos afetados

Imagemagick

Red Hat

Referências · 16

• https://nvd.nist.gov/vuln/detail/CVE-2006-2440 · Nota de Segurança
• http://debian.org/security/2006/dsa-1168 · Aviso do Fabricante
• ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc · Aviso do Fabricante
• http://secunia.com/advisories/24284 · Nota
• https://access.redhat.com/security/cve/CVE-2006-5868 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9481 · Nota
• https://osv.dev/vulnerability/CVE-2006-2440 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2007:0015 · Nota
• https://access.redhat.com/security/cve/CVE-2006-5456 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-2440 · Aviso do Fabricante
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=345595 · Correção
• https://access.redhat.com/security/cve/CVE-2006-2440 · Nota
• https://security-tracker.debian.org/tracker/CVE-2006-2440 · Aviso do Fabricante
• http://secunia.com/advisories/24186 · Nota
• http://secunia.com/advisories/21719 · Nota